linux/poky.git/meta/recipes-devtools/ruby, branch scarthgap-5.0.15

ruby: Upgrade 3.3.5 -> 3.3.10

2025-12-31T15:49:31+00:00

Per ruby maintenance policy [1], the 3.3.x branch should be still in normal maintenance, so upgrade to the latest version 3.3.10 to fix many security issues and bugs. Remove the fix for CVE-2025-27219, CVE-2025-27220 and CVE-2025-27221 as these fixes have been included in the new version. [1] https://www.ruby-lang.org/en/downloads/branches/ (From OE-Core rev: bad372ad8ec33334c6a74c077bf975851c1e59d2) Signed-off-by: Mingli Yu Signed-off-by: Steve Sakoman

ruby-ptest : some ptest fixes

2025-09-01T15:30:57+00:00

- Skip the test_rm_r_no_permissions test under the root user, as deletion always succeeds. - Filter out tests under the -ext- directory in run-ptest. Due to the commit [1],the packaging of .so test files under the .ext directory was removed. As a result, adjust the test filtering rules to avoid test failures caused by missing files. - Add installation of rdoc.rb and did_you_mean.rb files in do_install_ptest to ensure complete test dependencies. - Add init.rb file to PTEST installation path. (From OE-Core rev: fbbfbfd59fe74c6f742af29d32fae1327068b9ff) Signed-off-by: Jiaying Song Signed-off-by: Steve Sakoman

ruby: fix CVE-2025-27221

2025-06-02T14:12:34+00:00

In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host. Reference: https://security-tracker.debian.org/tracker/CVE-2025-27221 Upstream-patches: https://github.com/ruby/uri/commit/3675494839112b64d5f082a9068237b277ed1495 https://github.com/ruby/uri/commit/2789182478f42ccbb62197f952eb730e4f02bfc5 (From OE-Core rev: 421d7011269f4750f5942b815d68f77fa4559d69) Signed-off-by: Divya Chellam Signed-off-by: Steve Sakoman

ruby: fix CVE-2025-27220

2025-04-01T16:08:42+00:00

In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method. Reference: https://security-tracker.debian.org/tracker/CVE-2025-27220 Upstream-patch: https://github.com/ruby/cgi/commit/cd1eb08076c8b8e310d4d553d427763f2577a1b6 (From OE-Core rev: 8c31f8e142894f103409ee10deccc22fdeea897c) Signed-off-by: Divya Chellam Signed-off-by: Steve Sakoman

ruby: Fix CVE-2025-27219

2025-03-15T13:40:07+00:00

Upstream-Status: Backport from [https://github.com/ruby/cgi/commit/9907b76dad0777ee300de236dad4b559e07596ab] (From OE-Core rev: 7e0a96b5c0b7a5ca593df83861086d0980ea72e9) Signed-off-by: Ashish Sharma Signed-off-by: Steve Sakoman

ruby: upgrade 3.2.2 -> 3.3.5

2024-10-18T13:04:40+00:00

Includes fix for CVE-2024-41123 & CVE-2024-41946 Release notes: https://github.com/ruby/ruby/releases/tag/v3_3_5 Rebase: 0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch 0006-Make-gemspecs-reproducible.patch Drop: 0001-fiddle-Use-C11-_Alignof-to-define-ALIGN_OF-when-poss.patch 0002-Obey-LDFLAGS-for-the-link-of-libruby.patch CVE-2023-36617_1.patch CVE-2023-36617_2.patch CVE-2024-27281.patch CVE-2024-27282.patch (merged upstream) 0001-template-Makefile.in-do-not-write-host-cross-cc-item.patch 0002-template-Makefile.in-filter-out-f-prefix-map.patch remove_has_include_macros.patch (code rewritten upstream) License-Update: Updated LEGAL section (From OE-Core rev: 69ffe5bc09260918fb32bfcb29586dcaa1958a5c) Signed-off-by: Yogita Urade Signed-off-by: Steve Sakoman

ruby: Make docs generation deterministic

2024-09-19T12:11:35+00:00

The presence or lack of nroff on the host was changing the doc type. Set it explicitly to be deterministic and reproducible. (From OE-Core rev: 9ed723d1972b4e1bd1ae799661194ccbd4c6c759) Signed-off-by: Richard Purdie (cherry picked from commit f5053abb8957acf358b518ee3c76146dc5f4eb6c) Signed-off-by: Steve Sakoman

ruby: Backport fix for CVE-2024-27282

2024-08-26T12:18:43+00:00

Upstream-Status: Backport [https://github.com/ruby/ruby/commit/989a2355808a63fc45367785c82ffd46d18c900a] (From OE-Core rev: 1103182ac9ae5139a5c3d7381007f61c1f7d91a6) Signed-off-by: Ashish Sharma Signed-off-by: Steve Sakoman

ruby: fix CVE-2024-27281

2024-07-17T12:36:13+00:00

References: https://github.com/ruby/ruby/pull/10316 https://security-tracker.debian.org/tracker/CVE-2024-27281 Upstream-Status: Backport from https://github.com/ruby/rdoc/commit/da7a0c7553ef7250ca665a3fecdc01dbaacbb43d (From OE-Core rev: 16685f3b2d22eac20f0134cbd589c3b23a187084) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman

ruby: Fix CVE-2023-36617

2024-07-09T13:02:55+00:00

Backport two patches [1] [2] to fix CVE-2023-36617 [3]. [1] https://github.com/ruby/uri/commit/9010ee2536adda10a0555ae1ed6fe2f5808e6bf1 [2] https://github.com/ruby/uri/commit/9d7bcef1e6ad23c9c6e4932f297fb737888144c8 [3] https://www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617/ (From OE-Core rev: 959b2e5deae18969ffe1e9d90c901928bc47e332) Signed-off-by: Mingli Yu Signed-off-by: Steve Sakoman