[VUL-485][VUL-484] Upgrade rack in `Scalingo/nsq-ruby` to `2.2.23` - due 14/05/2026

[yanjost]

Context

Shared remediation for 2 Jira finding(s) in Scalingo/nsq-ruby.
The Jira issues below point to the same repository and remediation target, but they remain separate advisories at the Jira layer.

Jira Findings

• VUL-485 rack vulnerability in Scalingo/nsq-ruby
  • Version: rack 2.2.6.4 -> 2.2.23
  • GHSA: GHSA-8vqr-qjwx-82mw
  • Semgrep: https://semgrep.dev/orgs/scalingo/findings/743897823
• VUL-484 rack vulnerability in Scalingo/nsq-ruby
  • Version: rack 2.2.6.4 -> 2.2.23
  • GHSA: GHSA-h2jq-g4cq-5ppq
  • Semgrep: https://semgrep.dev/orgs/scalingo/findings/743897822

Shared Remediation

• Upgrade rack to 2.2.23
• Refresh the lockfile so the vulnerable version is no longer pinned
• Verify the application still boots and the dependency resolution remains clean

References

• Jira: VUL-485
• Jira: VUL-484
• Semgrep: VUL-485
• Semgrep: VUL-484
• GHSA: GHSA-8vqr-qjwx-82mw
• GHSA: GHSA-h2jq-g4cq-5ppq