Bump govuk_sidekiq, sidekiq, govuk_app_config and rack

[dependabot]

Bumps govuk_sidekiq, sidekiq, govuk_app_config and rack. These dependencies needed to be updated together.
Updates govuk_sidekiq from 8.0.1 to 9.0.0

Changelog

Sourced from govuk_sidekiq's changelog.

9.0.0

• Switch from using redis gem to redis-client
• BREAKING: Remove redis-namespace dependency and support for Redis namespaces
  • Run the redis_namespace:remove_namespace rake task immediately after upgrading to to this version, to retain existing queued jobs.
• BREAKING: Upgrade Sidekiq to version 7.0, follow these steps to upgrade:
  1. Sidekiq::Worker has been deprecated in Sidekiq 7. Replace all instances of Sidekiq::Worker with Sidekiq::Job, then rename/move your workers to be app/sidekiq/MyJob.rb instead of app/workers/MyWorker.rb.
  2. Remove the requirement for Sidekiq strict arguments from config/initializers/sidekiq.rb. This was added to include Sidekiq 7 strict arguments behaviour in Sidekiq 6, but is no longer needed to be explictly required, since this is now the default behaviour.
  3. If using sidekiq-unique-jobs, pin to < 8.0.8 until a known issue is resolved.
  4. Make any changes required based on the information in the Sidekiq 7 API migration guide.

Commits

• 946dd53 Merge pull request #115 from alphagov/sidekiq-mobbing
• 289da44 Release version 9.0.0 of the gem
• 749f82b Add rake task to remove Redis namespacing
• a89c0b9 Add upgrade instructions for Sidekiq 7
• 97050fb Upgrade Sidekiq to version 7.0
• 34c94ea Remove redis-namespace dependency
• 578789e Switch from redis to redis-client
• 53c521a Merge pull request #114 from alphagov/dependabot/bundler/rubocop-govuk-eq-5.0.2
• c8b44f0 Update rubocop-govuk requirement from = 5.0.1 to = 5.0.2
• 2e5127a Merge pull request #113 from alphagov/dependabot/bundler/rubocop-govuk-eq-5.0.1
• Additional commits viewable in compare view

Updates sidekiq from 6.5.12 to 7.3.2

Changelog

Sourced from sidekiq's changelog.

7.3.2

• Adjust ActiveRecord batch iteration to restart an interrupted batch from the beginning. Each batch should be processed as a single transaction in order to be idempotent. #6405
• Fix typo in S::DeadSet#kill #6397
• Fix CSS issue with bottom bar in Web UI #6414

7.3.1

• Don't count job interruptions as failures in metrics #6386
• Add frozen string literal to a number of .rb files.
• Fix frozen string error with style_tag and script_tag #6371
• Fix an error on Ruby 2.7 because of usage of Hash#except #6376

7.3.0

• NEW FEATURE Add Sidekiq::IterableJob, iteration support for long-running jobs. [#6286, fatkodima] Iterable jobs are interruptible and can restart quickly if running during a deploy. You must ensure that each_iteration doesn't take more than Sidekiq's -t timeout (default: 25 seconds). Iterable jobs must not implement perform.

class ProcessArrayJob
  include Sidekiq::IterableJob
  def build_enumerator(*args, **kwargs)
    array_enumerator(args, **kwargs)
  end
  def each_iteration(arg)
    puts arg
  end
end
ProcessArrayJob.perform_async(1, 2, 3)

See the Iteration wiki page and the RDoc in Sidekiq::IterableJob. This feature should be considered BETA until the next minor release.

• SECURITY The Web UI no longer allows extensions to use <script>. Adjust CSP to disallow inline scripts within the Web UI. Please see examples/webui-ext for how to register Web UI extensions and use dynamic CSS and JS. This will make Sidekiq immune to XSS attacks. #6270
• Add config option, :skip_default_job_logging to disable Sidekiq's default start/finish job logging. #6200
• Allow Sidekiq::Limiter.redis to use Redis Cluster #6288
• Retain CurrentAttributeѕ after inline execution #6307
• Ignore non-existent CurrentAttributes attributes when restoring #6341
• Raise default Redis {read,write,connect} timeouts from 1 to 3 seconds to minimize ReadTimeoutErrors #6162
• Add logger as a dependency since it will become bundled in Ruby 3.5 #6320
• Ignore unsupported locales in the Web UI #6313

... (truncated)

Commits

• e26cba9 changes
• 88133f5 Fix missing require in test
• 57baa35 Reduce max-width for redis-url elements (#6414)
• 164b690 bump
• 96c5ee9 Iterable Jobs: Update cursor after processing iteration (#6405)
• ed8b217 add test cases
• 7f692c1 Fix bug in Deadset#kill ex param
• 16b7115 formatting
• bd2aac5 prep for release
• ce29f51 remove need for S::Component in job_logger, see #6385
• Additional commits viewable in compare view

Updates govuk_app_config from 9.14.0 to 9.14.2

Changelog

Sourced from govuk_app_config's changelog.

9.14.2

• Update dependencies

9.14.1

• Update dependencies

Commits

• b0dd13d Merge pull request #398 from alphagov/release-9.14.2
• a74df93 Release v9.14.2
• 1568ac2 Merge pull request #397 from alphagov/dependabot/bundler/opentelemetry-instru...
• 99b357e Update opentelemetry-instrumentation-all requirement from >= 0.39.1, < 0.65.0...
• fad6ea0 Merge pull request #394 from alphagov/release-9.14.1
• 594021a Merge pull request #396 from alphagov/dependabot/bundler/opentelemetry-instru...
• e8b795d Update opentelemetry-instrumentation-all requirement from >= 0.39.1, < 0.64.0...
• 884b6e1 Merge pull request #395 from alphagov/dependabot/bundler/opentelemetry-export...
• 4ab300d Update opentelemetry-exporter-otlp requirement from >= 0.25, < 0.29 to >= 0.2...
• dd0d790 Release v9.14.1
• Additional commits viewable in compare view

Updates rack from 2.2.9 to 3.1.7

Release notes

Sourced from rack's releases.

v3.0.9.1

What's Changed

• Fixed ReDoS in Accept header parsing [CVE-2024-26146]
• Fixed ReDoS in Content Type header parsing [CVE-2024-25126]
• Reject Range headers which are too large [CVE-2024-26141]

Full Changelog: rack/rack@v3.0.9...v3.0.9.1

v3.0.9

What's Changed

• Fix content-length calcuation in Rack:Response#write #2150

Full Changelog: rack/rack@v3.0.8...v3.0.9

v3.0.8

What's Changed

• Backport "Fix some unused variable verbose warnings" by @​skipkayhil in rack/rack#2084

New Contributors

• @​skipkayhil made their first contribution in rack/rack#2084

Full Changelog: rack/rack@v3.0.7...v3.0.8

v3.0.7

What's Changed

• Backport "Make query parameters without = have nil values". by @​jeremyevans in rack/rack#2060

Full Changelog: rack/rack@v3.0.6.1...v3.0.7

v3.0.6.1

No release notes provided.

v3.0.4.1

Full Changelog: rack/rack@v3.0.4...v3.0.4.1

v3.0.4

Full Changelog: rack/rack@v3.0.3...v3.0.4

v3.0.3

What's Changed

• Release v3.0.3 by @​ioquatix in rack/rack#2000

Full Changelog: rack/rack@v3.0.2...v3.0.3

v3.0.2

Full Changelog: rack/rack@v3.0.1...v3.0.2

Changelog

Sourced from rack's changelog.

[3.1.7] - 2024-07-11

Fixed

• Do not remove escaped opening/closing quotes for content-disposition filenames. (#2229, [@​jeremyevans])
• Fix encoding setting for non-binary IO-like objects in MockRequest#env_for. (#2227, [@​jeremyevans])
• Rack::Response should not generate invalid content-length header. (#2219, [@​ioquatix])
• Allow empty PATH_INFO. (#2214, [@​ioquatix])

[3.1.6] - 2024-07-03

Fixed

• Fix several edge cases in Rack::Request#parse_http_accept_header's implementation. (#2226, [@​ioquatix])

[3.1.5] - 2024-07-02

Security

• Fix potential ReDoS attack in Rack::Request#parse_http_accept_header. (GHSA-cj83-2ww7-mvq7, @​dwisiswant0)

[3.1.4] - 2024-06-22

Fixed

• Fix Rack::Lint matching some paths incorrectly as authority form. (#2220, [@​ioquatix])

[3.1.3] - 2024-06-12

Fixed

• Fix passing non-strings to Rack::Utils.escape_html. (#2202, [@​earlopain])
• Rack::MockResponse gracefully handles empty cookies (#2203 [@​wynksaiddestroy])

[3.1.2] - 2024-06-11

• Rack::Response will take in to consideration chunked encoding responses (#2204, [@​tenderlove])

[3.1.1] - 2024-06-11

• Oops! I shouldn't have shipped that

[3.1.0] - 2024-06-11

⚠️ This release includes several breaking changes. Refer to the Removed section below for the list of deprecated methods that have been removed in this release.

Rack v3.1 is primarily a maintenance release that removes features deprecated in Rack v3.0. Alongside these removals, there are several improvements to the Rack SPEC, mainly focused on enhancing input and output handling. These changes aim to make Rack more efficient and align better with the requirements of server implementations and relevant HTTP specifications.

SPEC Changes

... (truncated)

Commits

• 4bb2f72 Bump patch version.
• 1c1e413 Ignore external tests directory.
• b4a1036 Prepare for 3.1.7 release.
• d0da91b Add more external tests.
• f6f1510 Improve Rack::Response content-length header generation. (#2219)
• fb339e0 Fix encoding setting for non-binary IO-like objects in MockRequest#env_for
• e21872d Do not remove escaped opening/closing quotes for content-disposition filenames
• 5c3d79f Synchronize changelog with HEAD.
• bca33b4 Allow empty PATH_INFO. (#2214) (#2234)
• 98aa947 Bump patch version.
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

⚠️ This repo is Continuously Deployed: make sure you follow the guidance ⚠️

Follow these steps if you are doing a Rails upgrade.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.