CVE-2026-85396 rubyzip path traversal vulnerability #966

Dependabot is complaining for the consumers of github-pages gem for above-mentioned security issue for one of its transitive dependency rubyzip.

Because github-pages >= 213 depends on jekyll-remote-theme = 0.4.3  and jekyll-remote-theme >= 0.4.2, < 0.5.2 depends on rubyzip >= 1.3.0, < 3.0,  github-pages >= 213 requires rubyzip >= 1.3.0, < 3.0.

But CVE-2026-85396 is fixed only in rubyzip >= 3.4.0.

The consumers of this gem have NO easier option to fix this CVE on their own.
Either we consider this gem as abandoned and directly specify jekyll gems on our own or a security update is provided.