build(deps): bump rack-session from 2.1.1 to 2.1.2

[dependabot]

Bumps rack-session from 2.1.1 to 2.1.2.

Release notes

Sourced from rack-session's releases.

v2.1.2

• CVE-2026-39324 Don't fall back to unencrypted coder if encryptors are present.

Changelog

Sourced from rack-session's changelog.

v2.1.2

• CVE-2026-39324 Don't fall back to unencrypted coder if encryptors are present.

Commits

• 504367b Bump patch version.
• f43638c Don't fall back to unencrypted coder if encryptors are present.
• dadcfe6 Bump actions/checkout from 4 to 5 (#54)
• 4eb9ea8 Add top level session spec to validate existing formats.
• 8f94577 Add rails to external tests.
• 38ea47d Allow the v2 encryptor to serialize messages with Marshal (#44)
• 43f2e3a Fix compatibility with older Rubies.
• 6a060b8 Support UTF-8 data when using the JSON serializer (#39)
• 8ce0146 Fix auth_tag retrieval on JRuby (#32)
• 7727185 Add AEAD encryption (#23)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

@dependabot merge

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

This PR upgrades rack-session to 2.1.2 to address CVE-2026-39324 and bumps rack to 3.2.6. While the primary goal is met and Codacy reports the PR is up to standards, the Gemfile.lock contains multiple unresolved security vulnerabilities in other dependencies. Specifically, net-imap and nokogiri have high-severity issues that should be addressed to maintain a secure posture. There is also a lack of verification for application boot and session persistence which are critical given the middleware changes.

About this PR

• While this PR fixes rack-session, the lockfile currently contains critical and high-severity vulnerabilities in net-imap, nokogiri, graphql, and yard. It is recommended to schedule a follow-up task to update these dependencies.

4 comments outside of the diff

Gemfile.lock

_{line 155 🔴 HIGH RISK}
Update net-imap to 0.5.14 or later to patch a critical STARTTLS stripping vulnerability and multiple command injection vectors.

_{line 179 🔴 HIGH RISK}
Update nokogiri to 1.19.3 or later to resolve a high-severity ReDoS vulnerability and a memory leak in XSLT transforms.

_{line 111 🟡 MEDIUM RISK}
Update graphql to 2.5.26 or later to fix a lexer-based resource exhaustion vulnerability.

_{line 441 🟡 MEDIUM RISK}
Update yard to 0.9.42 or later to address a path traversal vulnerability.

Test suggestions

• Verify application boots and initializes middleware stack successfully with updated gems
• Smoke test session persistence and retrieval to ensure compatibility with rack 3.2.6

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify application boots and initializes middleware stack successfully with updated gems
2. Smoke test session persistence and retrieval to ensure compatibility with rack 3.2.6

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}