On Fri, Oct 23, 2026 at 09:17:31PM -0700, Jeremy Evans wrote: > These are the latest releases of Ruby 4.0 and 3.4. The 4.0.9 release is > the same as the 4.0.8 release with security fixes for CVE-2026-89078, > CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. Ruby 3.4.12 has the > same security fixes. Note that these fixes protect against cases where > untrusted input is used to create Regexp objects, which is just asking > for trouble IMO. > > Release announcements: > 4.0.9: https://www.ruby-lang.org/en/news/2026/10/23/ruby-4-0-9-released/ > 3.4.12: https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-4-12-released/ > > Ruby 3.3.13 was also released today, but since it was just sent to the > Attic, no patch for it. > > Tested on amd64. Will be committing in a couple days unless I hear > objections.
Given that these were the underlying cause for this week's gitlab RCE, I'm not sure there's a good reason for waiting. I'd prefer if you just went ahead. ok tb Backports would seem appropriate. Should we update 3.3 in stable as well?
