Uh oh!
There was an error while loading. Please reload this page.
Allow concurrent-ruby 1.3.x - #473
Open
log0u7 wants to merge 1 commit into
Open
Conversation
The ~> 1.1.3 pessimistic pin blocks every dependent (Foreman, smart-proxy plugins) from resolving the security-fixed concurrent-ruby releases: 1.3.7+ fixes CVE-2026-54906 and CVE-2026-54904. Relax the three related constraints: - dynflow.gemspec: concurrent-ruby '>= 1.1.3', '< 2.0' - dynflow.gemspec: concurrent-ruby-edge '~> 0.7.0' (0.7.x supports concurrent-ruby ~> 1.3, 0.6.x pins ~> 1.1.6) - Gemfile: concurrent-ruby-ext '~> 1.3.0' (ext releases follow the main gem: 1.3.8 is available) Code change: lib/dynflow.rb requires 'logger' explicitly. concurrent-ruby 1.1 loaded it as a side effect; 1.3 no longer does, so the global logger wiring in lib/dynflow.rb crashes with NameError on 1.3.x. Test evidence (ruby 3.3, concurrent-ruby 1.3.8 + edge 0.7.2 + ext 1.3.8): 397 tests of the suite pass. The full suite later hangs in the multi-executor dispatcher tests in our environment; the same hang reproduces on master with concurrent-ruby 1.1.10 (progressing through fewer tests), so it is pre-existing and unrelated to this change. Signed-off-by: log0u7 <70974447+log0u7@users.noreply.github.com>
log0u7
marked this pull request as ready for review
September 6, 2026 22:59
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
~> 1.1.3pessimistic pin on concurrent-ruby (and the~> 0.6.0pin on concurrent-ruby-edge, which itself pinsconcurrent-ruby ~> 1.1.6) blocks every dependent from resolving the security-fixed concurrent-ruby releases. 1.3.7+ fixes CVE-2026-54906 and CVE-2026-54904; Foreman and the smart-proxy plugins (which pull dynflow) therefore ship a vulnerable concurrent-ruby with no resolver path to the fixed release.Fixes#474
Changes
dynflow.gemspec: concurrent-ruby'~> 1.1.3'->'>= 1.1.3', '< 2.0'dynflow.gemspec: concurrent-ruby-edge'~> 0.6.0'->'~> 0.7.0'(0.7.x supports concurrent-ruby~> 1.3; latest 0.7.2 released 2025-01)Gemfile: concurrent-ruby-ext'~> 1.1.3'->'~> 1.3.0'(ext releases follow the main gem, 1.3.8 available)lib/dynflow.rb:require 'logger'- concurrent-ruby 1.1 loaded logger as a side effect, 1.3 no longer does, so the global logger wiring crashed with NameError on 1.3.xTest evidence
ruby 3.3, concurrent-ruby 1.3.8 + edge 0.7.2 + ext 1.3.8: