chore(deps-dev): Bump concurrent-ruby and json for security advisories

[ahogappa]

Summary

The bundler-audit job (Security workflow) has been failing on master since at least 2026-08-24. The advisories are against the locked versions of two development dependencies:

Gem	Locked	Pulled in by	Advisories	Fixed in
concurrent-ruby	1.3.6	steep	CVE-2026-54904, CVE-2026-54905, CVE-2026-54906	>= 1.3.7
json	2.19.4	rubocop, steep	CVE-2026-54696	>= 2.19.9

This PR updates only these two, with bundle update --conservative concurrent-ruby json:

• concurrent-ruby 1.3.6 → 1.3.8
• json 2.19.4 → 2.21.2

Gemfile.lock is the only file changed (2 lines).

Verification

Run locally on Ruby 3.3:

• bundle audit check --update: No vulnerabilities found
• rake test: 856 runs, 0 failures, 0 errors
• rake standard: passes

This also turns the bundler-audit check green on #257, which failed for this reason only.

🤖 Generated with Claude Code

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• Gemfile.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 7635afd1-80ff-45e6-844b-6f4e860e72bc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}