Upgrade Rails to 8.1.3.1 and refresh dependency security posture

Gemfile

@@ -5,11 +5,11 @@ source 'https://rubygems.org'
 ruby '3.4.10'
 
 # Bundle edge Rails instead: gem 'rails', github: 'rails/rails'
-gem 'rails', '~> 8.0.0'
+gem 'rails', '~> 8.1.0'
 # Use postgresql as the database for Active Record
 gem 'pg', '>= 0.18', '< 2.0'
 # Use Puma as the app server
-gem 'puma', '~> 7.0'
+gem 'puma', '~> 8.0'
 # Asset pipeline for JavaScript bundling
 gem 'jsbundling-rails'
 # Asset pipeline for Rails
@@ -19,7 +19,7 @@ gem 'turbolinks', '~> 5'
 # Build JSON APIs with ease. Read more: https://github.com/rails/jbuilder
 gem 'jbuilder', '~> 2.7'
 # Use HAML instead of ERB
-gem 'haml-rails', '~> 2.0'
+gem 'haml-rails', '~> 3.1'
 # Add Devise for authentication
 gem 'devise', '~> 5.0'
 # PBKDF2-SHA512 password hashing for FIPS 140-2 compliance
@@ -32,13 +32,13 @@ gem 'omniauth', '~> 2.1'
 # LDAP Auth — original omniauth-ldap (actively maintained, no nkf/kconv dependency).
 # Replaces gitlab_omniauth-ldap which had a dead `require 'kconv'` that triggered
 # Ruby VM crash bugs.ruby-lang.org/issues/21967 on parallel_tests forking.
-gem 'omniauth-ldap', '~> 2.3', require: false
+gem 'omniauth-ldap', '~> 3.0', require: false
 # Allow users to sign in with GitHub
 gem 'omniauth-github'
 # https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284
-gem 'omniauth-rails_csrf_protection', '~> 1.0'
+gem 'omniauth-rails_csrf_protection', '~> 2.0'
 # Allow users to sign in with OIDC providers
-gem 'omniauth_openid_connect', '~> 0.6.0'
+gem 'omniauth_openid_connect', '~> 0.8'
 # Vulcan settings - upgraded for Ruby 3.1+ compatibility
 gem 'mitre-settingslogic', '~> 3.0'
 # Use Redis adapter to run Action Cable in production
@@ -79,7 +79,7 @@ gem 'amoeba'
 # For writing excel files with xml:space="preserve" (fixes whitespace round-trip)
 gem 'caxlsx'
 # For reading excel files
-gem 'ruh-roo', '~> 3.0.0', require: 'roo'
+gem 'roo', '~> 3.0'
 
 # REXML - required explicitly in Ruby 3.0+
 gem 'rexml'
@@ -95,6 +95,12 @@ gem 'commonmarker'
 gem 'rack-attack'
 
 gem 'mitre-inspec-objects'
+# inspec-core is only consumed as a library (control-code generation via
+# mitre-inspec-objects). It resolves from the Cinc Project's community gem
+# server, which builds current InSpec releases from source.
+source 'https://rubygems.cinc.sh' do
+  gem 'inspec-core', '~> 7.1'
+end
 gem 'rest-client'
 
 group :development do
@@ -113,6 +119,8 @@ end
 group :test do
   # Adds support for Capybara system testing and selenium driver
   gem 'capybara', '>= 2.15'
+  # Parallel-safe ENV mutation for specs (never bare ENV assignment)
+  gem 'climate_control', '~> 1.2'
   gem 'selenium-webdriver'
   # Easy installation and use of web drivers to run system tests with browsers
   # gem 'webdrivers'
@@ -125,7 +133,7 @@ group :test do
   gem 'rubocop-rails'
   gem 'rubocop-rspec'
   gem 'rubocop-rspec_rails'
-  gem 'shoulda-matchers', '~> 7.0'
+  gem 'shoulda-matchers', '~> 8.0'
   gem 'simplecov', require: false
   gem 'test-prof', '~> 1.5'
   gem 'webmock'
@@ -137,7 +145,7 @@ group :development, :test do
   gem 'factory_bot_rails', '~> 6.5.0'
   gem 'parallel_tests'
   gem 'rspec-mocks'
-  gem 'rspec-rails', '~> 6.0'
+  gem 'rspec-rails', '~> 8.0'
   # Load environment variables from .env files in development and test
   gem 'dotenv-rails'
 end
@@ -147,7 +155,7 @@ gem 'tzinfo-data'
 
 gem 'highline', '~> 2.0'
 # Ruby wrapper around slack API
-gem 'slack-ruby-client', '1.0.0'
+gem 'slack-ruby-client', '~> 3.2'
 # Slack notification formatting
 gem 'slack_block_kit', '0.3.3'
 
@@ -157,4 +165,4 @@ gem 'blueprinter-activerecord', '~> 1.3'
 
 gem 'oj', '~> 3.16'
 
-gem 'faraday', '~> 1.10', '>= 1.10.6'
+gem 'faraday', '~> 2.0'