Merge pull request #4775 from Growstuff/dependabot/bundler/scout_apm-6.3.0

Bump scout_apm from 6.2.1 to 6.3.0

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/devcontainers/ruby:3.4-trixie
+FROM mcr.microsoft.com/devcontainers/ruby:4-trixie
 
 # Install Rails
 RUN gem install rails:8.0.5

.ruby-version

@@ -1 +1 @@
-3.4.9
+4.0.6

Dockerfile

@@ -1,4 +1,4 @@
-FROM ruby:3.4.9-trixie
+FROM 4.0.6-trixie
 
 # Install system dependencies
 RUN apt-get update -qq && \

Gemfile

@@ -18,6 +18,7 @@ gem 'bundler', '>= 2.4.22'
 gem 'coffee-rails'
 gem 'haml'
 gem 'sassc-rails'
+gem 'oauth', '1.1.6' # Explicitly pinned, as the maintainer does huge (400 files, 45k lines) changes in point releases - required manual plus agentic security review.
 
 # API data
 gem 'jsonapi-resources'

Gemfile.lock

@@ -119,7 +119,11 @@ GEM
       uri (>= 0.13.1)
     addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
+    anonymous_loader (0.1.3)
+      version_gem (~> 1.1, >= 1.1.14)
     ast (2.4.3)
+    auth-sanitizer (0.2.3)
+      version_gem (~> 1.1, >= 1.1.14)
     autoprefixer-rails (10.4.16.0)
       execjs (~> 2)
     aws-eventstream (1.4.0)
@@ -141,12 +145,12 @@ GEM
       aws-sigv4 (~> 1.5)
     aws-sigv4 (1.12.1)
       aws-eventstream (~> 1, >= 1.0.2)
-    axe-core-api (4.12.0)
+    axe-core-api (4.13.0)
       dumb_delegator
-    axe-core-capybara (4.12.0)
-      axe-core-api (= 4.12.0)
-    axe-core-rspec (4.12.0)
-      axe-core-api (= 4.12.0)
+    axe-core-capybara (4.13.0)
+      axe-core-api (= 4.13.0)
+    axe-core-rspec (4.13.0)
+      axe-core-api (= 4.13.0)
     base64 (0.3.0)
     bcrypt (3.1.22)
     better_errors (2.10.1)
@@ -167,7 +171,7 @@ GEM
       actionpack (>= 6.1)
       activemodel (>= 6.1)
     builder (3.3.0)
-    bullet (8.1.3)
+    bullet (8.2.0)
       activesupport (>= 3.0.0)
       uniform_notifier (~> 1.11)
     byebug (13.0.0)
@@ -195,6 +199,7 @@ GEM
       image_processing (~> 1.1)
       marcel (~> 1.0.0)
       ssrf_filter (~> 1.0)
+    cgi (0.5.2)
     chartkick (5.2.1)
     childprocess (5.1.0)
       logger (~> 1.5)
@@ -223,7 +228,7 @@ GEM
     csv_shaper (1.4.0)
       activesupport (>= 3.0.0)
       csv
-    dalli (5.0.6)
+    dalli (5.1.0)
       logger
     database_cleaner (2.1.0)
       database_cleaner-active_record (>= 2, < 3)
@@ -298,7 +303,7 @@ GEM
     gravatar-ultimate (2.0.0)
       activesupport (>= 2.3.14)
       rack
-    haml (7.3.0)
+    haml (7.5.1)
       prism (>= 1.1.0)
       temple (>= 0.8.2)
       thor
@@ -308,7 +313,7 @@ GEM
       activesupport (>= 5.1)
       haml (>= 4.0.6)
       railties (>= 5.1)
-    haml_lint (0.77.0)
+    haml_lint (0.78.0)
       haml (>= 5.0)
       parallel (>= 1.10)
       rainbow
@@ -350,7 +355,7 @@ GEM
     image_processing (1.14.0)
       mini_magick (>= 4.9.5, < 6)
       ruby-vips (>= 2.0.17, < 3)
-    io-console (0.9.1)
+    io-console (0.9.2)
     irb (1.18.0)
       pp (>= 0.6.0)
       prism (>= 1.3.0)
@@ -446,7 +451,17 @@ GEM
       racc (~> 1.4)
     nokogiri (1.19.4-x86_64-linux-gnu)
       racc (~> 1.4)
-    oauth (0.5.8)
+    oauth (1.1.6)
+      auth-sanitizer (~> 0.2, >= 0.2.1)
+      base64 (~> 0.1)
+      cgi
+      oauth-tty (~> 1.0, >= 1.0.8)
+      snaky_hash (~> 2.0, >= 2.0.5)
+      version_gem (~> 1.1, >= 1.1.11)
+    oauth-tty (1.0.13)
+      anonymous_loader (~> 0.1, >= 0.1.3)
+      auth-sanitizer (~> 0.2, >= 0.2.3)
+      version_gem (~> 1.1, >= 1.1.14)
     oj (3.17.6)
       bigdecimal (>= 3.0)
       ostruct (>= 0.2)
@@ -487,7 +502,7 @@ GEM
       nio4r (~> 2.0)
     query_diet (0.7.3)
     racc (1.8.1)
-    rack (2.2.23)
+    rack (2.2.24)
     rack-attack (6.8.0)
       rack (>= 1.0, < 4)
     rack-cors (2.0.2)
@@ -550,7 +565,7 @@ GEM
     rb-fsevent (0.11.2)
     rb-inotify (0.11.1)
       ffi (~> 1.0)
-    rbs (4.1.2)
+    rbs (4.2.0)
       logger
       prism (>= 1.6.0)
       tsort
@@ -567,7 +582,7 @@ GEM
       io-console (~> 0.5)
     request_store (1.7.0)
       rack (>= 1.4)
-    responders (3.2.0)
+    responders (3.2.1)
       actionpack (>= 7.0)
       railties (>= 7.0)
     rest-client (2.1.0)
@@ -619,8 +634,8 @@ GEM
     rswag-ui (2.17.0)
       actionpack (>= 5.2, < 8.2)
       railties (>= 5.2, < 8.2)
-    rubocop (1.89.0)
-      json (~> 2.3)
+    rubocop (1.90.0)
+      json (>= 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
       parallel (>= 1.10)
@@ -639,11 +654,11 @@ GEM
     rubocop-factory_bot (2.28.0)
       lint_roller (~> 1.1)
       rubocop (~> 1.72, >= 1.72.1)
-    rubocop-rails (2.36.0)
+    rubocop-rails (2.37.0)
       activesupport (>= 4.2.0)
       lint_roller (~> 1.1)
       rack (>= 1.1)
-      rubocop (>= 1.75.0, < 2.0)
+      rubocop (>= 1.89.0, < 2.0)
       rubocop-ast (>= 1.44.0, < 2.0)
     rubocop-rake (0.7.1)
       lint_roller (~> 1.1)
@@ -661,7 +676,7 @@ GEM
     ruby-vips (2.3.0)
       ffi (~> 1.12)
       logger
-    rubyzip (3.4.1)
+    rubyzip (3.6.0)
     sass (3.7.4)
       sass-listen (~> 4.0.0)
     sass-listen (4.0.0)
@@ -675,13 +690,13 @@ GEM
       sprockets (> 3.0)
       sprockets-rails
       tilt
-    scout_apm (6.2.1)
+    scout_apm (6.3.0)
       parser
     searchkick (5.3.1)
       activemodel (>= 6.1)
       hashie
     securerandom (0.4.1)
-    selenium-webdriver (4.47.0)
+    selenium-webdriver (4.48.0)
       base64 (~> 0.2)
       logger (~> 1.4)
       rexml (~> 3.2, >= 3.2.5)
@@ -696,6 +711,9 @@ GEM
     simple_po_parser (1.1.6)
     sitemap_generator (7.1.1)
       builder (~> 3.0)
+    snaky_hash (2.0.7)
+      hashie (>= 0.1.0, < 6)
+      version_gem (~> 1.1, >= 1.1.14)
     sprockets (3.7.5)
       base64
       concurrent-ruby (~> 1.0)
@@ -706,13 +724,13 @@ GEM
       sprockets (>= 3.0.0)
     ssrf_filter (1.5.0)
     sysexits (1.2.0)
-    temple (0.10.6)
+    temple (0.10.7)
     terminal-table (4.0.0)
       unicode-display_width (>= 1.1.1, < 4)
     terser (1.2.8)
       execjs (>= 0.3.0, < 3)
     thor (1.5.0)
-    tilt (2.8.0)
+    tilt (2.9.0)
     timecop (0.9.11)
     timeout (0.6.1)
     tsort (0.2.0)
@@ -731,6 +749,7 @@ GEM
       activemodel (>= 3.0.0)
       public_suffix
     vcr (6.4.0)
+    version_gem (1.1.15)
     warden (1.2.9)
       rack (>= 2.0.9)
     webrat (0.7.3)
@@ -820,6 +839,7 @@ DEPENDENCIES
   material_icons
   memcachier
   msgpack
+  oauth (= 1.1.6)
   oj
   omniauth (~> 1.3)
   omniauth-flickr (>= 0.0.15)
@@ -872,7 +892,7 @@ DEPENDENCIES
   xmlrpc
 
 RUBY VERSION
-   ruby 3.4.9
+   ruby 4.0.6
 
 BUNDLED WITH
    2.4.22

config/initializers/rack_attack.rb

@@ -4,9 +4,9 @@ class Rack::Attack
   ### Throttle Config ###
 
   if Rails.env.production?
-    # Throttle requests to /plantings, /harvests, and /members to 10 per minute per IP
+    # Throttle requests to /plantings, /harvests, and /members to 15 per minute per IP
     # Includes API routes
-    throttle('req/ip/restricted_routes', limit: 20, period: 1.minute) do |req|
+    throttle('req/ip/restricted_routes', limit: 15, period: 1.minute) do |req|
       if req.path =~ %r{^/(plantings|harvests|members)(/|$)} || req.path =~ %r{^/api/v1/(plantings|harvests|members)(/|$)}
         req.ip
       end