One new truffleruby advisory

[jasnow]

One new truffleruby advisory

• rubies/truffleruby/GHSA-93gp-836g-85f2.yml

Also fixed spec for new rubies value.

[simi]

I'm not sure this is actually truffleruby security issue, since it is documentation issue about non existent library. And the versioning also doesn't match the traditional entries. Probably worth to ignore.

[jasnow]

@flavorjones - Do you agree with @simi?
Without a gem/library, someone could create one with malicious contents.

[flavorjones]

I agree we should ignore since it doesn't fit the structure of the db. I'm not sure why they even issued this CVE TBH since it would have been easier to just reserve the gem name?

[simi]

We can assign/attribute CVE to the non-existing gem :)

[jasnow]

Returning this advisory to the GHSA Unreviewed queue.