Merged in r2-3230-security-gems-docker (pull request #7089)

R2-3230 Security: Gem & NPM dependency scan for v2.12.0

Approved-by: Pavel Nabutovsky

Author: aespinoza-quoin

.rspec

@@ -1,5 +1,5 @@
 --color
---order default
+--order defined
 --backtrace
 --profile
 --require rspec/instafail

.ruby-version

@@ -1 +1 @@
-ruby-3.3.5
+ruby-3.3.7

Gemfile

@@ -3,7 +3,7 @@
 # Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
 
 source 'https://rubygems.org'
-ruby '3.3.5'
+ruby '3.3.7'
 
 gem 'activerecord-nulldb-adapter'      # Running Rake tasks at build time before DB is set up. TODO: Still needed?
 gem 'activerecord-session_store', '~> 2.0'
@@ -12,6 +12,10 @@ gem 'aws-sdk-s3',          '~> 1.130', # Access and manage Amazon S3 storage (wi
 gem 'azure-storage-blob',  '~> 1.1',   # Access and manage Microsoft Azure Storage Blob Services (with ActiveStorage).
     require: false
 gem 'cancancan',           '~> 3.5'    # Endpoint user authorization
+# TODO: concurrent-ruby v1.3.5 has removed the dependency on logger.
+# TODO: https://stackoverflow.com/a/79361034
+# TODO: Remove this dependency when upgrading to rails 7.x
+gem 'concurrent-ruby',     '1.3.4'
 gem 'csv-safe',            '~> 3.2'    # Safely export data to CSV to avoid formula injection
 gem 'daemons',             '~> 1.4.1'  # Gem to run the delayed jobs
 gem 'deep_merge',          '~> 1.2',   # Recursive merging of Hashes. Used for merging params to existing records.
@@ -28,7 +32,7 @@ gem 'jwt',                 '~> 2.8'    # Ruby JWT library used to authenticate 3
 gem 'matrix',              '~> 0.4'    # No longer part of Ruby 3.2 core. Must be included explicitly
 gem 'minipack',            '~> 0.3'    # An alternative to Webpacker. TODO: Is this still needed? In prod?
 gem 'net-http-persistent', '~> 4.0'    # Thread safe persistent HTTP connections, optional Faraday dependency
-gem 'nokogiri',            '~> 1.16'   # Security assertion on implicit dependency.
+gem 'nokogiri',            '~> 1.18'   # Security assertion on implicit dependency.
 gem 'pg',                  '~> 1.5'    # Ruby PostgreSQL binding
 gem 'prawn',               '~> 2.4'    # PDF generation
 gem 'prawn-table',         '~> 0.2'    # PDF generation
@@ -50,7 +54,7 @@ gem 'sunspot_solr',        '~> 2.6',    # Ruby bindings to Solr
 gem 'text',                '~> 1.3'    # Phonetic Search Algorithms
 gem 'twitter_cldr',        '~> 4.4'    # Localization for dates, money. TODO: Is this still used?
 gem 'tzinfo-data',         '~> 1.2023' # Timezone Data for TZInfo
-gem 'uri',                 '~> 0.12'   # CVE-2023-36617: ReDoS vulnerability in URI
+gem 'uri',                 '~> 0.13'   # CVE-2025-27221
 gem 'web-push',            '~> 3.0'
 gem 'will_paginate',       '~> 4.0'    # Paginates ActiveRecord models  TODO: This can be refactored away.
 gem 'write_xlsx',          '~> 1.11'   # Exports XLSX
@@ -84,7 +88,6 @@ group :development, :test do
   gem 'rubocop',                    '~> 1.54'
   gem 'rubocop-performance',        '~> 1.18'
   gem 'ruby-lsp',                   '~> 0.17'
-  gem 'ruby-prof',                  '~> 0.17'
   gem 'simplecov',                  '~> 0.18'
   # TODO: Latest version (1.2.5) of this conflicts with sunspot gem. Upgrade when we upgrade sunspot
   gem 'sunspot_test',               '~> 0.4', require: false