[yyuu]

Summary

Update the pinned gems and Gemfile.lock:

• httpclient: 2.9.0 → 2.10.0
• td-client: 3.0.1 → 3.1.0

HTTPClient 2.10.0 rejects compromised eMudhra intermediate CA public keys under its default TLS verification policy and includes an updated CA bundle.

td-client 3.1.0 requires HTTPClient >= 2.10.0 and removes its own bundled CA certificates, delegating default CA selection to HTTPClient.

Validation

• Verified Gemfile pins and lockfile dependency requirements.
• git diff --check passed.
• Package build not run. macOS bundle install remains blocked by the existing Linux-only capng_c dependency.

Compatibility

Default trusted issuers may change. Users of custom endpoints or TLS inspection proxies should review their CA configuration.

References

• https://rubygems.org/gems/httpclient/versions/2.10.0
• 2015 CA bundle still trusts the compromised eMudhra intermediates nahi/httpclient#480
• https://github.com/treasure-data/td-client-ruby/releases/tag/v3.1.0

[yyuu]

https://github.com/fluent/fluent-package-builder/actions/runs/41419158376/job/125190246800?pr=1146 is red and is reporting that there are vulns detected on addressable==2.9.0 and rubyzip==1.3.0. At least for the latter case has already been reported to upstream as treasure-data/td#279... 👀

[yyuu]

• Bundle audit / Audit (pull_request)

I've appended 5e55c96 to address CVE-2026-85396 discovered on the previous build.

addressable==2.9.0 required by fluent-plugin-webhdfs is still detected as vulnerable, though 🙄

https://github.com/fluent/fluent-package-builder/actions/runs/41787608851/job/126433246092?pr=1146