From 53f25b078642f92eda07713b0fd30f570aa72c8e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Wed, 8 Jul 2026 22:59:27 -0600 Subject: [PATCH] Unpin concurrent-ruby and update to 1.3.7 (security) The `< 1.3.5` ceiling was added in the Rails 6.1 era (commit 76656e2) to guard the concurrent-ruby 1.3.5 change that dropped its `logger` dependency and broke Rails < 7.1. On Rails 8.1 that guard is obsolete, and the ceiling was actively holding the app on 1.3.4, which carries CVE-2026-54904/5/6 (fixed in 1.3.7). Replaced the ceiling with a documented `>= 1.3.7` security floor. Used --conservative so nothing else moved (rack stays 2.x). Both lockfiles updated. Verified locally: bundle-audit no longer flags concurrent-ruby; app boots on 1.3.7; test suite green (16 runs, 52 assertions, 0 failures); rubocop + reek clean. --- Gemfile | 6 +++++- Gemfile.lock | 4 ++-- Gemfile.next.lock | 4 ++-- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/Gemfile b/Gemfile index d13a591..fde678d 100644 --- a/Gemfile +++ b/Gemfile @@ -24,7 +24,11 @@ end gem "bundler-audit" gem "next_rails" gem "ostruct" -gem "concurrent-ruby", "< 1.3.5" +# `< 1.3.5` was a Rails 6.1-era compatibility guard (concurrent-ruby 1.3.5 +# dropped its `logger` dependency, breaking Rails < 7.1); obsolete on Rails +# 8.1. Now a security floor instead: 1.3.4 carries CVE-2026-54904/5/6, fixed +# in 1.3.7. +gem "concurrent-ruby", ">= 1.3.7" gem "puma", "~> 8.0" # minitest 6.0 dropped minitest/mock.rb into a separate minitest-mock gem; # pinned below 6 so a transitive bump (e.g. via `bundle update rails`) diff --git a/Gemfile.lock b/Gemfile.lock index 6f2f217..44002d4 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -132,7 +132,7 @@ GEM regexp_parser (>= 1.5, < 3.0) xpath (~> 3.2) climate_control (1.2.0) - concurrent-ruby (1.3.4) + concurrent-ruby (1.3.7) connection_pool (3.0.2) crass (1.0.7) date (3.5.1) @@ -423,7 +423,7 @@ DEPENDENCIES aws-sdk-s3 bundler-audit capybara (~> 3.40) - concurrent-ruby (< 1.3.5) + concurrent-ruby (>= 1.3.7) dotenv-rails fastruby-styleguide! font-awesome-rails (>= 4.7.0.9) diff --git a/Gemfile.next.lock b/Gemfile.next.lock index 6f2f217..44002d4 100644 --- a/Gemfile.next.lock +++ b/Gemfile.next.lock @@ -132,7 +132,7 @@ GEM regexp_parser (>= 1.5, < 3.0) xpath (~> 3.2) climate_control (1.2.0) - concurrent-ruby (1.3.4) + concurrent-ruby (1.3.7) connection_pool (3.0.2) crass (1.0.7) date (3.5.1) @@ -423,7 +423,7 @@ DEPENDENCIES aws-sdk-s3 bundler-audit capybara (~> 3.40) - concurrent-ruby (< 1.3.5) + concurrent-ruby (>= 1.3.7) dotenv-rails fastruby-styleguide! font-awesome-rails (>= 4.7.0.9)