CVS commit: pkgsrc/lang

To: pkgsrc-changes%NetBSD.org@localhost
Subject: CVS commit: pkgsrc/lang
From: "Takahiro Kambe" <taca%netbsd.org@localhost>
Date: Sun, 25 Oct 2026 14:26:19 +0000

Module Name:    pkgsrc
Committed By:   taca
Date:           Sun Oct 25 14:26:19 UTC 2026

Modified Files:
        pkgsrc/lang/ruby: rubyversion.mk
        pkgsrc/lang/ruby40: distinfo

Log Message:
lang/ruby40: update to 4.0.9

pkgsrc change: reflect default/bundled gem changes.

This update contains these security fixes.

* CVE-2026-93577: Integer Overflow issue in Regular Expression Compiler
  (GitLab 19.4.1)

* CVE-2026-97229: Integer Overflow issue in CI/CD Regular Expression
  Compiler (GitLab 19.4.2)

* CVE-2026-110264: Integer Overflow issue in Regular Expression Compiler
  (GitLab 19.5.1)

4.0.8 (2026-10-22)

* Bug #22311: Build crashes on macOS 26 with the macOS 27 SDK because
  pipe2() and dup3() are unavailable

* Bug #22174: Set operations (&, ^, collect!, flatten, classify, divide) do
  not preserve compare_by_identity

* Bug #22383: Fix inverted STR_SHARED check in rb_str_tmp_frozen_release

* Bug #22387: str_shared_replace incorrectly recalculates termlen

* Bug #22327: RubyVM::ZJIT.reset_stats! aborts the process (Rust panic) when
  ZJIT is not enabled

* Bug #22381: MatchData assigned to $~ is incorrectly reused

* Bug #22321: Assertion Failed:
  rb_vm_search_method_slowpath:RB_TYPE_2_P(klass, RUBY_T_CLASS,
  RUBY_T_ICLASS): klass: T_MODULE

* Bug #22315: heap-use-after-free in String unpack with a block that mutates
  the receiver

* Bug #22318: heap uaf triggered in array.flatten

* Bug #22319: heap buffer overflow triggered by array's zip function

* Bug #22322: AddressSanitizer: use-after-poison in econv_description
  /ruby-src/build/../transcode.c

* Bug #22334: Assertion Failed: VM_ENV_FLAGS:FIXNUM_P(flags)

* Bug #22336: IO:Buffer Heap uaf

* Bug #22330: heap uaf from string.encode()

* Bug #22340: Win32: File.stat succeeds on symbolic-link loops on Windows

* Bug #22335: Stack corruption with >31 keyword args and refined Integer#==

* Bug #22339: Ruby::Box: crash / hang at VM shutdown with
  RUBY_FREE_AT_EXIT=1

* Bug #22342: IO#gets can ignore the limit argument in some edge cases

* Bug #22391: Fix propagation of errno in rb_io_maybe_wait.

* Bug #22384: Regexp compile error in the 2nd+ branch of a top-level
  alternation leaks the parse tree (regression from #13332, Ruby 4.0)

* Bug #22388: Use-after-free when an Enumerable retains its each block

* Bug #22284: Passing an object with to_int to curry as its arity causes
  problems with LLP64.

* Bug #22416: Respect timezone abbreviation encodings in Time#strftime

* Bug #22426: ZJIT: keyword arguments swapped when passed out of declared
  order to a method with a block (please backport d81a11d4e6 to 4.0)

* Bug #22406: Process.fork can leave the child unable to resolve hostnames:
  getaddrinfo helper threads take glibc's resolver lock after releasing the
  fork lock

* Bug #22445: On macOS, a child of Kernel#fork can abort with "[BUG]
  pthread_rwlock_destroy: Resource busy (EBUSY)"

* Bug #22415: Thread.handle_interrupt needs to preserve errinfo

* Bug #22434: "No live threads left. Deadlock?" when running system() or
  spawn in Ractors

* Backport the regexp compiler program size overflow fixes to ruby_4_0 by
  hsbt · Pull Request #19025

4.0.9 (2026-10-23)

* Reject overflowed repeat/null-check IDs in huge regexps by makenowjust ·
  Pull Request #16801


To generate a diff of this commit:
cvs rdiff -u -r1.332 -r1.333 pkgsrc/lang/ruby/rubyversion.mk
cvs rdiff -u -r1.11 -r1.12 pkgsrc/lang/ruby40/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/ruby/rubyversion.mk
diff -u pkgsrc/lang/ruby/rubyversion.mk:1.332 pkgsrc/lang/ruby/rubyversion.mk:1.333
--- pkgsrc/lang/ruby/rubyversion.mk:1.332       Thu Sep 24 15:28:57 2026
+++ pkgsrc/lang/ruby/rubyversion.mk     Sun Oct 25 14:26:19 2026
@@ -1,4 +1,4 @@
-# $NetBSD: rubyversion.mk,v 1.332 2026/09/24 15:28:57 taca Exp $
+# $NetBSD: rubyversion.mk,v 1.333 2026/10/25 14:26:19 taca Exp $
 #
 
 # This file determines which Ruby version is used as a dependency for
@@ -214,7 +214,7 @@ RUBY_VERSION_REQD?= ${PKGNAME_REQD:C/rub
 # current supported Ruby's version
 RUBY33_VERSION=                3.3.12
 RUBY34_VERSION=                3.4.11
-RUBY40_VERSION=                4.0.7
+RUBY40_VERSION=                4.0.9
 
 # current API compatible version; used for version of shared library
 RUBY33_API_VERSION=    3.3.0
@@ -487,11 +487,11 @@ RUBY_OPEN3_VER=                   0.2.1
 RUBY_OPTPARSE_VER=             0.8.1
 RUBY_PP_VER=                   0.6.3
 RUBY_PRETTYPRINT_VER=          0.2.0
-RUBY_PRISM_VER=                        1.8.1
+RUBY_PRISM_VER=                        1.8.2
 RUBY_RESOLV_VER=               0.7.2
 RUBY_RUBY2_KEYWORDS_VER=       0.0.5
 RUBY_SECURERANDOM_VER=         0.4.1
-RUBY_SET_VER=                  1.1.1   #
+RUBY_SET_VER=                  1.1.1
 RUBY_SHELLWORDS_VER=           0.2.2
 RUBY_SINGLETON_VER=            0.3.0
 RUBY_SYNTAX_SUGGEST_VER=       2.0.3
@@ -515,9 +515,7 @@ RUBY_IO_NONBLOCK_VER=               0.3.2
 RUBY_IO_WAIT_VER=              0.4.0
 RUBY_JSON_VER=                 2.18.0
 RUBY_OPENSSL_VER=              4.0.2
-RUBY_OSTRUCT_VER=              0.6.3
 RUBY_PATHNAME_VER=             0.4.0
-RUBY_PSTORE_VER=               0.2.1
 RUBY_PSYCH_VER=                        5.3.1
 RUBY_STRINGIO_VER=             3.2.0
 RUBY_STRSCAN_VER=              3.1.6
@@ -544,8 +542,10 @@ RUBY_NET_POP_VER=          0.1.2
 RUBY_NET_SMTP_VER=             0.5.1
 RUBY_NKF_VER=                  0.2.0
 RUBY_OBSERVER_VER=             0.1.2
+RUBY_OSTRUCT_VER=              0.6.3
 RUBY_POWER_ASSERT_VER=         3.0.1
 RUBY_PRIME_VER=                        0.1.4
+RUBY_PSTORE_VER=               0.2.1
 RUBY_RACC_VER=                 1.8.1
 RUBY_RAKE_VER=                 13.3.1
 RUBY_RBS_VER=                  3.10.0

Index: pkgsrc/lang/ruby40/distinfo
diff -u pkgsrc/lang/ruby40/distinfo:1.11 pkgsrc/lang/ruby40/distinfo:1.12
--- pkgsrc/lang/ruby40/distinfo:1.11    Wed Sep 16 14:08:24 2026
+++ pkgsrc/lang/ruby40/distinfo Sun Oct 25 14:26:19 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.11 2026/09/16 14:08:24 taca Exp $
+$NetBSD: distinfo,v 1.12 2026/10/25 14:26:19 taca Exp $
 
-BLAKE2s (ruby-4.0.7.tar.xz) = 1ba142e7e04de5a460853b3fc9a28bf42b6c60eb87a6c365c2bb576bb0af28b7
-SHA512 (ruby-4.0.7.tar.xz) = d1d345c25bff43aa86f536b22cd04746a7d3372077bf47ec75ef1820c0b43d0dbe3573dd5e5c55ee517796f46f0cdbd22c7506aebd06581241eefb5ffd9d2e5f
-Size (ruby-4.0.7.tar.xz) = 17995980 bytes
+BLAKE2s (ruby-4.0.9.tar.xz) = ed25e1d18f7d97fd166bab90704a4069bbaaa15f93482b1cf053905c3feea1ce
+SHA512 (ruby-4.0.9.tar.xz) = 7160b1c6fb61b0e369cddccb29eadae85390d86777c875efc18a56de390b1fe1ff47d6e37ccaf39d2ed477c9811f1224cbb3d2f54a0cbd5d5daf418b1cf2557e
+Size (ruby-4.0.9.tar.xz) = 17996144 bytes
 SHA1 (patch-.bundle_gems_rdoc-7.0.4_lib_rdoc_encoding.rb) = 896fc0825d59174b508bcfc5d17727f0d0b1050f
 SHA1 (patch-common.mk) = c23eed58427b2fd4ba8fdb3692f609701a666c6d
 SHA1 (patch-configure) = ff1b1e659ddc7cb1d62a71e1447df55f1f7b07c2

Prev by Date: CVS commit: pkgsrc/doc
Next by Date: CVS commit: pkgsrc/doc
Previous by Thread: CVS commit: pkgsrc/doc
Next by Thread: CVS commit: pkgsrc/doc
Indexes:

Home | Main Index | Thread Index | Old Index