Issue #20667 has been updated by k0kubun (Takashi Kokubun). Backport changed from 3.1: REQUIRED, 3.2: DONE, 3.3: REQUIRED to 3.1: REQUIRED, 3.2: DONE, 3.3: DONE ruby_3_3 commit:e0e23e7d5eb4da42c490b1d3408bd6e5047e8f83 merged revision(s) commit:29500e30346. ---------------------------------------- Bug #20667: Backport REXML CVE fixes https://bugs.ruby-lang.org/issues/20667#change-109580 * Author: vo.x (Vit Ondruch) * Status: Closed * ruby -v: ruby 3.3.4 (2024-07-09 revision be1089c8ec) [x86_64-linux] * Backport: 3.1: REQUIRED, 3.2: DONE, 3.3: DONE ---------------------------------------- It would be nice to have the recent REXML CVE fixes backported everywhere. BTW it is surprising that REXML was recently bumped in 3.1 / 3.2 branches, but 3.3 branch stays with older REXML 3.2. -- https://bugs.ruby-lang.org/