Update Sidekiq to enable rack upgrade (#4499)

department-of-veterans-affairs · Jul 9, 2020 · ea5cbdd · ea5cbdd
1 parent ec04481
commit ea5cbdd
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 26 deletions.
diff --git a/Gemfile.lock b/Gemfile.lock
@@ -263,7 +263,7 @@ GEM
     config (2.2.1)
       deep_merge (~> 1.2, >= 1.2.1)
       dry-validation (~> 1.0, >= 1.0.0)
-    connection_pool (2.2.2)
+    connection_pool (2.2.3)
     content_disposition (1.0.0)
     cork (0.3.0)
       colored2 (~> 3.1)
@@ -547,7 +547,7 @@ GEM
     pundit (1.1.0)
       activesupport (>= 3.0.0)
     raabro (1.1.6)
-    rack (2.0.9)
+    rack (2.2.3)
     rack-attack (6.2.2)
       rack (>= 1.0, < 3)
     rack-cors (1.1.1)
@@ -692,11 +692,11 @@ GEM
     shrine-memory (0.2.2)
       down
       shrine (~> 2.0)
-    sidekiq (5.2.8)
+    sidekiq (5.2.9)
       connection_pool (~> 2.2, >= 2.2.2)
-      rack (< 2.1.0)
+      rack (~> 2.0)
       rack-protection (>= 1.5.0)
-      redis (>= 3.3.5, < 5)
+      redis (>= 3.3.5, < 4.2)
     sidekiq-ent (1.8.1)
       einhorn (= 0.7.4)
       sidekiq (>= 5.2.3)

diff --git a/config/initializers/rack-CVE-2020-8184.rb b/config/initializers/rack-CVE-2020-8184.rb
diff --git a/rakelib/security.rake b/rakelib/security.rake
@@ -14,7 +14,7 @@ task security: :environment do
 
   puts 'running bundle-audit to check for insecure dependencies...'
   exit!(1) unless ShellCommand.run('bundle-audit update')
-  audit_result = ShellCommand.run('bundle-audit check --ignore CVE-2020-8161 CVE-2020-8184')
+  audit_result = ShellCommand.run('bundle-audit check')
 
   puts "\n"
   if brakeman_result && audit_result