[TBT-456] update gems with critical/high vulnerability

Gemfile

@@ -5,14 +5,17 @@ ruby '~> 3.2.2'
 source 'https://rubygems.org'
 
 gem 'hashr'
-gem 'puma', '~> 6'
+gem 'puma', '~> 6.4', '>= 6.4.3'
+gem 'rack', '>= 2.2.20'
 gem 'rack-mobile-detect'
-gem 'rack-protection', '~> 3.0'
+gem 'rack-protection', '>= 4.2.0'
 gem 'rack-ssl', '~> 1.4'
+gem 'rackup'
+gem 'rexml', '>= 3.3.9'
 gem 'sanitize'
-gem 'sinatra'
+gem 'sinatra', '>= 4.2.0'
 gem 'travis-web', path: 'waiter'
-gem 'nokogiri', '~> 1.13.6'
+gem 'nokogiri', '>= 1.18.9'
 
 group :development, :test do
   gem 'rake'

Gemfile.lock

@@ -8,44 +8,53 @@ GEM
   specs:
     ansi (1.5.0)
     ast (2.4.2)
-    base64 (0.2.0)
+    base64 (0.3.0)
     crass (1.0.6)
     diff-lcs (1.5.1)
     docile (1.4.0)
     foreman (0.87.2)
     hashr (2.0.1)
     json (2.7.1)
     language_server-protocol (3.17.0.3)
-    mini_portile2 (2.8.5)
-    multi_json (1.15.0)
-    mustermann (3.0.0)
+    logger (1.7.0)
+    multi_json (1.17.0)
+    mustermann (3.0.4)
       ruby2_keywords (~> 0.0.1)
-    nio4r (2.7.1)
-    nokogiri (1.13.10)
-      mini_portile2 (~> 2.8.0)
+    nio4r (2.7.5)
+    nokogiri (1.18.10-aarch64-linux-gnu)
+      racc (~> 1.4)
+    nokogiri (1.18.10-arm64-darwin)
+      racc (~> 1.4)
+    nokogiri (1.18.10-x86_64-linux-gnu)
       racc (~> 1.4)
     parallel (1.24.0)
     parser (3.3.0.5)
       ast (~> 2.4.1)
       racc
     power_assert (2.0.3)
-    puma (6.4.2)
+    puma (6.6.1)
       nio4r (~> 2.0)
-    racc (1.7.3)
-    rack (2.2.9)
+    racc (1.8.1)
+    rack (3.2.4)
     rack-mobile-detect (0.4.0)
       rack
-    rack-protection (3.2.0)
+    rack-protection (4.2.1)
+      base64 (>= 0.1.0)
+      logger (>= 1.6.0)
+      rack (>= 3.0.0, < 4)
+    rack-session (2.1.1)
       base64 (>= 0.1.0)
-      rack (~> 2.2, >= 2.2.4)
+      rack (>= 3.0.0)
     rack-ssl (1.4.1)
       rack
     rack-test (2.1.0)
       rack (>= 1.3)
+    rackup (2.2.1)
+      rack (>= 3)
     rainbow (3.1.1)
     rake (13.1.0)
     regexp_parser (2.9.0)
-    rexml (3.2.6)
+    rexml (3.4.4)
     rspec (3.13.0)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
@@ -98,46 +107,52 @@ GEM
       terminal-table
     simplecov-html (0.12.3)
     simplecov_json_formatter (0.1.4)
-    sinatra (3.2.0)
+    sinatra (4.2.1)
+      logger (>= 1.6.0)
       mustermann (~> 3.0)
-      rack (~> 2.2, >= 2.2.4)
-      rack-protection (= 3.2.0)
+      rack (>= 3.0.0, < 4)
+      rack-protection (= 4.2.1)
+      rack-session (>= 2.0.0, < 3)
       tilt (~> 2.0)
-    sinatra-contrib (3.2.0)
+    sinatra-contrib (4.2.1)
       multi_json (>= 0.0.2)
       mustermann (~> 3.0)
-      rack-protection (= 3.2.0)
-      sinatra (= 3.2.0)
+      rack-protection (= 4.2.1)
+      sinatra (= 4.2.1)
       tilt (~> 2.0)
     terminal-table (3.0.2)
       unicode-display_width (>= 1.1.1, < 3)
     test-unit (3.6.2)
       power_assert
-    tilt (2.3.0)
+    tilt (2.6.1)
     unicode-display_width (2.5.0)
 
 PLATFORMS
   aarch64-linux
+  arm64-darwin-21
   x86_64-linux
 
 DEPENDENCIES
   foreman
   hashr
-  nokogiri (~> 1.13.6)
-  puma (~> 6)
+  nokogiri (>= 1.18.9)
+  puma (~> 6.4, >= 6.4.3)
+  rack (>= 2.2.20)
   rack-mobile-detect
-  rack-protection (~> 3.0)
+  rack-protection (>= 4.2.0)
   rack-ssl (~> 1.4)
   rack-test
+  rackup
   rake
+  rexml (>= 3.3.9)
   rspec (~> 3.12)
   rubocop
   rubocop-performance
   rubocop-rspec
   sanitize
   simplecov
   simplecov-console
-  sinatra
+  sinatra (>= 4.2.0)
   sinatra-contrib
   test-unit
   travis-web!

waiter/lib/travis/web/app.rb

@@ -45,7 +45,8 @@ def build(options = {})
          options[:environment] == 'staging'
         builder.use Rack::SSL, hsts: Travis.config.ssl.hsts
       end
-      builder.use Rack::Deflater
+      # Rack::Deflater disabled to avoid double-compression issues with Rack 3.x
+      # builder.use Rack::Deflater
       builder.use Rack::Head
       builder.use Rack::Protection::XSSHeader
       builder.use Rack::Protection::FrameOptions