Upgrade rexml to 3.3.8 to fix CVE-2024-43398

[raymzag]

Resolves CVE-2024-43398

Name: rexml
--
  | Version: 3.2.8
  | CVE: CVE-2024-43398
  | GHSA: GHSA-vmwr-mc7x-5vc3
  | Criticality: Medium
  | URL: https://github.com/ruby/rexml/security/advisories/GHSA-vmwr-mc7x-5vc3
  | Title: REXML denial of service vulnerability
  | Solution: update to '>= 3.3.6'

Tests

bundle exec rake test:local

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
6012 tests, 80277 assertions, 0 failures, 0 errors, 0 pendings, 0 omissions, 0 notifications
100% passed
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
177.93 tests/s, 2375.84 assertions/s
Running RuboCop...
Inspecting 801 files
.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

801 files inspected, no offenses detected

Tip: Based on detected gems, the following RuboCop extension libraries might be helpful:
  * rubocop-rake (https://github.com/rubocop/rubocop-rake)

You can opt out of this message by adding the following to your config (see https://docs.rubocop.org/rubocop/extensions.html#extension-suggestions for more options):
  AllCops:
    SuggestExtensions: false

[raymzag]

Hey @aenand could you help with the review with this?

[aenand]

Hey @aenand could you help with the review with this?

Absolutely! Thank you for raising this. I'll review it today

[aenand]

This looks good to me from a changelog perspective. @Buitragox is performing some more in depth testing to see if the latest available version (3.3.7) works

[raymzag]

Thanks @aenand . should I bump the version here to 3.3.7?

[aenand]

Yes please bump to 3.3.7

[Buitragox]

Latest version 3.3.7 works fine

[raymzag]

bumped.

thanks! @aenand @Buitragox

[aenand]

Thank you for this! This will get merged next week

[raymzag]

there's a new version just came out, https://github.com/ruby/rexml/releases should we update to that since we haven't merged it yet?

[aenand]

there's a new version just came out, https://github.com/ruby/rexml/releases should we update to that since we haven't merged it yet?

@Buitragox what is your deploy plan? Would you rather retest on the new version or are you planning to merge this soon?

[Buitragox]

@aenand @raymzag We can update to the new version and retest 👍

[raymzag]

done. thanks @Buitragox