Upgrade dependencies with known CVEs

Gemfile

@@ -10,3 +10,8 @@ end
 gem 'prometheus-client', '~> 4.0'
 gem 'rake', '~> 13.0'
 gem 'webrick', '~> 1.8'
+
+# public_suffix 7 requires Ruby >= 3.2; cap it so the dev/test resolution (it
+# comes in transitively via webmock -> addressable) keeps working on the
+# Ruby 3.0/3.1 CI jobs the gemspec still supports.
+gem 'public_suffix', '< 7.0'

Gemfile.lock

@@ -2,16 +2,16 @@ PATH
   remote: .
   specs:
     conductor_ruby (0.1.1)
-      concurrent-ruby (~> 1.2)
-      faraday (~> 2.0)
+      concurrent-ruby (>= 1.3.7, < 2.0)
+      faraday (>= 2.14.3, < 3.0)
       faraday-net_http_persistent (~> 2.0)
       faraday-retry (~> 2.0)
       json (>= 2.0)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.8.8)
+    addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
     ast (2.4.3)
     async (2.39.0)
@@ -23,7 +23,7 @@ GEM
     base64 (0.3.0)
     bigdecimal (4.0.1)
     coderay (1.1.3)
-    concurrent-ruby (1.3.6)
+    concurrent-ruby (1.3.8)
     connection_pool (2.5.5)
     console (1.35.1)
       fiber-annotation
@@ -33,11 +33,12 @@ GEM
       bigdecimal
       rexml
     diff-lcs (1.6.2)
-    faraday (2.8.1)
-      base64
-      faraday-net_http (>= 2.0, < 3.1)
-      ruby2_keywords (>= 0.0.4)
-    faraday-net_http (3.0.2)
+    faraday (2.15.0)
+      faraday-net_http (>= 2.0, < 3.6)
+      json
+      logger
+    faraday-net_http (3.5.0)
+      net-http (~> 0.5)
     faraday-net_http_persistent (2.3.1)
       faraday (~> 2.5)
       net-http-persistent (>= 4.0.4, < 5)
@@ -57,10 +58,16 @@ GEM
       hana (~> 1.3)
       regexp_parser (~> 2.0)
       simpleidn (~> 0.2)
+    logger (1.7.0)
     method_source (1.1.0)
     metrics (0.15.0)
+    net-http (0.10.0)
+      net-protocol (>= 0.3.0)
+      uri (>= 0.11.1)
     net-http-persistent (4.0.8)
       connection_pool (>= 2.2.4, < 4)
+    net-protocol (0.4.0)
+      timeout
     parallel (1.24.0)
     parser (3.3.10.1)
       ast (~> 2.4.1)
@@ -71,7 +78,7 @@ GEM
       coderay (~> 1.1)
       method_source (~> 1.0)
       reline (>= 0.6.0)
-    public_suffix (5.1.1)
+    public_suffix (6.0.2)
     racc (1.8.1)
     rainbow (3.1.1)
     rake (13.3.1)
@@ -110,10 +117,11 @@ GEM
       rubocop (~> 1.33)
       rubocop-capybara (~> 2.17)
     ruby-progressbar (1.13.0)
-    ruby2_keywords (0.0.5)
     simpleidn (0.3.0)
+    timeout (0.6.1)
     traces (0.18.2)
     unicode-display_width (2.6.0)
+    uri (1.1.2)
     webmock (3.26.1)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
@@ -129,6 +137,7 @@ DEPENDENCIES
   json_schemer (~> 2.0)
   prometheus-client (~> 4.0)
   pry (~> 0.14)
+  public_suffix (< 7.0)
   rake (~> 13.0)
   rspec (~> 3.0)
   rubocop (~> 1.0)

conductor_ruby.gemspec

@@ -30,12 +30,12 @@ Gem::Specification.new do |spec|
   spec.require_paths = ['lib']
 
   # HTTP client with HTTP/2 support
-  spec.add_dependency 'faraday', '~> 2.0'
+  spec.add_dependency 'faraday', '>= 2.14.3', '< 3.0'
   spec.add_dependency 'faraday-net_http_persistent', '~> 2.0'
   spec.add_dependency 'faraday-retry', '~> 2.0'
 
   # Concurrency primitives
-  spec.add_dependency 'concurrent-ruby', '~> 1.2'
+  spec.add_dependency 'concurrent-ruby', '>= 1.3.7', '< 2.0'
 
   # JSON handling
   spec.add_dependency 'json', '>= 2.0'

spec/conductor/http/rest_client_spec.rb

@@ -19,7 +19,10 @@
 
   let(:retry_options) do
     handler = client.connection.builder.handlers.find { |h| h.klass == Faraday::Retry::Middleware }
-    handler.instance_variable_get(:@args).first
+    # faraday >= 2.9 stores keyword middleware options in @kwargs; older faraday
+    # passed them as a single positional options hash in @args.first.
+    kwargs = handler.instance_variable_get(:@kwargs)
+    kwargs.nil? || kwargs.empty? ? handler.instance_variable_get(:@args).first : kwargs
   end
 
   describe 'retry configuration' do