diff --git a/Gemfile.lock b/Gemfile.lock
index b453194f2..fe691427b 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -3,7 +3,8 @@ PATH
   specs:
     xdrgen (0.1.3)
       activesupport (~> 6)
-      concurrent-ruby (<= 1.3.4)
+      concurrent-ruby (>= 1.3.7)
+      logger
       memoist (~> 0.11.0)
       slop (~> 3.4)
       treetop (~> 1.5.3)
@@ -18,7 +19,7 @@ GEM
       tzinfo (~> 2.0)
       zeitwerk (~> 2.3)
     coderay (1.1.3)
-    concurrent-ruby (1.1.10)
+    concurrent-ruby (1.3.7)
     diff-lcs (1.5.0)
     ffi (1.15.5)
     formatador (1.1.0)
@@ -41,6 +42,7 @@ GEM
     listen (3.7.1)
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
+    logger (1.7.0)
     lumberjack (1.2.8)
     memoist (0.11.0)
     method_source (1.0.0)
diff --git a/lib/xdrgen.rb b/lib/xdrgen.rb
index 03f928c32..d9fc14836 100644
--- a/lib/xdrgen.rb
+++ b/lib/xdrgen.rb
@@ -1,4 +1,7 @@
 require "xdrgen/version"
+# activesupport 6 references ::Logger without requiring it, and
+# concurrent-ruby >= 1.3.5 no longer requires it either, so load it first.
+require "logger"
 require "active_support/all"
 require 'memoist'
 
diff --git a/xdrgen.gemspec b/xdrgen.gemspec
index 396da5876..56687d1e9 100644
--- a/xdrgen.gemspec
+++ b/xdrgen.gemspec
@@ -17,14 +17,16 @@ Gem::Specification.new do |spec|
   spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
   spec.require_paths = ["lib"]
 
-  spec.required_ruby_version = '>= 2.1.0'
+  spec.required_ruby_version = '>= 2.5.0'
 
   spec.add_dependency "treetop", "~> 1.5.3"
   spec.add_dependency "activesupport", "~> 6"
   spec.add_dependency "slop", "~> 3.4"
   spec.add_dependency "memoist", "~> 0.11.0"
-  # https://stackoverflow.com/questions/79360526/uninitialized-constant-activesupportloggerthreadsafelevellogger-nameerror
-  spec.add_dependency "concurrent-ruby", "<= 1.3.4"
+  # >= 1.3.7 fixes GHSA-h8w8-99g7-qmvj, GHSA-wv3x-4vxv-whpp and GHSA-6wx8-w4f5-wwcr
+  spec.add_dependency "concurrent-ruby", ">= 1.3.7"
+  # required at load time by lib/xdrgen.rb; no longer a default gem on Ruby >= 3.5
+  spec.add_dependency "logger"
   
   spec.add_development_dependency "bundler", "~> 2"
   spec.add_development_dependency "rake", "~> 12.0"