15122 Commits
Author SHA1 Message Date
Takashi Kokubun d8cd2c2e89 [ruby/prism] Bump the remaining version references to v1.8.2
(https://github.com/ruby/prism/pull/4301)

https://github.com/ruby/prism/commit/6870939137
2026-10-22 06:10:37 +00:00
Hiroshi SHIBATAandClaude Opus 5 8c6c731547 Merge RubyGems/Bundler 4.0.20
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-08 09:25:43 -07:00
Hiroshi SHIBATAandClaude Opus 5 8aad2b9b57 Merge RubyGems/Bundler 4.0.19
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-08 09:25:43 -07:00
Hiroshi SHIBATAandClaude Opus 5 b667732024 Merge RubyGems/Bundler 4.0.18
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-08 09:25:43 -07:00
Hiroshi SHIBATAandClaude Opus 5 5853985383 Merge RubyGems/Bundler 4.0.17
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-08 09:25:43 -07:00
Hiroshi SHIBATAandClaude Opus 5 2da9a6ef3f Bump up resolv-0.7.2 for Ruby 4.0
Backport of the August 2026 resolv security release.

CVE-2026-80212
CVE-2026-80213

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-27 08:13:15 -07:00
Takashi Kokubun 617b835ea7 Bump ERB to 6.0.7 (#18282)
Merge erb-6.0.7
2026-08-10 12:11:15 -07:00
Hiroshi SHIBATA 7329bd121e Merge RubyGems/Bundler 4.0.16 2026-07-13 17:20:58 -07:00
Hiroshi SHIBATA 66893ba75a Merge RubyGems/Bundler 4.0.15 2026-07-13 17:20:58 -07:00
Hiroshi SHIBATA 2bfa562097 Merge RubyGems/Bundler 4.0.14 2026-07-13 17:20:58 -07:00
BurdetteLamar 86306050d8 [ruby/error_highlight] [DOC] Fix link in ErrorHighlight
https://github.com/ruby/error_highlight/commit/6096a05b2f
2026-06-26 09:46:44 -07:00
Yusuke Endoh 29a3b2e97d [ruby/error_highlight] Bump version to 0.7.2
https://github.com/ruby/error_highlight/commit/d945ffd2aa
2026-06-26 09:45:28 -07:00
Randy Stauner 2507783423 [ruby/error_highlight] Return nil instead of raising NotImplementedError for def/lambda/block args
ErrorHighlight.spot defaults point_type to :args for ArgumentError. When an
ArgumentError originates from argument binding (e.g. a missing required
keyword), its first backtrace location maps to a def/lambda/block node. The
spotter had no implementation for the :args point type on those nodes and did
`raise NotImplementedError`.

This is a regression from 0.7.0 (and in Ruby 4.0 compared to Ruby 3.4).

ErrorHighlight.spot only rescues SyntaxError/SystemCallError/ArgumentError, and
NotImplementedError is not a StandardError, so it escaped through
CoreExt#generate_snippet -> Exception#detailed_message / #full_message and
replaced the original exception. This is normally hidden because the VM's
"missing keyword" message matches the keyword regex in generate_snippet and
takes the safe :name branch, but it surfaces as soon as the ArgumentError is
re-raised/wrapped with a custom message that falls into the :args else branch.

Return nil (the documented "no spot" result) for these cases instead, matching
the graceful-degradation behavior of the surrounding feature. The fix is
applied consistently across both compilers:
  - prism:     def_node / lambda_node / block_node
  - parse.y:   DEFN / DEFS (raised NotImplementedError) and LAMBDA / ITER
               (silently returned a spot for :args, inconsistent with prism)

All of these branches were introduced together by the experimental "wrong
number of arguments" snippet feature and are only intended for point_type
:name, so returning nil for any other point_type keeps the two parsers in sync.

https://github.com/ruby/error_highlight/commit/ca126db2db

[Bug #22129] (Backport for 4.0)
(cherry picked from 12ef8a66ab)
2026-06-26 09:43:25 -07:00
Hiroshi SHIBATA c552f2bc39 [ruby/cgi] Fix unescapeHTML CompatibilityError in pure-Ruby fallback
The ascii-compatible path builds a binary buffer but returned numeric
character references via chr(enc), so a non-ASCII replacement appended
to a buffer that already held non-ASCII bytes raised
Encoding::CompatibilityError. Decode into the binary buffer instead,
matching the C extension's optimized_unescape_html for out-of-range
references (kept verbatim, leading zeros included) and surrogate code
points (emitted as raw bytes).

https://github.com/ruby/cgi/issues/103

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

https://github.com/ruby/cgi/commit/09970b06d328
(cherry picked from commit 23f3148e1c)
2026-06-24 16:56:13 -07:00
Hiroshi SHIBATA adc44f9ab3 [ruby/cgi] Fix escape_html/h aliases to use C extension instead of pure Ruby fallback
The snake_case aliases (escape_html, h, unescape_html) were defined
before `require 'cgi/escape.so'`, so they captured references to the
pure Ruby methods. After the C extension loads and prepends EscapeExt,
only the camelCase names (escapeHTML, etc.) resolved to the fast C
implementation — the aliases still called the ~10x slower Ruby path.

Move alias definitions after the C extension loads, and define them on
EscapeExt when available so they bind to the optimized C methods.

https://github.com/ruby/cgi/commit/97b055dab04a

(cherry picked from commit d916df88df)
2026-06-24 16:56:13 -07:00
Hiroshi SHIBATA 6c080d71bc Merge RubyGems/Bundler 4.0.13 2026-06-03 16:56:21 -07:00
Hiroshi SHIBATA c74ca5c5c1 Merge RubyGems/Bundler 4.0.12 2026-06-03 16:56:21 -07:00
Hiroshi SHIBATA 56058d238b Merge RubyGems/Bundler 4.0.11 2026-06-03 16:56:21 -07:00
Takashi Kokubun cb26283b56 [ruby/erb] Version 6.0.1.1 2026-04-21 17:10:32 +09:00
Takashi KokubunandTristan Madani c35379df52 [ruby/erb] Prohibit def_method on marshal-loaded ERB instances
Extends the @_init guard to def_method so that an ERB object created
via Marshal.load (which bypasses initialize) raises ArgumentError
instead of evaluating arbitrary source. def_module and def_class both
delegate to def_method and are covered by the same check.

Co-authored-by: Tristan Madani <TristanInSec@gmail.com>
2026-04-21 17:10:30 +09:00
Hiroshi SHIBATA 4edfd93c0a Merge RubyGems/Bundler 4.0.10 2026-04-08 15:49:38 -07:00
Hiroshi SHIBATA dc13b5adc9 Merge RubyGems/Bundler 4.0.9 2026-04-08 15:49:38 -07:00
Hiroshi SHIBATA 36084c2457 Merge RubyGems/Bundler 4.0.8 2026-04-08 15:49:38 -07:00
Hiroshi SHIBATA f13b391174 Merge RubyGems/Bundler 4.0.7 2026-04-08 15:49:38 -07:00
Hiroshi SHIBATA 019c261cd7 Merge RubyGems/Bundler 4.0.6 2026-04-08 15:49:38 -07:00
Takashi Kokubun fda2bc4ee3 merge revision(s) 8ecf28f938: [Backport #21954]
[ruby/rubygems] Fix NoMethodError in Gem.try_activate when activation conflicts occur
2026-04-03 20:17:03 -07:00
Takashi Kokubun 3fd1181a9d Bump Prism to v1.8.1 2026-03-16 15:46:12 -07:00
Takashi Kokubun f808ff5fc1 merge revision(s) f315d250b4: [Backport #21947]
[ruby/timeout] Compatibility with Fiber scheduler.
	(https://github.com/ruby/timeout/pull/97)

	[Bug #21947]
2026-03-16 11:56:14 -07:00
Hiroshi SHIBATAandClaude Opus 4.6 9bcd9ba9b3 Suppress bundled gems warning for subfeatures found outside stdlib [Bug #21828]
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-11 17:42:58 -07:00
Chris Hasiński 485a603791 Fix bundled gems warning for all subfeatures of hyphenated gems
PR #15822 fixed the warning for direct hyphenated gem requires like
`benchmark/ips` → `benchmark-ips`. However, hyphenated gems often
provide multiple files under their namespace.

For example, `benchmark-ips` provides:
- benchmark/ips.rb
- benchmark/timing.rb
- benchmark/compare.rb

When requiring `benchmark/timing`, the previous fix only checked for
`benchmark-timing` gem (doesn't exist), not `benchmark-ips` which
actually provides the file.

This fix checks if ANY gem matching `{prefix}-*` is in the bundle
specs, which covers all subfeatures provided by hyphenated gems.

Reported in https://github.com/ruby/ruby/pull/15822#issuecomment-123456
2026-02-12 10:41:49 -08:00
Hiroshi SHIBATA e025c839ac Merge RubyGems/Bundler 4.0.6 2026-02-09 17:38:24 -08:00
Hiroshi SHIBATA 87b544b8c4 Merge RubyGems/Bundler 4.0.5 2026-02-09 17:38:24 -08:00
Hiroshi SHIBATA 91a4926c9a Merge RubyGems/Bundler 4.0.4 2026-02-09 17:38:24 -08:00
Earlopain e4dd078a27 [ruby/syntax_suggest] v2.0.3
https://github.com/ruby/syntax_suggest/commit/a81b92fcf2

[Bug #21847]
2026-01-21 10:11:17 -08:00
Schneems 12203963d2 [ruby/syntax_suggest] Refactor multi-prism version logic
The reason this logic for different methods branches in the class instead of internally was to be eagerly aggressive about runtime performance. This code is currently only used once for the document where it's invoked ~N times (where N is number of lines):

```ruby
module SyntaxSuggest
  class CleanDocument
    # ...
    def join_trailing_slash!
      trailing_groups = @document.select(&:trailing_slash?).map do |code_line|
        take_while_including(code_line.index..) { |x| x.trailing_slash? }
      end
      join_groups(trailing_groups)
      self
    end
```

Since this is not currently a hot-spot I think merging the branches and using a case statement is a reasonable tradeoff and avoids the need to do specific version testing.

An alternative idea was presented in #241 of behavior-based testing for branch logic (which I would prefer), however, calling the code triggered requiring a `DelegateClass` when the `syntax_suggest/api` is being required.

https://github.com/ruby/syntax_suggest/commit/ab122c455f
2026-01-21 10:11:17 -08:00
Earlopain bbba57f22c [ruby/syntax_suggest] Handle on_sp when using prism
It used to not emit this token type, but now it does.
So when a newer version of prism is present, we can fall back
to the same code that ripper uses.

Ref:
* https://github.com/ruby/ruby/pull/15914
* https://github.com/ruby/prism/pull/3859

https://github.com/ruby/syntax_suggest/commit/42a3b8f6cb
2026-01-21 10:11:17 -08:00
Daisuke Aritomo a3dc71eb5f Suppress bundled gem warning on `binding.irb'
This patch silences the "this won't work in the next version of Ruby"
warning displayed when irb is autoloaded via `binding.irb`.

    main.rb:1: warning: irb used to be loaded from the standard library, but is not part of the default gems since Ruby 4.0.0.
    You can add irb to your Gemfile or gemspec to fix this error.
    /.../irb.rb:9: warning: reline used to be loaded from the standard library, but is not part of the default gems since Ruby 4.0.0.
    You can add reline to your Gemfile or gemspec to fix this error.

    From: main.rb @ line 1 :

     => 1: binding.irb

    /.../input-method.rb:284: warning: rdoc used to be loaded from the standard library, but is not part of the default gems since Ruby 4.0.0.
    You can add rdoc to your Gemfile or gemspec to fix this error.

This warning is incorrect and misleading: users should not need to
include irb (and its dependencies) to their Gemfiles to use
`binding.irb`, even in future versions of Ruby. It is agreed that the
runtime takes care of that.
2026-01-20 10:49:33 -08:00
Daisuke Aritomo 3046e27852 Add comments 2026-01-20 10:49:33 -08:00
Daisuke Aritomo 20e4a9a807 Fake BUNDLE_GEMFILE and BUNDLE_LOCKFILE to let checks pass
Bundler::Runtime#setup requires a real existing lockfile (see
Bundler::SharedHelpers#default_lockfile).
2026-01-20 10:49:33 -08:00
Daisuke Aritomo 83479483c9 [Bug #21723] Let binding.irb properly load irb by fixing force_activate()
This patch fixes a problem where `binding.irb` (= force_activate('irb'))
fails under `bundle exec` when the Gemfile does not contain `irb` and
does contain a gem which is (1) not installed in GEM_HOME (2) sourced
using `path:`/`git:`.

The original approach constructing a temporary definition fails since
it does not set the equalivent of `path:`/`git:`.

Always reconstructing a definition from a Gemfile and applying lockfile
constraints should be a more robust approach.

[Bug #21723]
2026-01-20 10:49:33 -08:00
Takashi Kokubun a10f7fac1f Sync Prism to 1.8.0 2026-01-12 17:59:55 -08:00
Chris Hasiński 8d764da357 Fix incorrect bundled gems warning for hyphenated gem names
When requiring a file like "benchmark/ips", the warning system would
incorrectly warn about the "benchmark" gem not being a default gem,
even when the user has "benchmark-ips" (a separate third-party gem)
in their Gemfile.

The fix checks if a hyphenated version of the require path exists in
the bundle specs before issuing a warning. For example, requiring
"benchmark/ips" now checks for both "benchmark" and "benchmark-ips"
in the Gemfile.

[Bug #21828]
2026-01-08 09:08:38 -08:00
zverok 9154d72a3e Improve CGI.escape* docs 2025-12-24 11:21:11 +09:00
Hiroshi SHIBATA 1c3ef27191 Merge RubyGems 4.0.3 and Bundler 4.0.3 2025-12-23 16:10:04 +09:00
Yusuke Endoh 8eaf6739fd [ruby/error_highlight] Bump version
https://github.com/ruby/error_highlight/commit/dc2dad6632
2025-12-23 13:03:02 +09:00
Kevin Newton 5c0c0dd873 [ruby/prism] Bump to v1.7.0
https://github.com/ruby/prism/commit/21c499d6e4
2025-12-18 19:58:53 -05:00
Earlopain 76248400b7 [ruby/prism] Add Ruby 4.1 as a version specifier
https://github.com/ruby/prism/commit/138db9ccc4
2025-12-18 19:58:53 -05:00
Hiroshi SHIBATA 0e85881e0c [ruby/delegate] v0.6.1
https://github.com/ruby/delegate/commit/90ffceb6d6
2025-12-18 16:46:29 +09:00
Hiroshi SHIBATA 0006591407 Reapply "Merge pull request #52 from ruby/revert-49"
This reverts commit 02e4b58b615d0dd83a6af5cd7c2b8861724011ee.
2025-12-18 16:46:29 +09:00
Hiroshi SHIBATA 2fcad967aa Revert "Allow use of DelegateClass in ractor"
This reverts commit 6e0f2b31f0f4a2a942f3c1daad1bb64852fe6815.
2025-12-18 16:46:29 +09:00