Wednesday, March 25, 2026

Update: Ruby 3.3.11

Simple update to the latest version of Ruby 3.3. Release notes at:
https://www.ruby-lang.org/en/news/2026/03/26/ruby-3-3-11-released/

Fixes CVE-2026-27820: Buffer overflow vulnerability in Zlib::GzipReader

One of our patches was merged upstream.

Tested on amd64. I'll be committing in a couple days unless I hear
objections.

If someone could handle the -stable backport, I would appreciate it.

Best,
Jeremy

Index: Makefile
===================================================================
RCS file: /cvs/ports/lang/ruby/3.3/Makefile,v
retrieving revision 1.20
diff -u -p -u -p -r1.20 Makefile
--- Makefile 25 Mar 2026 07:01:44 -0000 1.20
+++ Makefile 26 Mar 2026 02:48:15 -0000
@@ -1,8 +1,7 @@
# used to work, but perhaps this was changed by the LLVM update
USE_NOBTCFI-aarch64 = Yes

-VERSION = 3.3.10
-REVISION = 1
+VERSION = 3.3.11
DISTNAME = ruby-${VERSION}
PKGNAME-main = ruby-${VERSION}
PKGNAME-ri_docs = ruby${BINREV}-ri_docs-${VERSION}
Index: distinfo
===================================================================
RCS file: /cvs/ports/lang/ruby/3.3/distinfo,v
retrieving revision 1.11
diff -u -p -u -p -r1.11 distinfo
--- distinfo 24 Oct 2025 13:26:13 -0000 1.11
+++ distinfo 26 Mar 2026 02:48:15 -0000
@@ -1,2 +1,2 @@
-SHA256 (ruby-3.3.10.tar.gz) = tVW6pGejBs/I5sbtJNDSeyfpob7R2R2VUJhZ6saw6Sg=
-SIZE (ruby-3.3.10.tar.gz) = 22233705
+SHA256 (ruby-3.3.11.tar.gz) = WfD6+xpZoF3DdlEXrz+mjhU+tIJUcIVJ8yHB6eB416A=
+SIZE (ruby-3.3.11.tar.gz) = 21483089
Index: patches/patch-configure
===================================================================
RCS file: /cvs/ports/lang/ruby/3.3/patches/patch-configure,v
retrieving revision 1.8
diff -u -p -u -p -r1.8 patch-configure
--- patches/patch-configure 24 Oct 2025 13:26:13 -0000 1.8
+++ patches/patch-configure 26 Mar 2026 02:48:15 -0000
@@ -35,7 +35,7 @@ Index: configure
;; #(
solaris*) :

-@@ -34136,7 +34136,7 @@ then :
+@@ -34137,7 +34137,7 @@ then :

else $as_nop

Index: patches/patch-ext_extmk_rb
===================================================================
RCS file: /cvs/ports/lang/ruby/3.3/patches/patch-ext_extmk_rb,v
retrieving revision 1.2
diff -u -p -u -p -r1.2 patch-ext_extmk_rb
--- patches/patch-ext_extmk_rb 25 Apr 2024 22:04:30 -0000 1.2
+++ patches/patch-ext_extmk_rb 26 Mar 2026 02:48:15 -0000
@@ -3,7 +3,7 @@ Build extensions in verbose mode by defa
Index: ext/extmk.rb
--- ext/extmk.rb.orig
+++ ext/extmk.rb
-@@ -722,7 +722,7 @@ exts.map! {|d| "#{ext_prefix}/#{d}/."}
+@@ -723,7 +723,7 @@ exts.map! {|d| "#{ext_prefix}/#{d}/."}
FileUtils.makedirs(File.dirname($command_output))
begin
atomic_write_open($command_output) do |mf|
Index: patches/patch-include_ruby_internal_core_rstring_h
===================================================================
RCS file: patches/patch-include_ruby_internal_core_rstring_h
diff -N patches/patch-include_ruby_internal_core_rstring_h
--- patches/patch-include_ruby_internal_core_rstring_h 28 Nov 2025 12:41:57 -0000 1.1
+++ /dev/null 1 Jan 1970 00:00:00 -0000
@@ -1,98 +0,0 @@
-gcc15 workaround: https://github.com/ruby/ruby/pull/15113
-
-Index: include/ruby/internal/core/rstring.h
---- include/ruby/internal/core/rstring.h.orig
-+++ include/ruby/internal/core/rstring.h
-@@ -369,43 +369,8 @@ RSTRING_LEN(VALUE str)
- return RSTRING(str)->len;
- }
-
--RBIMPL_WARNING_PUSH()
--#if RBIMPL_COMPILER_IS(Intel)
--RBIMPL_WARNING_IGNORED(413)
--

No comments:

Post a Comment