Upgrade mini_magick to fix CVE-2019-13574

More information
high severity
Vulnerable versions: < 4.9.4
Patched version: 4.9.4

In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote
image filename could cause remote command execution because Image.open
input is directly passed to Kernel#open, which accepts a '|' character
followed by a command.

Gemfile

@@ -114,7 +114,7 @@ gem 'kaminari', '~> 1.1.1'
 gem 'kramdown', '~> 1.3.3'
 gem 'liquid', '~> 4.0.3'
 gem 'loofah', '~> 2.0'
-gem 'mini_magick'
+gem 'mini_magick', ">= 4.9.4"
 gem 'multi_xml'
 gem 'nokogiri'
 gem 'omniauth', '~> 1.6.1'

Gemfile.lock

@@ -401,7 +401,7 @@ GEM
       mime-types-data (~> 3.2015)
     mime-types-data (3.2016.0521)
     mimemagic (0.3.3)
-    mini_magick (4.2.3)
+    mini_magick (4.9.5)
     mini_mime (1.0.1)
     mini_portile2 (2.4.0)
     mini_racer (0.2.4)
@@ -720,7 +720,7 @@ DEPENDENCIES
   liquid (~> 4.0.3)
   listen (~> 3.0.5)
   loofah (~> 2.0)
-  mini_magick
+  mini_magick (>= 4.9.4)
   mini_racer (~> 0.2.4)
   mqtt
   multi_xml