build(deps): bump rack, rails and activerecord

[dependabot]

Bumps rack, rails and activerecord. These dependencies needed to be updated together.
Updates rack from 1.6.13 to 2.2.3

Commits

• 1741c58 bump version
• 5ccca47 When parsing cookies, only decode the values
• a5e80f0 Bump version.
• b0de37d Remove trailing whitespace.
• 1a784e5 Prepare CHANGELOG for next patch release.
• a0d57d4 Fix to handle same_site option for session pool
• a9b223b Ensure full match. Fixes #1590.
• f4c5645 Double assignment is still needed to prevent an "unused variable" warning
• 5c121dd Revert "Update Thin handler to better handle more options"
• 961d976 Prepare point release.
• Additional commits viewable in compare view

Updates rails from 4.2.11.1 to 5.2.4.3

Release notes

Sourced from rails's releases.

5.2.4.3

Active Support

• [CVE-2020-8165] Deprecate Marshal.load on raw cache read in RedisCacheStore

• [CVE-2020-8165] Avoid Marshal.load on raw cache value in MemCacheStore

Active Model

• No changes.

Active Record

• No changes.

Action View

• [CVE-2020-8167] Check that request is same-origin prior to including CSRF token in XHRs

Action Pack

• [CVE-2020-8166] HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token

• [CVE-2020-8164] Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

Commits

• 7b5cc5a Preparing for 5.2.4.3 release
• 559cce2 updating changelog
• 3c806b9 bumping version
• 9cb66f6 update changelog
• fbc7bec Check that request is same-origin prior to including CSRF token in XHRs
• d124f19 HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a ...
• 467e339 activesupport: Deprecate Marshal.load on raw cache read in RedisCacheStore
• f7e077f activesupport: Avoid Marshal.load on raw cache value in MemCacheStore
• 7a3ee4f Return self when calling #each, #each_pair, and #each_value instead of the ra...
• e8df564 Include Content-Length in signature for ActiveStorage direct upload
• Additional commits viewable in compare view

Updates activerecord from 4.2.11.1 to 5.2.4.3

Release notes

Sourced from activerecord's releases.

5.2.4.3

Active Support

• [CVE-2020-8165] Deprecate Marshal.load on raw cache read in RedisCacheStore

• [CVE-2020-8165] Avoid Marshal.load on raw cache value in MemCacheStore

Active Model

• No changes.

Active Record

• No changes.

Action View

• [CVE-2020-8167] Check that request is same-origin prior to including CSRF token in XHRs

Action Pack

• [CVE-2020-8166] HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token

• [CVE-2020-8164] Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

Commits

• 7b5cc5a Preparing for 5.2.4.3 release
• 3c806b9 bumping version
• 4dcc543 update version
• ac30e38 Preparing for 5.2.4.1 release
• 8bec77c Preparing for 5.2.4 release
• 9e2a341 Preparing for 5.2.4.rc1 release
• 1c070a5 Merge pull request #37747 from bradleyprice/check-association-loaded-across-c...
• 4074c06 Merge pull request #36526 from yahonda/test_statement_cache_with_in_clause_pg
• fde4401 Fix random CI failure due to non-deterministic sorting order
• 94b6887 Merge pull request #37489 from giraffate/fix_random_ci_failure_due_to_non-det...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.