(PA-7106) Update rexml gem to 3.3.9 to address CVE-2024-49761

[shubhamshinde360]

Vanagon build links: Agent runtime 7x: https://jenkins-platform.delivery.puppetlabs.net/view/vanagon-generic-builder/job/platform_vanagon-generic-builder_vanagon-packaging_generic-builder/3342/ The osx-(11|12)-arm platforms are failing for unrelated issues (https://perforce.atlassian.net/browse/PA-7103)

pe-bolt-server-runtime-main: https://jenkins-platform.delivery.puppetlabs.net/view/vanagon-generic-builder/job/platform_vanagon-generic-builder_vanagon-packaging_generic-builder/3341/

pe-bolt-server-runtime-2023.8.x https://jenkins-platform.delivery.puppetlabs.net/view/vanagon-generic-builder/job/platform_vanagon-generic-builder_vanagon-packaging_generic-builder/3340/

Artifacts: https://builds.delivery.puppetlabs.net/puppet-runtime/c67b0201f9d14545faa8a43da6433d3dea4e4c8c/artifacts/ https://builds.delivery.puppetlabs.net/puppet-runtime/2ffd8051b54b66feff2a8e1d2e00579589ef59eb/artifacts

Agent-runtime main is not applicable here since the ruby upgrade in https://github.com/puppetlabs/puppet-runtime/pull/931 will update rexml to 3.3.9 by default.

[mhashizume]

It looks like there was a force push since those artifacts were built. What changed?

[shubhamshinde360]

Hey @mhashizume, Sorry, these changes were from another ticket I'm working on: https://github.com/puppetlabs/puppet-runtime/compare/a4def19065728fbe6579461b091ef171b0a492ec..dc49de921572ba5b84c7026275131d832e4bc2a6

https://perforce.atlassian.net/browse/PA-7099

I accidentally mixed up the two and pushed changes from the other ticket to this branch. But the builds are from before the changes were made. Should I run the builds again?

[mhashizume]

Should I run the builds again?

That's ok, the changes are pretty minimal, I just wanted to check.

LGTM!