security: Fix CVE-2025-58767 - Update REXML to 3.4.4

- Add rexml >= 3.4.2 constraint to gemspec
- Update Gemfile.lock with rexml 3.4.4 (was 3.2.5)
- Fixes DoS vulnerability in XML parsing
- Aligns with security updates across dchbx repositories

Author: saimekala07

.ruby-version

@@ -1 +1 @@
-3.2.1
+3.2.5

Gemfile.lock

@@ -21,6 +21,7 @@ PATH
       nokogiri (>= 1.13.0)
       oj (~> 3.11)
       ox (~> 2.14)
+      rexml (>= 3.4.2)
       typhoeus (~> 1.4.0)
 
 GEM
@@ -87,12 +88,13 @@ GEM
       zeitwerk (~> 2.3)
     addressable (2.8.0)
       public_suffix (>= 2.0.2, < 5.0)
-    amq-protocol (2.3.2)
+    amq-protocol (2.3.4)
     ast (2.4.2)
+    bigdecimal (3.2.3)
     bson (4.12.1)
     builder (3.2.4)
-    bunny (2.19.0)
-      amq-protocol (~> 2.3, >= 2.3.1)
+    bunny (2.24.0)
+      amq-protocol (~> 2.3)
       sorted_set (~> 1, >= 1.0.2)
     byebug (11.1.3)
     coderay (1.1.3)
@@ -106,34 +108,32 @@ GEM
       activerecord (>= 5.a)
       database_cleaner-core (~> 2.0.0)
     database_cleaner-core (2.0.1)
-    deep_merge (1.2.1)
+    deep_merge (1.2.2)
     diff-lcs (1.4.4)
-    dry-configurable (0.12.1)
+    dry-configurable (0.15.0)
       concurrent-ruby (~> 1.0)
-      dry-core (~> 0.5, >= 0.5.0)
-    dry-container (0.8.0)
+      dry-core (~> 0.6)
+    dry-container (0.11.0)
       concurrent-ruby (~> 1.0)
-      dry-configurable (~> 0.1, >= 0.1.3)
-    dry-core (0.7.1)
+    dry-core (0.8.1)
       concurrent-ruby (~> 1.0)
-    dry-equalizer (0.3.0)
     dry-events (0.3.0)
       concurrent-ruby (~> 1.0)
       dry-core (~> 0.5, >= 0.5)
-    dry-inflector (0.2.1)
-    dry-initializer (3.0.4)
+    dry-inflector (0.3.0)
+    dry-initializer (3.2.0)
     dry-logic (1.2.0)
       concurrent-ruby (~> 1.0)
       dry-core (~> 0.5, >= 0.5)
     dry-monads (1.4.0)
       concurrent-ruby (~> 1.0)
       dry-core (~> 0.7)
-    dry-schema (1.6.2)
+    dry-schema (1.10.6)
       concurrent-ruby (~> 1.0)
-      dry-configurable (~> 0.8, >= 0.8.3)
+      dry-configurable (~> 0.13, >= 0.13.0)
       dry-core (~> 0.5, >= 0.5)
       dry-initializer (~> 3.0)
-      dry-logic (~> 1.0)
+      dry-logic (~> 1.2)
       dry-types (~> 1.5)
     dry-struct (1.4.0)
       dry-core (~> 0.5, >= 0.5)
@@ -145,15 +145,14 @@ GEM
       dry-core (~> 0.5, >= 0.5)
       dry-inflector (~> 0.1, >= 0.1.2)
       dry-logic (~> 1.0, >= 1.0.2)
-    dry-validation (1.6.0)
+    dry-validation (1.8.1)
       concurrent-ruby (~> 1.0)
       dry-container (~> 0.7, >= 0.7.1)
-      dry-core (~> 0.4)
-      dry-equalizer (~> 0.2)
+      dry-core (~> 0.5, >= 0.5)
       dry-initializer (~> 3.0)
-      dry-schema (~> 1.5, >= 1.5.2)
+      dry-schema (~> 1.8, >= 1.8.0)
     erubi (1.10.0)
-    ethon (0.15.0)
+    ethon (0.17.0)
       ffi (>= 1.15.0)
     faker (2.18.0)
       i18n (>= 1.6, < 2)
@@ -166,48 +165,57 @@ GEM
       multipart-post (>= 1.2, < 3)
       ruby2_keywords (>= 0.0.4)
     faraday-em_http (1.0.0)
-    faraday-em_synchrony (1.0.0)
+    faraday-em_synchrony (1.0.1)
     faraday-excon (1.1.0)
-    faraday-net_http (1.0.1)
+    faraday-net_http (1.0.2)
     faraday-net_http_persistent (1.2.0)
-    faraday_middleware (1.2.0)
+    faraday_middleware (1.2.1)
       faraday (~> 1.0)
-    ffi (1.15.4)
+    ffi (1.17.2)
     globalid (0.5.2)
       activesupport (>= 5.0)
     hashdiff (1.0.1)
     i18n (1.8.10)
       concurrent-ruby (~> 1.0)
     ice_nine (0.11.2)
     little-plugger (1.1.4)
-    logging (2.3.0)
+    logger (1.7.0)
+    logging (2.3.1)
       little-plugger (~> 1.1)
       multi_json (~> 1.14)
-    loofah (2.12.0)
+    loofah (2.24.1)
       crass (~> 1.0.2)
-      nokogiri (>= 1.5.9)
+      nokogiri (>= 1.12.0)
     mail (2.7.1)
       mini_mime (>= 0.1.1)
     marcel (1.0.2)
     method_source (1.0.0)
-    mime-types (3.3.1)
-      mime-types-data (~> 3.2015)
-    mime-types-data (3.2021.0901)
+    mime-types (3.7.0)
+      logger
+      mime-types-data (~> 3.2025, >= 3.2025.0507)
+    mime-types-data (3.2025.0916)
     mini_mime (1.1.2)
-    mini_portile2 (2.8.1)
+    mini_portile2 (2.8.9)
     minitest (5.14.4)
     mongo (2.14.0)
       bson (>= 4.8.2, < 5.0.0)
     mongoid (7.3.0)
       activemodel (>= 5.1, < 6.2)
       mongo (>= 2.10.5, < 3.0.0)
-    multi_json (1.15.0)
-    multipart-post (2.1.1)
+    multi_json (1.17.0)
+    multipart-post (2.4.1)
     mustermann (1.1.1)
       ruby2_keywords (~> 0.0.1)
     nio4r (2.5.8)
-    oj (3.13.9)
-    ox (2.14.5)
+    nokogiri (1.18.10)
+      mini_portile2 (~> 2.8.2)
+      racc (~> 1.4)
+    oj (3.16.11)
+      bigdecimal (>= 3.0)
+      ostruct (>= 0.2)
+    ostruct (0.6.3)
+    ox (2.14.23)
+      bigdecimal (>= 3.0)
     parallel (1.20.1)
     parser (3.0.1.1)
       ast (~> 2.4.1)
@@ -218,7 +226,7 @@ GEM
       byebug (~> 11.0)
       pry (~> 0.10)
     public_suffix (4.0.6)
-    racc (1.6.2)
+    racc (1.8.1)
     rack (2.2.3)
     rack-protection (2.1.0)
       rack
@@ -239,8 +247,9 @@ GEM
       bundler (>= 1.15.0)
       railties (= 6.1.4.1)
       sprockets-rails (>= 2.0.0)
-    rails-dom-testing (2.0.3)
-      activesupport (>= 4.2.0)
+    rails-dom-testing (2.3.0)
+      activesupport (>= 5.0.0)
+      minitest
       nokogiri (>= 1.6)
     rails-html-sanitizer (1.4.2)
       loofah (~> 2.3)
@@ -254,7 +263,7 @@ GEM
     rake (13.0.6)
     rbtree (0.4.6)
     regexp_parser (2.1.1)
-    rexml (3.2.5)
+    rexml (3.4.4)
     rspec-core (3.10.1)
       rspec-support (~> 3.10.0)
     rspec-expectations (3.10.1)
@@ -285,7 +294,7 @@ GEM
       parser (>= 3.0.1.1)
     ruby-progressbar (1.11.0)
     ruby2_keywords (0.0.4)
-    set (1.0.2)
+    set (1.1.2)
     sinatra (2.1.0)
       mustermann (~> 1.0)
       rack (~> 2.2)
@@ -303,7 +312,7 @@ GEM
       sprockets (>= 3.0.0)
     thor (1.1.0)
     tilt (2.0.10)
-    typhoeus (1.4.0)
+    typhoeus (1.4.1)
       ethon (>= 0.9.0)
     tzinfo (2.0.4)
       concurrent-ruby (~> 1.0)
@@ -336,4 +345,4 @@ DEPENDENCIES
   yard
 
 BUNDLED WITH
-   2.2.14
+   2.5.22

event_source.gemspec

@@ -54,6 +54,8 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'mime-types'
   spec.add_dependency 'oj', '~> 3.11'
   spec.add_dependency 'ox', '~> 2.14'
+  # Security: Fix CVE-2025-58767 - REXML DoS vulnerability
+  spec.add_dependency 'rexml', '>= 3.4.2'
   spec.add_dependency 'typhoeus', '~> 1.4.0'
 
   # TODO: Change to development dependency