Fix CVE-2026-41316: upgrade Ruby erb gem to >=6.0.4

The erb default gem is bundled into Ruby (which enters via
mummer4 → yaggo → ruby) and has a HIGH-severity Marshal
deserialization bypass: ERB#def_module evaluates @src via
eval() without the @_init guard added in Ruby 2.7.0.

Same fix pattern as CVE-2026-33210 (json gem, fe939b2):
delete the bundled default gem files and gemspec, then
gem install the patched version.

GHSA-q339-8rmv-2mhv

Author: dpark01

docker/Dockerfile.assemble

@@ -32,12 +32,17 @@ COPY docker/install-conda-deps.sh /tmp/
 #   - mafft's dash_client: Go 1.22.1 binary with Go stdlib CVEs; we never use --dash mode
 #   - Ruby json gem: mummer4/sequip pull in Ruby (via yaggo), whose bundled json gem
 #     has CVE-2026-33210; remove the old default gem and install patched version (>=2.19.2)
+#   - Ruby erb gem: same chain (mummer4 → yaggo → ruby), CVE-2026-41316 (Marshal
+#     deserialization bypass via ERB#def_module); remove default gem and install >=6.0.4
 RUN /tmp/install-conda-deps.sh /tmp/requirements/baseimage.txt /tmp/requirements/core.txt /tmp/requirements/assemble.txt \
     --x86-only:/tmp/requirements/assemble-x86.txt && \
     rm -f /opt/conda/libexec/mafft/dash_client && \
     find /opt/conda/lib/ruby -maxdepth 3 -name 'json*' -not -path '*/psych/*' -exec rm -rf {} + && \
     rm -f /opt/conda/lib/ruby/gems/*/specifications/default/json-*.gemspec && \
-    gem install json --version '>=2.19.2' --no-document
+    gem install json --version '>=2.19.2' --no-document && \
+    find /opt/conda/lib/ruby -maxdepth 3 -name 'erb*' -exec rm -rf {} + && \
+    rm -f /opt/conda/lib/ruby/gems/*/specifications/default/erb-*.gemspec && \
+    gem install erb --version '>=6.0.4' --no-document
 
 # Copy source code (includes assembly module)
 COPY src/ /opt/viral-ngs/source/src/

docker/Dockerfile.mega

@@ -29,14 +29,19 @@ COPY docker/install-conda-deps.sh /tmp/
 #   - mafft's dash_client: Go 1.22.1 binary with Go stdlib CVEs; we never use --dash mode
 #   - Ruby json gem: mummer4 → yaggo → Ruby, whose bundled json gem has CVE-2026-33210;
 #     remove the old default gem and install patched version (>=2.19.2)
+#   - Ruby erb gem: same chain (mummer4 → yaggo → ruby), CVE-2026-41316 (Marshal
+#     deserialization bypass via ERB#def_module); remove default gem and install >=6.0.4
 RUN /tmp/install-conda-deps.sh /tmp/requirements/baseimage.txt /tmp/requirements/core.txt /tmp/requirements/assemble.txt /tmp/requirements/classify.txt /tmp/requirements/phylo.txt \
     --x86-only:/tmp/requirements/assemble-x86.txt \
     --x86-only:/tmp/requirements/classify-x86.txt \
     --x86-only:/tmp/requirements/phylo-x86.txt && \
     rm -f /opt/conda/libexec/mafft/dash_client && \
     find /opt/conda/lib/ruby -maxdepth 3 -name 'json*' -not -path '*/psych/*' -exec rm -rf {} + && \
     rm -f /opt/conda/lib/ruby/gems/*/specifications/default/json-*.gemspec && \
-    gem install json --version '>=2.19.2' --no-document
+    gem install json --version '>=2.19.2' --no-document && \
+    find /opt/conda/lib/ruby -maxdepth 3 -name 'erb*' -exec rm -rf {} + && \
+    rm -f /opt/conda/lib/ruby/gems/*/specifications/default/erb-*.gemspec && \
+    gem install erb --version '>=6.0.4' --no-document
 
 # Copy source code (includes all modules)
 COPY src/ /opt/viral-ngs/source/src/

docker/Dockerfile.phylo

@@ -29,12 +29,17 @@ COPY docker/install-conda-deps.sh /tmp/
 #   - mafft's dash_client: Go 1.22.1 binary with Go stdlib CVEs; we never use --dash mode
 #   - Ruby json gem: mummer4 pulls in yaggo → Ruby, whose bundled json gem has
 #     CVE-2026-33210; remove the old default gem and install patched version (>=2.19.2)
+#   - Ruby erb gem: same chain (mummer4 → yaggo → ruby), CVE-2026-41316 (Marshal
+#     deserialization bypass via ERB#def_module); remove default gem and install >=6.0.4
 RUN /tmp/install-conda-deps.sh /tmp/requirements/baseimage.txt /tmp/requirements/core.txt /tmp/requirements/phylo.txt \
     --x86-only:/tmp/requirements/phylo-x86.txt && \
     rm -f /opt/conda/libexec/mafft/dash_client && \
     find /opt/conda/lib/ruby -maxdepth 3 -name 'json*' -not -path '*/psych/*' -exec rm -rf {} + && \
     rm -f /opt/conda/lib/ruby/gems/*/specifications/default/json-*.gemspec && \
-    gem install json --version '>=2.19.2' --no-document
+    gem install json --version '>=2.19.2' --no-document && \
+    find /opt/conda/lib/ruby -maxdepth 3 -name 'erb*' -exec rm -rf {} + && \
+    rm -f /opt/conda/lib/ruby/gems/*/specifications/default/erb-*.gemspec && \
+    gem install erb --version '>=6.0.4' --no-document
 
 # Copy source code (includes phylo module)
 COPY src/ /opt/viral-ngs/source/src/