[renovate-coveo]

This PR contains the following updates:

Package	Type	Update	Change	Pending
ruby (source)	uses-with	patch	4.0.0 → 4.0.7	4.0.9 (+1)
step-security/harden-runner	action	minor	v2.19.4 → v2.22.2	v2.22.3

[skip release]

---

Release Notes

ruby/ruby (ruby)

v4.0.7: 4.0.7

Compare Source

What's Changed

• Bug #​22188: addr2line doesn't find symbols when compiled with GCC LTO - Ruby - Ruby Issue Tracking System
• Bug #​22210: Check if issue #​19969 is still reproducible / re-opened in 4.0.x - Ruby - Ruby Issue Tracking System
• Bug #​22217: Segmentation fault when resuming execution with Coverage.start and ruby/debug - Ruby - Ruby Issue Tracking System
• Fix formatting in ObjectSpace._id2ref error path by eregon · Pull Request #​18206
• Bug #​22200: ObjectSpace._id2ref can return a different object than the id's owner on Ruby 4.0 (stale id2ref_tbl entry for objects with generic fields) - Ruby - Ruby Issue Tracking System
• Bug #​22123: Ruby::Box + BUNDLER_SETUP can evaluate gemspecs before main-box RubyGems initialization - Ruby - Ruby Issue Tracking System
• Bump ERB to 6.0.7 by k0kubun · Pull Request #​18282
• Bug #​22237: GC.auto_compact corrupts a String or segfaults from String#tr with dup or gsub - Ruby - Ruby Issue Tracking System
• Bug #​22243: Change fork behavior when Process._fork raises an exception during fork with a block argument - Ruby - Ruby Issue Tracking System
• Bug #​22223: Socket.tcp with connect_timeout returns a phantom "connected" socket for a refused connection on macOS 27 (kernel answers EISCONN on connect retry; SO_ERROR never consulted) - Ruby - Ruby Issue Tracking System
• Bug #​22220: Performance regression when requiring aws-sdk-ec2 in Ruby 4.0.6 - Ruby - Ruby Issue Tracking System
• Bug #​22218: Line TracePoint misses executed loop condition after a guard - Ruby - Ruby Issue Tracking System
• Bug #​22198: win32: heap overflow in Kernel#system - Ruby - Ruby Issue Tracking System
• Bug #​22196: Heap-use-after-free in fiber_switch with transfer-terminated async tasks on 3.4.10 - Ruby - Ruby Issue Tracking System
• Bug #​22190: Class#subclasses does not include clones of classes that include modules - Ruby - Ruby Issue Tracking System
• Bug #​11438: native_thread_init_stack() get machine.stack_start unequal to thread's stack start address, x86 win32 - Ruby - Ruby Issue Tracking System
• Bug #​22257: Prepending a module to an already-included module leaves stale super caches - Ruby - Ruby Issue Tracking System
• Bug #​22242: SEGV in method dispatch (vm_call_iseq_setup_kwparm_nokwarg / def_iseq_ptr) on Ruby 4.0.6 — Rails CI - Ruby - Ruby Issue Tracking System
• Bug #​22269: Coverage.line_stub clobbers already-collected coverage data - Ruby - Ruby Issue Tracking System
• Bug #​22290: Adding instance variables to anonymous object may bloat all future classes - Ruby - Ruby Issue Tracking System
• Bug #​22292: YJIT/ZJIT: Struct accessor crashes after an instance variable is set on a Struct that exactly fills the largest GC slot - Ruby - Ruby Issue Tracking System
• Bug #​20958: fix ENV.keys encoding on windows - Ruby - Ruby Issue Tracking System
• Bug #​22259: Arrays sharding a buffer segfault when concatenating with each other - Ruby - Ruby Issue Tracking System
• Bug #​22264: Warning missing from parse.y hash literals - Ruby - Ruby Issue Tracking System
• Bug #​22303: EncodingError from interpolating symbol crashes whole process - Ruby - Ruby Issue Tracking System
• Bug #​22224: YJIT: rb_yjit_invalidate_ep_is_bp takes the VM lock stopping Ractors on every Proc materialization; multi-Ractor throughput collapses (up to ~150x) - Ruby - Ruby Issue Tracking System

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

v4.0.6: 4.0.6

Compare Source

What's Changed

• Bug #​22070: Thread.each_caller_location(1, 1) segfaults when called from a cfunc - Ruby - Ruby Issue Tracking System
• Bug #​22075: heap-use-after-free in rb_vm_ci_lookup under parallel Ractors - Ruby - Ruby Issue Tracking System
• Bug #​22076: defined? returns nil for protected methods defined in a module even when callable - Ruby - Ruby Issue Tracking System
• Bug #​22072: [BUG] should have cvar cache entry - Ruby - Ruby Issue Tracking System
• Bug #​22074: YJIT misaligns locals when there are > 256 local variables - Ruby - Ruby Issue Tracking System
• Bug #​22064: GC compaction breaks compare-by-identity sets - Ruby - Ruby Issue Tracking System
• Bug #​22084: invokesuper from define_method in Ractor can call wrong super method or crash - Ruby - Ruby Issue Tracking System
• Bug #​22092: Array#sum takes slow path, does not perform compensated summation of Float elements when init argument is a Float - Ruby - Ruby Issue Tracking System
• Bug #​14635: Float#round(n) returns a wrong result when n is big - Ruby - Ruby Issue Tracking System
• Bug #​22079: Float#ceil gives incorrect result - Ruby - Ruby Issue Tracking System
• Bug #​22096: Freeing a mutex locked by a fiber inside fiber scheduler can crash - Ruby - Ruby Issue Tracking System
• Bug #​21996: Crash when modifying instance variables during inspect or Marshal dump - Ruby - Ruby Issue Tracking System
• Bug #​22101: ASAN heap-use-after-free in rb_data_free after TypedData dfree frees dynamic rb_data_type_t - Ruby - Ruby Issue Tracking System
• Bug #​22103: Constant-folded /o regexp crashes with dupstring of a Regexp - Ruby - Ruby Issue Tracking System
• Bug #​21991: $! stays as the first exception in Ruby Box - Ruby - Ruby Issue Tracking System
• Feature #​21881: Split the root box into the (newer) root box and the master of copied user boxes - Ruby - Ruby Issue Tracking System
• Bug #​22120: Segfault caused by ar_find_entry_hint() not checking for conversion to st_table - Ruby - Ruby Issue Tracking System
• Bug #​22129: error_highlight raises NotImplementedError for ArgumentErrors that get wrapped - Ruby - Ruby Issue Tracking System
• Bug #​21864: Inconsistencies in type coercion error messages for integers - Ruby - Ruby Issue Tracking System
• Bug #​21882: IO::Buffer#locked leaves the buffer locked when the block raises - Ruby - Ruby Issue Tracking System
• Bug #​22127: parse.y regexp crash on invalid encoding - Ruby - Ruby Issue Tracking System
• Bug #​22126: Stack underflow for partial DCE and loops - Ruby - Ruby Issue Tracking System
• Bug #​22124: void value missed in parse.y - Ruby - Ruby Issue Tracking System
• Bug #​22104: Segfault in PRISM while Bootsnap compiles aws-sdk client_api.rb - Ruby - Ruby Issue Tracking System
• Bug #​21685: Unnecessary context-switching, especially bad on multi-core machines. - Ruby - Ruby Issue Tracking System
• Bug #​22099: Keyword-only method silently accepts a positional argument - Ruby - Ruby Issue Tracking System
• Bug #​22183: parse.y interpolation inside lambda literal - Ruby - Ruby Issue Tracking System
• Bug #​22181: SEGV in branch peephole optimization due to label/insn struct aliasing - Ruby - Ruby Issue Tracking System
• Bug #​22133: Ruby's default SIGINT handling ignores Thread.handle_interrupt masking. - Ruby - Ruby Issue Tracking System
• Bug #​22189: Enumerator::Lazy#to_enum does not accept method names as strings - Ruby - Ruby Issue Tracking System
• Bug #​22191: Signal.trap(:EXIT) exception only shown if at_exit also raises - Ruby - Ruby Issue Tracking System

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

v4.0.5: 4.0.5

Compare Source

What's Changed

• CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler
• Bug #​22065: make rdoc fails with invalid byte sequence in US-ASCII on Ruby 4.0.4 under C locale - Ruby - Ruby Issue Tracking System

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

v4.0.4: 4.0.4

Compare Source

What's Changed

• Bug #​21955: Fiber#transfer: machine stack not released when fiber terminates, causing FiberError: can't set a guard page - Ruby - Ruby Issue Tracking System
• Bug #​21964: Fiber stack acquire can expand unnecessarily - Ruby - Ruby Issue Tracking System
• Bug #​21971: Fix regexp performance regression for patterns starting with s/k - Ruby - Ruby Issue Tracking System
• Bug #​21961: Marshal.load freeze option fail to freeze linked strings - Ruby - Ruby Issue Tracking System
• Bug #​21959: rb_internal_thread_event_hooks_rw_lock is not reinitialized after fork causing deadlocks - Ruby - Ruby Issue Tracking System
• Bug #​21954: NoMethodError instead of Gem::LoadError on gem activation problem in Ruby 4.0.2 - Ruby - Ruby Issue Tracking System
• Bug #​21844: Inconsistent ArgumentError message for Data::define.new - Ruby - Ruby Issue Tracking System
• Bug #​21992: Defining BasicObject#initialize causes segmentation fault - Ruby - Ruby Issue Tracking System
• Bug #​22018: ISeq created via RubyVM::InstructionSequence.compile don't support coverage - Ruby - Ruby Issue Tracking System
• Bug #​21985: RubyVM::AST negative numbers do not include - in location - Ruby - Ruby Issue Tracking System
• Bug #​21986: RubyVM::AST incorrect location for literals followed by modifier if - Ruby - Ruby Issue Tracking System
• Bug #​21933: Ruby::Box: named capture local variable can become nil after non-matching lines - Ruby - Ruby Issue Tracking System
• Bug #​21940: Ruby::Box: $_ returns stale value due to gvar_tbl caching - Ruby - Ruby Issue Tracking System
• Bug #​22004: parse.y doesn't executes loop body with while true || true condition - Ruby - Ruby Issue Tracking System
• Bug #​21952: Ruby::Box double free at process exit when fiddle/import is required in multiple boxes - Ruby - Ruby Issue Tracking System
• Bug #​22003: .bundle extensions not built when doing out-of-source build - Ruby - Ruby Issue Tracking System
• Bug #​22002: argument stack underflow (-1) - Ruby - Ruby Issue Tracking System

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

v4.0.3: 4.0.3

Compare Source

What's Changed

• Prohibit def_method on marshal-loaded ERB instances (CVE-2026-41316)

Full Changelog

v4.0.2: 4.0.2

Compare Source

What's Changed

• Bug #​21941: Local variable becomes nil when YJIT enabled mid-method with fork/signal/ensure - Ruby - Ruby Issue Tracking System
• Bug #​21832: segfault with argument forwarding, when combined with splat & positional arg - Ruby - Ruby Issue Tracking System
• Bug #​21723: binding.irb raises a LoadError under bundle exec when Gemfile contains path: or git: - Ruby - Ruby Issue Tracking System
• Bug #​21847: Backport syntax_suggest 2.0.3 to supported branches - Ruby - Ruby Issue Tracking System
• Bug #​21866: Backport Fix for integer overflow checks in enumerator - Ruby - Ruby Issue Tracking System
• Bug #​21865: Crash on signal raise - Ruby - Ruby Issue Tracking System
• Bug #​21842: Encoding of rb_interned_str - Ruby - Ruby Issue Tracking System
• Bug #​21838: Rails seeing degradation (20% slowdown) related to Revision 079ef92b "Implement global allocatable slots and empty pages" (from Sep 5 2024) - Ruby - Ruby Issue Tracking System
• Bug #​21873: UnboundMethod#== returns false for methods from included/extended modules - Ruby - Ruby Issue Tracking System
• ZJIT: Avoid runtime exceptions from RubyVM::ZJIT.stats_string by k0kubun · Pull Request #​16139
• Bug #​21931: GC Crash in String#% (backport 726205b354d1068147719fb42e1de743f1838ef1) - Ruby - Ruby Issue Tracking System
• Bug #​21944: "Cannot allocate memory" with M:N threads or Ractors on a low RAM Linux machine - Ruby - Ruby Issue Tracking System
• Bug #​21946: and? predicate confused for leading and keyword - Ruby - Ruby Issue Tracking System
• Bug #​21927: Prism: misleading error message for forwarding in lambda argument - Ruby - Ruby Issue Tracking System
• Bug #​21925: Prism misparses standalone "in" pattern matching in "case/in" - Ruby - Ruby Issue Tracking System
• Bug #​21828: An incorrect warning message related to benchmark is shown when using benchmark-ips - Ruby - Ruby Issue Tracking System
• Bug #​21917: Unable to build 4.0.1 on AIX 7.2 - Ruby - Ruby Issue Tracking System
• Bug #​21945: Ripper lexes newline between identifier and and? as ignored newline - Ruby - Ruby Issue Tracking System
• Bug #​21947: Timeout.timeout doesn't use Timeout::ExitException when Fiber scheduler is in use. - Ruby - Ruby Issue Tracking System
• Bug #​21926: Thread#value on popen3 wait thread hangs in finalizer - Ruby - Ruby Issue Tracking System
• Bug #​21880: The ultra_safe mode of pstore bundled with Ruby 4.0 is broken. - Ruby - Ruby Issue Tracking System
• Bug #​21097: x = a rescue b in c and def f = a rescue b in c parsed differently between parse.y and prism - Ruby - Ruby Issue Tracking System

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

v4.0.1: 4.0.1

Compare Source

What's Changed

• Bug #​21812: Kernel#sleep without arguments returns immediately when subprocess exits in another thread (regression in Ruby 4.0) - Ruby - Ruby Issue Tracking System
• Bug #​21828: An incorrect warning message related to benchmark is shown when using benchmark-ips - Ruby - Ruby Issue Tracking System
• Bug #​21811: Fix underflow in Array#pack - Ruby - Ruby Issue Tracking System
• Bug #​21814: 0.pow(2,-9999999999999999990) should be zero - Ruby - Ruby Issue Tracking System
• Bug #​21819: A Data object should be frozen even if it has no members - Ruby - Ruby Issue Tracking System

Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing.

Full Changelog

step-security/harden-runner

v2.22.2

Compare Source

What's Changed

• Fixed inbound (ingress) network traffic being incorrectly classified as outbound (egress) traffic on macOS
• Fixed implicit endpoints intended for self-hosted runners being applied to custom VM environments on Linux (enterprise tier)
• Improved network and DNS tracing, enforcement logic, and process information correlation on Linux (enterprise tier)

Full Changelog: step-security/harden-runner@v2.22.1...v2.22.2

v2.22.1

Compare Source

What's Changed

• Fixed security rules not initializing on GHES self-hosted runners
• Fixed GHES connectivity in block mode by implicitly allowing the GHES hostname

Full Changelog: step-security/harden-runner@v2.22.0...v2.22.1

v2.22.0

Compare Source

What's Changed

• Linux ARM64 support for community tier
• GHES support for self-hosted VMs (enterprise tier)
• MacOS and Windows runner deny list support for block policy (enterprise tier).

Full Changelog: step-security/harden-runner@v2.21.1...v2.22.0

v2.21.1

Compare Source

What's Changed

• Improved performance of the disable-sudo feature.
• Fixed an issue in the Community tier where new endpoints required by the GitHub Actions runner were not being implicitly allowed in block mode.
• Fixed the Harden-Runner post step failing on Linux distributions that do not have a merged /usr filesystem layout (for example Debian 11), where /usr/bin/echo does not exist. This mainly affected self-hosted runners.
• Documentation updates: clarified which features are in the Community (free) vs Enterprise tier.

Full Changelog: step-security/harden-runner@v2.21.0...v2.21.1

v2.21.0

Compare Source

What's Changed

• Support for denied endpoints in block mode. This is included in the enterprise tier. Customers can deny outbound calls, for example, to public package registries.
• Improved Support for AWS CodeBuild GitHub Actions Runners.
• Bug fixes.

Full Changelog: step-security/harden-runner@v2.20.1...v2.21.0

v2.20.1

Compare Source

What's Changed

• AWS CodeBuild-hosted runner support
• Implicitly allow single-labeled (internal) domains in block-mode

Full Changelog: step-security/harden-runner@v2.20.0...v2.20.1

v2.20.0

Compare Source

What's Changed

• Support for block policy for MacOS and Windows GitHub-hosted runners
• Support for Bitrise MacOS GitHub Actions runners
• HTTPS monitoring support for Bun for Linux runners (enterprise tier)

Full Changelog: step-security/harden-runner@v2.19.4...v2.20.0

---

Configuration

📅 Schedule: (in timezone America/Toronto)

• Branch creation
  • "before 6:00am on Tuesday"
• Automerge
  • "after 9:00am and before 12:00pm on tuesday, wednesday, thursday"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[svcsnykcoveo]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.