[renovate]

This PR contains the following updates:

Package	Type	Update	Change
ruby (source)		patch	3.4.9 → 3.4.12
ruby (source)	tools	patch	3.4.9 → 3.4.12

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

This PR updates Ruby from 3.4.9 to 3.4.12, spanning three patch releases (3.4.10, 3.4.11, and 3.4.12). These are maintenance releases within the same minor version series.

Ruby 3.4.10 (June 30, 2026):

• Updated bundled gem net-imap to v0.5.15 with security fixes for:
  • CVE-2026-47240 (Moderate): Command injection via non-synchronizing literal
  • CVE-2026-47242 (Moderate): Command injection via unvalidated ID and ENABLE arguments
  • CVE-2026-47241 (Low): Denial of service via incomplete raw argument validation
• 24 bug fixes including BasicObject segfault prevention, YJIT improvements, memory leak fixes, and parser corrections

Ruby 3.4.11 (September 23, 2026):

• 34 bug fixes focused on memory safety and stability
• Critical fixes: heap-use-after-free in fiber switching, buffer overflow in array operations, UAF in string unpack
• Platform-specific improvements for Windows and macOS
• Parser and language feature fixes

Ruby 3.4.12 (October 23, 2026):

• CRITICAL SECURITY FIXES: Patches for Onigmo (Ruby's regex engine) bugs that enable GitLab CVEs:
  • CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264
  • These vulnerabilities allow unauthenticated RCE (CVSS 10.0) when user-controlled regex patterns are compiled
  • Fixes: double-free for excessive repetition quantifiers, parse tree memory leaks, overflow detection
• 13 total bug fixes including IO operations, memory safety improvements, threading/process fixes

Breaking Changes: None. These are patch releases following semantic versioning with full backward compatibility maintained.

🎯 Impact Scope Investigation

Ruby Runtime Usage in Sandbox:

• Ruby 3.4.x is installed via mise and bound to /mise/installs/ruby/current in the Docker image
• Pre-installed gems: base64 0.3.0, csv 3.3.5, fiddle 1.1.8 (defined in internal/sandbox/defaults/ruby/Gemfile)
• The sandbox executes user-submitted Ruby code in isolated nsjail environments with resource limits
• E2E tests cover: basic I/O, error handling, class/inheritance, regex usage, JSON, arrays, hashes, iterators, and pre-installed gems

Security Consideration - Onigmo CVEs:
The regex engine vulnerabilities (CVE-2026-110264, etc.) are particularly relevant to code execution sandboxes. However, the sandbox's threat model already assumes user code can attempt malicious actions:

• Users submit arbitrary Ruby code that runs inside nsjail isolation
• The regex vulnerabilities require compiling attacker-controlled regex patterns, which users can already do freely in their submitted code
• nsjail provides process isolation, namespace isolation, seccomp filtering, and resource limits regardless of what the Ruby runtime does
• The vulnerabilities don't bypass sandbox protections - they would only affect the sandboxed Ruby process itself, which is already untrusted

Configuration Changes:

• Only version numbers updated in Dockerfile (ARG RUBY_VERSION) and mise.toml
• No API changes, no dependency conflicts, no configuration adjustments needed

Other Dependencies:

• No impact on Go server code, nsjail configuration, or other runtimes
• Pre-installed gems remain compatible (no version changes required)

💡 Recommended Actions

Immediate Actions:

1. ✅ Merge this PR - The update is safe and brings important security fixes
2. ✅ No code changes required - Full backward compatibility maintained
3. ✅ Run E2E tests after merge to verify Ruby runtime functionality (standard practice)

Testing Priority:

• E2E test suite at e2e/tests/runtime/ruby.yml and e2e/tests/runtime/ruby_stdin.yml should all pass
• Security tests that exercise Ruby runtime should continue working unchanged

Post-Merge:

• Monitor for any unexpected behavior in Ruby sandbox executions (unlikely given patch release stability)
• The Onigmo security fixes improve defense-in-depth even though the sandbox already isolates untrusted code

🔗 Reference Links

Official Release Announcements:

• Ruby 3.4.10 Released
• Ruby 3.4.11 Released
• Ruby 3.4.12 Released

GitHub Release Notes:

• v3_4_10 on GitHub
• v3_4_11 on GitHub
• v3_4_12 on GitHub

Security Vulnerabilities:

• net-imap v0.5.15 Security Fixes
• Ruby Fixes Onigmo Bugs Behind Four GitLab CVEs
• Ruby Patches Onigmo Regex Bugs - Glitchwire
• GitLab CVE-2026-110264 RCE: Fixed Versions

Generated by koki-develop/claude-renovate-review