From 281d767204058f91567e49b94c3c06a1d7f2f0a6 Mon Sep 17 00:00:00 2001
From: Andrey Prokopyuk <andrey.prokopyuk@gmail.com>
Date: Sat, 26 Sep 2026 19:40:24 +0300
Subject: [PATCH] Fix rubyzip path traversal by updating Fastlane

---
 Gemfile      |  2 +-
 Gemfile.lock | 19 ++++++++++---------
 2 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/Gemfile b/Gemfile
index 2b65e2b..b9d81cb 100644
--- a/Gemfile
+++ b/Gemfile
@@ -1,3 +1,3 @@
 source "https://rubygems.org"
 
-gem "fastlane", "2.238.0"
+gem "fastlane", "2.240.1"
diff --git a/Gemfile.lock b/Gemfile.lock
index bc01cfd..7689033 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -30,6 +30,7 @@ GEM
     base64 (0.3.0)
     benchmark (0.5.0)
     bigdecimal (4.1.2)
+    cgi (0.5.2)
     claide (1.1.0)
     colored (1.2)
     colored2 (3.1.2)
@@ -61,7 +62,7 @@ GEM
     faraday-retry (2.4.0)
       faraday (~> 2.0)
     fastimage (2.4.1)
-    fastlane (2.238.0)
+    fastlane (2.240.1)
       CFPropertyList (>= 2.3, < 5.0.0)
       abbrev (~> 0.1)
       addressable (>= 2.9.0, < 3.0.0)
@@ -71,6 +72,7 @@ GEM
       base64 (~> 0.2)
       benchmark (>= 0.1.0)
       bundler (>= 2.4.0, < 5.0.0)
+      cgi (~> 0.4)
       colored (~> 1.2)
       commander (~> 4.6)
       csv (~> 3.3)
@@ -85,12 +87,11 @@ GEM
       fastimage (>= 2.1.0, < 3.0.0)
       fastlane-sirp (>= 1.1.0)
       gh_inspector (>= 1.1.2, < 2.0.0)
-      google-apis-androidpublisher_v3 (~> 0.3)
+      google-apis-androidpublisher_v3 (~> 0.99)
       google-apis-playcustomapp_v1 (~> 0.1)
-      google-cloud-env (>= 1.6.0, < 2.3.0)
+      google-cloud-env (>= 1.6.0, < 2.4.0)
       google-cloud-storage (~> 1.31)
       highline (~> 2.0)
-      http-cookie (~> 1.0.5)
       irb (>= 1.8)
       json (< 3.0.0)
       jwt (>= 2.10.3, < 4)
@@ -104,8 +105,8 @@ GEM
       optparse (>= 0.1.1, < 1.0.0)
       ostruct (>= 0.1.0)
       plist (>= 3.1.0, < 4.0.0)
-      rubyzip (>= 2.0.0, < 3.0.0)
-      security (= 0.1.5)
+      rubyzip (>= 3.4.0, < 4.0.0)
+      security (~> 0.3)
       simctl (~> 1.6.3)
       terminal-notifier (>= 2.0.0, < 3.0.0)
       terminal-table (~> 4)
@@ -212,8 +213,8 @@ GEM
     retriable (4.2.0)
     rexml (3.4.4)
     rouge (3.28.0)
-    rubyzip (2.4.1)
-    security (0.1.5)
+    rubyzip (3.7.0)
+    security (0.3.0)
     signet (0.22.0)
       addressable (~> 2.8)
       faraday (>= 0.17.5, < 3.a)
@@ -257,7 +258,7 @@ PLATFORMS
   x86_64-linux-musl
 
 DEPENDENCIES
-  fastlane (= 2.238.0)
+  fastlane (= 2.240.1)
 
 BUNDLED WITH
    2.6.9