NHSDigital · dependabot · Mar 17, 2026
diff --git a/Gemfile b/Gemfile
@@ -42,7 +42,7 @@ gem 'delayed_job_active_record'
 
 gem 'cancancan', '~> 3.0'
 gem 'cocoon'
-gem 'devise', '~> 4.7', '>=  4.7.1'
+gem 'devise', '~> 5.0'
 gem 'highline'
 gem 'paper_trail', '~> 16.0'
 gem 'paper_trail-association_tracking'

diff --git a/Gemfile.lock b/Gemfile.lock
@@ -87,10 +87,10 @@ GEM
       execjs (~> 2)
     avro (1.11.3)
       multi_json (~> 1.0)
-    base64 (0.2.0)
-    bcrypt (3.1.20)
-    benchmark (0.4.1)
-    bigdecimal (3.1.8)
+    base64 (0.3.0)
+    bcrypt (3.1.21)
+    benchmark (0.5.0)
+    bigdecimal (3.3.1)
     bindex (0.8.1)
     bio-vcf (0.9.5)
     bootstrap-sass (3.4.1)
@@ -145,7 +145,7 @@ GEM
       execjs
     coffee-script-source (1.12.2)
     concurrent-ruby (1.3.4)
-    connection_pool (2.5.3)
+    connection_pool (3.0.2)
     crass (1.0.6)
     csv (3.3.0)
     daemons (1.4.1)
@@ -155,10 +155,10 @@ GEM
     delayed_job_active_record (4.1.11)
       activerecord (>= 3.0, < 9.0)
       delayed_job (>= 3.0, < 5)
-    devise (4.9.4)
+    devise (5.0.3)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
-      railties (>= 4.1.0)
+      railties (>= 7.0)
       responders
       warden (~> 1.2.3)
     devise_saml_authenticatable (1.9.1)
@@ -172,8 +172,8 @@ GEM
     em-websocket (0.5.3)
       eventmachine (>= 0.12.9)
       http_parser.rb (~> 0)
-    erb (5.0.2)
-    erubi (1.13.0)
+    erb (6.0.2)
+    erubi (1.13.1)
     eventmachine (1.2.7)
     execjs (2.10.0)
     ffi (1.17.0)
@@ -217,11 +217,12 @@ GEM
       reline
     htmlentities (4.3.4)
     http_parser.rb (0.8.0)
-    i18n (1.14.6)
+    i18n (1.14.8)
       concurrent-ruby (~> 1.0)
-    io-console (0.7.2)
-    irb (1.15.2)
+    io-console (0.8.2)
+    irb (1.17.0)
       pp (>= 0.6.0)
+      prism (>= 1.3.0)
       rdoc (>= 4.0.0)
       reline (>= 0.4.2)
     jquery-rails (4.6.0)
@@ -243,7 +244,7 @@ GEM
     listen (3.9.0)
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
-    logger (1.6.1)
+    logger (1.7.0)
     loofah (2.23.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
@@ -389,9 +390,10 @@ GEM
     pg (1.4.6)
     possibly (1.0.1)
     power_assert (2.0.4)
-    pp (0.6.2)
+    pp (0.6.3)
       prettyprint
     prettyprint (0.2.0)
+    prism (1.9.0)
     prometheus-client (4.0.0)
     pry (0.15.0)
       coderay (~> 1.1)
@@ -415,9 +417,9 @@ GEM
     rack-session (2.1.1)
       base64 (>= 0.1.0)
       rack (>= 3.0.0)
-    rack-test (2.1.0)
+    rack-test (2.2.0)
       rack (>= 1.3)
-    rackup (2.2.1)
+    rackup (2.3.1)
       rack (>= 3)
     railroady (1.6.0)
     rails (7.2.2.2)
@@ -434,11 +436,11 @@ GEM
       activesupport (= 7.2.2.2)
       bundler (>= 1.15.0)
       railties (= 7.2.2.2)
-    rails-dom-testing (2.2.0)
+    rails-dom-testing (2.3.0)
       activesupport (>= 5.0.0)
       minitest
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.6.1)
+    rails-html-sanitizer (1.6.2)
       loofah (~> 2.21)
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
     railties (7.2.2.2)
@@ -450,24 +452,25 @@ GEM
       thor (~> 1.0, >= 1.2.2)
       zeitwerk (~> 2.6)
     rainbow (3.1.1)
-    rake (13.2.1)
+    rake (13.3.1)
     rb-fsevent (0.11.2)
     rb-inotify (0.11.1)
       ffi (~> 1.0)
-    rdoc (6.14.2)
+    rdoc (7.2.0)
       erb
       psych (>= 4.0.0)
+      tsort
     regexp-examples (1.6.0)
       regexp_property_values (~> 1.5)
     regexp_parser (2.9.3)
     regexp_property_values (1.5.2)
-    reline (0.5.11)
+    reline (0.6.3)
       io-console (~> 0.5)
     request_store (1.7.0)
       rack (>= 1.4)
-    responders (3.1.1)
-      actionpack (>= 5.2)
-      railties (>= 5.2)
+    responders (3.2.0)
+      actionpack (>= 7.0)
+      railties (>= 7.0)
     rexml (3.4.4)
     roo (2.10.1)
       nokogiri (~> 1)
@@ -549,9 +552,10 @@ GEM
     terminal-notifier-guard (1.7.0)
     test-unit (3.6.2)
       power_assert
-    thor (1.4.0)
+    thor (1.5.0)
     tilt (2.4.0)
     timeout (0.4.2)
+    tsort (0.2.0)
     ttfunk (1.8.0)
       bigdecimal (~> 3.1)
     turbolinks (5.2.1)
@@ -583,7 +587,7 @@ GEM
     xpath (3.2.0)
       nokogiri (~> 1.8)
     yubikey (1.4.1)
-    zeitwerk (2.6.18)
+    zeitwerk (2.7.5)
 
 PLATFORMS
   arm64-darwin
@@ -608,7 +612,7 @@ DEPENDENCIES
   date (= 3.3.4)
   delayed_job (~> 4.1)
   delayed_job_active_record
-  devise (~> 4.7, >= 4.7.1)
+  devise (~> 5.0)
   guard
   guard-livereload (~> 2.5)
   guard-rubocop

diff --git a/vendor/cache/base64-0.2.0.gem b/vendor/cache/base64-0.2.0.gem
diff --git a/vendor/cache/base64-0.3.0.gem b/vendor/cache/base64-0.3.0.gem
diff --git a/vendor/cache/bcrypt-3.1.20.gem b/vendor/cache/bcrypt-3.1.20.gem
diff --git a/vendor/cache/bcrypt-3.1.21.gem b/vendor/cache/bcrypt-3.1.21.gem
diff --git a/vendor/cache/benchmark-0.4.1.gem b/vendor/cache/benchmark-0.4.1.gem
diff --git a/vendor/cache/benchmark-0.5.0.gem b/vendor/cache/benchmark-0.5.0.gem
diff --git a/vendor/cache/bigdecimal-3.1.8.gem b/vendor/cache/bigdecimal-3.1.8.gem
diff --git a/vendor/cache/bigdecimal-3.3.1.gem b/vendor/cache/bigdecimal-3.3.1.gem
diff --git a/vendor/cache/connection_pool-2.5.3.gem b/vendor/cache/connection_pool-2.5.3.gem
diff --git a/vendor/cache/connection_pool-3.0.2.gem b/vendor/cache/connection_pool-3.0.2.gem
diff --git a/vendor/cache/devise-4.9.4.gem b/vendor/cache/devise-4.9.4.gem
diff --git a/vendor/cache/devise-5.0.3.gem b/vendor/cache/devise-5.0.3.gem
diff --git a/vendor/cache/erb-5.0.2.gem b/vendor/cache/erb-5.0.2.gem
diff --git a/vendor/cache/erb-6.0.2.gem b/vendor/cache/erb-6.0.2.gem
diff --git a/vendor/cache/erubi-1.13.0.gem b/vendor/cache/erubi-1.13.0.gem
diff --git a/vendor/cache/erubi-1.13.1.gem b/vendor/cache/erubi-1.13.1.gem
diff --git a/vendor/cache/i18n-1.14.6.gem b/vendor/cache/i18n-1.14.6.gem
diff --git a/vendor/cache/i18n-1.14.8.gem b/vendor/cache/i18n-1.14.8.gem
diff --git a/vendor/cache/io-console-0.7.2.gem b/vendor/cache/io-console-0.7.2.gem
diff --git a/vendor/cache/io-console-0.8.2.gem b/vendor/cache/io-console-0.8.2.gem
diff --git a/vendor/cache/irb-1.15.2.gem b/vendor/cache/irb-1.15.2.gem
diff --git a/vendor/cache/irb-1.17.0.gem b/vendor/cache/irb-1.17.0.gem
diff --git a/vendor/cache/logger-1.6.1.gem b/vendor/cache/logger-1.6.1.gem
diff --git a/vendor/cache/logger-1.7.0.gem b/vendor/cache/logger-1.7.0.gem
diff --git a/vendor/cache/pp-0.6.2.gem b/vendor/cache/pp-0.6.2.gem
diff --git a/vendor/cache/pp-0.6.3.gem b/vendor/cache/pp-0.6.3.gem
diff --git a/vendor/cache/prism-1.9.0.gem b/vendor/cache/prism-1.9.0.gem
diff --git a/vendor/cache/rack-test-2.1.0.gem b/vendor/cache/rack-test-2.1.0.gem
diff --git a/vendor/cache/rack-test-2.2.0.gem b/vendor/cache/rack-test-2.2.0.gem
diff --git a/vendor/cache/rackup-2.2.1.gem b/vendor/cache/rackup-2.2.1.gem
diff --git a/vendor/cache/rackup-2.3.1.gem b/vendor/cache/rackup-2.3.1.gem
diff --git a/vendor/cache/rails-dom-testing-2.2.0.gem b/vendor/cache/rails-dom-testing-2.2.0.gem
diff --git a/vendor/cache/rails-dom-testing-2.3.0.gem b/vendor/cache/rails-dom-testing-2.3.0.gem
diff --git a/vendor/cache/rails-html-sanitizer-1.6.1.gem b/vendor/cache/rails-html-sanitizer-1.6.1.gem
diff --git a/vendor/cache/rails-html-sanitizer-1.6.2.gem b/vendor/cache/rails-html-sanitizer-1.6.2.gem
diff --git a/vendor/cache/rake-13.2.1.gem b/vendor/cache/rake-13.2.1.gem
diff --git a/vendor/cache/rake-13.3.1.gem b/vendor/cache/rake-13.3.1.gem
diff --git a/vendor/cache/rdoc-6.14.2.gem b/vendor/cache/rdoc-6.14.2.gem
diff --git a/vendor/cache/rdoc-7.2.0.gem b/vendor/cache/rdoc-7.2.0.gem
diff --git a/vendor/cache/reline-0.5.11.gem b/vendor/cache/reline-0.5.11.gem
diff --git a/vendor/cache/reline-0.6.3.gem b/vendor/cache/reline-0.6.3.gem
diff --git a/vendor/cache/responders-3.1.1.gem b/vendor/cache/responders-3.1.1.gem
diff --git a/vendor/cache/responders-3.2.0.gem b/vendor/cache/responders-3.2.0.gem
diff --git a/vendor/cache/thor-1.4.0.gem b/vendor/cache/thor-1.4.0.gem
diff --git a/vendor/cache/thor-1.5.0.gem b/vendor/cache/thor-1.5.0.gem
diff --git a/vendor/cache/tsort-0.2.0.gem b/vendor/cache/tsort-0.2.0.gem
diff --git a/vendor/cache/zeitwerk-2.6.18.gem b/vendor/cache/zeitwerk-2.6.18.gem
diff --git a/vendor/cache/zeitwerk-2.7.5.gem b/vendor/cache/zeitwerk-2.7.5.gem