[orien]

Note: Samson is a public repo, do not include Zendesk-internal information, urls, etc.

Updates the gems that bundle audit flags and that can be fixed without a major version bump or a Gemfile change. Only Gemfile.lock changes.

Gem	From	To
rack	2.2.14	2.2.24
nokogiri	1.18.9	1.19.4
net-imap	0.5.8	0.5.15
datadog	2.15.0	2.44.0
dalli	3.2.8	3.2.13
faraday-http-cache	2.5.1	2.8.0
oauth2	2.0.9	2.0.25
faraday	2.13.1	2.14.4
httparty	0.23.1	0.24.3
websocket-driver	0.7.7	0.8.2
aws-sdk-s3	1.185.0	1.233.2
json	2.11.3	2.21.2
jwt	2.10.1	2.10.3
uri	1.0.3	1.1.2
addressable	2.8.7	2.9.0
loofah	2.24.0	2.25.2
rails-html-sanitizer	1.6.2	1.7.1
concurrent-ruby	1.3.5	1.3.8
crass	1.0.6	1.0.7
msgpack	1.8.0	1.8.5
rexml	3.4.1	3.4.4

The updates ran with bundle update --conservative --minor --strict so no other gem moved past what these required. datadog's native companion gems libdatadog (16 to 44) and libddwaf (1.22 to 1.30) follow datadog's own pins, and oauth2 2.0.25 brings in two small new dependencies, anonymous_loader and auth-sanitizer. rubocop stays at 1.70.0.

This clears 119 of the 137 advisories in the current bundler-audit database. The remaining 18 are in Rails 7.0 (fixed in 7.1.5.2 and 7.2.3.1), Puma 5 (fixed in 7.2.1), sqlite3 1.x (fixed in 2.9.6) and mail, which the Gemfile pins to 2.7.x with a note that upgrading breaks rails c. Those are tracked in PE-7185 and stay out of this change, so the bundle_audit CI job still fails.

References

• Jira link: PE-7185 - Resolve bundle audit security advisories in Samson

Risks

• Low: oauth2 2.0.9 to 2.0.25 sits under the GitHub, GitLab and Bitbucket login strategies. The test suite covers them with mocked providers, so a real login on staging is the check that matters.
• Low: rack 2.2.18 and later tighten the default query and multipart parsing limits. Samson's forms are small, but a deploy with an unusually large parameter payload would now be rejected.
• None expected from faraday-http-cache 2.8. Its two fixes apply to the JSON serializer and to shared caches, and the Octokit middleware in config/initializers/octokit.rb already uses Marshal with shared_cache: false. The dalli socket patch in config/initializers/sockify.rb still applies, because lib/dalli/socket.rb is identical between 3.2.8 and 3.2.13.
• Low: datadog 2.15 to 2.44 is a large span of minor releases for the tracer. Traces and the Datadog dashboards on staging will show any change in instrumentation.