Update dependencies to latest patch versions including Rails CVE fix

[cycomachead]

General Info

• Pivotal Tracker Story
• Breaking?

Changes

Updates Gemfile.lock and package-lock.json to resolve active security vulnerabilities. No changes to Gemfile or package.json.

Key security fixes:

• Rails 8.1.3 → 8.1.3.1 — addresses an Active Storage CVE (libvips untrusted loaders). Behavioral impact is inert here since the app has no image_processing/ruby-vips usage.
• mcp 0.22.0 → 0.25.0 — resolves five advisories including one High severity (unbounded JSON-RPC body → uncontrolled memory allocation), SSE session poisoning, DNS-rebinding, and two DoS issues.
• npm audit fix — resolves 3 advisories (js-yaml quadratic-complexity DoS) in dev-only transitive dependencies.

Other patch-level gem bumps: oauth2, net-imap, http-cookie, snaky_hash, version_gem, csv, msgpack, guard, parser, tzinfo-data.

bundle audit and npm audit now report 0 vulnerabilities.

⚠️ Blazer 3.5.0 deferred — needs follow-up ticket

Blazer 3.4.0 has a stored XSS (GHSA-m5f6-4589-m89f), fixed in 3.5.0. However, upgrading breaks asset compilation because sassc (libsass, EOL) cannot parse modern CSS max(var(...), ...) syntax introduced in blazer 3.5.0's bundled tom-select.css. This is the same sassc-rails → dartsass-sprockets migration already noted in the Gemfile TODOs. A follow-up ticket should address that migration to unblock this security patch.

Testing

• RSpec: 584 examples, 0 failures (86.7% line coverage)
• Accessibility specs: 40 examples, 0 failures
• Cucumber: 21/26 passing — the 5 failing @javascript scenarios fail identically on the unmodified lockfile (pre-existing environmental issue, not caused by this update)
• RuboCop: 154 files, no offenses
• Brakeman: 0 security warnings
• bundle-audit: no vulnerabilities
• npm audit: 0 vulnerabilities
• Production boot smoke test: BOOT OK rails=8.1.3.1 ruby=3.4.10

Documentation

No documentation changes required.

Checklist

• Name of branch corresponds to story

---

Superconductor Ticket Implementation | App Preview | Guided Review