Upgrade Ruby to 2.4.10

[depfu]

---

🚀 New Feature: Engine Updates

Welcome to your first update for the engine or runtime! It tries to change all the places where the version of the engine is configured. We're most likely missing a few of those or handling them incorrectly, so please help us and let us know and we'll quickly add it to the workflow.

If you want to know more about this feature, we just blogged about it.

If you're not interested in engine updates at all, you can reply to this PR with @depfu pause.

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

Release Notes

2.4.10

Posted by usa on 31 Mar 2020

Ruby 2.4.10 has been released.

This release includes a security fix. Please check the topics below for details.

• CVE-2020-16255: Unsafe Object Creation Vulnerability in JSON (Additional fix)

Ruby 2.4 is now under the state of the security maintenance phase, until the end of March of 2020. After that date, maintenance of Ruby 2.4 will be ended. Thus, this release would be the last of Ruby 2.4 series. We recommend you immediately upgrade Ruby to newer versions, such as 2.7 or 2.6 or 2.5.

2.4.9

Posted by usa on 2 Oct 2019

Ruby 2.4.9 has been released.

This release is a re-package of 2.4.8 because the previous Ruby 2.4.8 release tarball does not install. (See [Bug #16197] in detail.) There are no essential change except their version numbers between 2.4.8 and 2.4.9.

Ruby 2.4 is now under the state of the security maintenance phase, until the end of March of 2020. After that date, maintenance of Ruby 2.4 will be ended. We recommend you start planning the migration to newer versions of Ruby, such as 2.6 or 2.5.

2.4.8

Posted by usa on 1 Oct 2019

Ruby 2.4.8 has been released.

This release includes security fixes. Please check the topics below for details.

• CVE-2019-16255: A code injection vulnerability of Shell#[] and Shell#test
• CVE-2019-16254: HTTP response splitting in WEBrick (Additional fix)
• CVE-2019-15845: A NUL injection vulnerability of File.fnmatch and File.fnmatch?
• CVE-2019-16201: Regular Expression Denial of Service vulnerability of WEBrick’s Digest access authentication

Ruby 2.4 is now under the state of the security maintenance phase, until the end of March of 2020. After that date, maintenance of Ruby 2.4 will be ended. We recommend you start planning the migration to newer versions of Ruby, such as 2.6 or 2.5.

Update (Oct 2nd 4:00 UTC): We’re working on the issue that the Ruby 2.4.8 release tarball doesn’t install under non-root user. Follow [Bug #16197] for detailed updates.

2.4.7

Posted by usa on 28 Aug 2019

Ruby 2.4.7 has been released.

This release includes a security fix. Please check the topics below for details.

• Multiple jQuery vulnerabilities in RDoc

Ruby 2.4 is now under the state of the security maintenance phase, until the end of March of 2020. After that date, maintenance of Ruby 2.4 will be ended. We recommend you start planning the migration to newer versions of Ruby, such as 2.6 or 2.5.

2.4.6

Posted by usa on 1 Apr 2019

Ruby 2.4.6 has been released.

This release includes about 20 bug fixes after the previous release, and also includes several security fixes. Please check the topics below for details.

• Multiple vulnerabilities in RubyGems

See the commit log for details.

After this release, we will end the normal maintenance phase of Ruby 2.4, and start the security maintenance phase of it. This means that after the release of 2.4.6 we will never backport any bug fixes to 2.4 except security fixes. The term of the security maintenance phase is scheduled for 1 year. By the end of this term, official support of Ruby 2.4 will be over. Therefore, we recommend that you start planning to upgrade to Ruby 2.6 or 2.5.

2.4.5

Posted by usa on 17 Oct 2018

Ruby 2.4.5 has been released.

This release includes about 40 bug fixes after the previous release, and also includes several security fixes. Please check the topics below for details.

• CVE-2018-16396: Tainted flags are not propagated in Array#pack and String#unpack with some directives
• CVE-2018-16395: OpenSSL::X509::Name equality check does not work correctly

See the commit logs for details.

2.4.4

Posted by nagachika on 28 Mar 2018

Ruby 2.4.4 has been released.

This release includes some bug fixes and some security fixes.

• CVE-2017-17742: HTTP response splitting in WEBrick
• CVE-2018-6914: Unintentional file and directory creation with directory traversal in tempfile and tmpdir
• CVE-2018-8777: DoS by large request in WEBrick
• CVE-2018-8778: Buffer under-read in String#unpack
• CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket
• CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in Dir
• Multiple vulnerabilities in RubyGems

There are also some bug fixes. See commit logs for more details.

2.4.3

Posted by nagachika on 14 Dec 2017

Ruby 2.4.3 has been released.

This release includes some bug fixes and a security fix.

• CVE-2017-17405: Command injection vulnerability in Net::FTP

There are also some bug fixes. See commit logs for more details.

2.4.2

Posted by nagachika on 14 Sep 2017

We are pleased to announce the release of Ruby 2.4.2. This release contains some security fixes.

• CVE-2017-0898: Buffer underrun vulnerability in Kernel.sprintf
• CVE-2017-10784: Escape sequence injection vulnerability in the Basic authentication of WEBrick
• CVE-2017-14033: Buffer underrun vulnerability in OpenSSL ASN1 decode
• CVE-2017-14064: Heap exposure in generating JSON
• Multiple vulnerabilities in RubyGems
• Update bundled libyaml to version 0.1.7.

There are also many bug-fixes. See commit logs for more details.

Known Problem

(This section was added at September 15, 2017.)

An incompatibility has been found for Ruby 2.4.2. Ruby 2.4.2 can not link with libgmp nor jemalloc. We will fix this problem with the next release, but if you are facing the problem now and need to overcome it immediately, get a patch from this link:

• Ruby 2.4.2 and 2.3.5 cannot link with libgmp nor jemalloc

2.4.1

Posted by naruse on 22 Mar 2017

We are pleased to announce the release of Ruby 2.4.1. This is the first TEENY version release of the stable 2.4 series.

See commit logs for details.

---

All Depfu comment commands

@​depfu refresh

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Pauses all engine updates and closes this PR

[san983]

@​depfu close