From 424b01af4bb1dd2775a4550a2b68aedf9add221b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 18 Aug 2026 10:28:43 +0000
Subject: [PATCH 1/2] Bump redis from 4.8.1 to 5.4.1

Bumps [redis](https://github.com/redis/redis-rb) from 4.8.1 to 5.4.1.
- [Release notes](https://github.com/redis/redis-rb/releases)
- [Changelog](https://github.com/redis/redis-rb/blob/master/CHANGELOG.md)
- [Commits](https://github.com/redis/redis-rb/compare/v4.8.1...v5.4.1)

---
updated-dependencies:
- dependency-name: redis
  dependency-version: 5.4.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Gemfile.lock | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 1e94d2799..b7d79b772 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -624,7 +624,10 @@ GEM
       rbs (>= 4.0.0)
       tsort
     redcarpet (3.6.1)
-    redis (4.8.1)
+    redis (5.4.1)
+      redis-client (>= 0.22.0)
+    redis-client (0.30.1)
+      connection_pool
     redis-session-store (0.11.6)
       actionpack (>= 5.2.4.1, < 9)
       redis (>= 3, < 6)
@@ -1026,7 +1029,8 @@ CHECKSUMS
   rbs (4.1.3) sha256=0c4474a9751cdc14364bfad0b3e53678323bbdc2c31683b0445932867dbab8c4
   rdoc (8.0.0) sha256=03bf8c08a9639658855a0cfd77c0abca8325c227693f7f33f82957811348c469
   redcarpet (3.6.1) sha256=d444910e6aa55480c6bcdc0cdb057626e8a32c054c29e793fa642ba2f155f445
-  redis (4.8.1) sha256=387ee086694fffc9632aaeb1efe4a7b1627ca783bf373320346a8a20cd93333a
+  redis (5.4.1) sha256=b5e675b57ad22b15c9bcc765d5ac26f60b675408af916d31527af9bd5a81faae
+  redis-client (0.30.1) sha256=5151bc5c7bbfe48623732cdae3b900d8a22dc691cc7cdfacfb351ac55116522d
   redis-session-store (0.11.6) sha256=12067ebb8bef7056e542f113dac398450a06a2b3737b3901c1372ba37e8978a5
   regexp_parser (2.12.0) sha256=35a916a1d63190ab5c9009457136ae5f3c0c7512d60291d0d1378ba18ce08ebb
   reline (0.7.0) sha256=5b012d8e55dbf9d450f12bde2cf7d15ff546ae80b3f8f3b30e570d431815583d

From 738f639c822a1c3ef0a0578eeb1b6937993ed77d Mon Sep 17 00:00:00 2001
From: Sean Rankine <sean.rankine@me.com>
Date: Tue, 18 Aug 2026 13:41:54 +0100
Subject: [PATCH 2/2] Fix session store boot error with redis 5

redis-session-store passes any unrecognised keys in the redis options
hash to Redis.new. redis-rb 4 ignored unknown options but redis-rb 5
raises ArgumentError for the ttl key, so the app failed to boot.

Move ttl to the top-level session store options, where the gem reads
it from when setting the session expiry. Redis keys still expire
after 20 hours and the cookie expiry is unchanged.
---
 config/initializers/session_store.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/initializers/session_store.rb b/config/initializers/session_store.rb
index c83a35039..697e1b067 100644
--- a/config/initializers/session_store.rb
+++ b/config/initializers/session_store.rb
@@ -8,9 +8,9 @@
 else
   Rails.application.config.session_store :redis_session_store,
                                          key: "_forms",
+                                         ttl: 20.hours, # set the redis ttl to 20 hours, but the cookie expiry will still be session
                                          redis: {
                                            url: redis_url,
-                                           ttl: 20.hours, # set the redis ttl to 20 hours, but the cookie expiry will still be session
                                            key_prefix: "session:",
                                          },
                                          on_redis_down: ->(_e, _env, _sid) { Rails.logger.warn "Unable to connect to Redis session store." },