CHEF-25968: Security dependency upgrades (rack, rexml, puma, fugit, uri, brace-expansion)

.gitignore

@@ -5,3 +5,6 @@
 license-cache
 results/
 dump.rdb
+
+# Pending release notes (managed separately in wiki)
+PENDING_RELEASE_NOTES.md

.vscode/mcp.json

@@ -0,0 +1,9 @@
+{
+	"servers": {
+		"atlassian-mcp-server": {
+			"url": "https://mcp.atlassian.com/v1/sse",
+			"type": "http"
+		}
+	},
+	"inputs": []
+}

.vscode/settings.json

@@ -0,0 +1,21 @@
+{
+    "github.copilot.enable": {
+        "*": true,
+        "plaintext": false,
+        "markdown": false,
+        "scminput": false
+    },
+    "[markdown]": {
+        "editor.tabSize": 2,
+        "editor.insertSpaces": true
+    },
+    "chat.mcp.serverSampling": {
+        "supermarket/.vscode/mcp.json: atlassian-mcp-server": {
+            "allowedModels": [
+                "copilot/gpt-4.1",
+                "copilot/claude-sonnet-4",
+                "copilot/gpt-5"
+            ]
+        }
+    }
+}

dev-docs/connect_supermarket_with_local_infra_server_ocid.md

@@ -76,7 +76,7 @@ Once you have your local Supermarket and local Chef Infra Server setup you need
 -   Install Nginx in mac using Homebrew
     -   `brew install nginx`
 -   generate ssl ceritificate
-    -   `openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /usr/local/etc/nginx/cert.key -out /usr/local/etc/nginx/cert.crt`
+    -   `openssl req -x509 -nodes -days 365 -newkey rsa:4096 -keyout /usr/local/etc/nginx/cert.key -out /usr/local/etc/nginx/cert.crt`
 -   Go to /usr/local/etc/nginx and update the conf file as follows:
 
 ```

dev-docs/habitat_configurations_for_development.md

@@ -18,7 +18,7 @@ Start with `hab studio enter`
 
 ## Create openssl certificates required for nginx
 
-`hab pkg exec core/openssl openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /hab/svc/supermarket-nginx/cert.key -out /hab/svc/supermarket-nginx/cert.cert`
+`hab pkg exec core/openssl openssl req -x509 -nodes -days 365 -newkey rsa:4096 -keyout /hab/svc/supermarket-nginx/cert.key -out /hab/svc/supermarket-nginx/cert.cert`
 
 
 ## default.toml changes 

dev-docs/supermarket-release-checklist.md

@@ -108,7 +108,7 @@ To download the cookbook archive use the following command:
 ### Cookbook Install
 
 To install a cookbook from chef server use the command from supermarket instance:
-`knife supermarket download <cookbook_name> -m https://<supermarket IP>`
+`knife supermarket install <cookbook_name> -m https://<supermarket IP>`
 
 To validate whether the installation is working fine or not I first deleted the specific cookbook from my chef repo where from I pushed the cookbook.
 Then after installing the same cookbook from chef server the same cookbook was put back into the cookbooks directory inside my chef-repo.

nginx/config/sites-enabled/rails

@@ -35,11 +35,29 @@ server {
   {{~ #if ssl_dhparam }}
   ssl_dhparam               {{ ssl_dhparam }};
   {{~ /if }}
-  ssl_prefer_server_ciphers on;
+  ssl_prefer_server_ciphers {{ #if ../cfg.ssl.prefer_server_ciphers }}{{ ../cfg.ssl.prefer_server_ciphers }}{{ else }}on{{ /if }};
   ssl_ciphers               {{ #if ../cfg.fips.enabled }}{{ ../cfg.fips.ciphers }}{{ else }}{{ ciphers }}{{ /if }};
   ssl_protocols             {{ protocols }};
   ssl_session_cache         {{ session_cache }};
   ssl_session_timeout       {{ session_timeout }};
+  {{~ #if ../cfg.ssl.ssl_ecdh_curve }}
+  ssl_ecdh_curve            {{ ../cfg.ssl.ssl_ecdh_curve }};
+  {{~ /if }}
+
+  # Modern security headers for OpenSSL 3.2.4
+  {{~ #if ../cfg.ssl.hsts_max_age }}
+  add_header Strict-Transport-Security "max-age={{ ../cfg.ssl.hsts_max_age }}{{ #if ../cfg.ssl.hsts_include_subdomains }}; includeSubDomains{{ /if }}" always;
+  {{~ /if }}
+  {{~ #if ../cfg.ssl.ocsp_stapling }}
+  ssl_stapling on;
+  {{~ #if ../cfg.ssl.ocsp_stapling_verify }}
+  ssl_stapling_verify on;
+  {{~ /if }}
+  {{~ /if }}
+  add_header X-Frame-Options DENY always;
+  add_header X-Content-Type-Options nosniff always;
+  add_header X-XSS-Protection "1; mode=block" always;
+  add_header Referrer-Policy "strict-origin-when-cross-origin" always;
   {{~ /if }}
   {{~ /with }}
     {{~ /if }}

omnibus/Gemfile.lock

@@ -1,28 +1,28 @@
 GIT
   remote: https://github.com/chef/omnibus-software.git
-  revision: 2dc7aa6530d7bf2860c6771f1f572e06d1b52907
+  revision: 0cb128b237c26b5796370b761adbd499f71e5413
   branch: main
   specs:
-    omnibus-software (24.6.323)
+    omnibus-software (25.10.350)
       omnibus (>= 9.0.0)
 
 GIT
   remote: https://github.com/chef/omnibus.git
-  revision: 3efa84c1a26daf55c4d477bf3653e5905ab4f737
+  revision: a1e33b8d33a6ea8013260f83b2764932d8dc2a0f
   branch: main
   specs:
-    omnibus (9.0.25)
+    omnibus (9.1.3)
       aws-sdk-s3 (~> 1.116.0)
       chef-cleanroom (~> 1.0)
       chef-utils (>= 15.4)
       contracts (>= 0.16.0, < 0.17.0)
       ffi-yajl (~> 2.2)
-      license_scout (~> 1.0)
+      license_scout (~> 1.4.0)
       mixlib-shellout (>= 2.0, < 4.0)
       mixlib-versioning
-      ohai (>= 16, < 19)
+      ohai (>= 18.2.6, < 19)
       pedump
-      rexml (~> 3.2)
+      rexml (~> 3.4)
       ruby-progressbar (~> 1.7)
       thor (>= 0.18, < 2.0)
 
@@ -34,15 +34,18 @@ GEM
     artifactory (3.0.17)
     ast (2.4.2)
     awesome_print (1.9.2)
-    aws-eventstream (1.3.0)
-    aws-partitions (1.961.0)
-    aws-sdk-core (3.201.3)
+    aws-eventstream (1.4.0)
+    aws-partitions (1.1171.0)
+    aws-sdk-core (3.233.0)
       aws-eventstream (~> 1, >= 1.3.0)
-      aws-partitions (~> 1, >= 1.651.0)
-      aws-sigv4 (~> 1.8)
+      aws-partitions (~> 1, >= 1.992.0)
+      aws-sigv4 (~> 1.9)
+      base64
+      bigdecimal
       jmespath (~> 1, >= 1.6.1)
-    aws-sdk-kms (1.88.0)
-      aws-sdk-core (~> 3, >= 3.201.0)
+      logger
+    aws-sdk-kms (1.113.0)
+      aws-sdk-core (~> 3, >= 3.231.0)
       aws-sigv4 (~> 1.5)
     aws-sdk-s3 (1.116.0)
       aws-sdk-core (~> 3, >= 3.127.0)
@@ -51,9 +54,9 @@ GEM
     aws-sdk-secretsmanager (1.102.0)
       aws-sdk-core (~> 3, >= 3.201.0)
       aws-sigv4 (~> 1.5)
-    aws-sigv4 (1.9.1)
+    aws-sigv4 (1.12.1)
       aws-eventstream (~> 1, >= 1.0.2)
-    base64 (0.2.0)
+    base64 (0.3.0)
     bcrypt_pbkdf (1.1.1)
     berkshelf (8.0.9)
       chef (>= 15.7.32)
@@ -68,7 +71,7 @@ GEM
       retryable (>= 2.0, < 4.0)
       solve (~> 4.0)
       thor (>= 0.20)
-    bigdecimal (3.1.8)
+    bigdecimal (3.3.1)
     builder (3.3.0)
     chef (18.5.0)
       addressable
@@ -147,7 +150,7 @@ GEM
     citrus (3.0.2)
     cleanroom (1.0.0)
     coderay (1.1.3)
-    concurrent-ruby (1.3.3)
+    concurrent-ruby (1.3.5)
     contracts (0.16.1)
     cookbook-omnifetch (0.12.2)
       mixlib-archive (>= 0.4, < 2.0)
@@ -210,10 +213,10 @@ GEM
       train-core (~> 3.10)
       tty-prompt (~> 0.17)
       tty-table (~> 0.10)
-    iostruct (0.1.3)
+    iostruct (0.5.0)
     ipaddress (0.8.3)
     jmespath (1.6.2)
-    json (2.7.2)
+    json (2.15.1)
     kitchen-vagrant (2.0.1)
       test-kitchen (>= 1.4, < 4)
     libyajl2 (2.1.0)
@@ -222,7 +225,7 @@ GEM
       tomlrb (>= 1.2, < 3.0)
       tty-box (~> 0.6)
       tty-prompt (~> 0.20)
-    license_scout (1.3.10)
+    license_scout (1.4.0)
       ffi-yajl (~> 2.2)
       mixlib-shellout (>= 2.2, < 4.0)
       toml-rb (>= 1, < 3)
@@ -246,9 +249,9 @@ GEM
       mixlib-shellout
       mixlib-versioning
       thor
-    mixlib-log (3.1.1)
-      ffi (< 1.17.0)
-    mixlib-shellout (3.2.8)
+    mixlib-log (3.2.3)
+      ffi (>= 1.15.5)
+    mixlib-shellout (3.3.9)
       chef-utils
     mixlib-versioning (1.2.12)
     molinillo (0.8.0)
@@ -261,11 +264,11 @@ GEM
       uri
     net-protocol (0.2.2)
       timeout
-    net-scp (4.0.0)
+    net-scp (4.1.0)
       net-ssh (>= 2.6.5, < 8.0.0)
     net-sftp (4.0.0)
       net-ssh (>= 5.0.0, < 8.0.0)
-    net-ssh (7.2.3)
+    net-ssh (7.3.0)
     net-ssh-gateway (2.0.0)
       net-ssh (>= 4.0.0)
     netrc (0.11.0)
@@ -274,10 +277,10 @@ GEM
     octokit (4.25.1)
       faraday (>= 1, < 3)
       sawyer (~> 0.9)
-    ohai (18.1.18)
+    ohai (18.2.6)
       chef-config (>= 14.12, < 19)
       chef-utils (>= 16.0, < 19)
-      ffi (~> 1.9)
+      ffi (~> 1.9, <= 1.17.0)
       ffi-yajl (~> 2.2)
       ipaddress
       mixlib-cli (>= 1.7.0)
@@ -300,14 +303,14 @@ GEM
       multipart-post (>= 2.0.0)
       rainbow
       zhexdump (>= 0.0.2)
-    plist (3.7.1)
+    plist (3.7.2)
     proxifier2 (1.1.0)
     pry (0.14.2)
       coderay (~> 1.1)
       method_source (~> 1.0)
-    public_suffix (6.0.1)
+    public_suffix (6.0.2)
     racc (1.8.1)
-    rack (2.2.9)
+    rack (2.2.20)
     rainbow (3.1.1)
     regexp_parser (2.9.2)
     rest-client (2.1.0)
@@ -316,7 +319,7 @@ GEM
       mime-types (>= 1.16, < 4.0)
       netrc (~> 0.8)
     retryable (3.0.5)
-    rexml (3.4.0)
+    rexml (3.4.4)
     rspec (3.11.0)
       rspec-core (~> 3.11.0)
       rspec-expectations (~> 3.11.0)
@@ -376,16 +379,16 @@ GEM
       winrm (~> 2.0)
       winrm-elevated (~> 1.0)
       winrm-fs (~> 1.1)
-    thor (1.3.1)
+    thor (1.4.0)
     time (0.3.0)
       date
     timeout (0.4.1)
     toml-rb (2.2.0)
       citrus (~> 3.0, > 3.0)
     tomlrb (1.3.0)
-    train-core (3.12.6)
+    train-core (3.13.4)
       addressable (~> 2.5)
-      ffi (!= 1.13.0)
+      ffi (~> 1.16.0)
       json (>= 1.8, < 3.0)
       mixlib-shellout (>= 2.0, < 4.0)
       net-scp (>= 1.2, < 5.0)
@@ -445,7 +448,7 @@ GEM
       winrm (~> 2.0)
     wisper (2.0.1)
     wmi-lite (1.0.7)
-    zhexdump (0.2.0)
+    zhexdump (0.3.0)
 
 PLATFORMS
   ruby
@@ -461,4 +464,4 @@ DEPENDENCIES
   test-kitchen
 
 BUNDLED WITH
-   2.6.3
+   2.3.7

omnibus/config/projects/supermarket.rb

@@ -30,10 +30,10 @@
 
 # NOTE: see the omnibus-supermarket cookbook gemfile for controlling the infra client version
 override :chef, version: "v17.5.22" #with the new change in chef we have to specify the exact version
-override :ruby, version: "3.1.2"
-override :'openssl-fips', version: '2.0.16'
+override :ruby, version: "3.1.2", fips_version: "3.1.2"
+# override :'openssl-fips', version: '2.0.16'
 override :'omnibus-ctl', version: 'main'
-override :openssl, version: '1.0.2zi'
+override :openssl, version: "3.2.4", fips_version: "3.1.2"
 override :logrotate, version: '3.21.0'
 
 # Creates required build directories

omnibus/config/software/file.rb

@@ -25,6 +25,8 @@
 license_file "COPYING"
 
 source url: "ftp://ftp.astron.com/pub/file/file-#{version}.tar.gz"
+internal_source url: "#{ENV["ARTIFACTORY_REPO_URL"]}/#{name}/#{name}-#{version}.tar.gz",
+                authorization: "X-JFrog-Art-Api:#{ENV["ARTIFACTORY_TOKEN"]}"
 
 relative_path "file-#{version}"
 

omnibus/config/software/postgresql13.rb

@@ -16,7 +16,7 @@
 
 name "postgresql13"
 
-default_version "13.18"
+default_version "13.22"
 
 license "PostgreSQL"
 license_file "COPYRIGHT"
@@ -30,6 +30,15 @@
 dependency "config_guess"
 
 source url: "https://ftp.postgresql.org/pub/source/v#{version}/postgresql-#{version}.tar.bz2"
+internal_source url: "#{ENV["ARTIFACTORY_REPO_URL"]}/#{name}/#{name}-#{version}.tuxcare.1.0.0.tar.bz2",
+                authorization: "X-JFrog-Art-Api:#{ENV["ARTIFACTORY_TOKEN"]}"
+
+version("13.22") do
+  source url: "#{ENV["ARTIFACTORY_REPO_URL"]}/postgresql13/#{name}-#{version}.tuxcare.1.0.0.tar.bz2",
+         authorization: "X-JFrog-Art-Api:#{ENV["ARTIFACTORY_TOKEN"]}",
+         sha256: "d36d83dc89e625502cf6fb1d0529642ba1266bd614b4e4a41cefd1dddcf09080"
+end
+version("13.21") { source sha256: "dcda1294df45f033b0656cf7a8e4afbbc624c25e1b144aec79530f74d7ef4ab4" }
 version("13.18") { source sha256: "ceea92abee2a8c19408d278b68de6a78b6bd3dbb4fa2d653fa7ca745d666aab1" }
 version("13.4") { source sha256: "ea93e10390245f1ce461a54eb5f99a48d8cabd3a08ce4d652ec2169a357bc0cd" }