On 10/24 07:45, Theo Buehler wrote:
> On Fri, Oct 23, 2026 at 09:17:31PM -0700, Jeremy Evans wrote:
> > These are the latest releases of Ruby 4.0 and 3.4. The 4.0.9 release is
> > the same as the 4.0.8 release with security fixes for CVE-2026-89078,
> > CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. Ruby 3.4.12 has the
> > same security fixes. Note that these fixes protect against cases where
> > untrusted input is used to create Regexp objects, which is just asking
> > for trouble IMO.
> >
> > Release announcements:
> > 4.0.9: https://www.ruby-lang.org/en/news/2026/10/23/ruby-4-0-9-released/
> > 3.4.12: https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-4-12-released/
> >
> > Ruby 3.3.13 was also released today, but since it was just sent to the
> > Attic, no patch for it.
> >
> > Tested on amd64. Will be committing in a couple days unless I hear
> > objections.
>
> Given that these were the underlying cause for this week's gitlab RCE,
> I'm not sure there's a good reason for waiting. I'd prefer if you just
> went ahead.
>
> ok tb
OK, I've committed the changes.
> Backports would seem appropriate. Should we update 3.3 in stable as well?
Yes, it would be best to backport 3.3.13 to -stable since it is affected
as well. The PLIST diff looks something like this, otherwise, the only change
needed should be a version bump.
Best,
Jeremy
--- pkg/PLIST
+++ pkg/PLIST
@@ -2696,7 +2696,7 @@ lib/ruby/gems/${REV}/gems/rdoc-6.6.3.1/exe/rdoc
lib/ruby/gems/${REV}/gems/rdoc-6.6.3.1/exe/ri
lib/ruby/gems/${REV}/gems/readline-0.0.4/
lib/ruby/gems/${REV}/gems/reline-0.5.10/
-lib/ruby/gems/${REV}/gems/resolv-0.3.1/
+lib/ruby/gems/${REV}/gems/resolv-0.3.2/
lib/ruby/gems/${REV}/gems/resolv-replace-0.1.1/
lib/ruby/gems/${REV}/gems/rexml-3.4.4/
lib/ruby/gems/${REV}/gems/rexml-3.4.4/LICENSE.txt
@@ -3014,7 +3014,7 @@
lib/ruby/gems/${REV}/specifications/default/psych-5.1.2.gemspec
lib/ruby/gems/${REV}/specifications/default/rdoc-6.6.3.1.gemspec
lib/ruby/gems/${REV}/specifications/default/readline-0.0.4.gemspec
lib/ruby/gems/${REV}/specifications/default/reline-0.5.10.gemspec
-lib/ruby/gems/${REV}/specifications/default/resolv-0.3.1.gemspec
+lib/ruby/gems/${REV}/specifications/default/resolv-0.3.2.gemspec
lib/ruby/gems/${REV}/specifications/default/resolv-replace-0.1.1.gemspec
lib/ruby/gems/${REV}/specifications/default/rinda-0.2.0.gemspec
lib/ruby/gems/${REV}/specifications/default/ruby2_keywords-0.0.5.gemspec
