Issue: #300 Update rack to resolve vulnerabilities#301
Merged
jonrandahl merged 29 commits intodevfrom Nov 3, 2025
Merged
Conversation
- Change constrained versions to minimum versions - Update configuration to allow more flexible dependency selection
- Bump major and minor versions of the primary framework and its core dependencies - Update all direct and transitive dependencies to match new framework requirements - Add a new direct dependency in the stack as required by dependencies - Cover all parts of the framework: core, storage, job, view, text, and support - Update development tool versions for compatibility - Synchronise downstream dependency versions to prevent mismatches - Change compatibility constraints for testing gems to fit new versions
- Bump patch and minor versions for supporting libraries - Synchronise runtime, dev, and utility gems with upstream - Narrow compatibility range for styling and template packages - Lightly adjust the version of the core style library
- Update faraday to latest minor version - Ensure compatibility with updated faraday-net_http and logger - Keep deps current for improved functionality
- Bump json gem to a newer version for nested data handling - Raise net-http gem version to latest patch - Follow security and performance improvements from upstream
- Update logger dependency to the latest minor release - Improve compatibility and gain recent fixes - Prepare for potential new features from upstream
- Cleans up testing dependencies by dropping unnecessary gem - Simplifies test setup and reduces maintenance overhead
- Include csv in the dependencies list - Update lockfile to reflect csv addition
- Switch superclass to appropriate integration test base
- Restore MiniTest constant for compatibility - Explicitly require related support gem - Integrate capybara dsl into test base - Ensure capybara sessions reset after each test
- Replace legacy negative assertions with standard refute - Use modern assertion syntax in specs for better consistency - Improve readability and future compatibility of tests
- Defer require for select test gems for flexibility - Set up rails env and environment file loading earlier - Add compatibility alias for legacy minitest constant use - Add comments explaining ordering and intent in helpers - Require minitest-vcr and minitest/spec in setup
- Switches from specialised assertion helpers to standard assertion macros - Updates CSV array type and length checks to use assert_kind_of and assert_operator - Makes assertions more consistent and less reliant on framework-specific syntax
- Changes expected values to argument-first order in equality assertions - Replaces 'must_equal' and 'must_be' helpers with assert_equal and assert_operator - Standardises core assertion approach
- Updates all equality and nil assertions to standard macros - Changes from old-style helpers to assert_equal and refute_nil - Applies changes throughout multiple nested and default hash behaviour tests
- Bump versions for performance and security - Increase version for puma to latest release - Update puma-metrics to match new dependency requirements - Ensure compatibility in requirements for both packages
- Updates a frontend library to the latest patch version - Ensures compatibility and includes minor bug fixes from upstream
- Upgrades monitoring tools to address compatibility and security - Ensures better integration with current dependencies - Prepares for upcoming platform and library changes
- Updates several packages to newer versions for improved security - Addresses known vulnerabilities for compliance and stability - Enhances compatibility with latest dependency versions - Keeps development tools current and up to date
- Bumps several dependencies to include latest security patches - Improves overall reliability by resolving known vulnerabilities - Keeps components in sync with supported upstream versions
- Bumps language server and code analysis tool versions for latest features and fixes - Relaxes version constraint on type signature tool to enhance compatibility - Adds support utility for documentation - Prepares for improved compatibility and potential vulnerability fixes
- Bumps component version to ensure compatibility with other libraries - Addresses potential issues with outdated dependency - Prepares project for future updates and security patches
- Removes unused browser test and driver dependencies - Updates browser driver gems to latest versions - Streamlines test group for more reliable dependency management
- Remove test gem for vcr integration and its dependencies - Clean up references to vcr integration in dependency config - Update gem group for tests - Simplify dependency lock entries for fewer test deps
- Remove direct loading of removed test support lib - Simplify initialisation of test helper for spec usage - Drop compatibility code for removed integration
- Bumps documentation library version to address minor issues - Ensures compatibility and improved developer experience
- Removes setting for legacy time zone preservation to clean up config - Prepares for compatibility with future framework versions
- Update framework and core dependencies to address security issues - Modernise test suite for improved compatibility and maintainability - Remove unused test and integration dependencies - Fix deprecation warnings and compatibility with latest versions - Improve test logging for better clarity - Add missing dependency for compatibility with newer language versions
- Reorganises mention of deprecated configuration removal
bogdanadrianmarc
approved these changes
Nov 3, 2025
jonrandahl
deleted the
issue/300-update-rack-to-resolve-vulnerabilities
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
chore: update rack and related dependencies to address vulnerabilities
Note
Currently there is a "warning" in the start-up logs
Use 'after_stopped', 'on_stopped' is deprecated and will be removed in v8which is not caught by the JSON rails logger, that is from the
puma-metricsgem and outside of our control until the developer releases an update accordingly. I've created a ticket here for follow-up: https://github.com/epimorphics/front-end-backlog/issues/71Relates to #300