v0.4.25

[nevans]

Important

The 0.4.x release branch will only receive security fixes, and will be unsupported when ruby 3.3 is EOL.
Please upgrade to a newer version.

What's Changed

Special thanks to @hsbt for backporting most of these PRs, in #707!

🔒 Security

This release fixes several more security vulnerabilities which are related to the fixes in v0.4.24. Please see the linked security advisories for more information.

• (moderate) Command Injection via non-synchronizing literal in "raw" argument (CVE-2026-47240, GHSA-8p34-64r3-mwg8)
  This vulnerability depends how the server interprets non-synchronizing literals.
  The connection is not vulnerable if the server supports non-synchronizing literals.
  • 🥅 Validate non-synchronizing literals support (backports 🥅 Validate non-synchronizing literals support #701)
• (moderate) Command Injection via unvalidated ID and ENABLE arguments (CVE-2026-47242, GHSA-46q3-7gv7-qmgg)
  • 🥅 Validate ID values contain only valid bytes (backports 🥅 Validate ID values contain only valid bytes #698)
  • 🥅 Validate #enable arguments are all atoms (backports 🥅 Validate #enable arguments are all atoms #699)
    NOTE: #enable should never be called with untrusted input.
• (low) Denial of Service via incomplete "raw" argument validation (CVE-2026-47241, GHSA-c4fp-cxrr-mj66)
  This results in the affected command hanging until the connection is closed. If another thread attempts to send a concurrent pipelined command, the first thread will return with a syntax error and the second thread will hang until the connection closes.
  • Reported by @fg0x0
  • 🐛 Prevent trailing {0} in RawData validation (backports 🐛 Prevent trailing {0} in RawData validation #700)

Fixed

• Remove dead code resulting from cherry-pick of 6f82e28. by @jackorp in Remove dead code resulting from cherry-pick of 6f82e28. #706
• 🏷️ Allow 64-bit Integer arguments (backports 🏷 Allow 64-bit Integer arguments #675)
• 🥅 Validate that Atom and Flag are not empty (backports 🥅 Validate that Atom and Flag are not empty #684)
• 🧵 Fix deadlock in #disconnect (backports 🧵 Fix deadlock in #disconnect #686)

Documentation

• ⚠️ Boost visibility of raw data argument documentation warnings (backports ⚠️ Boost visibility of raw data argument documentation warnings #677)

Other Changes

• 🧵 Close socket in #disconnect before waiting for lock & thread join (backports 🧵 Close socket in #disconnect before waiting for lock & thread join #493)
• 🥅 Ensure send_number_data input is an Integer (backports 🥅 Ensure send_number_data input is an Integer #676)
• ♻️ Improve RawData.new, Add RawData.split (backports ♻️ Improve RawData.new, Add RawData.split #679)
• 🥅 Validate response literal byte size format (backports 🥅 Validate response literal byte size format #681)

Miscellaneous

• ✅ Fix flaky tests with FakeServer#Connection#close mutex (backports half of ✅ Fix flaky tests with FakeServer#Connection#close mutex #520
• ✅ Improvements to tests' FakeServer (backports ✅ Improvements to tests' FakeServer #678)
• Backport the security fixes to v0.4 for a 0.4.25 release by @hsbt in Backport the security fixes to v0.4 for a 0.4.25 release #707

New Contributors

• @jackorp made their first contribution in Remove dead code resulting from cherry-pick of 6f82e28. #706

Full Changelog: v0.4.24...v0.4.25

---

This discussion was created from the release v0.4.25.

[nevans]

I'd somehow misremembered ruby's support for 3.3 as being critical security vulnerabilities only. So I never backported these fixes to v0.4-stable. Thanks to @hsbt for catching my mistake!