From a14eae2347dbb2cef1a651ad175d0eca43b5f24b Mon Sep 17 00:00:00 2001 From: ricci-mwangela Date: Thu, 22 Oct 2026 17:28:34 +0100 Subject: [PATCH 1/4] Ruby 3.4.11 and Alpine 3.24 to pick up the eMudhra CA bundle fix The ruby:3.4.9-alpine3.22 base image was last built in April 2026 and ships ca-certificates-bundle 20260413, which still trusts the eight compromised eMudhra intermediate certificates. The image connects to the incident test hosts when it should refuse them. Alpine fixed this in ca-certificates-bundle 20261020-r0 and cut point releases on 21 October 2026: https://alpinelinux.org/posts/Alpine-3.21.9-3.22.7-3.23.7-3.24.3-released.html ruby:3.4.11-alpine3.24 was rebuilt on that base and carries the new bundle. Verified inside the built amd64 image: wget and the http gem both reject dv-g3b-emudhra and dv-g3b-aaa-emudhra .we-have-a-problem.com with a certificate error, and ws.postcoder.com still connects. Rubocop and rspec pass. --- .ruby-version | 2 +- CHANGELOG.md | 6 ++++++ Dockerfile | 2 +- Gemfile.lock | 2 +- lib/version.rb | 2 +- 5 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.ruby-version b/.ruby-version index 7bcbb38..0ce07b7 100644 --- a/.ruby-version +++ b/.ruby-version @@ -1 +1 @@ -3.4.9 +3.4.11 diff --git a/CHANGELOG.md b/CHANGELOG.md index 463088f..7a34dcc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ # CHANGELOG +## v4.5.1 _22 October 2026_ + +- Ruby 3.4.11 +- Alpine 3.24 +- Picks up ca-certificates-bundle 20261020, which removes the compromised eMudhra intermediates + ## v4.4.0 _22 October 2025_ - Add lookahead search endpoints, including find and retrieve queries diff --git a/Dockerfile b/Dockerfile index a79aa1d..8987755 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM ruby:3.4.9-alpine3.22 AS base +FROM ruby:3.4.11-alpine3.24 AS base ENV APP_HOME=/app ENV LANG=C.UTF-8 diff --git a/Gemfile.lock b/Gemfile.lock index f0b588e..6a23c3b 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -236,7 +236,7 @@ DEPENDENCIES webmock RUBY VERSION - ruby 3.4.9p82 + ruby 3.4.11p137 BUNDLED WITH 2.7.2 diff --git a/lib/version.rb b/lib/version.rb index 501fad8..6817710 100644 --- a/lib/version.rb +++ b/lib/version.rb @@ -1,3 +1,3 @@ # frozen_string_literal: true -VERSION = "4.4.0" +VERSION = "4.5.1" From d5826b4f1f2c65e5bf47f1ba3e0628832fedf1c8 Mon Sep 17 00:00:00 2001 From: ricci-mwangela Date: Tue, 27 Oct 2026 08:44:27 +0000 Subject: [PATCH 2/4] Set code owners to adviser-engineers --- .github/CODEOWNERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index cd63bf4..881be85 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1 +1 @@ -* @citizensadvice/case-management-engineers +* @citizensadvice/adviser-engineers From 7a805f99f04685d1f73d3aa527d4131571d174e5 Mon Sep 17 00:00:00 2001 From: ricci-mwangela Date: Tue, 27 Oct 2026 08:44:46 +0000 Subject: [PATCH 3/4] Ruby 3.4.12 Released 23 October 2026 with fixes for four Regexp CVEs: CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-4-12-released/ The ruby:3.4.12-alpine3.24 image is built on the same Alpine 3.24.3 base and ca-certificates-bundle 20261020-r0 as 3.4.11, so the eMudhra fix is unchanged. Verified in the built amd64 image: both eMudhra test hosts are rejected and ws.postcoder.com connects. Rubocop and rspec pass. --- .ruby-version | 2 +- CHANGELOG.md | 2 +- Dockerfile | 2 +- Gemfile.lock | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.ruby-version b/.ruby-version index 0ce07b7..25e8632 100644 --- a/.ruby-version +++ b/.ruby-version @@ -1 +1 @@ -3.4.11 +3.4.12 diff --git a/CHANGELOG.md b/CHANGELOG.md index 7a34dcc..3a73e3b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ ## v4.5.1 _22 October 2026_ -- Ruby 3.4.11 +- Ruby 3.4.12 - Alpine 3.24 - Picks up ca-certificates-bundle 20261020, which removes the compromised eMudhra intermediates diff --git a/Dockerfile b/Dockerfile index 8987755..95e0f7d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM ruby:3.4.11-alpine3.24 AS base +FROM ruby:3.4.12-alpine3.24 AS base ENV APP_HOME=/app ENV LANG=C.UTF-8 diff --git a/Gemfile.lock b/Gemfile.lock index 6a23c3b..16e5b91 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -236,7 +236,7 @@ DEPENDENCIES webmock RUBY VERSION - ruby 3.4.11p137 + ruby 3.4.12p148 BUNDLED WITH 2.7.2 From 458d764308aac5576b828811063585b592ab0776 Mon Sep 17 00:00:00 2001 From: ricci-mwangela Date: Tue, 27 Oct 2026 08:44:46 +0000 Subject: [PATCH 4/4] Update activesupport to 8.1.4 and bigdecimal to 4.1.3 Resolved with bundle lock in the Ruby 3.4.12 image. Bundle check, rubocop and rspec pass against the rebuilt image. --- Gemfile.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 16e5b91..d0dc3d9 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -15,7 +15,7 @@ GIT GEM remote: https://rubygems.org/ specs: - activesupport (8.1.3.1) + activesupport (8.1.4) base64 bigdecimal concurrent-ruby (~> 1.0, >= 1.3.1) @@ -32,7 +32,7 @@ GEM public_suffix (>= 2.0.2, < 8.0) ast (2.4.3) base64 (0.3.0) - bigdecimal (4.1.2) + bigdecimal (4.1.3) concurrent-ruby (1.3.8) connection_pool (3.0.2) crack (1.0.1)