3.3.12

What's Changed

This release includes the following security fixes.

• CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / def_class

This release updates the default gem erb to 4.0.3.1 and the bundled gem net-imap to 0.4.25. The net-imap update fixes CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258, CVE-2026-47240, CVE-2026-47241 and CVE-2026-47242. Please see the release notes of net-imap v0.4.24 and net-imap v0.4.25 for the details of these fixes.

Full Changelog

v3_3_11...v3_3_12