Summary

Update mail from 2.8.1 to 2.9.1 in Gemfile.lock to fix GHSA-mvxr-6m87-mv2q / CVE-2026-63435 (medium): email address spoofing via malformed RFC 2047 encoded-words. This resolves Dependabot alert #163.

After #522, mail is no longer a direct dependency and comes in through Action Mailer / Action Mailbox. Only mail changes, plus the logger dependency it declares since 2.9. No other gem versions move. The Rails app generated by test:rails also resolves mail 2.9.1.

Test plan

• bundle exec rake coverage: unit 31 / rack 19 / sinatra 2 / rails 53, 0 failures
• bundle exec rubocop, bundle exec rbs validate, bundle exec steep check

🤖 Generated with Claude Code

https://claude.ai/code/session_01WymJYCdiCabZ3uTcLXFKe7