From 05e75991eba87dd2bb4941cb69b981ab3b6a1eb3 Mon Sep 17 00:00:00 2001 From: jazairi <16103405+jazairi@users.noreply.github.com> Date: Thu, 2 Jul 2026 09:44:43 -0700 Subject: [PATCH 1/2] Major and security dependency updates Pin connection pool --- Gemfile | 2 +- Gemfile.lock | 143 ++++++++++++++++++++++++--------------------------- 2 files changed, 68 insertions(+), 77 deletions(-) diff --git a/Gemfile b/Gemfile index 94410e82..ef010d75 100644 --- a/Gemfile +++ b/Gemfile @@ -27,7 +27,7 @@ gem 'stringex' gem 'terser' group :production do - gem 'connection_pool', '< 4' # 3.x requires keyword args; pin to 2.x for Rails 7.2.3 + gem 'connection_pool', '~> 2.4' # 3.x requires keyword args; pin to 2.x for Rails 7.2.3 gem 'dalli' gem 'pg' end diff --git a/Gemfile.lock b/Gemfile.lock index 53f6e43d..28bcb6a3 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -91,37 +91,39 @@ GEM minitest (>= 5.1, < 6) securerandom (>= 0.3) tzinfo (~> 2.0, >= 2.0.5) - addressable (2.8.8) + addressable (2.9.0) public_suffix (>= 2.0.2, < 8.0) annotate (3.2.0) activerecord (>= 3.2, < 8.0) rake (>= 10.4, < 14.0) ast (2.4.3) - barnes (0.0.9) - multi_json (~> 1) - statsd-ruby (~> 1.1) + barnes (1.0.1) + json + logger + ostruct base64 (0.3.0) benchmark (0.5.0) better_errors (2.10.1) erubi (>= 1.0.0) rack (>= 0.9.0) rouge (>= 1.0.0) - bigdecimal (4.0.1) + bigdecimal (4.1.2) bindex (0.8.1) - binding_of_caller (1.0.1) + binding_of_caller (2.0.0) debug_inspector (>= 1.2.0) - bootsnap (1.23.0) + bootsnap (1.24.6) msgpack (~> 1.2) builder (3.3.0) cgi (0.5.2) climate_control (1.2.0) concurrent-ruby (1.3.7) - connection_pool (3.0.2) + connection_pool (2.5.5) crack (1.0.1) bigdecimal rexml crass (1.0.7) - dalli (3.2.8) + dalli (5.0.5) + logger date (3.5.1) debug (1.11.1) irb (~> 1.10) @@ -137,19 +139,16 @@ GEM drb (2.2.3) erb (6.0.4) erubi (1.13.1) - execjs (2.10.0) - faraday (2.14.0) + execjs (2.10.1) + faraday (2.14.3) faraday-net_http (>= 2.0, < 3.5) json logger - faraday-net_http (3.4.2) + faraday-net_http (3.4.4) net-http (~> 0.5) - ffi (1.17.3) - ffi-compiler (1.3.2) - ffi (>= 1.15.5) - rake + ffi (1.17.4) gems (1.3.0) - globalid (1.3.0) + globalid (1.4.0) activesupport (>= 6.1) google-api-client (0.53.0) google-apis-core (~> 0.1) @@ -162,9 +161,9 @@ GEM mutex_m representable (~> 3.0) retriable (>= 2.0, < 4.a) - google-apis-discovery_v1 (0.20.0) + google-apis-discovery_v1 (0.21.0) google-apis-core (>= 0.15.0, < 2.a) - google-apis-generator (0.18.0) + google-apis-generator (0.19.0) activesupport (>= 5.0) gems (~> 1.2) google-apis-core (>= 0.15.0, < 2.a) @@ -174,31 +173,28 @@ GEM base64 (~> 0.2) faraday (>= 1.0, < 3.a) google-logging-utils (0.2.0) - googleauth (1.16.0) + googleauth (1.17.1) faraday (>= 1.0, < 3.a) google-cloud-env (~> 2.2) google-logging-utils (~> 0.1) jwt (>= 1.4, < 4.0) - multi_json (~> 1.11) os (>= 0.9, < 2.0) + pstore (~> 0.1) signet (>= 0.16, < 2.a) hashdiff (1.2.1) - http (5.3.1) - addressable (~> 2.8) + http (6.0.3) http-cookie (~> 1.0) - http-form_data (~> 2.2) - llhttp-ffi (~> 0.5.0) - http-cookie (1.1.0) + llhttp (~> 0.6.1) + http-cookie (1.1.6) domain_name (~> 0.5) - http-form_data (2.3.0) - http_logger (1.0.1) + http_logger (1.0.2) httpclient (2.9.0) mutex_m - i18n (1.14.8) + i18n (1.15.2) concurrent-ruby (~> 1.0) io-console (0.8.2) ipaddr_range_set (1.0.0) - irb (1.17.0) + irb (1.18.0) pp (>= 0.6.0) prism (>= 1.3.0) rdoc (>= 4.0.0) @@ -208,10 +204,8 @@ GEM railties (>= 4.2.0) thor (>= 0.14, < 2.0) jquery-validation-rails (1.19.0) - json (2.18.1) - json-schema (4.3.1) - addressable (>= 2.8) - jwt (3.1.2) + json (2.20.0) + jwt (3.2.0) base64 language_server-protocol (3.17.0.5) lint_roller (1.1.0) @@ -219,9 +213,7 @@ GEM logger rb-fsevent (~> 0.10, >= 0.10.3) rb-inotify (~> 0.9, >= 0.9.10) - llhttp-ffi (0.5.1) - ffi-compiler (~> 1.0) - rake (~> 13.0) + llhttp (0.6.2) logger (1.7.0) lograge (0.14.0) actionpack (>= 4) @@ -237,16 +229,13 @@ GEM net-imap net-pop net-smtp - marcel (1.1.1) - mcp (0.7.1) - json-schema (>= 4.1) + marcel (1.2.1) mini_mime (1.1.5) mini_portile2 (2.8.9) minitest (5.27.0) - mocha (3.0.2) + mocha (3.1.0) ruby2_keywords (>= 0.0.5) - msgpack (1.8.0) - multi_json (1.19.1) + msgpack (1.8.3) mutex_m (0.3.0) net-http (0.9.1) uri (>= 0.11.1) @@ -264,8 +253,9 @@ GEM mini_portile2 (~> 2.8.2) racc (~> 1.4) os (1.1.4) - parallel (1.27.0) - parser (3.3.10.2) + ostruct (0.6.3) + parallel (2.1.0) + parser (3.3.11.1) ast (~> 2.4.1) racc pg (1.6.3) @@ -273,11 +263,9 @@ GEM prettyprint prettyprint (0.2.0) prism (1.9.0) - psych (5.3.1) - date - stringio - public_suffix (7.0.2) - puma (7.2.0) + pstore (0.2.1) + public_suffix (7.0.5) + puma (8.0.2) nio4r (~> 2.0) racc (1.8.1) rack (3.2.6) @@ -322,15 +310,20 @@ GEM tsort (>= 0.2) zeitwerk (~> 2.6) rainbow (3.1.1) - rake (13.3.1) + rake (13.4.2) rb-fsevent (0.11.2) rb-inotify (0.11.1) ffi (~> 1.0) - rdoc (7.2.0) + rbs (4.0.3) + logger + prism (>= 1.6.0) + tsort + rdoc (8.0.0) erb - psych (>= 4.0.0) + prism (>= 1.6.0) + rbs (>= 4.0.0) tsort - regexp_parser (2.11.3) + regexp_parser (2.12.0) reline (0.6.3) io-console (~> 0.5) representable (3.2.0) @@ -339,25 +332,25 @@ GEM uber (< 0.2.0) request_store (1.7.0) rack (>= 1.4) - retriable (3.1.2) + retriable (3.8.0) rexml (3.4.4) - rouge (4.7.0) - rubocop (1.85.0) + rouge (5.0.0) + strscan (~> 3.1) + rubocop (1.88.1) json (~> 2.3) language_server-protocol (~> 3.17.0.2) lint_roller (~> 1.1.0) - mcp (~> 0.6) - parallel (~> 1.10) + parallel (>= 1.10) parser (>= 3.3.0.2) rainbow (>= 2.2.2, < 4.0) regexp_parser (>= 2.9.3, < 3.0) rubocop-ast (>= 1.49.0, < 2.0) ruby-progressbar (~> 1.7) unicode-display_width (>= 2.4.0, < 4.0) - rubocop-ast (1.49.0) + rubocop-ast (1.49.1) parser (>= 3.3.7.2) prism (~> 1.7) - rubocop-rails (2.34.3) + rubocop-rails (2.35.5) activesupport (>= 4.2.0) lint_roller (~> 1.1) rack (>= 1.1) @@ -376,18 +369,17 @@ GEM sprockets-rails tilt securerandom (0.4.1) - sentry-rails (6.4.1) + sentry-rails (6.6.2) railties (>= 5.2.0) - sentry-ruby (~> 6.4.1) - sentry-ruby (6.4.1) + sentry-ruby (~> 6.6.2) + sentry-ruby (6.6.2) bigdecimal concurrent-ruby (~> 1.0, >= 1.0.2) logger - signet (0.21.0) + signet (0.22.0) addressable (~> 2.8) faraday (>= 0.17.5, < 3.a) jwt (>= 1.5, < 4.0) - multi_json (~> 1.10) simplecov (0.22.0) docile (~> 1.1) simplecov-html (~> 0.11) @@ -395,8 +387,8 @@ GEM simplecov-html (0.13.2) simplecov-lcov (0.9.0) simplecov_json_formatter (0.1.4) - skylight (7.0.0) - activesupport (>= 7.1.0) + skylight (7.1.1) + activesupport (>= 7.2.0) sprockets (4.2.2) concurrent-ruby (~> 1.0) logger @@ -405,15 +397,14 @@ GEM actionpack (>= 6.1) activesupport (>= 6.1) sprockets (>= 3.0.0) - sqlite3 (2.9.1) + sqlite3 (2.9.5) mini_portile2 (~> 2.8.0) - statsd-ruby (1.5.0) stringex (2.8.6) - stringio (3.2.0) - terser (1.2.6) + strscan (3.1.8) + terser (1.2.7) execjs (>= 0.3.0, < 3) thor (1.5.0) - tilt (2.6.1) + tilt (2.7.0) timeout (0.6.1) trailblazer-option (0.1.2) tsort (0.2.0) @@ -431,7 +422,7 @@ GEM activemodel (>= 6.0.0) bindex (>= 0.4.0) railties (>= 6.0.0) - webmock (3.26.1) + webmock (3.26.2) addressable (>= 2.8.0) crack (>= 0.3.2) hashdiff (>= 0.4.0, < 2.0.0) @@ -439,7 +430,7 @@ GEM base64 websocket-extensions (>= 0.1.0) websocket-extensions (0.1.5) - zeitwerk (2.7.5) + zeitwerk (2.8.2) PLATFORMS ruby @@ -452,7 +443,7 @@ DEPENDENCIES binding_of_caller bootsnap climate_control - connection_pool (< 4) + connection_pool (~> 2.4) dalli debug dotenv-rails From fe78899ef13cf228fd2c22f7b70b6759cb81973c Mon Sep 17 00:00:00 2001 From: jazairi <16103405+jazairi@users.noreply.github.com> Date: Thu, 2 Jul 2026 10:07:09 -0700 Subject: [PATCH 2/2] Explicitly add multi_json to Gemfile --- Gemfile | 1 + Gemfile.lock | 2 ++ 2 files changed, 3 insertions(+) diff --git a/Gemfile b/Gemfile index ef010d75..5535eddf 100644 --- a/Gemfile +++ b/Gemfile @@ -12,6 +12,7 @@ gem 'jquery-rails' gem 'jquery-validation-rails' gem 'lograge' gem 'mitlibraries-theme', git: 'https://github.com/mitlibraries/mitlibraries-theme', tag: 'v1.4' +gem 'multi_json' gem 'net-imap', require: false gem 'net-pop', require: false gem 'net-smtp', require: false diff --git a/Gemfile.lock b/Gemfile.lock index 28bcb6a3..5abc8070 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -236,6 +236,7 @@ GEM mocha (3.1.0) ruby2_keywords (>= 0.0.5) msgpack (1.8.3) + multi_json (1.21.1) mutex_m (0.3.0) net-http (0.9.1) uri (>= 0.11.1) @@ -458,6 +459,7 @@ DEPENDENCIES minitest (< 6) mitlibraries-theme! mocha + multi_json net-imap net-pop net-smtp