[dependabot]

Bumps microsandbox-rb from 0.17.0 to 0.17.4.

Release notes

Sourced from microsandbox-rb's releases.

v0.17.4

Gem-only fix release; the embedded runtime stays at v0.6.18. Fork safety now also survives pid reuse (a process is identified by its pid and fork generation together), install/setup in a forked child no longer touch the backend, a Sandbox subclass's initialize no longer runs with interrupts masked, and the macOS limit that a forked child must not build network clients is documented. It also picks up dependency updates: magnus 0.9, tokio 1.53, rb-sys 0.9.130, and rustls 0.23.46 for four TLS advisories (see Security).

Fixed

• A Sandbox subclass's initialize no longer runs with interrupts masked. Sandbox.create, .connect_or_create and .start (and PullSession#sandbox) hold a queued Thread#raise/Timeout/Thread#kill back only while the native call runs; the wrapper is now built after that, so a subclass whose constructor blocks or runs long no longer delays a Timeout.timeout or Thread#kill until the constructor returns. The best-effort interrupt cleanup moved to the native handle with it: an interrupt that lands before or during initialize, or an exception initialize raises, still stops the sandbox when the call owns it and leaves one it merely connected to running. Behaviour of Sandbox itself is unchanged.

• Microsandbox.install and Microsandbox.setup no longer take over the backend in a forked child. They went through the same entry as every other native call, so in a child they first rebuilt the backend inherited from the parent — which they never use — and failed with the configuration error when the parent's selection no longer resolved in the child (say its environment selected the cloud backend without an API key). They now leave the backend alone; the child's first call that uses it takes it over, as before.

• Fork safety no longer identifies a process by its pid alone. A forked process that the kernel had given the pid of an ancestor whose SDK state it inherited (the pid counter wrapped onto exactly that value, with no SDK call in between) was taken for that ancestor: it would have used the inherited runtime, backend and handles instead of rebuilding them or raising ForkedHandleError. The extension now counts forks with a pthread_atfork child handler and identifies a process by its pid and that count together. ForkedHandleError's message no longer names one pid as two processes when the pids are equal.

Security

• rustls 0.23.45 → 0.23.46 (a transitive dependency, through the network stack's DNS client and the HTTP client). Fixes RUSTSEC-2026-0346 (Debug output of client session values exposed TLS secrets), RUSTSEC-2026-0347 (buffered application data sent to the outer server after ECH rejection), RUSTSEC-2026-0348 (Brotli certificate decompression could allocate up to

... (truncated)

Changelog

Sourced from microsandbox-rb's changelog.

[0.17.4] - 2026-10-14

Gem-only fix release; the embedded runtime stays at v0.6.18. Fork safety now also survives pid reuse (a process is identified by its pid and fork generation together), install/setup in a forked child no longer touch the backend, a Sandbox subclass's initialize no longer runs with interrupts masked, and the macOS limit that a forked child must not build network clients is documented. It also picks up dependency updates: magnus 0.9, tokio 1.53, rb-sys 0.9.130, and rustls 0.23.46 for four TLS advisories (see Security).

Fixed

• A Sandbox subclass's initialize no longer runs with interrupts masked. Sandbox.create, .connect_or_create and .start (and PullSession#sandbox) hold a queued Thread#raise/Timeout/Thread#kill back only while the native call runs; the wrapper is now built after that, so a subclass whose constructor blocks or runs long no longer delays a Timeout.timeout or Thread#kill until the constructor returns. The best-effort interrupt cleanup moved to the native handle with it: an interrupt that lands before or during initialize, or an exception initialize raises, still stops the sandbox when the call owns it and leaves one it merely connected to running. Behaviour of Sandbox itself is unchanged.

• Microsandbox.install and Microsandbox.setup no longer take over the backend in a forked child. They went through the same entry as every other native call, so in a child they first rebuilt the backend inherited from the parent — which they never use — and failed with the configuration error when the parent's selection no longer resolved in the child (say its environment selected the cloud backend without an API key). They now leave the backend alone; the child's first call that uses it takes it over, as before.

• Fork safety no longer identifies a process by its pid alone. A forked process that the kernel had given the pid of an ancestor whose SDK state it inherited (the pid counter wrapped onto exactly that value, with no SDK call in between) was taken for that ancestor: it would have used the inherited runtime, backend and handles instead of rebuilding them or raising ForkedHandleError. The extension now counts forks with a pthread_atfork child handler and identifies a process by its pid and that count together. ForkedHandleError's message no longer names one pid as two processes when the pids are equal.

Security

• rustls 0.23.45 → 0.23.46 (a transitive dependency, through the network stack's DNS client and the HTTP client). Fixes RUSTSEC-2026-0346 (Debug output of client session values exposed TLS secrets), RUSTSEC-2026-0347 (buffered application data sent to the outer server after ECH rejection), RUSTSEC-2026-0348 (Brotli certificate decompression could allocate up to

... (truncated)

Commits

• e6c5e2f Merge pull request #91 from ya-luotao/chore/release-0.17.4
• c09dc53 docs(changelog): note the rustls advisory fix in 0.17.4
• 5e9a367 Merge remote-tracking branch 'origin/main' into chore/release-0.17.4
• cdf456d Merge pull request #92 from ya-luotao/build/rustls-0.23.46
• ac9cffd build(deps): bump rustls to 0.23.46
• 1442f0d chore(release): 0.17.4
• 9061eaf Merge pull request #90 from ya-luotao/fix/fork-generation
• e6adafd Merge remote-tracking branch 'origin/main' into fix/fork-generation
• aa79310 Merge pull request #89 from ya-luotao/fix/install-no-backend-rebuild
• 9b46b17 Merge remote-tracking branch 'origin/main' into fix/install-no-backend-rebuild
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Looks like microsandbox-rb is up-to-date now, so this is no longer needed.