From 84041d1aa73bd6cef3c6d100aeed58e420e66bbd Mon Sep 17 00:00:00 2001
From: Evgeny Vlasov <e.vlasov@foxford.ru>
Date: Mon, 22 Jun 2026 17:07:17 +0300
Subject: [PATCH] STOEGE-28668 Fix vulnerable gem versions

---
 Gemfile.lock               | 33 +++++++++++++++++++++------------
 lib/metabase/connection.rb | 22 ++++++++++++++++------
 metabase.gemspec           |  9 +++++++--
 3 files changed, 44 insertions(+), 20 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index e55b618..4634e24 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -2,34 +2,38 @@ PATH
   remote: .
   specs:
     metabase (0.5.0)
-      faraday (~> 2.0)
+      faraday (~> 2.14, >= 2.14.2)
+      json (>= 2.19.2)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.8.8)
+    addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
     amazing_print (1.2.2)
     ast (2.4.1)
+    base64 (0.3.0)
+    bigdecimal (3.3.1)
     bump (0.10.0)
     coderay (1.1.3)
     crack (0.4.5)
       rexml
     diff-lcs (1.6.2)
     docile (1.3.5)
-    faraday (2.12.2)
+    faraday (2.14.3)
       faraday-net_http (>= 2.0, < 3.5)
       json
       logger
-    faraday-net_http (3.4.0)
-      net-http (>= 0.5.0)
+    faraday-net_http (3.4.4)
+      net-http (~> 0.5)
     hashdiff (1.0.1)
     io-console (0.8.2)
-    json (2.18.0)
-    logger (1.6.6)
+    json (2.19.9)
+    logger (1.7.0)
     method_source (1.1.0)
-    net-http (0.6.0)
-      uri
+    net-http (0.9.1)
+      uri (>= 0.11.1)
+    ostruct (0.6.1)
     parallel (1.20.1)
     parser (3.0.0.0)
       ast (~> 2.4.1)
@@ -37,7 +41,8 @@ GEM
       coderay (~> 1.1)
       method_source (~> 1.0)
       reline (>= 0.6.0)
-    public_suffix (7.0.0)
+    public_suffix (7.0.5)
+    racc (1.8.1)
     rainbow (3.0.0)
     rake (13.0.3)
     regexp_parser (2.0.3)
@@ -82,24 +87,28 @@ GEM
       addressable (>= 2.3.6)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
-    yard (0.9.38)
+    yard (0.9.44)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
   amazing_print
+  base64
+  bigdecimal
   bump
   bundler
   metabase!
+  ostruct
   pry
+  racc
   rake
   rspec
   rubocop
   simplecov
   vcr
   webmock
-  yard
+  yard (>= 0.9.42)
 
 BUNDLED WITH
    2.2.5
diff --git a/lib/metabase/connection.rb b/lib/metabase/connection.rb
index d1e0d5e..f1b3e4c 100644
--- a/lib/metabase/connection.rb
+++ b/lib/metabase/connection.rb
@@ -28,14 +28,12 @@ def head(path, **params)
     private
 
     def request(method, path, params)
-      headers = params.delete(:headers)
-      query_params = params.delete(:query_params) || {}
-      query_params[:format_rows] = params.delete(:format_rows)
+      headers = request_headers(params)
+      query_params = request_query_params(params)
 
       response = connection.public_send(method, path, params) do |request|
-        request.headers['X-Metabase-Session'] = @token if @token
-        headers&.each_pair { |k, v| request.headers[k] = v }
-        request.params = query_params.compact
+        request.headers.update(headers)
+        request.params.update(query_params)
       end
 
       error = Error.from_response(response)
@@ -44,6 +42,18 @@ def request(method, path, params)
       response.body
     end
 
+    def request_headers(params)
+      headers = { 'X-Metabase-Session' => @token }.compact
+      headers.update(params.delete(:headers) || {})
+    end
+
+    def request_query_params(params)
+      query_params = params.delete(:query_params) || {}
+      format_rows = params.delete(:format_rows)
+      query_params[:format_rows] = format_rows if format_rows
+      query_params.compact
+    end
+
     def connection
       @connection ||= Faraday.new(url: @url) do |c|
         c.request :json
diff --git a/metabase.gemspec b/metabase.gemspec
index 9b1ceb2..b66f36c 100644
--- a/metabase.gemspec
+++ b/metabase.gemspec
@@ -24,17 +24,22 @@ Gem::Specification.new do |spec|
 
   spec.required_ruby_version = '>= 3.2'
 
-  spec.add_runtime_dependency 'faraday', '~> 2.0'
+  spec.add_runtime_dependency 'faraday', '~> 2.14', '>= 2.14.2'
+  spec.add_runtime_dependency 'json', '>= 2.19.2'
 
   spec.add_development_dependency 'amazing_print'
+  spec.add_development_dependency 'base64'
+  spec.add_development_dependency 'bigdecimal'
   spec.add_development_dependency 'bump'
   spec.add_development_dependency 'bundler'
+  spec.add_development_dependency 'ostruct'
   spec.add_development_dependency 'pry'
+  spec.add_development_dependency 'racc'
   spec.add_development_dependency 'rake'
   spec.add_development_dependency 'rspec'
   spec.add_development_dependency 'rubocop'
   spec.add_development_dependency 'simplecov'
   spec.add_development_dependency 'vcr'
   spec.add_development_dependency 'webmock'
-  spec.add_development_dependency 'yard'
+  spec.add_development_dependency 'yard', '>= 0.9.42'
 end