On Fri, Oct 23, 2026 at 11:54:09PM -0700, Jeremy Evans wrote: > On 10/24 07:45, Theo Buehler wrote: > > On Fri, Oct 23, 2026 at 09:17:31PM -0700, Jeremy Evans wrote: > > > These are the latest releases of Ruby 4.0 and 3.4. The 4.0.9 release is > > > the same as the 4.0.8 release with security fixes for CVE-2026-89078, > > > CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. Ruby 3.4.12 has the > > > same security fixes. Note that these fixes protect against cases where > > > untrusted input is used to create Regexp objects, which is just asking > > > for trouble IMO. > > > > > > Release announcements: > > > 4.0.9: https://www.ruby-lang.org/en/news/2026/10/23/ruby-4-0-9-released/ > > > 3.4.12: https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-4-12-released/ > > > > > > Ruby 3.3.13 was also released today, but since it was just sent to the > > > Attic, no patch for it. > > > > > > Tested on amd64. Will be committing in a couple days unless I hear > > > objections. > > > > Given that these were the underlying cause for this week's gitlab RCE, > > I'm not sure there's a good reason for waiting. I'd prefer if you just > > went ahead. > > > > ok tb > > OK, I've committed the changes. > > > Backports would seem appropriate. Should we update 3.3 in stable as well? > > Yes, it would be best to backport 3.3.13 to -stable since it is affected > as well. The PLIST diff looks something like this, otherwise, the only change > needed should be a version bump.
Done. PLIST diff was exactly that, and then there was a patch offset.
