build(deps): bump newrelic_rpm from 9.11.0 to 9.12.0

[dependabot]

Bumps newrelic_rpm from 9.11.0 to 9.12.0.

Changelog

Sourced from newrelic_rpm's changelog.

v9.12.0

Version 9.12.0 adds support for the newrelic_security agent, introduces instrumentation for the LogStasher gem, improves instrumentation for the redis-clustering gem, and updates the Elasticsearch instrumentation to only attempt to get the cluster name once per client, even if it fails.

• Feature: Add support for the newrelic_security agent

  New Relic Interactive Application Security Testing (IAST) can help you prevent cyberattacks and breaches on your applications by probing your running code for exploitable vulnerabilities.

  The newrelic_security gem provides this feature for Ruby. It depends on newrelic_rpm. This is the first version of newrelic_rpm compatible with newrelic_security.

  At this time, the security agent is intended for use only within a dedicated security testing environment with data that can tolerate modification or deletion. The security agent is available as a separate Ruby gem, newrelic_security. It is recommended that this separate gem only be introduced to a security testing environment by leveraging Bundler grouping like so:

    # Gemfile
    gem 'newrelic_rpm'               # New Relic APM observability agent
    gem 'newrelic-infinite_tracing'  # New Relic Infinite Tracing
  group :security do
  gem 'newrelic_security', require: false        # New Relic security agent
  end

  In order to run the security agent, you need to update your configuration. At a minimum, security.agent.enabled and security.enabled must be set to true. They are false by default. Similar to the gem installation, we recommend you set these configurations for a special security testing environment only.

  Here's an example using newrelic.yml:

    common: &default_settings
      license_key: <%= ENV['NEW_RELIC_LICENSE_KEY'] %>
      app_name: "Example app"
  development:
  <<: *default_settings
  app_name: <%= app_name %> (Development)
  security:
  <<: *default_settings
  security.enabled: true
  security.agent.enabled: true
  production:
  <<: *default_settings

  The following configuration relate to the newrelic_security gem:

  Configuration name	Default	Behavior
  security.agent.enabled	false	If true, the security agent is loaded (a Ruby 'require' is performed)
  security.enabled	false	If true, the security agent is started (the agent runs in its event loop)

... (truncated)

Commits

• 0658fec Merge pull request #2772 from newrelic/update-newrelic-yml
• a957d68 Add Security Agent to config.rake (#2766)
• 4d99f75 Add security agent content back to newrelic.yml
• e7a3f8b Merge pull request #2770 from newrelic/update-newrelic-yml
• 18b33c0 Regenerate newrelic.yml
• be2b5be Revert spacing changes
• ae46673 Merge pull request #2768 from newrelic/newrelic-security-changelog-entry
• 65217ec Apply suggestions from code review
• 6dbe2ba Merge branch 'dev' into newrelic-security-changelog-entry
• 8ebf172 Merge pull request #2764 from newrelic/prerelease_updates_9.12.0-pre
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)