Bump fastlane to fix rubyzip vulnerability

CHANGELOG.md

@@ -14,7 +14,7 @@ _None_
 
 ### Bug Fixes
 
-_None_
+- Bump `fastlane` to `~> 2.240` to require `rubyzip >= 3.4.0`, fixing CVE-2026-85396 / GHSA-47m2-wp7j-p9vc. [#775]
 
 ### Internal Changes
 

Gemfile

@@ -9,16 +9,6 @@ gem 'activesupport', '~> 8.1'
 gem 'buildkite-test_collector', '~> 2.3'
 gem 'codecov', require: false
 gem 'danger-dangermattic', '~> 1.0'
-# Security:
-# - https://github.com/lostisland/faraday/pull/1665
-# - https://github.com/lostisland/faraday/pull/1681
-#
-# Faraday 2.0 is not compatible with Fastlane
-#
-# See also:
-# - https://github.com/fastlane/fastlane/issues/21334
-# - https://github.com/fastlane/fastlane/pull/30089
-gem 'faraday', '~> 1.10', '>= 1.10.6'
 gem 'pry', '~> 0.12.2'
 gem 'rmagick', '~> 5.3'
 gem 'rspec', '~> 3.8'

Gemfile.lock

@@ -6,7 +6,7 @@ PATH
       chroma (= 0.2.0)
       diffy (~> 3.3)
       dotenv (~> 2.8)
-      fastlane (~> 2.237)
+      fastlane (~> 2.240)
       gettext (~> 3.5)
       git (~> 1.3)
       google-cloud-storage (~> 1.31)
@@ -70,6 +70,7 @@ GEM
       sawyer (>= 0.6)
     buildkite-test_collector (2.13.0)
       concurrent-ruby
+    cgi (0.5.2)
     chroma (0.2.0)
     claide (1.1.0)
     claide-plugins (0.9.2)
@@ -125,41 +126,29 @@ GEM
     dotenv (2.8.1)
     drb (2.2.3)
     emoji_regex (3.2.3)
+    erb (6.0.7)
     erubi (1.13.1)
     excon (1.5.0)
       logger
-    faraday (1.10.6)
-      faraday-em_http (~> 1.0)
-      faraday-em_synchrony (~> 1.0)
-      faraday-excon (~> 1.1)
-      faraday-httpclient (~> 1.0)
-      faraday-multipart (~> 1.0)
-      faraday-net_http (~> 1.0)
-      faraday-net_http_persistent (~> 1.0)
-      faraday-patron (~> 1.0)
-      faraday-rack (~> 1.0)
-      faraday-retry (~> 1.0)
-      ruby2_keywords (>= 0.0.4)
+    faraday (2.14.4)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
     faraday-cookie_jar (0.0.8)
       faraday (>= 0.8.0)
       http-cookie (>= 1.0.0)
-    faraday-em_http (1.0.0)
-    faraday-em_synchrony (1.0.1)
-    faraday-excon (1.1.0)
+    faraday-follow_redirects (0.5.0)
+      faraday (>= 1, < 3)
     faraday-http-cache (2.7.0)
       faraday (>= 0.8)
-    faraday-httpclient (1.0.1)
     faraday-multipart (1.2.0)
       multipart-post (~> 2.0)
-    faraday-net_http (1.0.2)
-    faraday-net_http_persistent (1.2.0)
-    faraday-patron (1.0.0)
-    faraday-rack (1.0.0)
-    faraday-retry (1.0.4)
-    faraday_middleware (1.2.1)
-      faraday (~> 1.0)
+    faraday-net_http (3.4.4)
+      net-http (~> 0.5)
+    faraday-retry (2.4.0)
+      faraday (~> 2.0)
     fastimage (2.4.1)
-    fastlane (2.237.0)
+    fastlane (2.240.1)
       CFPropertyList (>= 2.3, < 5.0.0)
       abbrev (~> 0.1)
       addressable (>= 2.9.0, < 3.0.0)
@@ -169,24 +158,27 @@ GEM
       base64 (~> 0.2)
       benchmark (>= 0.1.0)
       bundler (>= 2.4.0, < 5.0.0)
+      cgi (~> 0.4)
       colored (~> 1.2)
       commander (~> 4.6)
       csv (~> 3.3)
       dotenv (>= 2.1.1, < 3.0.0)
       emoji_regex (>= 0.1, < 4.0)
       excon (>= 0.71.0, < 2.0.0)
-      faraday (~> 1.0)
-      faraday-cookie_jar (~> 0.0.6)
-      faraday_middleware (~> 1.0)
+      faraday (~> 2.7)
+      faraday-cookie_jar (~> 0.0.8)
+      faraday-follow_redirects (~> 0.3)
+      faraday-multipart (~> 1.0)
+      faraday-retry (~> 2.0)
       fastimage (>= 2.1.0, < 3.0.0)
       fastlane-sirp (>= 1.1.0)
       gh_inspector (>= 1.1.2, < 2.0.0)
-      google-apis-androidpublisher_v3 (~> 0.3)
+      google-apis-androidpublisher_v3 (~> 0.99)
       google-apis-playcustomapp_v1 (~> 0.1)
-      google-cloud-env (>= 1.6.0, < 2.3.0)
+      google-cloud-env (>= 1.6.0, < 2.4.0)
       google-cloud-storage (~> 1.31)
       highline (~> 2.0)
-      http-cookie (~> 1.0.5)
+      irb (>= 1.8)
       json (< 3.0.0)
       jwt (>= 2.10.3, < 4)
       logger (>= 1.6, < 2.0)
@@ -199,11 +191,11 @@ GEM
       optparse (>= 0.1.1, < 1.0.0)
       ostruct (>= 0.1.0)
       plist (>= 3.1.0, < 4.0.0)
-      rubyzip (>= 2.0.0, < 3.0.0)
-      security (= 0.1.5)
+      rubyzip (>= 3.4.0, < 4.0.0)
+      security (~> 0.3)
       simctl (~> 1.6.3)
       terminal-notifier (>= 2.0.0, < 3.0.0)
-      terminal-table (~> 3)
+      terminal-table (~> 4)
       tty-screen (>= 0.6.3, < 1.0.0)
       tty-spinner (>= 0.8.0, < 1.0.0)
       word_wrap (~> 1.0.0)
@@ -272,6 +264,12 @@ GEM
       mutex_m
     i18n (1.14.8)
       concurrent-ruby (~> 1.0)
+    io-console (0.9.4)
+    irb (1.18.0)
+      pp (>= 0.6.0)
+      prism (>= 1.3.0)
+      rdoc (>= 4.0.0)
+      reline (>= 0.4.2)
     java-properties (0.3.0)
     jmespath (1.6.2)
     json (2.21.2)
@@ -299,6 +297,8 @@ GEM
     nanaimo (0.4.0)
     nap (1.1.0)
     naturally (2.3.0)
+    net-http (0.9.1)
+      uri (>= 0.11.1)
     nkf (0.2.0)
     nokogiri (1.19.4)
       mini_portile2 (~> 2.8.2)
@@ -318,6 +318,9 @@ GEM
       racc
     pkg-config (1.6.5)
     plist (3.7.2)
+    pp (0.6.4)
+      prettyprint
+    prettyprint (0.2.0)
     prime (0.1.4)
       forwardable
       singleton
@@ -335,8 +338,19 @@ GEM
     rake (13.4.2)
     rake-compiler (1.3.1)
       rake
+    rbs (4.2.0)
+      logger
+      prism (>= 1.6.0)
+      tsort
     rchardet (1.10.2)
+    rdoc (8.0.0)
+      erb
+      prism (>= 1.6.0)
+      rbs (>= 4.0.0)
+      tsort
     regexp_parser (2.12.0)
+    reline (0.7.0)
+      io-console (~> 0.5)
     representable (3.2.0)
       declarative (< 0.1.0)
       trailblazer-option (>= 0.1.1, < 0.2.0)
@@ -379,13 +393,12 @@ GEM
     rubocop-rspec (3.0.0)
       rubocop (~> 1.40)
     ruby-progressbar (1.13.0)
-    ruby2_keywords (0.0.5)
-    rubyzip (2.4.1)
+    rubyzip (3.7.0)
     sawyer (0.9.3)
       addressable (>= 2.3.5)
       faraday (>= 0.17.3, < 3)
     securerandom (0.4.1)
-    security (0.1.5)
+    security (0.3.0)
     signet (0.21.0)
       addressable (~> 2.8)
       faraday (>= 0.17.5, < 3.a)
@@ -401,10 +414,11 @@ GEM
     simplecov-html (0.10.2)
     singleton (0.3.0)
     terminal-notifier (2.0.0)
-    terminal-table (3.0.2)
-      unicode-display_width (>= 1.1.1, < 3)
+    terminal-table (4.0.0)
+      unicode-display_width (>= 1.1.1, < 4)
     text (1.3.1)
     trailblazer-option (0.1.2)
+    tsort (0.2.0)
     tty-cursor (0.7.1)
     tty-screen (0.8.2)
     tty-spinner (0.9.3)
@@ -440,7 +454,6 @@ DEPENDENCIES
   buildkite-test_collector (~> 2.3)
   codecov
   danger-dangermattic (~> 1.0)
-  faraday (~> 1.10, >= 1.10.6)
   fastlane-plugin-wpmreleasetoolkit!
   pry (~> 0.12.2)
   rmagick (~> 5.3)

fastlane-plugin-wpmreleasetoolkit.gemspec

@@ -27,7 +27,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'chroma', '0.2.0'
   spec.add_dependency 'diffy', '~> 3.3'
   spec.add_dependency 'dotenv', '~> 2.8'
-  spec.add_dependency 'fastlane', '~> 2.237'
+  spec.add_dependency 'fastlane', '~> 2.240'
   spec.add_dependency 'gettext', '~> 3.5'
   spec.add_dependency 'git', '~> 1.3'
   spec.add_dependency 'java-properties', '~> 0.3.0'