From 6c59fde9984ce3be661dd0f8b1a0575742e16d36 Mon Sep 17 00:00:00 2001
From: Nigel Brookes-Thomas <nigel.brookes-thomas@dvla.gov.uk>
Date: Wed, 18 Feb 2026 09:56:12 +0000
Subject: [PATCH] fix: patch rack vuln

---
 Gemfile.lock                         | 119 +++++++++++----------------
 lib/dvla/dataverse/helper/version.rb |   2 +-
 2 files changed, 48 insertions(+), 73 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index e19e207..9d13efb 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -11,102 +11,77 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    base64 (0.2.0)
-    bigdecimal (3.1.7)
-    colorize (0.8.1)
-    concurrent-ruby (1.2.3)
-    config (4.2.1)
+    base64 (0.3.0)
+    bigdecimal (4.0.1)
+    colorize (1.1.0)
+    config (5.6.1)
       deep_merge (~> 1.2, >= 1.2.1)
-      dry-validation (~> 1.0, >= 1.0.0)
+      ostruct
     deep_merge (1.2.2)
-    diff-lcs (1.5.1)
+    diff-lcs (1.6.2)
     domain_name (0.6.20240107)
-    dry-configurable (1.1.0)
-      dry-core (~> 1.0, < 2)
-      zeitwerk (~> 2.6)
-    dry-core (1.0.1)
-      concurrent-ruby (~> 1.0)
-      zeitwerk (~> 2.6)
-    dry-inflector (1.0.0)
-    dry-initializer (3.1.1)
-    dry-logic (1.5.0)
-      concurrent-ruby (~> 1.0)
-      dry-core (~> 1.0, < 2)
-      zeitwerk (~> 2.6)
-    dry-schema (1.13.3)
-      concurrent-ruby (~> 1.0)
-      dry-configurable (~> 1.0, >= 1.0.1)
-      dry-core (~> 1.0, < 2)
-      dry-initializer (~> 3.0)
-      dry-logic (>= 1.4, < 2)
-      dry-types (>= 1.7, < 2)
-      zeitwerk (~> 2.6)
-    dry-types (1.7.2)
-      bigdecimal (~> 3.0)
-      concurrent-ruby (~> 1.0)
-      dry-core (~> 1.0)
-      dry-inflector (~> 1.0)
-      dry-logic (~> 1.4)
-      zeitwerk (~> 2.6)
-    dry-validation (1.10.0)
-      concurrent-ruby (~> 1.0)
-      dry-core (~> 1.0, < 2)
-      dry-initializer (~> 3.0)
-      dry-schema (>= 1.12, < 2)
-      zeitwerk (~> 2.6)
-    faraday (2.9.0)
-      faraday-net_http (>= 2.0, < 3.2)
-    faraday-net_http (3.1.0)
-      net-http
-    hashie (5.0.0)
+    faraday (2.14.1)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
+    faraday-net_http (3.4.2)
+      net-http (~> 0.5)
+    hashie (5.1.0)
+      logger
     http-accept (1.7.0)
-    http-cookie (1.0.5)
+    http-cookie (1.1.0)
       domain_name (~> 0.5)
-    jwt (2.8.1)
+    json (2.18.1)
+    jwt (3.1.2)
       base64
-    mime-types (3.5.2)
-      mime-types-data (~> 3.2015)
-    mime-types-data (3.2024.0305)
-    multi_xml (0.6.0)
-    net-http (0.4.1)
-      uri
+    logger (1.7.0)
+    mime-types (3.7.0)
+      logger
+      mime-types-data (~> 3.2025, >= 3.2025.0507)
+    mime-types-data (3.2026.0203)
+    multi_xml (0.8.1)
+      bigdecimal (>= 3.1, < 5)
+    net-http (0.9.1)
+      uri (>= 0.11.1)
     netrc (0.11.0)
-    oauth2 (2.0.9)
-      faraday (>= 0.17.3, < 3.0)
-      jwt (>= 1.0, < 3.0)
+    oauth2 (2.0.18)
+      faraday (>= 0.17.3, < 4.0)
+      jwt (>= 1.0, < 4.0)
+      logger (~> 1.2)
       multi_xml (~> 0.5)
       rack (>= 1.2, < 4)
-      snaky_hash (~> 2.0)
-      version_gem (~> 1.1)
-    rack (3.0.10)
-    rake (13.2.1)
+      snaky_hash (~> 2.0, >= 2.0.3)
+      version_gem (~> 1.1, >= 1.1.9)
+    ostruct (0.6.3)
+    rack (3.2.5)
+    rake (13.3.1)
     rest-client (2.1.0)
       http-accept (>= 1.7.0, < 2.0)
       http-cookie (>= 1.0.2, < 2.0)
       mime-types (>= 1.16, < 4.0)
       netrc (~> 0.8)
-    rspec (3.13.0)
+    rspec (3.13.2)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
       rspec-mocks (~> 3.13.0)
-    rspec-core (3.13.0)
+    rspec-core (3.13.6)
       rspec-support (~> 3.13.0)
-    rspec-expectations (3.13.0)
+    rspec-expectations (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-mocks (3.13.0)
+    rspec-mocks (3.13.7)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-support (3.13.1)
-    snaky_hash (2.0.1)
-      hashie
-      version_gem (~> 1.1, >= 1.1.1)
-    uri (0.13.0)
-    version_gem (1.1.4)
-    zeitwerk (2.6.13)
+    rspec-support (3.13.7)
+    snaky_hash (2.0.3)
+      hashie (>= 0.1.0, < 6)
+      version_gem (>= 1.1.8, < 3)
+    uri (1.1.1)
+    version_gem (1.1.9)
 
 PLATFORMS
   arm64-darwin-23
+  arm64-darwin-25
   x86_64-darwin-21
   x86_64-linux
 
@@ -117,4 +92,4 @@ DEPENDENCIES
   rspec (~> 3.0)
 
 BUNDLED WITH
-   2.5.7
+  4.0.5
diff --git a/lib/dvla/dataverse/helper/version.rb b/lib/dvla/dataverse/helper/version.rb
index 0031ce3..dd5ce90 100644
--- a/lib/dvla/dataverse/helper/version.rb
+++ b/lib/dvla/dataverse/helper/version.rb
@@ -3,7 +3,7 @@
 module Dvla
   module Dataverse
     module Helper
-      VERSION = "0.1.4"
+      VERSION = "0.1.5"
     end
   end
 end