[Security] Bump rails from 4.2.10 to 4.2.11

[greysteil]

Bumps rails from 4.2.10 to 4.2.11. This update includes security fixes.

Vulnerabilities fixed

Sourced from The Ruby Advisory Database.

Broken Access Control vulnerability in Active Job
There is a vulnerability in Active Job. This vulnerability has been assigned the CVE identifier CVE-2018-16476.

Impact

Carefully crafted user input can cause Active Job to deserialize it using GlobalId and allow an attacker to have access to information that they should not have.

Vulnerable code will look something like this:

MyJob.perform_later(user_input)

All users running an affected release should either upgrade or use one of the workarounds immediately.

Patched versions: >= 4.2.11, < 5.0.0; >= 5.0.7.1, < 5.1.0; >= 5.1.6.1, < 5.2.0; >= 5.2.1.1
Unaffected versions: < 4.2.0

Commits

• 474b739 Preparing for 4.2.11 release
• 0cada53 Do not deserialize GlobalID objects that were not generated by Active Job
• 22aec58 Tweak queue_classic and pg versions
• 3e84bb3 Lock pg gem to < 0.21.0
• 73b43c9 Fix tests on Mail 2.7.1
• 3804d01 Update sidekiq
• 06e2c91 Update lockfile to match Gemfile rake spec
• 51b3394 Lock Sidekiq for < 5 for Ruby 2.2
• 54a5e72 Leave rubygems at 2.6.13 because of YAML safe loading
• 26a7dbe Lock rake to < 12.3.0 on Ruby 1.9.3
• Additional commits viewable in compare view

Another security update PR that Dependabot generated against my fork. I won't create any more of these because it looks like you haven't merged the Rack one from earlier this month and I don't want to spam you with PRs, but I'd love you to use Dependabot to automate these. Ping me if you do and have any questions / I can help at all.

[markets]

This also supersedes #450 and #438 👍