With a subexp call, the result of unset_addr_list_fix overwrote the error, so a pattern over the limit compiled without raising RegexpError.
Follow-up to cf35145fc4.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 16d8a554b2)
Concatenated large repeats reach a program past INT_MAX from a few hundred
kilobytes of source, and the offsets emitted into it wrap. Cap the size
while the program is emitted, which does not depend on the length pass that
overflows along with it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit cf35145fc4)
Nested bounded repeats let the int product tlen * qn->lower overflow, so
the check that keeps the compiler from unrolling a large repeat could pass
for an enormous one, hanging the compile or emitting wrapped jump offsets.
Compare against the limit by division instead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 7cfe8dc82f)
Add explicit errors for excessive range-repeat and null-check IDs;
map new errors in regerror; add regression tests for oversized generated
patterns.
(cherry picked from commit 493d26dcde)
Prevent double free for too big repetition quantifiers
The previous implementation calls `free(node)` twice (on parsing and compiling a
regexp) when it has an error, so it leads to a double-free issue. This
commit enforces `free(node)` once by introducing a temporal pointer to hold
parsing nodes.
(cherry picked from commit 35000ac2ed)
CI: mingw: Use the official actions for msys2
Because ruby/setup-ruby is affected to test result.
Also includes the prerequisite changes from e4b386e090, 90f8199412,
a443cd012a and 4adb6f6969 (Remove Strawberry Perl pkg-config, misc
system & package info, `cmd` as the default shell, set up msys2
environment variables).
(cherry picked from commit 98ec35899b, adapted to the mingw workflow on ruby_3_3)
setup-ruby v1.236.0 raises "Cannot find Git's cert file" on Windows
runners because Git for Windows moved from mingw64 to ucrt64.
This was fixed in ruby/setup-ruby#947 (v1.328.0).
(cherry picked from commit 89856b96b1, adapted to the workflows on ruby_3_3)
C23 has qualifier-preserving standard library functions, so calling
strchr with a `const char *` will return a `const char *`. We can change
the type of the local variables because we don't mutate the strings.
(cherry picked from commit e068856616)
The result jobs in macOS workflows only check if other jobs failed
(just runs `exit 1`). They don't need macOS runners. Using
ubuntu-latest instead frees up macOS runner slots and starts faster
due to shorter queue times.
To account for cases where binaries for older OS versions are built
using the new SDK, check at runtime whether the API functions are
available actually.
[Bug #21703]
RUBY_CRASH_REPORT does not work in some cases when shelling out on Linux.
For example, given the following shell script dump.sh:
#!/usr/bin/env bash
cat > /tmp/crash
And we see it fails like this:
$ RUBY_CRASH_REPORT="|dump.sh" ruby -rfiddle -e "Fiddle::Pointer.new(1, 10)[0]"
cat: -: Resource temporarily unavailable
MSYS2 dropped perl from its base install and the windows-2022 runner
image picked that up in 20260818.277.1, so autogen.sh now dies with
`/usr/bin/perl: bad interpreter`. master and ruby_4_0 set up their own
MSYS2 with autoconf, which pulls perl in as a dependency, so only the
branches that reuse the image MSYS2 need this.
https://github.com/actions/runner-images/issues/14562
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The full macOS fan-out (10 jobs, about 117 runner-minutes) repeats
test tasks that macos.yml already runs from the git tree on every
event; what is tarball-specific is only that the packaged tarball
configures, builds and installs. Run a single check on macos-26 for
pull requests and pushes, and keep the full matrix for
workflow_dispatch, which is how the nightly schedule and release
verification invoke it. Only macOS is trimmed: its org-wide
concurrency pool of 50 runners saturates during peak hours and has
been delaying release jobs, while Linux and Windows share a pool with
headroom.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit df977545f0)
The cache step hardcoded snapshot-*, which no longer matches when this
reusable workflow is called with a release archname such as
ruby-3.4.0-rc1 from ruby/actions, turning cache save and restore into
a no-op.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 674e93935c)
Backport of the June 2026 net-imap security releases to the v0.4 line.
CVE-2026-47240
CVE-2026-47242
CVE-2026-47241
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Since Git 2.46, commands like `git commit` spawn a detached
`git maintenance run --auto` process, which briefly creates
`.git/objects/maintenance.lock`. Specs copying a just-committed
repository with FileUtils.cp_r can hit the lock file disappearing
between readdir and lstat, causing flaky Errno::ENOENT failures on
macOS CI runners with newer Git.
https://github.com/ruby/ruby/actions/runs/28764006107/job/85284933867
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
`/..%5c../` resolves the backslash as a path separator on Windows, so the
vendored FileHandler returns 404 instead of the expected 200 and logs a
nondisclosure warning, breaking the daily Windows snapshot CI. This vendored
test only remains on ruby_3_3; 3.4 and later removed it together with WEBrick.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
openssl@1.1 is no longer available on the macos-26 runner image. Build
against openssl@3, matching master (18404af9ec), so the macos-26 check
job can install its dependencies.
The macos-15-intel runner image ships a pre-installed Ruby under
/usr/local whose default-gem dir collides with the build's on the 3.3.0
ABI path. During `make check`, the test-tool autoloads rake and scans
default-gem stubs there, hitting a stale bundler stub and failing with
ENOENT. Build under an isolated prefix on that runner only. Backport of
master #17339.
The macos-15 runner image ships a pre-installed Ruby under /usr/local
whose default-gem directory shares the 3.3.0 ABI path with the snapshot
build. With the default prefix, RDoc generation scans that directory and
dies on a stale bundler default-gem stub left by the runner's RubyGems
self-update. Build, install and verify under an isolated prefix instead.
(cherry picked from commit dc24122d90)
Dir.each_child yields entry names, so stat/digest/children ran against
the working directory instead of HOME. Join dir and name first.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Now that win32/Makefile.sub passes XINCFLAGS so the gmp headers under
--with-opt-dir are visible to cl.exe (bug #22078), the gmp build no
longer fails. Restore gmp to the vcpkg install to match master.
Make macos-26 the default runner for the tarball build verification and
keep macos-15, macos-15-intel, and macos-14 as regression coverage.
(cherry picked from commit 5c762e786b)
Replace secrets: inherit with explicit Slack webhook secrets, which are
the only secrets the ubuntu/macos/windows builds use. tarball-non-development
uses no secrets, so drop inherit there entirely.
(cherry picked from commit daea48078c)
The subsequent git steps only fetch from the public origin and operate
on local branches, so the token does not need to be persisted.
(cherry picked from commit f00e912db0)
The composite is blob-identical across branches after PR #17063 lands
everywhere, so pointing maintenance branches at master removes the
need to re-cherry-pick future fixes. The local copy stays in place
because ruby/actions still calls it via ruby/ruby/.github/actions/make-snapshot@<branch>.
Hiroshi SHIBATA