Repository navigation
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
I think there is a bot which handles version bumps, but it was last ran ~20h ago? 🤔 |
|
Thanks! I think the bot is fine — the release entries were added to FYI, this PR is exactly what |
|
This release has not been officially announced as fixing a Ruby vulnerability, but it includes a fix for an issue that GitLab, a Ruby user, treats as a vulnerability (CVE-2026-110264). So it would be great if this could be merged soon. Thanks for your consideration! https://www.ruby-lang.org/en/news/2026/10/23/ruby-4-0-9-released/ |
|
Would it be possible to consider some sort of a solution so that Ruby releases containing critical security fixes are built and published as soon as possible after the official release? |
Or just increase the frequency with which the bot runs from daily to e.g. hourly. |
|
The bot has picked up the update in 566c0b5, so I'm closing this. Thanks! |
Ruby 3.4.12 and 4.0.9 were released today (2026-10-23) with a fix for CVE-2026-110264, but docker-library/ruby has not published images for them yet (docker-library/ruby#531 is still open), so `FROM ruby:X.Y.Z-slim` has nothing to pull. ruby/Dockerfile now has two base stages selected by the BASE_IMAGE build arg: `official` (the Docker Hub image, the default and unchanged behaviour) and `source`, a copy of upstream's 4.0/slim-trixie/Dockerfile from that pull request that builds Ruby from the tarball on cache.ruby-lang.org and verifies it against RUBY_DOWNLOAD_SHA256. Only the selected stage is built, so the existing versions are unaffected. The workflow matrix gets an `include` list for versions without an official image; each entry carries the tarball sha256 from ruby-lang.org. Move an entry to the plain list once upstream publishes the image and it goes back to the official base.
🤖 Generated with Claude Code