Unpin concurrent-ruby and update to 1.3.7 (security) - #85

What

Security fix: unpin concurrent-ruby (< 1.3.5) and update to >= 1.3.7 (resolves to 1.3.7).

Why

The < 1.3.5 ceiling was added in the Rails 6.1 era (commit 76656e2) to guard the concurrent-ruby 1.3.5 change that dropped its logger dependency and broke Rails < 7.1. On Rails 8.1 that guard is obsolete — and the ceiling was actively pinning the app to 1.3.4, which carries CVE-2026-54904 / -54905 / -54906 (fixed in 1.3.7). So the pin was doing net harm: no longer protecting anything, and holding three CVEs open.

Changes

• Gemfile: replaced gem "concurrent-ruby", "< 1.3.5" with a documented >= 1.3.7 security floor (comment explains the obsolete guard + the CVEs)
• Both Gemfile.lock and the dual-boot Gemfile.next.lock updated (1.3.4 → 1.3.7)
• Used --conservative so nothing else moved (rack stays 2.x)

Verification (local)

• bundle-audit: concurrent-ruby advisories cleared (no longer flagged)
• App boots on concurrent-ruby 1.3.7
• Test suite: 16 runs, 52 assertions, 0 failures, 0 errors, 0 skips — the lifted guard causes no regression on Rails 8.1
• rubocop clean (exact CI config), reek clean

Note

This clears the last of the security advisories in the audit except webrick (transitive via rackup, no upstream patch yet, low exposure since puma serves production). The puma CVEs are handled in a separate PR.