CVS commit: [pkgsrc-2026Q3] pkgsrc/lang

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Mon Nov  9 08:16:34 UTC 2026

Modified Files:
        pkgsrc/lang/ruby [pkgsrc-2026Q3]: rubyversion.mk
        pkgsrc/lang/ruby40 [pkgsrc-2026Q3]: distinfo

Log Message:
Pullup ticket #7336 - requested by taca
lang/ruby40: Security fix

Revisions pulled up:
- lang/ruby/rubyversion.mk                                      1.333
- lang/ruby40/distinfo                                          1.12

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Sun Oct 25 14:26:19 UTC 2026

   Modified Files:
        pkgsrc/lang/ruby: rubyversion.mk
        pkgsrc/lang/ruby40: distinfo

   Log Message:
   lang/ruby40: update to 4.0.9

   pkgsrc change: reflect default/bundled gem changes.

   This update contains these security fixes.

   * CVE-2026-93577: Integer Overflow issue in Regular Expression Compiler=

     (GitLab 19.4.1)

   * CVE-2026-97229: Integer Overflow issue in CI/CD Regular Expression
     Compiler (GitLab 19.4.2)

   * CVE-2026-110264: Integer Overflow issue in Regular Expression Compile=
   r
     (GitLab 19.5.1)

   4.0.8 (2026-10-22)

   * Bug #22311: Build crashes on macOS 26 with the macOS 27 SDK because
     pipe2() and dup3() are unavailable

   * Bug #22174: Set operations (&, ^, collect!, flatten, classify, divide=
   ) do
     not preserve compare_by_identity

   * Bug #22383: Fix inverted STR_SHARED check in rb_str_tmp_frozen_releas=
   e

   * Bug #22387: str_shared_replace incorrectly recalculates termlen

   * Bug #22327: RubyVM::ZJIT.reset_stats! aborts the process (Rust panic)=
    when
     ZJIT is not enabled

   * Bug #22381: MatchData assigned to $~ is incorrectly reused

   * Bug #22321: Assertion Failed:
     rb_vm_search_method_slowpath:RB_TYPE_2_P(klass, RUBY_T_CLASS,
     RUBY_T_ICLASS): klass: T_MODULE

   * Bug #22315: heap-use-after-free in String unpack with a block that mu=
   tates
     the receiver

   * Bug #22318: heap uaf triggered in array.flatten

   * Bug #22319: heap buffer overflow triggered by array's zip function

   * Bug #22322: AddressSanitizer: use-after-poison in econv_description
     /ruby-src/build/../transcode.c

   * Bug #22334: Assertion Failed: VM_ENV_FLAGS:FIXNUM_P(flags)

   * Bug #22336: IO:Buffer Heap uaf

   * Bug #22330: heap uaf from string.encode()

   * Bug #22340: Win32: File.stat succeeds on symbolic-link loops on Windo=
   ws

   * Bug #22335: Stack corruption with >31 keyword args and refined Intege=
   r#=3D=3D

   * Bug #22339: Ruby::Box: crash / hang at VM shutdown with
     RUBY_FREE_AT_EXIT=3D1

   * Bug #22342: IO#gets can ignore the limit argument in some edge cases

   * Bug #22391: Fix propagation of errno in rb_io_maybe_wait.

   * Bug #22384: Regexp compile error in the 2nd+ branch of a top-level
     alternation leaks the parse tree (regression from #13332, Ruby 4.0)

   * Bug #22388: Use-after-free when an Enumerable retains its each block

   * Bug #22284: Passing an object with to_int to curry as its arity cause=
   s
     problems with LLP64.

   * Bug #22416: Respect timezone abbreviation encodings in Time#strftime

   * Bug #22426: ZJIT: keyword arguments swapped when passed out of declar=
   ed
     order to a method with a block (please backport d81a11d4e6 to 4.0)

   * Bug #22406: Process.fork can leave the child unable to resolve hostna=
   mes:
     getaddrinfo helper threads take glibc's resolver lock after releasing=
    the
     fork lock

   * Bug #22445: On macOS, a child of Kernel#fork can abort with "[BUG]
     pthread_rwlock_destroy: Resource busy (EBUSY)"

   * Bug #22415: Thread.handle_interrupt needs to preserve errinfo

   * Bug #22434: "No live threads left. Deadlock?" when running system() o=
   r
     spawn in Ractors

   * Backport the regexp compiler program size overflow fixes to ruby_4_0 =
   by
     hsbt =B7 Pull Request #19025

   4.0.9 (2026-10-23)

   * Reject overflowed repeat/null-check IDs in huge regexps by makenowjus=
   t =B7
     Pull Request #16801


To generate a diff of this commit:
cvs rdiff -u -r1.331.2.1 -r1.331.2.2 pkgsrc/lang/ruby/rubyversion.mk
cvs rdiff -u -r1.11 -r1.11.2.1 pkgsrc/lang/ruby40/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/ruby/rubyversion.mk
diff -u pkgsrc/lang/ruby/rubyversion.mk:1.331.2.1 pkgsrc/lang/ruby/rubyversion.mk:1.331.2.2
--- pkgsrc/lang/ruby/rubyversion.mk:1.331.2.1   Tue Oct 20 23:07:18 2026
+++ pkgsrc/lang/ruby/rubyversion.mk     Mon Nov  9 08:16:34 2026
@@ -1,4 +1,4 @@
-# $NetBSD: rubyversion.mk,v 1.331.2.1 2026/10/20 23:07:18 maya Exp $
+# $NetBSD: rubyversion.mk,v 1.331.2.2 2026/11/09 08:16:34 maya Exp $
 #
 
 # This file determines which Ruby version is used as a dependency for
@@ -214,7 +214,7 @@ RUBY_VERSION_REQD?= ${PKGNAME_REQD:C/rub
 # current supported Ruby's version
 RUBY33_VERSION=                3.3.12
 RUBY34_VERSION=                3.4.11
-RUBY40_VERSION=                4.0.7
+RUBY40_VERSION=                4.0.9
 
 # current API compatible version; used for version of shared library
 RUBY33_API_VERSION=    3.3.0
@@ -487,11 +487,11 @@ RUBY_OPEN3_VER=                   0.2.1
 RUBY_OPTPARSE_VER=             0.8.1
 RUBY_PP_VER=                   0.6.3
 RUBY_PRETTYPRINT_VER=          0.2.0
-RUBY_PRISM_VER=                        1.8.1
+RUBY_PRISM_VER=                        1.8.2
 RUBY_RESOLV_VER=               0.7.2
 RUBY_RUBY2_KEYWORDS_VER=       0.0.5
 RUBY_SECURERANDOM_VER=         0.4.1
-RUBY_SET_VER=                  1.1.1   #
+RUBY_SET_VER=                  1.1.1
 RUBY_SHELLWORDS_VER=           0.2.2
 RUBY_SINGLETON_VER=            0.3.0
 RUBY_SYNTAX_SUGGEST_VER=       2.0.3
@@ -515,9 +515,7 @@ RUBY_IO_NONBLOCK_VER=               0.3.2
 RUBY_IO_WAIT_VER=              0.4.0
 RUBY_JSON_VER=                 2.18.0
 RUBY_OPENSSL_VER=              4.0.2
-RUBY_OSTRUCT_VER=              0.6.3
 RUBY_PATHNAME_VER=             0.4.0
-RUBY_PSTORE_VER=               0.2.1
 RUBY_PSYCH_VER=                        5.3.1
 RUBY_STRINGIO_VER=             3.2.0
 RUBY_STRSCAN_VER=              3.1.6
@@ -544,8 +542,10 @@ RUBY_NET_POP_VER=          0.1.2
 RUBY_NET_SMTP_VER=             0.5.1
 RUBY_NKF_VER=                  0.2.0
 RUBY_OBSERVER_VER=             0.1.2
+RUBY_OSTRUCT_VER=              0.6.3
 RUBY_POWER_ASSERT_VER=         3.0.1
 RUBY_PRIME_VER=                        0.1.4
+RUBY_PSTORE_VER=               0.2.1
 RUBY_RACC_VER=                 1.8.1
 RUBY_RAKE_VER=                 13.3.1
 RUBY_RBS_VER=                  3.10.0

Index: pkgsrc/lang/ruby40/distinfo
diff -u pkgsrc/lang/ruby40/distinfo:1.11 pkgsrc/lang/ruby40/distinfo:1.11.2.1
--- pkgsrc/lang/ruby40/distinfo:1.11    Wed Sep 16 14:08:24 2026
+++ pkgsrc/lang/ruby40/distinfo Mon Nov  9 08:16:34 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.11 2026/09/16 14:08:24 taca Exp $
+$NetBSD: distinfo,v 1.11.2.1 2026/11/09 08:16:34 maya Exp $
 
-BLAKE2s (ruby-4.0.7.tar.xz) = 1ba142e7e04de5a460853b3fc9a28bf42b6c60eb87a6c365c2bb576bb0af28b7
-SHA512 (ruby-4.0.7.tar.xz) = d1d345c25bff43aa86f536b22cd04746a7d3372077bf47ec75ef1820c0b43d0dbe3573dd5e5c55ee517796f46f0cdbd22c7506aebd06581241eefb5ffd9d2e5f
-Size (ruby-4.0.7.tar.xz) = 17995980 bytes
+BLAKE2s (ruby-4.0.9.tar.xz) = ed25e1d18f7d97fd166bab90704a4069bbaaa15f93482b1cf053905c3feea1ce
+SHA512 (ruby-4.0.9.tar.xz) = 7160b1c6fb61b0e369cddccb29eadae85390d86777c875efc18a56de390b1fe1ff47d6e37ccaf39d2ed477c9811f1224cbb3d2f54a0cbd5d5daf418b1cf2557e
+Size (ruby-4.0.9.tar.xz) = 17996144 bytes
 SHA1 (patch-.bundle_gems_rdoc-7.0.4_lib_rdoc_encoding.rb) = 896fc0825d59174b508bcfc5d17727f0d0b1050f
 SHA1 (patch-common.mk) = c23eed58427b2fd4ba8fdb3692f609701a666c6d
 SHA1 (patch-configure) = ff1b1e659ddc7cb1d62a71e1447df55f1f7b07c2