Pin Ruby openssl gem past 3.2.x to clear SBOM EOL finding

[Copilot]

Authors: Please fill out this form carefully and completely.

Reviewers: By approving this Pull Request you are approving the code change, as well as its deployment and mitigation plans.
Please read this description carefully. If you feel there is anything unclear or missing, please ask for updates.

What are you trying to accomplish?

The primer-lookbook container is flagged by SBOM-Kustodian EOL rule eol-eoldate-openssl-008. The match is on the Ruby openssl stdlib gem at 3.2.2 — its own version line, unrelated to the system OpenSSL C library (3.0.x LTS in ruby-base:v3.4-noble, still supported). The scanner just sees the 3.2.x string and maps it to the OpenSSL 3.2 library EOL entry.

Changes:

• demo/Gemfile — declare the gem explicitly so it is no longer resolved as a default gem:

  # Pin the openssl stdlib gem past 3.2.x so the SBOM EOL scanner
  # (eol-eoldate-openssl-008) stops matching the OpenSSL 3.2 library EOL entry.
  gem "openssl", ">= 3.3"

• demo/Gemfile.lock — regenerated; adds openssl (4.0.2). No other gems changed.

Integration

No production code changes; demo/lookbook deployable only.

Risk Assessment

• Low risk the change is small, highly observable, and easily rolled back.
• Medium risk changes that are isolated, reduced in scope or could impact few users. The change will not impact library availability.
• High risk changes are those that could impact customers and SLOs, low or no test coverage, low observability, or slow to rollback.

Single dependency pin in the demo app; revert is a one-line change.

What approach did you choose and why?

Version-pinning the gem is the cheapest way to make the scanner stop matching, versus filing a suppression/exception per scan cycle. Nothing in the dependency graph caps openssl, so resolution was clean and did not perturb any other gem.

Anything you want to highlight for special attention from reviewers?

Bundler resolved to openssl 4.0.2 rather than a 3.3.x release — >= 3.3 accepts the latest, and the runtime image (Ruby 3.4) supports it. If a 3.3.x ceiling is preferred for conservatism, "~> 3.3" would pin it there instead.

Merge checklist

• Added/updated tests
• Added/updated documentation
• Added/updated previews (Lookbook)
• Tested in Chrome
• Tested in Firefox
• Tested in Safari
• Tested in Edge

Take a look at the What we look for in reviews section of the contributing guidelines for more information on how we review PRs.

• Fixes Bump Ruby openssl gem past 3.2.x to clear SBOM EOL finding (vuln-mgmt#230637) #4169

[changeset-bot]

⚠️ No Changeset found

Latest commit: cbd87fd

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[Copilot]

Pull request overview

This pull request updates the demo/lookbook app’s Ruby dependencies to avoid an SBOM false-positive that incorrectly flags the Ruby openssl stdlib gem 3.2.x as the OpenSSL C library 3.2 EOL line.

Changes:

• Add an explicit openssl (>= 3.3) dependency in demo/Gemfile.
• Regenerate demo/Gemfile.lock so Bundler resolves openssl to 4.0.2 and records the new top-level dependency.

Show a summary per file

File	Description
demo/Gemfile	Adds an explicit openssl version constraint to move off 3.2.x.
demo/Gemfile.lock	Records the resolved openssl (4.0.2) and adds openssl (>= 3.3) to dependencies.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 1/2 changed files
• Comments generated: 1
• Review effort level: Lite