Security updates
This release updates four bundled plugins to versions that fix published security advisories.
| Gem | Old | New | Fix |
|---|---|---|---|
| jekyll-redirect-from | 0.16.0 | 0.17.0 | GHSA-xfg6-hjrc-hpvx: script injection through redirect_to
|
| jekyll-seo-tag | 2.8.0 | 2.9.1 | GHSA-572m-7cg5-6j5r: HTML/script injection through metadata and JSON-LD |
| jekyll-feed | 0.17.0 | 0.18.0 | GHSA-3gx8-pqcm-38hw: unescaped post.lang and CDATA breakout
|
| jekyll-remote-theme | 0.4.3 | 0.6.2 | Allows rubyzip 3.x for the CVE-2026-85396 fix (#966); fixes GHSA-3343-386p-v26g |
Possible output changes
- jekyll-remote-theme 0.6.x requires Ruby 3.0 or later and adds a runtime dependency on
openssl(>= 3.1.2). - jekyll-seo-tag 2.9.x changes some
<head>output: it addstwitter:description, shortens descriptions to 100 words and supportscanonical: false. - jekyll-redirect-from 0.17.0 skips
redirect_totargets that aren't http(s) or relative, with a build warning. It also percent-encodes characters such as quotes,<and>.
What's Changed
- Fix security issues in various workflows by @yoannchaudet in #929
- Bump jekyll-seo-tag, jekyll-feed, jekyll-redirect-from, and jekyll-remote-theme for security fixes by @benbalter in #965
- Update integration test assertion by @tsusdere in #968
Full Changelog: v232...v233