fix(security): patch jwt and faraday CVEs reported by Snyk

[Snyk] Fix for 2 vulnerabilities

Author: MichaelPlathanus

Gemfile

@@ -58,9 +58,9 @@ gem 'sidekiq-scheduler'
 # Environment variables
 gem 'dotenv-rails'
 
-# HTTP client for Riot API — >= 2.14.2 fixes SSRF CVE
+# HTTP client for Riot API
 gem 'faraday', '>= 2.14.2'
-gem 'faraday-retry'
+gem 'faraday-retry', '>= 2.4.0'
 
 # Authorization
 gem 'pundit'
@@ -80,13 +80,13 @@ gem 'rswag-api'
 gem 'rswag-ui'
 
 # Elasticsearch client (for analytics queries)
-gem 'elasticsearch', '~> 8.19'
+gem 'elasticsearch', '~> 9.0', '>= 9.0.0'
 
 # Meilisearch — full-text search for players, organizations, scouting targets, etc.
 gem 'meilisearch', '~> 0.33'
 
 # LLM Integration for Support Chatbot
-gem 'ruby-openai', '~> 7.0'
+gem 'ruby-openai', '~> 8.0', '>= 8.0.0'
 
 # S3-compatible storage for file uploads (Supabase Storage)
 gem 'aws-sdk-s3', '~> 1.0'

Gemfile.lock

@@ -146,11 +146,11 @@ GEM
     elastic-transport (8.5.1)
       faraday (< 3)
       multi_json
-    elasticsearch (8.19.3)
+    elasticsearch (9.4.0)
       elastic-transport (~> 8.3)
-      elasticsearch-api (= 8.19.3)
-      ostruct
-    elasticsearch-api (8.19.3)
+      elasticsearch-api (= 9.4.0)
+    elasticsearch-api (9.4.0)
+      base64
       multi_json
     erb (6.0.4)
     erubi (1.13.1)
@@ -172,7 +172,7 @@ GEM
       multipart-post (~> 2.0)
     faraday-net_http (3.4.2)
       net-http (~> 0.5)
-    faraday-retry (2.3.2)
+    faraday-retry (2.4.0)
       faraday (~> 2.0)
     ffi (1.17.4-x86_64-linux-gnu)
     ffi-compiler (1.4.2)
@@ -253,7 +253,7 @@ GEM
     mini_mime (1.1.5)
     minitest (5.27.0)
     msgpack (1.8.0)
-    multi_json (1.20.1)
+    multi_json (1.21.1)
     multi_xml (0.8.1)
       bigdecimal (>= 3.1, < 5)
     multipart-post (2.4.1)
@@ -417,7 +417,7 @@ GEM
     rubocop-rspec (3.7.0)
       lint_roller (~> 1.1)
       rubocop (~> 1.72, >= 1.72.1)
-    ruby-openai (7.4.0)
+    ruby-openai (8.3.0)
       event_stream_parser (>= 0.3.0, < 2.0.0)
       faraday (>= 1)
       faraday-multipart (>= 1)
@@ -490,11 +490,11 @@ DEPENDENCIES
   database_cleaner-active_record
   debug
   dotenv-rails
-  elasticsearch (~> 8.19)
+  elasticsearch (~> 9.0, >= 9.0.0)
   factory_bot_rails
   faker
   faraday (>= 2.14.2)
-  faraday-retry
+  faraday-retry (>= 2.4.0)
   hashid-rails (~> 1.0)
   jwt (>= 3.2.0)
   kamal (~> 2.0)
@@ -519,7 +519,7 @@ DEPENDENCIES
   rubocop
   rubocop-rails
   rubocop-rspec
-  ruby-openai (~> 7.0)
+  ruby-openai (~> 8.0, >= 8.0.0)
   securerandom
   shoulda-matchers
   sidekiq (~> 7.0)
@@ -533,4 +533,4 @@ RUBY VERSION
    ruby 3.4.8p72
 
 BUNDLED WITH
-   2.3.27
+   2.6.9