Upgrade prawn-svg to address CVE-2026-53727

[alsutton]

Asciidoctor version

2.3.24

Description

The vulnerable css_parser gem is coming in through a transitive dependency via the prawn-svg gem. Trying to force it to a non-vulnerable version fails with the error below when running bundle update;

Could not find compatible versions

Because asciidoctor-pdf >= 2.3.14 depends on prawn-svg ~> 0.34.0
  and Gemfile depends on asciidoctor-pdf >= 2.3.24, < 3.A,
  prawn-svg ~> 0.34.0 is required.
So, because Gemfile depends on prawn-svg >= 0.40.3,
  version solving has failed.

Sample document

N/A - Dependency chain issue

Expected behavior

Ability to upgrade to a non-vulnerable css_parser version to ensure our SBOM doesn't contain any red flags about vulnerable dependencies which cause concern for users.

Actual behavior

Dependency update blocked by the Gemfile conditions in the current latest release.

[mojavelinux]

I understand the situation is frustrating. The version overrides in RubyGems make very little sense. I've always felt like the consumer should have the ability to override the versions like every other package management system. But we're stuck with what we've got.

We cannot upgrade prawn-svg in this release line because of #2604. However, we can upgrade in main and we plan on releasing Asciidoctor PDF 3.0.0 asap. So we can address it there.

But first, we actually need a PR to upgrade prawn-svg in main. You are welcome to submit that if you want to hurry this along.

[mojavelinux]

I tried to upgrade to 0.40.x in main and there are test failures. Those will need to be addressed.