diff --git a/package/ruby/0001-fix-CVE-2026-41316.patch b/package/ruby/0001-fix-CVE-2026-41316.patch deleted file mode 100644 index 1c5949c221..0000000000 --- a/package/ruby/0001-fix-CVE-2026-41316.patch +++ /dev/null @@ -1,73 +0,0 @@ -From c35379df5279777fb4e02d989064eecd9cbbf338 Mon Sep 17 00:00:00 2001 -From: Takashi Kokubun -Date: Tue, 21 Apr 2026 16:27:44 +0900 -Subject: [PATCH] [ruby/erb] Prohibit def_method on marshal-loaded ERB instances - -Extends the @_init guard to def_method so that an ERB object created -via Marshal.load (which bypasses initialize) raises ArgumentError -instead of evaluating arbitrary source. def_module and def_class both -delegate to def_method and are covered by the same check. - -Co-authored-by: Tristan Madani - -Upstream: https://github.com/ruby/ruby/commit/c35379df5279777fb4e02d989064eecd9cbbf338 -CVE: CVE-2026-41316 -[Titouan: Rebase on top of Ruby 3.4.9] -Signed-off-by: Titouan Christophe ---- - lib/erb.rb | 3 +++ - test/erb/test_erb.rb | 27 +++++++++++++++++++++++++++ - 2 files changed, 30 insertions(+) - -diff --git a/lib/erb.rb b/lib/erb.rb -index bc1615d7da..a7317c0856 100644 ---- a/lib/erb.rb -+++ b/lib/erb.rb -@@ -463,6 +463,9 @@ def new_toplevel(vars = nil) - # erb.def_method(MyClass, 'render(arg1, arg2)', filename) - # print MyClass.new.render('foo', 123) - def def_method(mod, methodname, fname='(ERB)') -+ unless @_init.equal?(self.class.singleton_class) -+ raise ArgumentError, "not initialized" -+ end - src = self.src.sub(/^(?!#|$)/) {"def #{methodname}\n"} << "\nend\n" - mod.module_eval do - eval(src, binding, fname, -1) -diff --git a/test/erb/test_erb.rb b/test/erb/test_erb.rb -index 09496d31e25ca2..9eec43da158c0c 100644 ---- a/test/erb/test_erb.rb -+++ b/test/erb/test_erb.rb -@@ -664,6 +664,33 @@ def test_prohibited_marshal_load - assert_raise(ArgumentError) {erb.result} - end - -+ def test_prohibited_marshal_load_def_method -+ erb = ERB.allocate -+ erb.instance_variable_set(:@src, "") -+ erb.instance_variable_set(:@lineno, 1) -+ erb.instance_variable_set(:@_init, true) -+ erb = Marshal.load(Marshal.dump(erb)) -+ assert_raise(ArgumentError) {erb.def_method(Class.new, 'render')} -+ end -+ -+ def test_prohibited_marshal_load_def_module -+ erb = ERB.allocate -+ erb.instance_variable_set(:@src, "") -+ erb.instance_variable_set(:@lineno, 1) -+ erb.instance_variable_set(:@_init, true) -+ erb = Marshal.load(Marshal.dump(erb)) -+ assert_raise(ArgumentError) {erb.def_module} -+ end -+ -+ def test_prohibited_marshal_load_def_class -+ erb = ERB.allocate -+ erb.instance_variable_set(:@src, "") -+ erb.instance_variable_set(:@lineno, 1) -+ erb.instance_variable_set(:@_init, true) -+ erb = Marshal.load(Marshal.dump(erb)) -+ assert_raise(ArgumentError) {erb.def_class} -+ end -+ - def test_multi_line_comment_lineno - erb = ERB.new(<<~EOS) - <%= __LINE__ %> diff --git a/package/ruby/ruby.hash b/package/ruby/ruby.hash index e8bf51ea43..dd97a6d867 100644 --- a/package/ruby/ruby.hash +++ b/package/ruby/ruby.hash @@ -1,5 +1,5 @@ -# https://www.ruby-lang.org/en/news/2026/03/11/ruby-3-4-9-released/ -sha512 356fb47cc56f2d25198cb95253fc20ff7d9a6fd1fa53bc475e5c440012aebe27562537c399d271357235114ade263fd625029b66cb0f9b526f9c04f169fb9580 ruby-3.4.9.tar.xz +# https://www.ruby-lang.org/en/news/2026/06/30/ruby-3-4-10-released/ +sha512 c28d59946c0a1b8e4385a772e0651c6f4154c18ab8a2a62289c3213eb4fe937cec0942e0076cda429576e58ad277b18f4b5611e644d15b122c1cd96baf10f284 ruby-3.4.10.tar.xz # License files, Locally calculated sha256 a2021e52d5d6adf7e3f45aab9d2b860ce03cdf6153776853e11d5668193eecfd LEGAL diff --git a/package/ruby/ruby.mk b/package/ruby/ruby.mk index a66bbd4cbf..ebe3004c6a 100644 --- a/package/ruby/ruby.mk +++ b/package/ruby/ruby.mk @@ -5,7 +5,7 @@ ################################################################################ RUBY_VERSION_MAJOR = 3.4 -RUBY_VERSION = $(RUBY_VERSION_MAJOR).9 +RUBY_VERSION = $(RUBY_VERSION_MAJOR).10 RUBY_VERSION_EXT = 3.4.0 RUBY_SITE = http://cache.ruby-lang.org/pub/ruby/$(RUBY_VERSION_MAJOR) RUBY_SOURCE = ruby-$(RUBY_VERSION).tar.xz @@ -19,9 +19,6 @@ RUBY_LICENSE_FILES = LEGAL COPYING BSDL RUBY_CPE_ID_VENDOR = ruby-lang -# 0001-fix-CVE-2026-41316.patch -RUBY_IGNORE_CVES += CVE-2026-41316 - RUBY_DEPENDENCIES = host-pkgconf host-ruby HOST_RUBY_DEPENDENCIES = host-libyaml host-pkgconf host-openssl RUBY_MAKE_ENV = $(TARGET_MAKE_ENV)