Update or patch other deps

Author: remi

.bundler-audit.yml

@@ -2,3 +2,4 @@
 ignore:
   - CVE-2024-27456 # https://github.com/advisories/GHSA-785g-282q-pwvx (packaging issue with rack-cors)
   - CVE-2024-54133 # https://github.com/rails/rails/security/advisories/GHSA-vfm5-rmrh-j26v (We don’t generate CSP from user input)
+  - CVE-2026-32700 # https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc (User model patched)

Gemfile.lock

@@ -92,7 +92,7 @@ GEM
       babel-source (>= 4.0, < 6)
       execjs (~> 2.0)
     base64 (0.3.0)
-    bcrypt (3.1.20)
+    bcrypt (3.1.22)
     benchmark (0.5.0)
     bigdecimal (4.0.1)
     blockenspiel (0.5.0)
@@ -154,7 +154,7 @@ GEM
     jquery-turbolinks (2.1.0)
       railties (>= 3.1.0)
       turbolinks
-    json (2.15.2)
+    json (2.19.2)
     json_schemer (2.4.0)
       bigdecimal
       hana (~> 1.3)

app/models/user.rb

@@ -46,4 +46,10 @@ def allowed_organizations
   def password_required?
     !persisted? || !password.nil? || !password_confirmation.nil?
   end
+
+  # Address <https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc> without updating  Devise
+  def postpone_email_change_until_confirmation_and_regenerate_confirmation_token
+    unconfirmed_email_will_change!
+    super
+  end
 end