From 2f7b572520ef3dd30a9af5b54add9128625d93f7 Mon Sep 17 00:00:00 2001
From: log0u7 <70974447+log0u7@users.noreply.github.com>
Date: Sun, 6 Sep 2026 22:53:54 +0200
Subject: [PATCH 1/3] Allow concurrent-ruby 1.3.x

The ~> 1.1.3 pessimistic pin blocks every dependent (Foreman, smart-proxy
plugins) from resolving the security-fixed concurrent-ruby releases:
1.3.7+ fixes CVE-2026-54906 and CVE-2026-54904.

Relax the three related constraints:

- dynflow.gemspec: concurrent-ruby '>= 1.1.3', '< 2.0'
- dynflow.gemspec: concurrent-ruby-edge '~> 0.7.0' (0.7.x supports
  concurrent-ruby ~> 1.3, 0.6.x pins ~> 1.1.6)
- Gemfile: concurrent-ruby-ext '~> 1.3.0' (ext releases follow the main
  gem: 1.3.8 is available)

Code change: lib/dynflow.rb requires 'logger' explicitly. concurrent-ruby
1.1 loaded it as a side effect; 1.3 no longer does, so the global logger
wiring in lib/dynflow.rb crashes with NameError on 1.3.x.

Test evidence (ruby 3.3, concurrent-ruby 1.3.8 + edge 0.7.2 + ext 1.3.8):
397 tests of the suite pass. The full suite later hangs in the
multi-executor dispatcher tests in our environment; the same hang
reproduces on master with concurrent-ruby 1.1.10 (progressing through
fewer tests), so it is pre-existing and unrelated to this change.

Signed-off-by: log0u7 <70974447+log0u7@users.noreply.github.com>
---
 Gemfile         | 2 +-
 dynflow.gemspec | 5 +++--
 lib/dynflow.rb  | 1 +
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/Gemfile b/Gemfile
index c3826ece..d3e6bf6d 100644
--- a/Gemfile
+++ b/Gemfile
@@ -8,7 +8,7 @@ gemspec
 gem 'json', '< 3.0' if Gem::Version.new(RUBY_VERSION) < Gem::Version.new('3.2')
 
 group :concurrent_ruby_ext, optional: ENV.key?('CI') && ENV['CONCURRENT_RUBY_EXT'] != 'true' do
-  gem 'concurrent-ruby-ext', '~> 1.1.3'
+  gem 'concurrent-ruby-ext', '~> 1.3.0'
 end
 
 group :pry, optional: ENV.key?('CI') do
diff --git a/dynflow.gemspec b/dynflow.gemspec
index 927da565..0da04058 100644
--- a/dynflow.gemspec
+++ b/dynflow.gemspec
@@ -21,8 +21,9 @@ Gem::Specification.new do |s|
   s.required_ruby_version = '>= 3.0.0'
 
   s.add_dependency "algebrick", '~> 0.7.0'
-  s.add_dependency "concurrent-ruby", '~> 1.1.3'
-  s.add_dependency "concurrent-ruby-edge", '~> 0.6.0'
+  s.add_dependency "concurrent-ruby", '>= 1.1.3', '< 2.0'
+  s.add_dependency "concurrent-ruby-edge", '~> 0.7.0'
+  s.add_dependency 'logger'
   s.add_dependency "csv", "~> 3.1"
   s.add_dependency "msgpack", '~> 1.3', '>= 1.3.3'
   s.add_dependency "multi_json"
diff --git a/lib/dynflow.rb b/lib/dynflow.rb
index f5b6c74c..5f39272b 100644
--- a/lib/dynflow.rb
+++ b/lib/dynflow.rb
@@ -5,6 +5,7 @@
 require 'base64'
 require 'concurrent'
 require 'concurrent-edge'
+require 'logger'
 
 logger                          = Logger.new($stderr)
 logger.level                    = Logger::INFO

From 7946f7ecedda56b3ed1d11e8e3e596ea3d20d89b Mon Sep 17 00:00:00 2001
From: log0u7 <70974447+log0u7@users.noreply.github.com>
Date: Thu, 24 Sep 2026 15:15:06 +0200
Subject: [PATCH 2/3] Sort dependencies alphabetically

---
 dynflow.gemspec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dynflow.gemspec b/dynflow.gemspec
index 0da04058..ba389e5e 100644
--- a/dynflow.gemspec
+++ b/dynflow.gemspec
@@ -23,8 +23,8 @@ Gem::Specification.new do |s|
   s.add_dependency "algebrick", '~> 0.7.0'
   s.add_dependency "concurrent-ruby", '>= 1.1.3', '< 2.0'
   s.add_dependency "concurrent-ruby-edge", '~> 0.7.0'
-  s.add_dependency 'logger'
   s.add_dependency "csv", "~> 3.1"
+  s.add_dependency 'logger'
   s.add_dependency "msgpack", '~> 1.3', '>= 1.3.3'
   s.add_dependency "multi_json"
   s.add_dependency "sequel", '>= 4.0.0'

From c8603f1bc976550aa670d05082fe1cf1b3d33366 Mon Sep 17 00:00:00 2001
From: log0u7 <70974447+log0u7@users.noreply.github.com>
Date: Thu, 24 Sep 2026 15:23:52 +0200
Subject: [PATCH 3/3] Bats: allow more time for world termination under
 concurrent-ruby 1.3

Under concurrent-ruby 1.3 the persistence retry chain surfaces the
fatal error after ~58s of polling rounds, past the previous 60s
window. Keep the assertion, widen the window.
---
 test/bats/sidekiq-orchestrator.bats | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/test/bats/sidekiq-orchestrator.bats b/test/bats/sidekiq-orchestrator.bats
index b75ae5f3..c7414bad 100644
--- a/test/bats/sidekiq-orchestrator.bats
+++ b/test/bats/sidekiq-orchestrator.bats
@@ -96,7 +96,10 @@ teardown() {
   wait_for 5 1 grep 'dynflow: Finished performing validity checks' "$(bg_output_file o1)"
 
   podman stop "$POSTGRES_CONTAINER_NAME"
-  wait_for 60 1 grep 'dynflow: World terminated, exiting.' "$(bg_output_file o1)"
+  # With concurrent-ruby 1.3 the persistence error surfaces after
+  # MAX_RETRIES polling rounds, which pushes the termination log past a
+  # 60s window (observed ~58s); allow a generous margin.
+  wait_for 180 1 grep 'dynflow: World terminated, exiting.' "$(bg_output_file o1)"
 }
 
 @test "active orchestrator can withstand temporary pg connection drop" {