[19.0] Backport of 'Uninstall the default net-imap gem shipped with Ruby'

What does this MR do and why?

Backport of !9523 (merged) to 19-0-stable.

The default net-imap gem shipped with Ruby is vulnerable, and GitLab Rails already bundles a newer, patched version. This uninstalls the default version during the gitlab-rails build so the vulnerable copy is not left on disk in the package (mirroring the existing rexml cleanup).

This stable branch ships Ruby 3.3.11 (current) and 3.4.9 (next), whose default net-imap versions (0.4.21 and 0.5.8) are both covered by the uninstall list.

Relates to https://gitlab.com/gitlab-org/gitlab/-/work_items/600949

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

  • This MR is backporting a bug fix, documentation update, or spec fix, previously merged in the default branch.
  • The original MR has been deployed to GitLab.com (not applicable for documentation or spec changes).
  • This MR has a severity label assigned (if applicable).

Note to the merge request author and maintainer

If you have questions about the patch release process, please:

Merge request reports

Loading