Update dependency sidekiq to v6.5.10 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
sidekiq (source, changelog)	6.5.6 → 6.5.10

---

sidekiq Denial of Service vulnerability

CVE-2023-26141 / GHSA-3qc2-v3hp-6cv8

More information

Details

Versions of the package sidekiq before 7.1.3 and 6.5.10 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests.

Severity

• CVSS Score: 5.7 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-26141
• https://github.com/sidekiq/sidekiq/commit/62c90d7c5a7d8a378d79909859d87c2e0702bf89
• https://gist.github.com/keeganparr1/1dffd3c017339b7ed5371ed3d81e6b2a
• https://security.snyk.io/vuln/SNYK-RUBY-SIDEKIQ-5885107
• https://github.com/sidekiq/sidekiq/blob/6-x/web/assets/javascripts/dashboard.js#L6
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sidekiq/CVE-2023-26141.yml
• https://github.com/sidekiq/sidekiq/blob/6-x/web/assets/javascripts/dashboard.js%23L6
• https://github.com/sidekiq/sidekiq/blob/6-x/Changes.md#6510
• https://github.com/advisories/GHSA-3qc2-v3hp-6cv8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

sidekiq/sidekiq (sidekiq)

v6.5.10

Compare Source

v6.5.9

Compare Source

• Ensure Sidekiq.options[:environment] == RAILS_ENV [#​5932]

v6.5.8

Compare Source

• Fail if using a bad version of scout_apm [#​5616]
• Add pagination to Busy page [#​5556]
• Speed up WorkSet#each [#​5559]
• Adjust CurrentAttributes to work with the String class name so we aren't referencing the Class within a Rails initializer [#​5536]

v6.5.7

Compare Source

• Updates for JA and ZH locales
• Further optimizations for scheduled polling [#​5513]

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request