What's Changed This release includes the following security fixes. CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / def_class This release updates the default gem erb to 4.0.3.1 and the bundled gem net-imap to 0.4.25. The net-imap update fixes CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258, CVE-2026-47240, CVE-2026-47241 and CVE-…
What's Changed Bug #22070: Thread.each_caller_location(1, 1) segfaults when called from a cfunc - Ruby - Ruby Issue Tracking System Bug #22075: heap-use-after-free in rb_vm_ci_lookup under parallel Ractors - Ruby - Ruby Issue Tracking System Bug #22076: defined? returns nil for protected methods defined in a module even when callable - Ruby - Ruby Issue Tracking System Bug #22072: [BUG] should hav…
What's Changed Bug #21992: Defining BasicObject#initialize causes segmentation fault - Ruby - Ruby Issue Tracking System Bug #22004: parse.y doesn't executes loop body with while true || true condition - Ruby - Ruby Issue Tracking System Bug #22018: ISeq created via RubyVM::InstructionSequence.compile don't support coverage - Ruby - Ruby Issue Tracking System Bug #21941: Local variable becomes nil…
What's Changed CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler Bug #22065: make rdoc fails with invalid byte sequence in US-ASCII on Ruby 4.0.4 under C locale - Ruby - Ruby Issue Tracking System Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing. Full Changelog v4.0.4...v4.0.5
What's Changed Bug #21955: Fiber#transfer: machine stack not released when fiber terminates, causing FiberError: can't set a guard page - Ruby - Ruby Issue Tracking System Bug #21964: Fiber stack acquire can expand unnecessarily - Ruby - Ruby Issue Tracking System Bug #21971: Fix regexp performance regression for patterns starting with s/k - Ruby - Ruby Issue Tracking System Bug #21961: Marshal.lo…
What's Changed Prohibit def_method on marshal-loaded ERB instances (CVE-2026-41316) Full Changelog v4.0.2...v4.0.3
What's Changed Bug #21715: Miscompilation on x86-64-v2 due to undefined behavior in search_nonascii in string.c - Ruby - Ruby Issue Tracking System Bug #21629: Ruby-3.4.7 prints -Wdefault-const-init-field-unsafe warnings on clang / llvm 21 - Ruby - Ruby Issue Tracking System Note: This list is automatically generated by tool/gen-github-release.rb. Because of this, some commits may be missing. Full…
What's Changed Bug #21625: Allow IO#wait_readable together with IO#ungetc even in text mode - Ruby - Ruby Issue Tracking System Fix indents in Onigmo files to use spaces instead of tabs by makenowjust · Pull Request #14047 Bug #13671: Regexp with lookbehind and case-insensitivity raises RegexpError only on strings with certain characters - Ruby - Ruby Issue Tracking System Bug #21560: RUBY_MN_THRE…
What's Changed Bug #21941: Local variable becomes nil when YJIT enabled mid-method with fork/signal/ensure - Ruby - Ruby Issue Tracking System Bug #21832: segfault with argument forwarding, when combined with splat & positional arg - Ruby - Ruby Issue Tracking System Bug #21723: binding.irb raises a LoadError under bundle exec when Gemfile contains path: or git: - Ruby - Ruby Issue Tracking System…
What's Changed Bug #21715: Miscompilation on x86-64-v2 due to undefined behavior in search_nonascii in string.c - Ruby - Ruby Issue Tracking System Bug #21787: IO::Buffer Integer Overflow in Range Validation Leads to Out-of-Bounds Memory Access - Ruby - Ruby Issue Tracking System Bug #21757: Splatted args array is mutated when passing unexpected kwargs - Ruby - Ruby Issue Tracking System Bug #2132…
This release includes the following security fixes: CVE-2025-61594: URI Credential Leakage Bypass previous fixes | Ruby CVE-2025-58767: DoS vulnerability in REXML | Ruby and the following fixes for some issues: Build issue of using Ruby 4.0 with BASERUBY at Windows platform Issue with OpenSSL 3.6.0 What's Changed Backport post_push.yml workflow to ruby_3_2 by k0kubun · Pull Request #14771 Backport…
What's Changed Bug #21812: Kernel#sleep without arguments returns immediately when subprocess exits in another thread (regression in Ruby 4.0) - Ruby - Ruby Issue Tracking System Bug #21828: An incorrect warning message related to benchmark is shown when using benchmark-ips - Ruby - Ruby Issue Tracking System Bug #21811: Fix underflow in Array#pack - Ruby - Ruby Issue Tracking System Bug #21814: 0…