Hello again,
On 02/10/2026 09:49, Sylvain Beucler wrote:
On 27/09/2026 01:49, Simon Quigley wrote:
I am a member of the Debian Ruby Team, and this is my first time
attempting an LTS update. I have claimed ruby-oj in dla-needed.txt,
per the guide. Bookworm has 3.14.2-1, which is still affected by the
memory- safety bugs fixed upstream in ruby-oj 3.17.2 and 3.17.3.
Incidentally, I see that 3.17.5 had a whole bunch of security fixes:
https://github.com/ohler55/oj/commit/aae0079b1178b9633d2bb27ae6ca924ff8018836#diff-06572a96a58dc510037d5efa622f9bec8519bc1beab13c9f251e97e657a9d4edR5
No CVE or GHSA seem to have been attributed.
Do you know if there's anything worth fixing?
Cheers!
Sylvain Beucler
Debian LTS Team
