Bump rack to 3.2.6 and nokogiri to 1.19.3 for security advisories

[treiff]

Summary

• Bumps rack 3.2.3 → 3.2.6 and nokogiri 1.18.9 → 1.19.3 in Gemfile.lock to clear the open high-severity Dependabot alerts on this fork.
• Conservative bundle update rack nokogiri — no other gems shifted.

Advisories resolved

rack 3.2.3 → 3.2.6

• CVE-2026-22860 — Rack::Directory directory traversal
• CVE-2026-34785 — Rack::Static prefix matching can expose unintended files
• CVE-2026-34827 — Multipart header parsing DoS via escape-heavy quoted params
• CVE-2026-34230 — Quadratic complexity in Rack::Utils.select_best_encoding
• CVE-2026-34829 — Multipart parsing without Content-Length allows unbounded uploads

nokogiri 1.18.9 → 1.19.3

• GHSA-c4rq-3m3g-8wgx (high) — CSS selector tokenizer ReDoS
• GHSA-v2fc-qm4h-8hqv (moderate) — XSLT transform memory leak (bonus, same upgrade)

Practical impact for solid_queue

solid_queue is a background job processor; most of the Rack CVEs (multipart, Rack::Static, Rack::Directory) aren't reachable through its surface. select_best_encoding is the one most likely exercised by any Mission Control / dashboard mount. The nokogiri ReDoS doesn't affect the gem at runtime — it's a transitive dep — but the alert is cleared with the bump.

Test plan

• CI passes against the appraisal matrix on this branch
• Confirm Dependabot closes alerts WIP: cli fix to support SOLID_QUEUE_SUPERVISOR_MODE envar #1, Merge batch-rc-2-on-v1.4.0 into main #8, Allow running scheduler and dispatchers separately rails/solid_queue#11, Allow dispatcher to shutdown after a number of jobs (executions) performed rails/solid_queue#15, Have the supervisor write a pidfile that we can use for readiness probes rails/solid_queue#17, Add small method to calculate max number of DB threads rails/solid_queue#22, Take into account the number of available threads before posting work to the thread pool rails/solid_queue#23 after merge

🤖 Generated with Claude Code

[nathanstpierre-wealthbox]

looks like some build failures, have claude look into it?

[treiff]

looks like some build failures, have claude look into it?

Yeah, these are upstream issues with solid queue. I guess when we forked this repo, it pulled in all their GitHub actions. They've actually been failing for some time. It basically runs tests against every rails version and db version going way back. I was told to ignore them in this repo

[nathanstpierre-wealthbox]

Ah gotcha. Well I see no issues with these updates outside of that!