rack 3.2.6 has a denial of service in the multipart parser
(CVE-2026-125111, GHSA-5v64-555j-wjxm): parsed data stays in the scan
buffer, so a crafted upload makes memory grow without bound. The app
is reachable from the internet and accepts multipart forms.
Only the lock changes; the Gemfile already allows ~> 3.2.
Assisted-by: Claude:fable-5-2
- pg + sequel: connect to the storage stack's Postgres.
- prawn + prawn-table: render invoice PDFs.
- aws-sdk-s3: upload PDFs to MinIO and mint presigned download URLs.
Also pulls libpq-dev into the Docker build (for the pg gem) and the
postgresql client lib into the Nix dev shell.
