diff mbox series

[1/1] ruby: upgrade 3.3.4 -> 3.3.5

Message ID 20240924113031.2229409-1-yogita.urade@windriver.com
State Under Review
Headers show
Series [1/1] ruby: upgrade 3.3.4 -> 3.3.5 | expand

Commit Message

yurade Sept. 24, 2024, 11:30 a.m. UTC 
From: Yogita Urade <yogita.urade@windriver.com>

Includes fix for CVE-2024-41123 & CVE-2024-41946

Changelog
=========
d3ab7be8ca merge revision(s) 657f4b99f61: [Backport #20667]
c69d59e9b2 Sync tool/lib/core_assertions.rb from master
cf9a6c2b63 merge revision(s) a3562c2a0abf1c2bdd1d50377b4f929580782594: [Backport #20701]
d83b5633b1 merge revision(s) 992596fb7af18a7f472589a607d0eb3fbb03b49a: [Backport #20344]
b210c86a02 merge revision(s) 97449338d6cb42d9dd7c9ca61550616e7e6b6ef6: [Backport #20649]
6a4e79533b merge revision(s) 1870505f478cc75993b296b7144a45137ace6937: [Backport #20651]
e0e23e7d5e merge revision(s) 29500e30346: [Backport #20667]
7b954e7bc6 Allow failures in Travis ppc64le and s390x
937964f346 Merge URI-0.13.1 for Ruby 3.3 (#11466)
ac8d50e52e [Backport 3.3] [Bug #20691] Fix use-after-free in WeakKeyMap#clear (#11443)
8657de70aa [Backport 3.3] [Bug #20688] Fix use-after-free for WeakMap and WeakKeyMap (#11439)
9ae91eb2aa Backport warning feature for bundled gems from master (#11420)
66312ad913 Re-initialize vm->ractor.sched.lock after fork (#11372)
4d11a0960d Added bootstrap job for release workflow
65cca99b30 parse.y: const_decl_path don't replace destination node by a literal (#11314)
f85c7deacc Update RubyGems 3.5.16 and Bundler 2.5.16 for Ruby 3.3 (#11252)
0922afa95b [Bug #20654] Fix floor and ceil when ndigits is large (#11277)
ce565cd4b8 [Bug #20653] Fix memory leak in String#start_with? when regexp times out (#11255)
6d744837ab [Bug #20088] Fix ARCH_FLAG for cross compiling
7571ad42f4 [Bug #20650] Fix memory leak in Regexp capture group when timeout (#11244)
4667f8ec10 bundled_gems.rb: Add a fast path (#11221)
425e468d25 [Backport #20633] Fix the condition for `atomic_signal_fence` (#11166)
3427a1679a retry on cancelling of `getaddrinfo` (#11131)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
---
 meta/recipes-devtools/ruby/{ruby_3.3.4.bb => ruby_3.3.5.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/ruby/{ruby_3.3.4.bb => ruby_3.3.5.bb} (98%)

Comments

Ross Burton Sept. 24, 2024, 12:02 p.m. UTC | #1 
On 24 Sep 2024, at 12:30, Urade, Yogita via lists.openembedded.org <Yogita.Urade=windriver.com@lists.openembedded.org> wrote:
> 
> From: Yogita Urade <yogita.urade@windriver.com>
> 
> Includes fix for CVE-2024-41123 & CVE-2024-41946

This causes a lot of new files to appear in /usr/bin:

packages/cortexa57-poky-linux/ruby/ruby: FILELIST: added "/usr/bin/rbs.lock /usr/bin/rdbg.lock /usr/bin/syntax_suggest.lock /usr/bin/rdoc.lock /usr/bin/rake.lock /usr/bin/erb.lock /usr/bin/bundle.lock /usr/bin/bundler.lock /usr/bin/irb.lock /usr/bin/racc.lock /usr/bin/typeprof.lock  /usr/bin/ri.lock”

Is this intentional? It doesn’t seem right that these .lock files will be in $bindir.

Ross
diff mbox series

Patch

diff --git a/meta/recipes-devtools/ruby/ruby_3.3.4.bb b/meta/recipes-devtools/ruby/ruby_3.3.5.bb
similarity index 98%
rename from meta/recipes-devtools/ruby/ruby_3.3.4.bb
rename to meta/recipes-devtools/ruby/ruby_3.3.5.bb
index ebff4136c9..7b531e2b10 100644
--- a/meta/recipes-devtools/ruby/ruby_3.3.4.bb
+++ b/meta/recipes-devtools/ruby/ruby_3.3.5.bb
@@ -47,7 +47,7 @@  do_configure:prepend() {
 
 DEPENDS:append:libc-musl = " libucontext"
 
-SRC_URI[sha256sum] = "fe6a30f97d54e029768f2ddf4923699c416cdbc3a6e96db3e2d5716c7db96a34"
+SRC_URI[sha256sum] = "3781a3504222c2f26cb4b9eb9c1a12dbf4944d366ce24a9ff8cf99ecbce75196"
 
 PACKAGECONFIG ??= ""
 PACKAGECONFIG += "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}"