Skip to content

fix(deps): update dependency ruby to v4#53

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/ruby-4.x
Open

fix(deps): update dependency ruby to v4#53
renovate[bot] wants to merge 1 commit intomainfrom
renovate/ruby-4.x

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Apr 18, 2026 •
edited
Loading

This PR contains the following updates:

Package Update Change
ruby (source) major 3.4.9 → 4.0.3

Release Notes

ruby/ruby (ruby)

v4.0.3: 4.0.3

Compare Source

What's Changed

Full Changelog

v4.0.2: 4.0.2

Compare Source

What's Changed

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

v4.0.1: 4.0.1

Compare Source

What's Changed

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

v4.0.0: 4.0.0

See also:

What's Changed

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
    • Only on Sunday and Saturday (* * * * 0,6)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 18, 2026 •
edited
Loading

Renovate PR Review Results

⚖️ Safety Assessment: ⚠️ Needs Manual Migration

🔍 Release Content Analysis

Version Jump: Ruby 3.4.9 → 4.0.3 (Major version upgrade)

Major Changes:

  • Ruby 4.0.0 (Dec 25, 2025): Major release celebrating Ruby's 30th anniversary
  • Ruby 4.0.1 (Jan 13, 2026): Bug fixes for sleep, Array#pack, pow, Data object
  • Ruby 4.0.2 (Mar 16, 2026): Bug fixes for YJIT, argument forwarding, binding.irb, enumerator, signal handling, encoding, GC, Prism parser issues
  • Ruby 4.0.3 (Latest): Security fix for CVE-2026-41316 (ERB deserialization vulnerability)

Breaking Changes:

  1. Fiddle gem moved to bundled gem status: Fiddle is no longer a default gem and requires explicit Gemfile entry
  2. Standard library changes: benchmark, irb, logger, ostruct, pstore, rdoc, readline, reline moved to bundled gems
  3. CGI library removed: Only cgi/escape functions retained
  4. Ractor API overhaul: Ractor.yield and Ractor#take removed, replaced with Ractor::Port mechanism
  5. Set class reimplementation: Internal @hash instance variable removed, behavior changes
  6. Net::HTTP behavior change: No longer automatically sets Content-Type header to application/x-www-form-urlencoded
  7. Binding methods: Numbered parameters (_1, _2) no longer appear in local_variables
  8. Language changes: Lines starting with &&/|| or and/or now recognized as continuations

Security Fixes:

  • CVE-2026-41316: ERB deserialization vulnerability allowing arbitrary code execution via Marshal.load on untrusted data (fixed in 4.0.3)

New Features:

  • ZJIT compiler (experimental): New JIT compiler requiring Rust 1.85.0+, enabled with --zjit flag (not production-ready)
  • Ruby Box (experimental): Isolated execution environments for definitions
  • Ractor improvements: Performance optimizations and new Ractor::Port API

🎯 Impact Scope Investigation

Direct Usage Locations:

  1. Dockerfile (line 43): ARG RUBY_VERSION=4.0.3
  2. mise.toml (line 8): ruby = "4.0.3"
  3. internal/sandbox/runtime.go (lines 222-283): Ruby runtime configuration
  4. internal/sandbox/defaults/ruby/Gemfile: Pre-installed gem configuration
  5. internal/sandbox/defaults/ruby/Gemfile.lock: Bundler 2.6.9

Critical Dependency: The sandbox pre-installs the fiddle gem (1.1.8) which is used in:

  • E2E test: e2e/tests/runtime/ruby.yml (line 374-398) - Tests fiddle availability
  • Security test: e2e/tests/security/dynamic_linker_attack.yml (line 86-106) - Tests that fiddle cannot load arbitrary shared objects

Breaking Change Impact:

  • CRITICAL: In Ruby 4.0, fiddle became a bundled gem (no longer default gem)
  • The existing Gemfile already includes gem "fiddle", "1.1.8", which means the sandbox architecture is already prepared for this change
  • The Bundler setup with BUNDLE_PATH=/mise/ruby-bundle and RUBYOPT=-rbundler/setup ensures fiddle remains accessible

Test Compatibility:

  • Ruby E2E tests use basic Ruby features (puts, classes, JSON, arrays, exceptions, regex) - fully compatible
  • Security tests expect specific error patterns from fiddle - compatible (fiddle behavior unchanged, only loading mechanism)
  • E2E test regex patterns use \\d+\\.\\d+\\.\\d+ for version matching - version-agnostic and compatible

Rust Version Compatibility:

  • Sandbox uses Rust 1.94.1 (Dockerfile line 74, mise.toml line 9)
  • Ruby 4.0's ZJIT compiler requires Rust 1.85.0+ only if building Ruby with ZJIT enabled
  • The sandbox uses pre-built Ruby binaries from mise, not building from source
  • No conflict: ZJIT requirement does not affect the sandbox

Backward Compatibility:

  • No code in the sandbox uses removed APIs (Ractor, Process::Status operators, CGI, SortedSet)
  • No custom Set subclasses or reliance on internal @hash instance variable
  • No code parsing backtraces that would break from internal frame filtering
  • Gemfile/Gemfile.lock are restricted files (users cannot override) - safe

💡 Recommended Actions

Required Actions:

  1. Verify Bundler Version Compatibility:

    • Current Gemfile.lock shows BUNDLED WITH 2.6.9
    • Ruby 4.0.3 ships with its own Bundler version
    • Action: After Docker build, verify Bundler compatibility with the existing Gemfile.lock

  2. Update Rust Toolchain Reference (Optional):

    • internal/sandbox/runtime.go:487 hardcodes RUSTUP_TOOLCHAIN=1.94.1
    • This is for the Rust runtime (sandbox user code), not Ruby
    • Action: No change required (separate concern)

  3. Monitor E2E Test Results:

    • Wait for CI/CD pipeline completion to verify all Ruby E2E tests pass
    • Specifically monitor: e2e/tests/runtime/ruby.yml and e2e/tests/runtime/ruby_stdin.yml
    • Security tests in e2e/tests/security/dynamic_linker_attack.yml must still pass

  4. Validate Fiddle Gem Availability:

    • Confirm fiddle gem loads successfully via Bundler setup
    • Test that require 'fiddle' works in sandbox execution
    • Verify Fiddle::SIZEOF_VOIDP returns expected value (8 on amd64/arm64)

Merge Decision:

✅ Safe to merge AFTER:

  • All E2E tests pass (currently pending)
  • Build completes successfully (currently pending)
  • No regression in fiddle gem functionality

⚠️ Risk Level: LOW-MEDIUM

  • Main concern: fiddle gem loading mechanism change
  • Mitigation: Existing Gemfile already includes fiddle explicitly
  • Ruby 4.0 is designed for backward compatibility with 3.x code

Post-Merge Monitoring:

  • Monitor production logs for any Ruby-related errors
  • Watch for Bundler-related issues or gem loading failures
  • Verify security sandbox isolation remains effective

🔗 Reference Links

Official Ruby Documentation:

Upgrade Guides:

Bundled Gems:

ZJIT Compiler:

Generated by koki-develop/claude-renovate-review

@renovate renovate Bot force-pushed the renovate/ruby-4.x branch 2 times, most recently from d40a464 to e94adb1 Compare April 28, 2026 22:47
@renovate renovate Bot force-pushed the renovate/ruby-4.x branch from e94adb1 to b52fd16 Compare April 29, 2026 16:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants