[Open-Source-Bot]

This PR contains the following updates:

Package	Type	Update	Change
ruby (source)	uses-with	major	3.3 → 4.0.9

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

ruby/ruby (ruby)

v4.0.9: 4.0.9

Compare Source

What's Changed

• Reject overflowed repeat/null-check IDs in huge regexps by makenowjust · Pull Request #​16801

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

v4.0.8: 4.0.8

Compare Source

What's Changed

• Bug #​22311: Build crashes on macOS 26 with the macOS 27 SDK because pipe2() and dup3() are unavailable - Ruby - Ruby Issue Tracking System
• Bug #​22174: Set operations (&, ^, collect!, flatten, classify, divide) do not preserve compare_by_identity - Ruby - Ruby Issue Tracking System
• Bug #​22383: Fix inverted STR_SHARED check in rb_str_tmp_frozen_release - Ruby - Ruby Issue Tracking System
• Bug #​22387: str_shared_replace incorrectly recalculates termlen - Ruby - Ruby Issue Tracking System
• Bug #​22327: RubyVM::ZJIT.reset_stats! aborts the process (Rust panic) when ZJIT is not enabled - Ruby - Ruby Issue Tracking System
• Bug #​22381: MatchData assigned to $~ is incorrectly reused - Ruby - Ruby Issue Tracking System
• Bug #​22321: Assertion Failed: rb_vm_search_method_slowpath:RB_TYPE_2_P(klass, RUBY_T_CLASS, RUBY_T_ICLASS): klass: T_MODULE - Ruby - Ruby Issue Tracking System
• Bug #​22315: heap-use-after-free in String unpack with a block that mutates the receiver - Ruby - Ruby Issue Tracking System
• Bug #​22318: heap uaf triggered in array.flatten - Ruby - Ruby Issue Tracking System
• Bug #​22319: heap buffer overflow triggered by array's zip function - Ruby - Ruby Issue Tracking System
• Bug #​22322: AddressSanitizer: use-after-poison in econv_description /ruby-src/build/../transcode.c - Ruby - Ruby Issue Tracking System
• Bug #​22334: Assertion Failed: VM_ENV_FLAGS:FIXNUM_P(flags) - Ruby - Ruby Issue Tracking System
• Bug #​22336: IO:Buffer Heap uaf - Ruby - Ruby Issue Tracking System
• Bug #​22330: heap uaf from string.encode() - Ruby - Ruby Issue Tracking System
• Bug #​22340: Win32: File.stat succeeds on symbolic-link loops on Windows - Ruby - Ruby Issue Tracking System
• Bug #​22335: Stack corruption with >31 keyword args and refined Integer#== - Ruby - Ruby Issue Tracking System
• Bug #​22339: Ruby::Box: crash / hang at VM shutdown with RUBY_FREE_AT_EXIT=1 - Ruby - Ruby Issue Tracking System
• Bug #​22342: IO#gets can ignore the limit argument in some edge cases - Ruby - Ruby Issue Tracking System
• Bug #​22391: Fix propagation of errno in rb_io_maybe_wait. - Ruby - Ruby Issue Tracking System
• Bug #​22384: Regexp compile error in the 2nd+ branch of a top-level alternation leaks the parse tree (regression from #​13332, Ruby 4.0) - Ruby - Ruby Issue Tracking System
• Bug #​22388: Use-after-free when an Enumerable retains its each block - Ruby - Ruby Issue Tracking System
• Bug #​22284: Passing an object with to_int to curry as its arity causes problems with LLP64. - Ruby - Ruby Issue Tracking System
• Bug #​22416: Respect timezone abbreviation encodings in Time#strftime - Ruby - Ruby Issue Tracking System
• Bug #​22426: ZJIT: keyword arguments swapped when passed out of declared order to a method with a block (please backport d81a11d4e6 to 4.0) - Ruby - Ruby Issue Tracking System
• Bug #​22406: Process.fork can leave the child unable to resolve hostnames: getaddrinfo helper threads take glibc's resolver lock after releasing the fork lock - Ruby - Ruby Issue Tracking System
• Bug #​22445: On macOS, a child of Kernel#fork can abort with "[BUG] pthread_rwlock_destroy: Resource busy (EBUSY)" - Ruby - Ruby Issue Tracking System
• Bug #​22415: Thread.handle_interrupt needs to preserve errinfo - Ruby - Ruby Issue Tracking System
• Bug #​22434: "No live threads left. Deadlock?" when running system() or spawn in Ractors - Ruby - Ruby Issue Tracking System
• Backport the regexp compiler program size overflow fixes to ruby_4_0 by hsbt · Pull Request #​19025

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

v4.0.7: 4.0.7

Compare Source

What's Changed

• Bug #​22188: addr2line doesn't find symbols when compiled with GCC LTO - Ruby - Ruby Issue Tracking System
• Bug #​22210: Check if issue #​19969 is still reproducible / re-opened in 4.0.x - Ruby - Ruby Issue Tracking System
• Bug #​22217: Segmentation fault when resuming execution with Coverage.start and ruby/debug - Ruby - Ruby Issue Tracking System
• Fix formatting in ObjectSpace._id2ref error path by eregon · Pull Request #​18206
• Bug #​22200: ObjectSpace._id2ref can return a different object than the id's owner on Ruby 4.0 (stale id2ref_tbl entry for objects with generic fields) - Ruby - Ruby Issue Tracking System
• Bug #​22123: Ruby::Box + BUNDLER_SETUP can evaluate gemspecs before main-box RubyGems initialization - Ruby - Ruby Issue Tracking System
• Bump ERB to 6.0.7 by k0kubun · Pull Request #​18282
• Bug #​22237: GC.auto_compact corrupts a String or segfaults from String#tr with dup or gsub - Ruby - Ruby Issue Tracking System
• Bug #​22243: Change fork behavior when Process._fork raises an exception during fork with a block argument - Ruby - Ruby Issue Tracking System
• Bug #​22223: Socket.tcp with connect_timeout returns a phantom "connected" socket for a refused connection on macOS 27 (kernel answers EISCONN on connect retry; SO_ERROR never consulted) - Ruby - Ruby Issue Tracking System
• Bug #​22220: Performance regression when requiring aws-sdk-ec2 in Ruby 4.0.6 - Ruby - Ruby Issue Tracking System
• Bug #​22218: Line TracePoint misses executed loop condition after a guard - Ruby - Ruby Issue Tracking System
• Bug #​22198: win32: heap overflow in Kernel#system - Ruby - Ruby Issue Tracking System
• Bug #​22196: Heap-use-after-free in fiber_switch with transfer-terminated async tasks on 3.4.10 - Ruby - Ruby Issue Tracking System
• Bug #​22190: Class#subclasses does not include clones of classes that include modules - Ruby - Ruby Issue Tracking System
• Bug #​11438: native_thread_init_stack() get machine.stack_start unequal to thread's stack start address, x86 win32 - Ruby - Ruby Issue Tracking System
• Bug #​22257: Prepending a module to an already-included module leaves stale super caches - Ruby - Ruby Issue Tracking System
• Bug #​22242: SEGV in method dispatch (vm_call_iseq_setup_kwparm_nokwarg / def_iseq_ptr) on Ruby 4.0.6 — Rails CI - Ruby - Ruby Issue Tracking System
• Bug #​22269: Coverage.line_stub clobbers already-collected coverage data - Ruby - Ruby Issue Tracking System
• Bug #​22290: Adding instance variables to anonymous object may bloat all future classes - Ruby - Ruby Issue Tracking System
• Bug #​22292: YJIT/ZJIT: Struct accessor crashes after an instance variable is set on a Struct that exactly fills the largest GC slot - Ruby - Ruby Issue Tracking System
• Bug #​20958: fix ENV.keys encoding on windows - Ruby - Ruby Issue Tracking System
• Bug #​22259: Arrays sharding a buffer segfault when concatenating with each other - Ruby - Ruby Issue Tracking System
• Bug #​22264: Warning missing from parse.y hash literals - Ruby - Ruby Issue Tracking System
• Bug #​22303: EncodingError from interpolating symbol crashes whole process - Ruby - Ruby Issue Tracking System
• Bug #​22224: YJIT: rb_yjit_invalidate_ep_is_bp takes the VM lock stopping Ractors on every Proc materialization; multi-Ractor throughput collapses (up to ~150x) - Ruby - Ruby Issue Tracking System

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

v4.0.6: 4.0.6

Compare Source

What's Changed

• Bug #​22070: Thread.each_caller_location(1, 1) segfaults when called from a cfunc - Ruby - Ruby Issue Tracking System
• Bug #​22075: heap-use-after-free in rb_vm_ci_lookup under parallel Ractors - Ruby - Ruby Issue Tracking System
• Bug #​22076: defined? returns nil for protected methods defined in a module even when callable - Ruby - Ruby Issue Tracking System
• Bug #​22072: [BUG] should have cvar cache entry - Ruby - Ruby Issue Tracking System
• Bug #​22074: YJIT misaligns locals when there are > 256 local variables - Ruby - Ruby Issue Tracking System
• Bug #​22064: GC compaction breaks compare-by-identity sets - Ruby - Ruby Issue Tracking System
• Bug #​22084: invokesuper from define_method in Ractor can call wrong super method or crash - Ruby - Ruby Issue Tracking System
• Bug #​22092: Array#sum takes slow path, does not perform compensated summation of Float elements when init argument is a Float - Ruby - Ruby Issue Tracking System
• Bug #​14635: Float#round(n) returns a wrong result when n is big - Ruby - Ruby Issue Tracking System
• Bug #​22079: Float#ceil gives incorrect result - Ruby - Ruby Issue Tracking System
• Bug #​22096: Freeing a mutex locked by a fiber inside fiber scheduler can crash - Ruby - Ruby Issue Tracking System
• Bug #​21996: Crash when modifying instance variables during inspect or Marshal dump - Ruby - Ruby Issue Tracking System
• Bug #​22101: ASAN heap-use-after-free in rb_data_free after TypedData dfree frees dynamic rb_data_type_t - Ruby - Ruby Issue Tracking System
• Bug #​22103: Constant-folded /o regexp crashes with dupstring of a Regexp - Ruby - Ruby Issue Tracking System
• Bug #​21991: $! stays as the first exception in Ruby Box - Ruby - Ruby Issue Tracking System
• Feature #​21881: Split the root box into the (newer) root box and the master of copied user boxes - Ruby - Ruby Issue Tracking System
• Bug #​22120: Segfault caused by ar_find_entry_hint() not checking for conversion to st_table - Ruby - Ruby Issue Tracking System
• Bug #​22129: error_highlight raises NotImplementedError for ArgumentErrors that get wrapped - Ruby - Ruby Issue Tracking System
• Bug #​21864: Inconsistencies in type coercion error messages for integers - Ruby - Ruby Issue Tracking System
• Bug #​21882: IO::Buffer#locked leaves the buffer locked when the block raises - Ruby - Ruby Issue Tracking System
• Bug #​22127: parse.y regexp crash on invalid encoding - Ruby - Ruby Issue Tracking System
• Bug #​22126: Stack underflow for partial DCE and loops - Ruby - Ruby Issue Tracking System
• Bug #​22124: void value missed in parse.y - Ruby - Ruby Issue Tracking System
• Bug #​22104: Segfault in PRISM while Bootsnap compiles aws-sdk client_api.rb - Ruby - Ruby Issue Tracking System
• Bug #​21685: Unnecessary context-switching, especially bad on multi-core machines. - Ruby - Ruby Issue Tracking System
• Bug #​22099: Keyword-only method silently accepts a positional argument - Ruby - Ruby Issue Tracking System
• Bug #​22183: parse.y interpolation inside lambda literal - Ruby - Ruby Issue Tracking System
• Bug #​22181: SEGV in branch peephole optimization due to label/insn struct aliasing - Ruby - Ruby Issue Tracking System
• Bug #​22133: Ruby's default SIGINT handling ignores Thread.handle_interrupt masking. - Ruby - Ruby Issue Tracking System
• Bug #​22189: Enumerator::Lazy#to_enum does not accept method names as strings - Ruby - Ruby Issue Tracking System
• Bug #​22191: Signal.trap(:EXIT) exception only shown if at_exit also raises - Ruby - Ruby Issue Tracking System

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

v4.0.5: 4.0.5

Compare Source

What's Changed

• CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler
• Bug #​22065: make rdoc fails with invalid byte sequence in US-ASCII on Ruby 4.0.4 under C locale - Ruby - Ruby Issue Tracking System

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

v4.0.4: 4.0.4

Compare Source

What's Changed

• Bug #​21955: Fiber#transfer: machine stack not released when fiber terminates, causing FiberError: can't set a guard page - Ruby - Ruby Issue Tracking System
• Bug #​21964: Fiber stack acquire can expand unnecessarily - Ruby - Ruby Issue Tracking System
• Bug #​21971: Fix regexp performance regression for patterns starting with s/k - Ruby - Ruby Issue Tracking System
• Bug #​21961: Marshal.load freeze option fail to freeze linked strings - Ruby - Ruby Issue Tracking System
• Bug #​21959: rb_internal_thread_event_hooks_rw_lock is not reinitialized after fork causing deadlocks - Ruby - Ruby Issue Tracking System
• Bug #​21954: NoMethodError instead of Gem::LoadError on gem activation problem in Ruby 4.0.2 - Ruby - Ruby Issue Tracking System
• Bug #​21844: Inconsistent ArgumentError message for Data::define.new - Ruby - Ruby Issue Tracking System
• Bug #​21992: Defining BasicObject#initialize causes segmentation fault - Ruby - Ruby Issue Tracking System
• Bug #​22018: ISeq created via RubyVM::InstructionSequence.compile don't support coverage - Ruby - Ruby Issue Tracking System
• Bug #​21985: RubyVM::AST negative numbers do not include - in location - Ruby - Ruby Issue Tracking System
• Bug #​21986: RubyVM::AST incorrect location for literals followed by modifier if - Ruby - Ruby Issue Tracking System
• Bug #​21933: Ruby::Box: named capture local variable can become nil after non-matching lines - Ruby - Ruby Issue Tracking System
• Bug #​21940: Ruby::Box: $_ returns stale value due to gvar_tbl caching - Ruby - Ruby Issue Tracking System
• Bug #​22004: parse.y doesn't executes loop body with while true || true condition - Ruby - Ruby Issue Tracking System
• Bug #​21952: Ruby::Box double free at process exit when fiddle/import is required in multiple boxes - Ruby - Ruby Issue Tracking System
• Bug #​22003: .bundle extensions not built when doing out-of-source build - Ruby - Ruby Issue Tracking System
• Bug #​22002: argument stack underflow (-1) - Ruby - Ruby Issue Tracking System

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

v4.0.3: 4.0.3

Compare Source

What's Changed

• Prohibit def_method on marshal-loaded ERB instances (CVE-2026-41316)

Full Changelog

v4.0.2: 4.0.2

Compare Source

What's Changed

• Bug #​21941: Local variable becomes nil when YJIT enabled mid-method with fork/signal/ensure - Ruby - Ruby Issue Tracking System
• Bug #​21832: segfault with argument forwarding, when combined with splat & positional arg - Ruby - Ruby Issue Tracking System
• Bug #​21723: binding.irb raises a LoadError under bundle exec when Gemfile contains path: or git: - Ruby - Ruby Issue Tracking System
• Bug #​21847: Backport syntax_suggest 2.0.3 to supported branches - Ruby - Ruby Issue Tracking System
• Bug #​21866: Backport Fix for integer overflow checks in enumerator - Ruby - Ruby Issue Tracking System
• Bug #​21865: Crash on signal raise - Ruby - Ruby Issue Tracking System
• Bug #​21842: Encoding of rb_interned_str - Ruby - Ruby Issue Tracking System
• Bug #​21838: Rails seeing degradation (20% slowdown) related to Revision 079ef92b "Implement global allocatable slots and empty pages" (from Sep 5 2024) - Ruby - Ruby Issue Tracking System
• Bug #​21873: UnboundMethod#== returns false for methods from included/extended modules - Ruby - Ruby Issue Tracking System
• ZJIT: Avoid runtime exceptions from RubyVM::ZJIT.stats_string by k0kubun · Pull Request #​16139
• Bug #​21931: GC Crash in String#% (backport 726205b354d1068147719fb42e1de743f1838ef1) - Ruby - Ruby Issue Tracking System
• Bug #​21944: "Cannot allocate memory" with M:N threads or Ractors on a low RAM Linux machine - Ruby - Ruby Issue Tracking System
• Bug #​21946: and? predicate confused for leading and keyword - Ruby - Ruby Issue Tracking System
• Bug #​21927: Prism: misleading error message for forwarding in lambda argument - Ruby - Ruby Issue Tracking System
• Bug #​21925: Prism misparses standalone "in" pattern matching in "case/in" - Ruby - Ruby Issue Tracking System
• Bug #​21828: An incorrect warning message related to benchmark is shown when using benchmark-ips - Ruby - Ruby Issue Tracking System
• Bug #​21917: Unable to build 4.0.1 on AIX 7.2 - Ruby - Ruby Issue Tracking System
• Bug #​21945: Ripper lexes newline between identifier and and? as ignored newline - Ruby - Ruby Issue Tracking System
• Bug #​21947: Timeout.timeout doesn't use Timeout::ExitException when Fiber scheduler is in use. - Ruby - Ruby Issue Tracking System
• Bug #​21926: Thread#value on popen3 wait thread hangs in finalizer - Ruby - Ruby Issue Tracking System
• Bug #​21880: The ultra_safe mode of pstore bundled with Ruby 4.0 is broken. - Ruby - Ruby Issue Tracking System
• Bug #​21097: x = a rescue b in c and def f = a rescue b in c parsed differently between parse.y and prism - Ruby - Ruby Issue Tracking System

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

v4.0.1: 4.0.1

Compare Source

What's Changed

• Bug #​21812: Kernel#sleep without arguments returns immediately when subprocess exits in another thread (regression in Ruby 4.0) - Ruby - Ruby Issue Tracking System
• Bug #​21828: An incorrect warning message related to benchmark is shown when using benchmark-ips - Ruby - Ruby Issue Tracking System
• Bug #​21811: Fix underflow in Array#pack - Ruby - Ruby Issue Tracking System
• Bug #​21814: 0.pow(2,-9999999999999999990) should be zero - Ruby - Ruby Issue Tracking System
• Bug #​21819: A Data object should be frozen even if it has no members - Ruby - Ruby Issue Tracking System

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

v4.0.0: 4.0.0

See also:

• Release 3.5.0-preview1 · ruby/ruby
• Release 4.0.0-preview2 · ruby/ruby
• Release 4.0.0-preview3 · ruby/ruby

What's Changed

• Bump RDoc to 7.0.1 by st0012 · Pull Request #​15628
• make rb_singleton_class ractor safe by luke-gruber · Pull Request #​15591
• Remove assertion in encoded_iseq_trace_instrument by luke-gruber · Pull Request #​15616
• Bug #​21793: function name conflict of "mutex_trylock" on Solaris - Ruby - Ruby Issue Tracking System
• [DOC] small improvements to ractor class docs by luke-gruber · Pull Request #​15584
• Check for NULL fields in TYPEDDATA memsize functions by luke-gruber · Pull Request #​15633
• Feature #​21785: Add signed and unsigned LEB128 support to pack / unpack - Ruby - Ruby Issue Tracking System
• Fix rbs test failure caused by minitest6 by soutaro · Pull Request #​15643
• Fix: Do not check open_timeout twice by shioimm · Pull Request #​15626
• Fix: Specifying 0 should cause an immediate timeout by shioimm · Pull Request #​15641
• Bug #​21794: O_CLOEXEC is not available on Solaris 10 - Ruby - Ruby Issue Tracking System
• Fiber scheduler: invoke #io_write hook on IO flush by noteflakes · Pull Request #​15609
• Update NEWS.md for Fiber Scheduler by noteflakes · Pull Request #​15629
• Small documentation adjustments for new/updated features by zverok · Pull Request #​15634
• Add clarifications about the Enumerator.size by zverok · Pull Request #​15615
• Bug #​21792: 4.0.0-preview3: Build fails with --with-ext= when ENABLE_SHARED=yes: ruby/digest.h not found for rubyspec CAPI extensions - Ruby - Ruby Issue Tracking System
• [DOC] Enhancements for globals.md by BurdetteLamar · Pull Request #​15545
• Small improvements to doc/language/ractor.md by luke-gruber · Pull Request #​15588
• More doc improvements to ractor.md by luke-gruber · Pull Request #​15676
• Bump RDoc to 7.0.2 by st0012 · Pull Request #​15691
• [DOC] Improve ractor class docs (grammar, code examples) by luke-gruber · Pull Request #​15686
• [DOC] Languages in Examples by BurdetteLamar · Pull Request #​15697
• Bundle RBS 3.10.0 by soutaro · Pull Request #​15701
• Describe base code layout rules by zverok · Pull Request #​15696
• [DOC] Enhance Fiber::Scheduler docs by zverok · Pull Request #​15708
• [DOC] Cross-links between Japanese and English pages by BurdetteLamar · Pull Request #​15705
• ZJIT: Don't mark control-flow opcodes as invalidating locals by tekknolagi · Pull Request #​15694
• [DOC] Add back Rust 1.85.0 requirement to NEWS.md by chancancode · Pull Request #​15728

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • At 10:00 PM through 11:59 PM and 12:00 AM through 06:59 AM (* 22-23,0-6 * * *)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.