Update bundled concurrent-ruby dependency to address CVE-2026-54906

[AdamWillden]

Hi,

The current CodeDeploy Agent gemspec specifies:

aws-codedeploy-agent/codedeploy_agent.gemspec

Line 22 in 800eb28

spec.add_dependency('concurrent-ruby', '~> 1.1.9')

AWS Inspector reports this bundled dependency as affected by CVE-2026-54906. Since concurrent-ruby is distributed as part of the CodeDeploy Agent, customers have no supported mechanism to update the dependency independently.

While the practical impact of this CVE appears limited, the current dependency version results in security findings that customers cannot remediate themselves, creating unnecessary operational and compliance overhead.

Would it be possible to update the bundled concurrent-ruby dependency to a version that addresses CVE-2026-54906 in a future CodeDeploy Agent release?

Thanks.

[AdamWillden]

I have a strong suspicion this package is also causing CVE-2026-8924 to show also as it appears on the same instances (only the ones using Blue Green deployments). But I can't tell where the curl dependency comes from.