The `>= 3.0.0` dependency was to get `ActiveSupport::Concern` defined.  It's a functionality compatibility requirement.  It should not just be bumped to the newest in the series for the security fix.  Doing `bundle install` or `bundle update` will get that for the `Gemfile.lock`.