chore(deps): bump ransack from 3.0.1 to 4.0.0

[veelenga]

Description

Vulnerability report: SNYK-RUBY-RANSACK-5776488
Ransack changelog: https://github.com/activerecord-hackery/ransack/blob/main/CHANGELOG.md

We use ransack 4 in production for a while, however since ransack 3.1.0 is a transitive dependency in Avo, the vulnerability scanner continuously reports the problem with the dependency.

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works

Manual review steps

1. Step 1
2. Step 2

Manual reviewer: please leave a comment with output from the test if that's the case.

[codeclimate]

Code Climate has analyzed commit 8e7a2a1 and detected 0 issues on this pull request.

View more on Code Climate.

[veelenga]

@adrianthedev @Paul-Bob could you please coordinate how we can proceed with this? Having ransack 3.1.0 in the bundle in a blocker for our project since it is vulnerable and breaks our company policies. I can see two options:

1. Upgrade ransack 3.1.0 -> 4.0.0 in Avo. But this may be a breaking change for the Avo end-user because of explicit whitelist.
2. Move ransack to the development section in Avo's Gemfile so it will not be bundled in the production build as a transitive dependency.

UPD: I followed with option 1 for now

[Paul-Bob]

Thank you for the PR @veelenga!

I think the upgrade to 4.0.0 Is a good path to follow. We should document it on the avo docs upgrade guide too.

[veelenga]

@Paul-Bob thanks for the feedback.

I did another look and it seems like the dependencies from Gemfile are not bundled by the app, so there is no risk in upgrading ransack to 4.0.0 since it is not a breaking change. Sorry for the confusion.

Also, docs already have a note regarding ransack 4 and ransackable_attributes so I think this is good to go.

[adrianthedev]

Yeah, ransack is not an actual dependency for Avo. The dep updated in the Appraisal file is just for the CI system.

Thanks for that!