[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
aube	tools	minor	2.8.0 → 2.9.0	v2.10.0
hk	tools	minor	2.9.0 → 2.12.0
ruby (source)	tools	patch	4.0.7 → 4.0.9

---

Release Notes

aubepkg/aube (aube)

v2.9.0: : Stricter npm trust checks, embedder provenance hook, and lockfile compatibility fixes

Compare Source

v2.9.0 tightens trustPolicy=no-downgrade to match pnpm, adds a provenance verification hook for programs that embed aube, and fixes several lockfile mismatches with npm, Yarn Classic, Bun, and pnpm.

Added

• Provenance verification for embedders (#​1900, @​jdx): programs that embed aube, such as mise, can register a verifier on the install control. aube then passes each registry package as (name, version, integrity) to the verifier before downloading or importing it. If the verifier returns an error, the install stops. While a verifier is registered, aube checks every tarball against its pinned integrity even when verifyStoreIntegrity=false. Standalone aube does not register a verifier, so its behavior is unchanged.

  let control = InstallControl::silent()
      .with_provenance_verifier(Arc::new(MyVerifier));

Changed

• trustPolicy now matches pnpm's evidence rules (#​1899, @​jdx): aube now reads staged-publish approval from npm's _npmUser.approver and ignores a top-level approver field. Before, aube never detected staged publishes. _npmUser.trustedPublisher now counts as evidence only when the version also has provenance. With no-downgrade, aube may now reject versions it previously accepted. trustPolicyExclude still applies. aube rebuilds cached resolution indexes automatically.

Fixed

• .modules.yaml with the global virtual store (#​1902, @​jdx): newly created node_modules/.modules.yaml files now include packageManager: aube@<version>. Without it, which-pm and the npm script detection in VS Code and Cursor crashed. Existing files are not updated. To pick up the fix, delete node_modules/.modules.yaml or reinstall from scratch.
• Yarn Classic #sha1 fragments (#​1886, #​1892, @​jdx): aube update --lockfile-only no longer removes #<sha1> fragments from unchanged resolved URLs in yarn.lock. New entries now get the fragment too, including packages that resolve from the bundled metadata primer. Packuments cached by an older aube may lack the shasum until the package publishes a new version or you run aube cache delete <name>.
• npm hasInstallScript (#​1894, @​jdx): package-lock.json entries now set hasInstallScript when a package has a preinstall, install, or postinstall script. Before, npm ci could skip install scripts for packages added with aube add under default settings.
• Frozen installs with npm lockfiles (#​1895, @​jdx): aube install --frozen-lockfile now rejects lockfiles that npm ci also rejects. This covers a workspace member renamed in its package.json and a new workspace member missing from npm-shrinkwrap.json.
• Bun lockfile metadata (#​1893, @​jdx): bun.lock no longer includes aube's internal __aube_* metadata. Before, the lockfile changed each time aube and Bun took turns installing.
• Local tarball dependencies (#​1896, @​jdx): a clean aube install --frozen-lockfile now links a local tarball's absolute file: dependency. Before, the install reported success, but requiring the dependency failed.

Full Changelog: aubepkg/aube@v2.8.5...v2.9.0

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.8.5: : Maintenance release

Compare Source

This release has no user-facing changes. It only updates dependencies and CI tooling.

Full Changelog: aubepkg/aube@v2.8.4...v2.8.5

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.8.4: : npm, pnpm, Bun and Yarn lockfile rewrites match each tool's own output

Compare Source

Lockfiles that aube rewrites now pass npm ci, pnpm install --frozen-lockfile, Bun frozen installs and yarn install --immutable in many more cases. This release also fixes --lockfile-dir with workspaces, fixes how bins of link: and workspace dependencies are linked, and puts workspace root bins on PATH for member scripts.

Fixed

npm package-lock.json

• npm ci no longer fails after an unrelated aube add (#​1851, #​1863): aube no longer drops or changes entries npm already wrote. It keeps auto-installed peer entries ("peer": true), hoisted required peers such as @emnapi/*, bundleDependencies and their nested placements, workspaces and engines on existing entries, and leftover nested optional entries. Before this fix, npm ci could fail with errors like Missing: @emnapi/core@1.11.3 from lock file.
• New entries match what npm writes: hasInstallScript is now recorded, so npm ci runs the package's install scripts (#​1846). deprecated is written and kept on rewrite, and a scoped package's string bin uses the unscoped command name (#​1858). libc is written only if the lockfile already uses it or packageManager is npm@11.11.0 or later, which stops churn for teams on older npm (#​1874).
• Workspace members with no dependencies are recorded (#​1876): before this fix, aube reported "Already up to date" and npm ci failed with Missing: <member> from lock file. Member entries also now copy os/cpu from the member's package.json and omit name when it matches the folder name, as npm does.
• Local dependencies: when a local package declares its own file: dependencies, aube now writes the declared spec instead of an internal file+<hash> key, so the next clean --frozen-lockfile install no longer fails (#​1855). Absolute file: directory targets are written as root-relative keys with "link": true, which fixes an EUSAGE error from npm ci (#​1853).
• Lockfiles with entries outside node_modules can be read again (#​1878): this covers a symlinked member's real path or an extraneous deleted member. Before this fix, aube failed with ERR_AUBE_LOCKFILE_PARSE ... could not determine package name. aube still drops these entries when it rewrites the lockfile.

pnpm pnpm-lock.yaml

• pnpm metadata is kept on rewrite: aube now keeps the leading packageManagerDependencies/configDependencies document that pnpm 12 writes (#​1842). It also keeps settings entries it doesn't model, such as peersSuffixMaxLength, and local tarball version, integrity and bundledDependencies (#​1857). Bundled children of a local tarball are no longer resolved from the registry. Together these fix ERR_PNPM_FROZEN_LOCKFILE_WITH_OUTDATED_LOCKFILE and ERR_PNPM_LOCKFILE_CONFIG_MISMATCH errors after aube add.
• Peer keys match pnpm, so pnpm and aube stop rewriting each other's lockfiles: peer suffixes now use the registry name of aliased providers, and an optional peer that is actually provided is included even when its version is out of range (#​1849). Peer-cycle providers are written bare (#​1859). A package's own declared peers are left out of its transitivePeerDependencies (#​1860).

Bun bun.lock

• When the root and a member need different versions of a peer provider, the member keeps its own version after a clean --frozen-lockfile install. For example, a member on React 19 no longer loads the root's React 18 (#​1847).
• Hoisted local tarballs whose paths are relative to the member that declares them now resolve from that member, not from the project root (#​1844).
• Folder identifiers for absolute file: directories inside the project are written relative to the lockfile (child@file:assets/child), which Bun's frozen install accepts (#​1854).

Yarn Berry yarn.lock

• Rewritten Yarn 4 lockfiles now pass yarn install --immutable (no more YN0028 error) (#​1862). Block headers list only the descriptors that are actually requested, peerDependencies ranges are quoted only when YAML requires it, and optional dependencies keep their dependenciesMeta: optional: true flags.

Install, linking and scripts

• --lockfile-dir works with workspaces (#​1856): before this fix, a clean --frozen-lockfile install failed with lockfile already records importers from other projects, and a relocated package-lock.json or bun.lock was rejected. aube and pnpm lockfiles now record every importer relative to the lockfile directory, as pnpm does.
  • Upgrade note: the next normal install migrates relocated workspace lockfiles written by older aube versions. A --frozen-lockfile install that would need this migration fails and asks you to run aube install --no-frozen-lockfile once.
• Workspace root bins are on PATH in member scripts (#​1845): <root>/node_modules/.bin is now added after the member's own .bin, as pnpm does. This applies to aube run (including -r, --filter and --parallel), the test/start shortcuts and aube exec.
• Bin changes in link: and workspace dependencies are picked up (#​1839, @​JamBalaya56562): before this fix, aube reported "Already up to date" and kept old commands in node_modules/.bin until --force. aube now checks bin and directories for changes, and a link: target that gains a package.json is linked on the next install.
• A dependency's link: deps get their bins linked into its .bin (#​1873, @​JamBalaya56562): the dependency's lifecycle scripts can now call those commands.
• file: dependencies:
  • A peer satisfied by a file: dependency now links to the directory aube actually creates, instead of a link that points nowhere. With the global virtual store, dependents of file: packages now stay in the project's virtual store instead of the shared one (#​1850).
  • A file:-linked directory in a package-lock.json project can now require its own dependencies (#​1848).
  • Absolute file:/link: children of local tarballs now resolve when block-exotic-subdeps=false (#​1852).

Registry

• No more false "0 downloads last week" warnings (#​1881): if npm's downloads API returns a stats window that is more than 7 days old, aube treats the count as unknown. Before this fix, aube add flagged legitimate new packages as suspicious during npm's stats outage.

Full Changelog: aubepkg/aube@v2.8.3...v2.8.4

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.8.3: : Honor NPM_CONFIG_GLOBALCONFIG for registry settings

Compare Source

aube now reads the npm global config file set by NPM_CONFIG_GLOBALCONFIG, so a registry and auth configured only there are used for installs, as npm does.

Fixed

• NPM_CONFIG_GLOBALCONFIG is now read (#​1818, @​jdx): before this fix, if the internal registry was set only through NPM_CONFIG_GLOBALCONFIG, with no ~/.npmrc or NPM_CONFIG_USERCONFIG, aube ignored it and fetched packages from registry.npmjs.org. aube now reads the file that NPM_CONFIG_GLOBALCONFIG or npm_config_globalconfig points to, including registry, scoped registry and auth token settings.

  • As in npm, the global file has the lowest precedence. Project .npmrc overrides user config, and user config overrides the global file. npm_config_* environment variables override all of them.
  • If both casings are set, the upper-case variable wins. A leading ~ in the path is expanded.
  • aube reads the global file only when one of these variables is set. It does not look in npm's default $PREFIX/etc/npmrc location.

  # file pointed to by $NPM_CONFIG_GLOBALCONFIG
  registry=<your internal registry URL>
  //<your registry host>/:_authToken=...

Full Changelog: aubepkg/aube@v2.8.2...v2.8.3

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.8.2: : Smaller lockfile diffs for yarn.lock v1 and package-lock.json, plus no more 5-minute cap on slow tarball downloads

Compare Source

v2.8.2 brings aube's rewrites of Yarn Classic, npm and pnpm lockfiles closer to each tool's own output. It also stops large tarball downloads from failing after 5 minutes while data is still arriving, and fixes several install and resolution differences from pnpm.

Fixed

Lockfiles

• Yarn Classic yarn.lock (#​1802): re-resolving no longer rewrites every entry. aube now keeps resolved URLs, including the #sha1 fragment, and quotes keys only where Yarn does. Block headers list only the ranges that consumers declare, and blocks are sorted the way Yarn sorts them. As a result, bumping one dependency changes only that package's entries:

  -"accepts@1.3.8", "accepts@~1.3.8":
  +accepts@~1.3.8:
     version "1.3.8"
  +  resolved "https://registry.yarnpkg.com/accepts/-/accepts-1.3.8.tgz#0bf0be125b67014adcb0b0921e62db7bffe16b2e"

• npm package-lock.json (#​1814): aube add and other rewrites leave unchanged entries byte-identical to npm's output.
  • Keys are now sorted the way npm sorts them, so "dev": true no longer moves.
  • funding values are kept exactly as written, including type and arrays with more than one URL.
  • New entries still record funding only as {"url": …}.
• pnpm 11 peer suffixes (#​1805): when a dependency needs a peer resolved from higher in the tree, the parent package's snapshot key now includes that peer even if the parent declares its own peers, as pnpm 11 does. For example, aube now writes @ai-sdk/react@4.0.138(react@19.3.1)(zod@4.6.7). The peer is also listed under transitivePeerDependencies:. Snapshot keys for affected packages change once on the next resolve; frozen installs read existing lockfiles unchanged.
• catalog: dependencies with ranged overrides (#​1816): an override with a version range, such as "is-odd@^3": "catalog:", no longer applies to a dependency declared as catalog:. This matches pnpm. The importer keeps specifier: 'catalog:', so pnpm install --frozen-lockfile no longer fails with ERR_PNPM_OUTDATED_LOCKFILE. Catalog entries that are referenced only by an override value are no longer written to catalogs:. Lockfiles that older aube versions wrote for this setup are reported as outdated until the next aube install rewrites them.

Install and resolution

• Slow tarball downloads (#​1804): a large tarball on a slow connection no longer fails with operation timed out after fetchTimeout (default 5 minutes) while data is still arriving. For tarballs, fetchTimeout is now the longest time a download can go without receiving data; a stalled download still fails and is retried. Registry metadata requests still use fetchTimeout as a limit on the whole response.
• Colliding npm aliases in frozen installs (#​1812, @​chrismatix): aube install --frozen-lockfile could install the wrong package when an npm alias shared a name and version with an ordinary package or another alias. For example, compiler: npm:@test/compiler@1.0.0 in one workspace member and compiler: 1.0.0 in another. Each member now gets the correct package and its binaries.
• Hidden hoisting (#​1815): when a package has several versions in the graph, node_modules/.aube/node_modules now gets the version closest to an importer, as with pnpm. Ties are broken by dependency path. In the default layout, the root project's direct dependencies are no longer hidden-hoisted because Node already finds them in the root node_modules/. Previously, an undeclared import from a package could resolve to a different version than under pnpm. In one reported case, Vite+ bundled the wrong rolldown version.
• supportedArchitectures platform lists (#​1813): pnpm-workspace.yaml can now use pnpm 12.5's list form, which previously failed with invalid type: sequence:

  supportedArchitectures:
    - darwin-arm64
    - linux-x64-manylinux_2_28

  Entries can be <os>-<cpu>[-<libc>], Rust target triples or current. aube merges the OS, CPU and libc values from all entries, so it can allow a few more combinations than pnpm. For example, darwin-arm64 plus linux-x64 also allows darwin-x64.
• aube outdated / aube update warnings (#​1807): aube no longer warns "updates hidden by minimumReleaseAge" when the hidden version is a prerelease latest outside the manifest range that is older than the cutoff (for example elm-test@0.19.3-0).

Full Changelog: aubepkg/aube@v2.8.1...v2.8.2

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.8.1: : pnpm 11 lockfile parity, Yarn Berry and npm lockfile fixes

Compare Source

v2.8.1 brings aube-written pnpm-lock.yaml files closer to pnpm 11's output and fixes lockfile round-trips for npm and Yarn Berry. It also fixes minimumReleaseAge in update/dedupe, install --force, workspace detection for nested projects, and handling of an empty CI variable.

Fixed

Lockfiles

• pnpm 11 parity (#​1792, #​1793, #​1788): when a tool such as Dependabot regenerates the lockfile with pnpm, it should rewrite fewer lines that did not change.
  • Peer suffixes are now sorted by the full name@version string, e.g. (react-dom@18.2.0(react@18.2.0))(react@18.2.0).
  • With dedupePeerDependents on (the default), aube resolves an optional peer from any matching version in the graph and lists it under optionalDependencies:. Compatible variants of a package are merged across importers.
  • catalogs: no longer lists entries that an override replaces.
• npm package-lock.json:
  • aube add now keeps "optional": true (for example on @esbuild/* platform packages) and "hasInstallScript": true. Previously, dropping these made npm fail with Unsupported platform (#​1775).
  • Root file: directory dependencies now keep their link and target entries, so npm ci no longer reports Missing: … from lock file (#​1799).
• file: peers on re-resolve (#​1775): aube add no longer fails with ERR_AUBE_BLOCKED_EXOTIC_SUBDEP when a direct file: dependency satisfies another package's peer.
• Yarn Berry yarn.lock (#​1798):
  • Changes to package.json are now detected even when some dependencies are unchanged. Previously aube could print "Lockfile is up to date" and leave yarn.lock stale. This also applies to Yarn Classic.
  • Rewritten lockfiles now keep the __metadata version and cacheKey, the root workspace entry, bin: maps and builtin<compat/…> patch blocks, and use Yarn's formatting. As a result, yarn install --immutable accepts them.
  • Not yet round-tripped: conditions:, dependenciesMeta: and non-root workspace blocks.

Install and resolution

• minimumReleaseAge on npmjs.org (#​1791): aube update and aube dedupe could install versions that minimumReleaseAge should have blocked, including with minimumReleaseAgeStrict: true. Both commands now fetch the publish times they need to apply the cutoff.
• npm's --min-release-age (#​1770): when aube receives npm-style install arguments, it now converts --min-release-age <days> and --min-release-age=<days> to aube's minimumReleaseAge, which is set in minutes. Arguments after -- are left as they are.
• aube install --force (#​1789): now rebuilds every linked package. Files deleted from node_modules are restored instead of the command printing "Already up to date". With the global virtual store, each shared entry is rebuilt in a staging directory and swapped into place.
• Nested non-member projects (#​1787): running aube install in a subdirectory that is not a workspace member now installs that subdirectory alone. This applies, for example, below an aube-workspace.yaml or pnpm-workspace.yaml that contains only settings. Previously aube installed the ancestor root. --ignore-workspace now works too and is listed in the CLI help.
• Empty CI variable (#​1786): CI= no longer turns on CI mode (frozen lockfile by default, global virtual store disabled). CI=0 and CI=false still count as CI.
• TLS root certificates (#​1797): updated rustls-webpki and webpki-root-certs to versions that drop the compromised eMudhra intermediate CA certificates.

Changed

• Homebrew tap (#​1771, #​1772): releases now go to the Aube-maintained tap, installed with brew install aubepkg/tap/aube. brew install aube installs the Homebrew core formula. The legacy jdx/tap/aube formula remains available during the transition.

Lockfile changes on upgrade

After upgrading, the next resolve rewrites some lines in existing aube-written pnpm-lock.yaml files: peer suffixes are reordered and newly resolved optional peers are added. Lockfiles are read as they are, so --frozen-lockfile installs of older lockfiles keep working.

Full Changelog: aubepkg/aube@v2.8.0...v2.8.1

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

jdx/hk (hk)

v2.12.0

Compare Source

🚀 Features

• (builtins) validate conventional commit scopes by @​jonahsnider in #​1817

🐛 Bug Fixes

• (hook) report the signal when a run is stopped by SIGTERM or SIGHUP by @​jdx in #​1814
• (install) install script shims with --legacy when hooks are configured globally by @​jdx in #​1828

🛡️ Security

• (deps) update github actions by @​renovate[bot] in #​1820

🔍 Other Changes

• release weekly instead of daily by @​jdx in #​1811

📦️ Dependency Updates

• update rust crate usage-rs to v7.2.0 by @​renovate[bot] in #​1810
• update rust crate usage-rs to v7.3.0 by @​renovate[bot] in #​1818
• update mise tools by @​renovate[bot] in #​1821
• lock file maintenance by @​renovate[bot] in #​1822
• lock file maintenance by @​renovate[bot] in #​1823

New Contributors

• @​jonahsnider made their first contribution in #​1817

v2.11.1

Compare Source

🐛 Bug Fixes

• (stash) read hk's own pathspecs as written under GIT_LITERAL_PATHSPECS by @​jdx in #​1796

📚 Documentation

• (contributing) remove the AI reply restriction by @​jdx in #​1802

🛡️ Security

• (deps) update github actions by @​renovate[bot] in #​1797
• (deps) update mise tools by @​renovate[bot] in #​1798

🔍 Other Changes

• set up jouet for agents by @​jdx in #​1805

📦️ Dependency Updates

• update rust crate usage-rs to v7.1.5 by @​renovate[bot] in #​1794
• lock file maintenance by @​renovate[bot] in #​1799
• update jdx/mr-boxington-action action to v1.7.3 by @​renovate[bot] in #​1800
• lock file maintenance by @​renovate[bot] in #​1801
• lock file maintenance by @​renovate[bot] in #​1803
• lock file maintenance by @​renovate[bot] in #​1804
• update rust crate pklr to v5.2.3 by @​renovate[bot] in #​1806
• lock file maintenance by @​renovate[bot] in #​1807
• update mise tools by @​renovate[bot] in #​1808
• lock file maintenance by @​renovate[bot] in #​1809

v2.11.0

Compare Source

🚀 Features

• (builtins) report diagnostics from clippy, ruff, eslint, tsc, shellcheck, pyright, biome and golangci-lint by @​jdx in #​1791

🐛 Bug Fixes

• (stash) restore unstaged-deleted files while pre-commit checks run by @​jdx in #​1789

📚 Documentation

• (builtins) show how to install each builtin's tool with mise by @​jdx in #​1785

🔍 Other Changes

• add Entire's StopFailure hook for Claude Code by @​jdx in #​1792

📦️ Dependency Updates

• update rust crate usage-rs to v7.1.4 by @​renovate[bot] in #​1787
• update libz-sys to 1.1.31 for RUSTSEC-2026-0418 by @​jdx in #​1793

v2.10.0

Compare Source

🚀 Features

• (builtins) add pyright builtin by @​illesnagy1 in #​1775
• (builtins) add protolint builtin by @​illesnagy1 in #​1777
• (builtins) add phpstan linter builtin by @​illesnagy1 in #​1778
• (builtins) add dotenv-linter as a builtin by @​illesnagy1 in #​1779
• (builtins) add osv dependency vulnerability scanner builtin by @​illesnagy1 in #​1782
• (hook) fail a hook that runs past its timeout by @​jdx in #​1776
• (pre-push) print reminder of stdin format if stdin contains malformed lines by @​connormharris in #​1781

🛡️ Security

• (builtins) add trufflehog secret scanner builtin by @​illesnagy1 in #​1774

📦️ Dependency Updates

• update dependency aube to latest by @​renovate[bot] in #​1765
• lock file maintenance by @​renovate[bot] in #​1771

ruby/ruby (ruby)

v4.0.9: 4.0.9

Compare Source

What's Changed

• Reject overflowed repeat/null-check IDs in huge regexps by makenowjust · Pull Request #​16801

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

v4.0.8: 4.0.8

Compare Source

What's Changed

• Bug #​22311: Build crashes on macOS 26 with the macOS 27 SDK because pipe2() and dup3() are unavailable - Ruby - Ruby Issue Tracking System
• Bug #​22174: Set operations (&, ^, collect!, flatten, classify, divide) do not preserve compare_by_identity - Ruby - Ruby Issue Tracking System
• Bug #​22383: Fix inverted STR_SHARED check in rb_str_tmp_frozen_release - Ruby - Ruby Issue Tracking System
• Bug #​22387: str_shared_replace incorrectly recalculates termlen - Ruby - Ruby Issue Tracking System
• Bug #​22327: RubyVM::ZJIT.reset_stats! aborts the process (Rust panic) when ZJIT is not enabled - Ruby - Ruby Issue Tracking System
• Bug #​22381: MatchData assigned to $~ is incorrectly reused - Ruby - Ruby Issue Tracking System
• Bug #​22321: Assertion Failed: rb_vm_search_method_slowpath:RB_TYPE_2_P(klass, RUBY_T_CLASS, RUBY_T_ICLASS): klass: T_MODULE - Ruby - Ruby Issue Tracking System
• Bug #​22315: heap-use-after-free in String unpack with a block that mutates the receiver - Ruby - Ruby Issue Tracking System
• Bug #​22318: heap uaf triggered in array.flatten - Ruby - Ruby Issue Tracking System
• Bug #​22319: heap buffer overflow triggered by array's zip function - Ruby - Ruby Issue Tracking System
• Bug #​22322: AddressSanitizer: use-after-poison in econv_description /ruby-src/build/../transcode.c - Ruby - Ruby Issue Tracking System
• Bug #​22334: Assertion Failed: VM_ENV_FLAGS:FIXNUM_P(flags) - Ruby - Ruby Issue Tracking System
• Bug #​22336: IO:Buffer Heap uaf - Ruby - Ruby Issue Tracking System
• Bug #​22330: heap uaf from string.encode() - Ruby - Ruby Issue Tracking System
• Bug #​22340: Win32: File.stat succeeds on symbolic-link loops on Windows - Ruby - Ruby Issue Tracking System
• Bug #​22335: Stack corruption with >31 keyword args and refined Integer#== - Ruby - Ruby Issue Tracking System
• Bug #​22339: Ruby::Box: crash / hang at VM shutdown with RUBY_FREE_AT_EXIT=1 - Ruby - Ruby Issue Tracking System
• Bug #​22342: IO#gets can ignore the limit argument in some edge cases - Ruby - Ruby Issue Tracking System
• Bug #​22391: Fix propagation of errno in rb_io_maybe_wait. - Ruby - Ruby Issue Tracking System
• Bug #​22384: Regexp compile error in the 2nd+ branch of a top-level alternation leaks the parse tree (regression from #​13332, Ruby 4.0) - Ruby - Ruby Issue Tracking System
• Bug #​22388: Use-after-free when an Enumerable retains its each block - Ruby - Ruby Issue Tracking System
• Bug #​22284: Passing an object with to_int to curry as its arity causes problems with LLP64. - Ruby - Ruby Issue Tracking System
• Bug #​22416: Respect timezone abbreviation encodings in Time#strftime - Ruby - Ruby Issue Tracking System
• Bug #​22426: ZJIT: keyword arguments swapped when passed out of declared order to a method with a block (please backport d81a11d4e6 to 4.0) - Ruby - Ruby Issue Tracking System
• Bug #​22406: Process.fork can leave the child unable to resolve hostnames: getaddrinfo helper threads take glibc's resolver lock after releasing the fork lock - Ruby - Ruby Issue Tracking System
• Bug #​22445: On macOS, a child of Kernel#fork can abort with "[BUG] pthread_rwlock_destroy: Resource busy (EBUSY)" - Ruby - Ruby Issue Tracking System
• Bug #​22415: Thread.handle_interrupt needs to preserve errinfo - Ruby - Ruby Issue Tracking System
• Bug #​22434: "No live threads left. Deadlock?" when running system() or spawn in Ractors - Ruby - Ruby Issue Tracking System
• Backport the regexp compiler program size overflow fixes to ruby_4_0 by hsbt · Pull Request #​19025

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

---

Configuration

📅 Schedule: (in timezone Australia/Melbourne)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.