Update omnibus submodule for rack gem cleanup (CVE-2025-61772, CVE-2026-22860, CVE-2026-25500)

[lbakerchef]

Summary

Updates the omnibus submodule to pull in the updated ruby_gems_cleanup recipe from chef/chef-server-omnibus-config#23.

See that PR for full details. In short: removes stale rack and rexml gem versions left on disk after chef-server upgrades, which are flagged by CVE scanners even though they are not actively loaded.

CVEs addressed

• CVE-2025-61772 — Rack multipart DoS (fixed >= 3.2.2)
• CVE-2026-22860 — Rack::Directory path traversal (fixed >= 3.2.5)
• CVE-2026-25500 — Rack::Directory stored XSS (fixed >= 3.2.5)
• CVE-2025-58767 — REXML entity expansion DoS (fixed >= 3.4.2)

Jira

CHEF-32453, CHEF-32457, CHEF-32458, CHEF-32459

[netlify]

👷 Deploy Preview for chef-server processing.

Name	Link
🔨 Latest commit	1fbc8e1
🔍 Latest deploy log	https://app.netlify.com/projects/chef-server/deploys/6a4d49063d0a3c0008674d44

[lbakerchef]

PRs
#4215
https://github.com/chef/chef-server-omnibus-config/pull/23

omnibus/adhoc
https://buildkite.com/chef/chef-chef-server-main-omnibus-adhoc/builds/8380

$ sudo chef-server-ctl status
 run: bookshelf: (pid 805) 3628s; run: log: (pid 795) 3629s
 run: nginx: (pid 58526) 1619s; run: log: (pid 754) 3630s
 run: oc_bifrost: (pid 778) 3629s; run: log: (pid 777) 3629s
 run: oc_id: (pid 785) 3629s; run: log: (pid 781) 3629s
 run: opensearch: (pid 58481) 1619s; run: log: (pid 771) 3630s
 run: opscode-erchef: (pid 802) 3629s; run: log: (pid 773) 3630s
 run: postgresql: (pid 787) 3629s; run: log: (pid 770) 3630s
 run: redis_lb: (pid 58455) 1621s; run: log: (pid 774) 3630s

$ sudo  chef-server-ctl test
Finished in 3 minutes 40.9 seconds (files took 18.56 seconds to load)
174 examples, 0 failures, 2 pending

# before cleanup
$ find /opt/opscode/embedded -path "*/rack-3*" 2>/dev/null | sort
/opt/opscode/embedded/lib/ruby/gems/3.1.0/gems/rack-3.1.4
/opt/opscode/embedded/lib/ruby/gems/3.1.0/gems/rack-3.2.5
/opt/opscode/embedded/lib/ruby/gems/3.1.0/gems/rack-3.2.6
/opt/opscode/embedded/lib/ruby/gems/3.1.0/specifications/rack-3.1.4.gemspec
/opt/opscode/embedded/lib/ruby/gems/3.1.0/specifications/rack-3.2.5.gemspec
/opt/opscode/embedded/lib/ruby/gems/3.1.0/specifications/rack-3.2.6.gemspec
/opt/opscode/embedded/service/gem/ruby/3.1.0/cache/rack-3.1.4.gem
/opt/opscode/embedded/service/gem/ruby/3.1.0/cache/rack-3.2.6.gem
/opt/opscode/embedded/service/gem/ruby/3.1.0/gems/rack-3.1.4
/opt/opscode/embedded/service/gem/ruby/3.1.0/gems/rack-3.2.6
/opt/opscode/embedded/service/gem/ruby/3.1.0/specifications/rack-3.1.4.gemspec
/opt/opscode/embedded/service/gem/ruby/3.1.0/specifications/rack-3.2.6.gemspec

$ # after cleanup
$ sudo chef-server-ctl reconfigure
...
Infra Phase complete, 44/476 resources updated in 03 minutes 23 seconds
Chef Infra Server Reconfigured!

$ find /opt/opscode/embedded -path "*/rack-3.1.4*" 2>/dev/null | sort
$
$ find /opt/opscode/embedded -path "*/rack-3*" 2>/dev/null | sort
/opt/opscode/embedded/lib/ruby/gems/3.1.0/gems/rack-3.2.5
/opt/opscode/embedded/lib/ruby/gems/3.1.0/gems/rack-3.2.6
/opt/opscode/embedded/lib/ruby/gems/3.1.0/specifications/rack-3.2.5.gemspec
/opt/opscode/embedded/lib/ruby/gems/3.1.0/specifications/rack-3.2.6.gemspec
/opt/opscode/embedded/service/gem/ruby/3.1.0/cache/rack-3.2.6.gem
/opt/opscode/embedded/service/gem/ruby/3.1.0/gems/rack-3.2.6
/opt/opscode/embedded/service/gem/ruby/3.1.0/specifications/rack-3.2.6.gemspec

$ # repo rack versions

$ grep "^    rack " /home/link/chef-server-repos/chef-server/omnibus/Gemfile.lock
   rack (3.2.6)

$ grep "^    rack " /home/link/chef-server-repos/chef-server/src/oc-id/Gemfile.lock
   rack (3.2.6)

$ grep "^    rack " /home/link/chef-server-repos/chef-server/src/chef-server-ctl/Gemfile.lock
   rack (3.2.6)

$ grep "^    rack " /home/link/chef-server-repos/chef-server/oc-chef-pedant/Gemfile.lock
   rack (3.2.6)

$ grep "^    rack " /home/link/chef-server-repos/chef-server-omnibus-config/Gemfile.lock
   rack (3.2.6)

$ gh api "repos/chef/chef/contents/Gemfile.lock?ref=v18.10.17" --jq '.content' | base64 -d | grep "^    rack "
   rack (3.2.5)

$ # running VM rack versions

$ /opt/opscode/embedded/bin/gem list rack
rack (3.2.6, 3.2.5)
rackup (2.3.1)

$ ls /opt/opscode/embedded/service/gem/ruby/3.1.0/gems/ | grep rack
rack-3.2.6
rack-protection-4.2.1
rack-session-2.1.2
rack-test-2.2.0
rackup-2.3.1