Remediate CVE-2026-54904 (concurrent-ruby)

[eng-cve-remediation-app]

This PR contains the following updates:

Package	Type	Update	Change
concurrent-ruby:concurrent-ruby	dependencies	security	unknown → 1.3.7

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity	CVSS Score	Vulnerability
High	7.5	CVE-2026-54904

---

Bump strategy

Direct dependency: concurrent-ruby is declared as a runtime dependency in puppet.gemspec (the Gemfile pulls it in via gemspec), not a transitive gem.

The old constraint ~> 1.0 (>=1.0, <2.0) already permitted 1.3.7+ but didn't require it — the resolved Gemfile.lock happened to already be at 1.3.8, but that's a coincidence, not a fix: Gemfile.lock is gitignored in this repo and gets regenerated on every bundle install/bundle lock, so nothing stopped a future resolve from landing back on a vulnerable pre-1.3.7 version.

Changed the constraint to ['>= 1.3.7', '< 2.0'], matching this gemspec's existing multi-part style (used elsewhere for facter, fast_gettext, ffi). This preserves the same upper bound as the original ~> 1.0 range while raising the floor to the fix version, so bundle lock can no longer resolve to a vulnerable release.

Ran bundle lock and confirmed the regenerated Gemfile.lock now resolves concurrent-ruby at 1.3.8 (>= 1.3.7), and bundle check passes.

[amitkarsale]

Closing this — opened by mistake against puppetlabs/puppet, which we've confirmed is a dormant fork (last real commit Dec 2024). Real development for this gem has moved to puppetlabs/puppet-private. The fix (widening the concurrent-ruby dependency floor) is being redirected there instead.

Apologies for the noise.

[bastelfreak]

well it wouldn't hurt if you fix it here.