fix: upgrade Devise 4.9 → 5.0.3 to fix CVE-2026-32700

Confirmable "change email" race condition permitted user to confirm
email they have no access to (GHSA-57hq-95w6-v4fc).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: duy211099

Gemfile

@@ -91,7 +91,7 @@ gem "inertia_rails", "~> 3.16"
 gem "vite_rails", "~> 3.0"
 
 # Authentication
-gem "devise", "~> 4.9"
+gem "devise", "~> 5.0"
 gem "omniauth-google-oauth2", "~> 1.2"
 gem "omniauth-rails_csrf_protection", "~> 2.0"
 

Gemfile.lock

@@ -144,10 +144,10 @@ GEM
       irb (~> 1.10)
       reline (>= 0.3.8)
     debug_inspector (1.2.0)
-    devise (4.9.4)
+    devise (5.0.3)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
-      railties (>= 4.1.0)
+      railties (>= 7.0)
       responders
       warden (~> 1.2.3)
     discard (1.4.0)
@@ -560,7 +560,7 @@ DEPENDENCIES
   database_consistency (~> 2.1)
   database_validations (~> 1.1)
   debug
-  devise (~> 4.9)
+  devise (~> 5.0)
   discard (~> 1.4)
   dotenv-rails (~> 3.1)
   i18n-tasks (~> 1.0)
@@ -637,7 +637,7 @@ CHECKSUMS
   date (3.5.1) sha256=750d06384d7b9c15d562c76291407d89e368dda4d4fff957eb94962d325a0dc0
   debug (1.11.1) sha256=2e0b0ac6119f2207a6f8ac7d4a73ca8eb4e440f64da0a3136c30343146e952b6
   debug_inspector (1.2.0) sha256=9bdfa02eebc3da163833e6a89b154084232f5766087e59573b70521c77ea68a2
-  devise (4.9.4) sha256=920042fe5e704c548aa4eb65ebdd65980b83ffae67feb32c697206bfd975a7f8
+  devise (5.0.3) sha256=c4c065051cdc4ace11547b2b7f5c3c4c97d0f1269250f5fe90f614ff78f29546
   discard (1.4.0) sha256=6efcd2a53ddf96781f81b825d398f1c88ab88c0faa84e131bea6e16ef95d65d0
   dotenv (3.2.0) sha256=e375b83121ea7ca4ce20f214740076129ab8514cd81378161f11c03853fe619d
   dotenv-rails (3.2.0) sha256=657e25554ba622ffc95d8c4f1670286510f47f2edda9f68293c3f661b303beab