Dependency on old version of rest-client

Has anyone else who is using the filestack-rails gem run into these messages on the bundle-audit check?

Name: rest-client
Version: 1.6.9
Advisory: CVE-2015-1820
Criticality: Unknown
URL: https://github.com/rest-client/rest-client/issues/369
Title: rubygem-rest-client: session fixation vulnerability via Set-Cookie headers in 30x redirection responses
Solution: upgrade to >= 1.8.0

Name: rest-client
Version: 1.6.9
Advisory: CVE-2015-3448
Criticality: Unknown
URL: http://www.osvdb.org/show/osvdb/117461
Title: Rest-Client Gem for Ruby logs password information in plaintext
Solution: upgrade to >= 1.7.3

I’m unable to update the rest-client gem because the latest version of the filestack-rails gem (3.1.0) has a dependency on rest-client 1.6.7:

  In Gemfile:
    rest-client (>= 1.8.0)

    filestack-rails was resolved to 3.1.0, which depends on
      filestack (~> 2.1.0) was resolved to 2.1.0, which depends on
        unirest (~> 1.1.2) was resolved to 1.1.2, which depends on
          rest-client (~> 1.6.7)```

[staturecrane]

@thejspr I will escalate this and start working on a new release. Will try to have it up sometime next week. I can’t promise because I’m not sure exactly how long it will take to rip out Unirest, but I will get started on it.

[staturecrane]

@LucasCioffi This appears to be an issue with Unirest, which is a dependency of the Ruby SDK, which is a dependency of the Rails plugin.

I can look into replacing Unirest or seeing if there is a newer version with upgraded dependencies.