[csandanov]

Problem

Ruby image builds keep JSON and the IMAP client on fixed release lines, so they can miss newer fixes and install an older release line than the base image already includes.

Cause

The security workaround specifies narrow version ranges and retains a check tied to one particular JSON release.

Solution

Refresh both bundled gems to current releases supported by the selected Ruby runtime. Continue removing the inherited JSON implementation and keep system gem updates separate from application dependencies.

Validation

• Ruby syntax and diff checks passed.
• The new image regression check rejects the unmodified Ruby 3.4 base image because inherited JSON code remains present.
• All 18 image jobs passed build, application/workspace tests, and vulnerability checks: Ruby 3.3.13, 3.4.12, and 4.0.9; AMD64 and ARM64; runtime, development, and development macOS variants. CI results.
• Local builds through the Wodby CLI verified gem replacement on Ruby 3.3 and 3.4; duplicate local builds were stopped after CI completed the image tests.

The updated build currently resolves JSON 3.1.0 and net-imap 0.6.8. Future builds resolve current releases rather than retaining fixed gem version ranges. Application bundles continue to select their own dependencies.