ruby: Update to version 4.0.9

- Update from version 4.0.1 to 4.0.9
- Update of rootfile
- 1 CVE Fix in 4.0.5 & 1 CVE Fix in 4.0.3
- Changelog
4.0.9
	Reject overflowed repeat/null-check IDs in huge regexps by makenowjust · Pull
	 Request #16801
4.0.8
	Bug #22311: Build crashes on macOS 26 with the macOS 27 SDK because pipe2()
	 and dup3() are unavailable - Ruby - Ruby Issue Tracking System
	Bug #22174: Set operations (&, ^, collect!, flatten, classify, divide) do
	 not preserve compare_by_identity - Ruby - Ruby Issue Tracking System
	Bug #22383: Fix inverted STR_SHARED check in rb_str_tmp_frozen_release -
	 Ruby - Ruby Issue Tracking System
	Bug #22387: str_shared_replace incorrectly recalculates termlen - Ruby - Ruby
	 Issue Tracking System
	Bug #22327: RubyVM::ZJIT.reset_stats! aborts the process (Rust panic) when
	 ZJIT is not enabled - Ruby - Ruby Issue Tracking System
	Bug #22381: MatchData assigned to $~ is incorrectly reused - Ruby - Ruby
	 Issue Tracking System
	Bug #22321: Assertion Failed: rb_vm_search_method_slowpath:RB_TYPE_2_P(klass,
	 RUBY_T_CLASS, RUBY_T_ICLASS): klass: T_MODULE - Ruby - Ruby Issue Tracking
	 System
	Bug #22315: heap-use-after-free in String unpack with a block that mutates
	 the receiver - Ruby - Ruby Issue Tracking System
	Bug #22318: heap uaf triggered in array.flatten - Ruby - Ruby Issue Tracking
	 System
	Bug #22319: heap buffer overflow triggered by array's zip function - Ruby -
	 Ruby Issue Tracking System
	Bug #22322: AddressSanitizer: use-after-poison in econv_description
	 /ruby-src/build/../transcode.c - Ruby - Ruby Issue Tracking System
	Bug #22334: Assertion Failed: VM_ENV_FLAGS:FIXNUM_P(flags) - Ruby - Ruby
	 Issue Tracking System
	Bug #22336: IO:Buffer Heap uaf - Ruby - Ruby Issue Tracking System
	Bug #22330: heap uaf from string.encode() - Ruby - Ruby Issue Tracking System
	Bug #22340: Win32: File.stat succeeds on symbolic-link loops on Windows -
	 Ruby - Ruby Issue Tracking System
	Bug #22335: Stack corruption with >31 keyword args and refined Integer#== -
	 Ruby - Ruby Issue Tracking System
	Bug #22339: Ruby::Box: crash / hang at VM shutdown with RUBY_FREE_AT_EXIT=1 -
	 Ruby - Ruby Issue Tracking System
	Bug #22342: IO#gets can ignore the limit argument in some edge cases - Ruby -
	 Ruby Issue Tracking System
	Bug #22391: Fix propagation of errno in rb_io_maybe_wait. - Ruby - Ruby Issue
	 Tracking System
	Bug #22384: Regexp compile error in the 2nd+ branch of a top-level
	 alternation leaks the parse tree (regression from #13332, Ruby 4.0) - Ruby -
	 Ruby Issue Tracking System
	Bug #22388: Use-after-free when an Enumerable retains its each block - Ruby -
	 Ruby Issue Tracking System
	Bug #22284: Passing an object with to_int to curry as its arity causes
	 problems with LLP64. - Ruby - Ruby Issue Tracking System
	Bug #22416: Respect timezone abbreviation encodings in Time#strftime - Ruby -
	 Ruby Issue Tracking System
	Bug #22426: ZJIT: keyword arguments swapped when passed out of declared order
	 to a method with a block (please backport d81a11d4e6 to 4.0) - Ruby - Ruby
	 Issue Tracking System
	Bug #22406: Process.fork can leave the child unable to resolve hostnames:
	 getaddrinfo helper threads take glibc's resolver lock after releasing the
	 fork lock - Ruby - Ruby Issue Tracking System
	Bug #22445: On macOS, a child of Kernel#fork can abort with "[BUG]
	 pthread_rwlock_destroy: Resource busy (EBUSY)" - Ruby - Ruby Issue Tracking
	 System
	Bug #22415: Thread.handle_interrupt needs to preserve errinfo - Ruby - Ruby
	 Issue Tracking System
	Bug #22434: "No live threads left. Deadlock?" when running system() or spawn
	 in Ractors - Ruby - Ruby Issue Tracking System
	Backport the regexp compiler program size overflow fixes to ruby_4_0 by hsbt
	 Pull Request #19025
4.0.7
	Bug #22188: addr2line doesn't find symbols when compiled with GCC LTO -
	 Ruby - Ruby Issue Tracking System
	Bug #22210: Check if issue #19969 is still reproducible / re-opened in
	 4.0.x - Ruby - Ruby Issue Tracking System
	Bug #22217: Segmentation fault when resuming execution with Coverage.start
	 and ruby/debug - Ruby - Ruby Issue Tracking System
	Fix formatting in ObjectSpace._id2ref error path by eregon · Pull Request #18206
	Bug #22200: ObjectSpace._id2ref can return a different object than the id's
	 owner on Ruby 4.0 (stale id2ref_tbl entry for objects with generic fields) -
	 Ruby - Ruby Issue Tracking System
	Bug #22123: Ruby::Box + BUNDLER_SETUP can evaluate gemspecs before main-box
	 RubyGems initialization - Ruby - Ruby Issue Tracking System
	Bump ERB to 6.0.7 by k0kubun · Pull Request #18282
	Bug #22237: GC.auto_compact corrupts a String or segfaults from String#tr
	 with dup or gsub - Ruby - Ruby Issue Tracking System
	Bug #22243: Change fork behavior when Process._fork raises an exception
	 during fork with a block argument - Ruby - Ruby Issue Tracking System
	Bug #22223: Socket.tcp with connect_timeout returns a phantom "connected"
	 socket for a refused connection on macOS 27 (kernel answers EISCONN on
	 connect retry; SO_ERROR never consulted) - Ruby - Ruby Issue Tracking System
	Bug #22220: Performance regression when requiring aws-sdk-ec2 in Ruby
	 4.0.6 - Ruby - Ruby Issue Tracking System
	Bug #22218: Line TracePoint misses executed loop condition after a guard -
	 Ruby - Ruby Issue Tracking System
	Bug #22198: win32: heap overflow in Kernel#system - Ruby - Ruby Issue
	 Tracking System
	Bug #22196: Heap-use-after-free in fiber_switch with transfer-terminated
	 async tasks on 3.4.10 - Ruby - Ruby Issue Tracking System
	Bug #22190: Class#subclasses does not include clones of classes that include
	 modules - Ruby - Ruby Issue Tracking System
	Bug #11438: native_thread_init_stack() get machine.stack_start unequal to
	 thread's stack start address, x86 win32 - Ruby - Ruby Issue Tracking System
	Bug #22257: Prepending a module to an already-included module leaves stale
	 super caches - Ruby - Ruby Issue Tracking System
	Bug #22242: SEGV in method dispatch (vm_call_iseq_setup_kwparm_nokwarg /
	 def_iseq_ptr) on Ruby 4.0.6 — Rails CI - Ruby - Ruby Issue Tracking System
	Bug #22269: Coverage.line_stub clobbers already-collected coverage data -
	 Ruby - Ruby Issue Tracking System
	Bug #22290: Adding instance variables to anonymous object may bloat all
	 future classes - Ruby - Ruby Issue Tracking System
	Bug #22292: YJIT/ZJIT: Struct accessor crashes after an instance variable is
	 set on a Struct that exactly fills the largest GC slot - Ruby - Ruby Issue
	 Tracking System
	Bug #20958: fix ENV.keys encoding on windows - Ruby - Ruby Issue Tracking System
	Bug #22259: Arrays sharding a buffer segfault when concatenating with each
	 other - Ruby - Ruby Issue Tracking System
	Bug #22264: Warning missing from parse.y hash literals - Ruby - Ruby Issue
	 Tracking System
	Bug #22303: EncodingError from interpolating symbol crashes whole process -
	 Ruby - Ruby Issue Tracking System
	Bug #22224: YJIT: rb_yjit_invalidate_ep_is_bp takes the VM lock stopping
	 Ractors on every Proc materialization; multi-Ractor throughput collapses
	 (up to ~150x) - Ruby - Ruby Issue Tracking System
4.0.6
    Bug #22070: Thread.each_caller_location(1, 1) segfaults when called from a
	cfunc - Ruby - Ruby Issue Tracking System
    Bug #22075: heap-use-after-free in rb_vm_ci_lookup under parallel Ractors -
	Ruby - Ruby Issue Tracking System
    Bug #22076: defined? returns nil for protected methods defined in a module even
	when callable - Ruby - Ruby Issue Tracking System
    Bug #22072: [BUG] should have cvar cache entry - Ruby - Ruby Issue Tracking System
    Bug #22074: YJIT misaligns locals when there are > 256 local variables - Ruby -
	Ruby Issue Tracking System
    Bug #22064: GC compaction breaks compare-by-identity sets - Ruby - Ruby Issue
	Tracking System
    Bug #22084: invokesuper from define_method in Ractor can call wrong super method
	or crash - Ruby - Ruby Issue Tracking System
    Bug #22092: Array#sum takes slow path, does not perform compensated summation of
	Float elements when init argument is a Float - Ruby - Ruby Issue Tracking System
    Bug #14635: Float#round(n) returns a wrong result when n is big - Ruby - Ruby
	Issue Tracking System
    Bug #22079: Float#ceil gives incorrect result - Ruby - Ruby Issue Tracking System
    Bug #22096: Freeing a mutex locked by a fiber inside fiber scheduler can crash -
	Ruby - Ruby Issue Tracking System
    Bug #21996: Crash when modifying instance variables during inspect or Marshal
	dump - Ruby - Ruby Issue Tracking System
    Bug #22101: ASAN heap-use-after-free in rb_data_free after TypedData dfree frees
	dynamic rb_data_type_t - Ruby - Ruby Issue Tracking System
    Bug #22103: Constant-folded /o regexp crashes with dupstring of a Regexp -
	Ruby - Ruby Issue Tracking System
    Bug #21991: $! stays as the first exception in Ruby Box - Ruby - Ruby Issue
	Tracking System
    Feature #21881: Split the root box into the (newer) root box and the master of
	copied user boxes - Ruby - Ruby Issue Tracking System
    Bug #22120: Segfault caused by ar_find_entry_hint() not checking for conversion
	to st_table - Ruby - Ruby Issue Tracking System
    Bug #22129: error_highlight raises NotImplementedError for ArgumentErrors that
	get wrapped - Ruby - Ruby Issue Tracking System
    Bug #21864: Inconsistencies in type coercion error messages for integers -
	Ruby - Ruby Issue Tracking System
    Bug #21882: IO::Buffer#locked leaves the buffer locked when the block raises -
	Ruby - Ruby Issue Tracking System
    Bug #22127: parse.y regexp crash on invalid encoding - Ruby - Ruby Issue
	Tracking System
    Bug #22126: Stack underflow for partial DCE and loops - Ruby - Ruby Issue
	Tracking System
    Bug #22124: void value missed in parse.y - Ruby - Ruby Issue Tracking System
    Bug #22104: Segfault in PRISM while Bootsnap compiles aws-sdk client_api.rb -
	Ruby - Ruby Issue Tracking System
    Bug #21685: Unnecessary context-switching, especially bad on multi-core
	machines. - Ruby - Ruby Issue Tracking System
    Bug #22099: Keyword-only method silently accepts a positional argument - Ruby -
	Ruby Issue Tracking System
    Bug #22183: parse.y interpolation inside lambda literal - Ruby - Ruby Issue
	Tracking System
    Bug #22181: SEGV in branch peephole optimization due to label/insn struct
	aliasing - Ruby - Ruby Issue Tracking System
    Bug #22133: Ruby's default SIGINT handling ignores Thread.handle_interrupt
	masking. - Ruby - Ruby Issue Tracking System
    Bug #22189: Enumerator::Lazy#to_enum does not accept method names as strings -
	Ruby - Ruby Issue Tracking System
    Bug #22191: Signal.trap(:EXIT) exception only shown if at_exit also raises -
	Ruby - Ruby Issue Tracking System
4.0.5
    CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler
    Bug #22065: make rdoc fails with invalid byte sequence in US-ASCII on Ruby 4.0.4
	under C locale - Ruby - Ruby Issue Tracking System
4.0.4
    Bug #21955: Fiber#transfer: machine stack not released when fiber terminates,
	causing FiberError: can't set a guard page - Ruby - Ruby Issue Tracking System
    Bug #21964: Fiber stack acquire can expand unnecessarily - Ruby - Ruby Issue
	Tracking System
    Bug #21971: Fix regexp performance regression for patterns starting with s/k -
	Ruby - Ruby Issue Tracking System
    Bug #21961: Marshal.load freeze option fail to freeze linked strings - Ruby -
	Ruby Issue Tracking System
    Bug #21959: rb_internal_thread_event_hooks_rw_lock is not reinitialized after
	fork causing deadlocks - Ruby - Ruby Issue Tracking System
    Bug #21954: NoMethodError instead of Gem::LoadError on gem activation problem
	in Ruby 4.0.2 - Ruby - Ruby Issue Tracking System
    Bug #21844: Inconsistent ArgumentError message for Data::define.new - Ruby -
	Ruby Issue Tracking System
    Bug #21992: Defining BasicObject#initialize causes segmentation fault - Ruby -
	Ruby Issue Tracking System
    Bug #22018: ISeq created via RubyVM::InstructionSequence.compile don't support
	coverage - Ruby - Ruby Issue Tracking System
    Bug #21985: RubyVM::AST negative numbers do not include - in location - Ruby -
	Ruby Issue Tracking System
    Bug #21986: RubyVM::AST incorrect location for literals followed by modifier
	if - Ruby - Ruby Issue Tracking System
    Bug #21933: Ruby::Box: named capture local variable can become nil after
	non-matching lines - Ruby - Ruby Issue Tracking System
    Bug #21940: Ruby::Box: $_ returns stale value due to gvar_tbl caching - Ruby -
	Ruby Issue Tracking System
    Bug #22004: parse.y doesn't executes loop body with while true || true
	condition - Ruby - Ruby Issue Tracking System
    Bug #21952: Ruby::Box double free at process exit when fiddle/import is required
	in multiple boxes - Ruby - Ruby Issue Tracking System
    Bug #22003: .bundle extensions not built when doing out-of-source build - Ruby -
	Ruby Issue Tracking System
    Bug #22002: argument stack underflow (-1) - Ruby - Ruby Issue Tracking System
4.0.3
	Prohibit def_method on marshal-loaded ERB instances (CVE-2026-41316)
4.0.2
    Bug #21941: Local variable becomes nil when YJIT enabled mid-method with
	fork/signal/ensure - Ruby - Ruby Issue Tracking System
    Bug #21832: segfault with argument forwarding, when combined with splat &
	positional arg - Ruby - Ruby Issue Tracking System
    Bug #21723: binding.irb raises a LoadError under bundle exec when Gemfile
	contains path: or git: - Ruby - Ruby Issue Tracking System
    Bug #21847: Backport syntax_suggest 2.0.3 to supported branches - Ruby - Ruby
	Issue Tracking System
    Bug #21866: Backport Fix for integer overflow checks in enumerator - Ruby -
	Ruby Issue Tracking System
    Bug #21865: Crash on signal raise - Ruby - Ruby Issue Tracking System
    Bug #21842: Encoding of rb_interned_str - Ruby - Ruby Issue Tracking System
    Bug #21838: Rails seeing degradation (20% slowdown) related to Revision 079ef92b
	"Implement global allocatable slots and empty pages" (from Sep 5 2024) -
	Ruby - Ruby Issue Tracking System
    Bug #21873: UnboundMethod#== returns false for methods from included/extended
	modules - Ruby - Ruby Issue Tracking System
    ZJIT: Avoid runtime exceptions from RubyVM::ZJIT.stats_string by k0kubun · Pull
	Request #16139
    Bug #21931: GC Crash in String#%
	(backport 726205b354d1068147719fb42e1de743f1838ef1) - Ruby - Ruby Issue
	Tracking System
    Bug #21944: "Cannot allocate memory" with M:N threads or Ractors on a low RAM
	Linux machine - Ruby - Ruby Issue Tracking System
    Bug #21946: and? predicate confused for leading and keyword - Ruby - Ruby Issue
	Tracking System
    Bug #21927: Prism: misleading error message for forwarding in lambda argument -
	Ruby - Ruby Issue Tracking System
    Bug #21925: Prism misparses standalone "in" pattern matching in "case/in" -
	Ruby - Ruby Issue Tracking System
    Bug #21828: An incorrect warning message related to benchmark is shown when
	using benchmark-ips - Ruby - Ruby Issue Tracking System
    Bug #21917: Unable to build 4.0.1 on AIX 7.2 - Ruby - Ruby Issue Tracking System
    Bug #21945: Ripper lexes newline between identifier and and? as ignored
	newline - Ruby - Ruby Issue Tracking System
    Bug #21947: Timeout.timeout doesn't use Timeout::ExitException when Fiber
	scheduler is in use. - Ruby - Ruby Issue Tracking System
    Bug #21926: Thread#value on popen3 wait thread hangs in finalizer - Ruby - Ruby
	Issue Tracking System
    Bug #21880: The ultra_safe mode of pstore bundled with Ruby 4.0 is broken. -
	Ruby - Ruby Issue Tracking System
    Bug #21097: x = a rescue b in c and def f = a rescue b in c parsed differently
	between parse.y and prism - Ruby - Ruby Issue Tracking System

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/common/ruby | 720 +++++++++++++++++------------------
 lfs/ruby                     |   4 +-
 2 files changed, 362 insertions(+), 362 deletions(-)

Message ID	20261103122625.3264251-4-adolf.belka@ipfire.org
State	New
Headers	From: Adolf Belka <adolf.belka@ipfire.org> To: development@lists.ipfire.org Cc: Adolf Belka <adolf.belka@ipfire.org> Subject: [PATCH] ruby: Update to version 4.0.9 Date: Tue, 3 Nov 2026 13:26:25 +0100 Message-ID: <20261103122625.3264251-4-adolf.belka@ipfire.org> In-Reply-To: <20261103122625.3264251-1-adolf.belka@ipfire.org> References: <20261103122625.3264251-1-adolf.belka@ipfire.org> Precedence: list Sender: <development@lists.ipfire.org> Mail-Followup-To: <development@lists.ipfire.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit
Series	ruby: Update to version 4.0.9 \| ruby: Update to version 4.0.9

ruby: Update to version 4.0.9

Commit Message

Patch