From 497bc88b9301753b8513a96fea64ed860ba74d70 Mon Sep 17 00:00:00 2001
From: Torrey Payne <11740989+torreypayne@users.noreply.github.com>
Date: Mon, 24 Aug 2026 18:12:34 +0000
Subject: [PATCH] fix(owlbot-postprocessor): remove default json gemspec to
 clear CVE

---
 owlbot-postprocessor/Dockerfile | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/owlbot-postprocessor/Dockerfile b/owlbot-postprocessor/Dockerfile
index da94207e..6d5105d2 100644
--- a/owlbot-postprocessor/Dockerfile
+++ b/owlbot-postprocessor/Dockerfile
@@ -18,6 +18,9 @@ RUN apt-get update \
     && apt-get -y autoremove \
     && apt-get -y autoclean
 RUN mkdir /ruby-postprocessor \
+    # Clear default gemspec so static scanners see only patched json 2.19.2.
+    # Can be cleaned up once json >= 2.19.2 is bundled in the Ruby base image.
+    && rm -f /usr/local/lib/ruby/gems/*/specifications/default/json-*.gemspec \
     && gem install toys:0.21.0 rexml:3.4.4 json:2.19.2
 WORKDIR /ruby-postprocessor
 COPY lib/*.rb /ruby-postprocessor/