[pull] master from ruby:master - #1415
Merged
Merged
Conversation
print_indented unconditionally sorted table rows by gem name, discarding the group clustering that --groups had already computed, so --groups produced output identical to plain outdated (ruby/rubygems#9333). Skip that re-sort when a --group/--groups option is active, since specs_for_outdated_check already sorts by name and group_by preserves that order within each group. Also fixes the outdated_spec.rb "--groups" test, which previously passed regardless of whether grouping worked because its expected output happened to match alphabetical-by-name ordering. ruby/rubygems@28b20ddd49
Skipping the name sort for --group left the rows in the order of their group sets, so a group spread over several sets was listed out of order. Filtering the name-sorted list directly keeps that order and makes the sort in print_indented unnecessary. ruby/rubygems@c4544e0842 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…-groups The groups were joined in the order they were declared, so gems in `group :test, :development` and `group :development, :test` were listed in two separate sets. ruby/rubygems@8a0d6f72be Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…oups Transitive dependencies have an empty group set, which sorted before every named set and put them at the top of the table. ruby/rubygems@2bff2a5d30 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
[Bug #22315]
The following script crashes because there is a use-after-free on the
source string during String#unpack:
s = "C" * 4000000
s.unpack("L*") { s.clear }
String#unpack will now instead raise RuntimeError with message "string modified".
…e local platform Gem::Specification#initialize skips the local platform when it takes the platform from Gem.platforms, so the option produced a ruby platform gem. A platform set in the gemspec still wins. ruby/rubygems#9344 ruby/rubygems@4467791def Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Under that setting git refuses to discover a bare repository through -C, so every command run against the bare cache clone failed. Bare repositories are now passed with --git-dir, while working trees such as local overrides keep -C. ruby/rubygems#7515 ruby/rubygems@65b695c6b4 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Vendored net/http loaded the whole 3500-line DNS resolver only to match Resolv::IPv4::Regex and Resolv::IPv6::Regex when deciding whether an address may be sent as a Server Name Indication. Inline equivalent regexps instead, so that a resolver RubyGems never resolves with is no longer shipped and no longer shows up as an outdated copy in security audits of the Ruby tarball. https://bugs.ruby-lang.org/issues/22317 ruby/rubygems@9f2bd5f66c Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Inside `module Gem`, `defined?(SecureRandom)` resolved to the vendored `Gem::SecureRandom` that vendored `net/http` happened to load through resolv. Without resolv the guard sees nothing and requires the stdlib, which activates the `securerandom` default gem and leaves Ruby 3.2 unable to activate `activesupport` against `securerandom` 0.2.2. ruby/rubygems@c2534fdadf Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
These specs need a length that no String or Array can hold, and a C long stops being one on LLP64 once the length itself is pointer-sized. They then ask for a 2**31-character string and 2**30-element arrays and get them. The value is unchanged on LP64 and ILP32. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
On LLP64 a pointer-sized length does not fit a C long, so `NUM2LONG` raises `RangeError` before the size check is reached. Which of the two the implementation raises is not what these specs are about, and `core/array/fill_spec.rb` already accepts either. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
[Bug #22318]
Array#flatten triggers an use-after-free it does not account for when the
call to rb_check_array_type modifies the source array. The following script
crashes:
a = (1..100_000).to_a
$a = a
bad = Object.new
def bad.to_ary; $a.clear; [1,2,3]; end
a << bad
a.flatten
`assert.h` always defines `RUBY_DEBUG`, as either 0 or 1, so `#ifdef` was always true and release builds paid for the two stores as well. They exist only so that the `RUBY_ASSERT` in `st_replace` and in `hash_copy` can tell an uninitialized table apart, and those compile away when `RUBY_DEBUG` is 0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
`assert.h` always defines `RUBY_DEBUG`, as either 0 or 1, so `#ifdef` was always true here too. The store exists only for the `RUBY_ASSERT` in `st_replace`, which compiles away when `RUBY_DEBUG` is 0, and `st_replace` overwrites the field immediately after. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
`RGV` is relative to the source root of the layout it was set in: `.` on master, `..` on the 4.0 branch, where the spec support files still live under `bundler/`. Defaulting it through `ENV` handed that layout-specific value to every child, so `prepare_release` re-execed the release branch's `bin/rake` forever looking for a `lib/rubygems.rb` that only exists in master's layout. ruby/rubygems@39b358e84d Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
`File.basename` never returns a name with a leading slash, so the comparison against `"/mkmf.rb"` was always false and the source `lib/mkmf.rb` was loaded again even when a caller such as `ext/extmk.rb` had already loaded it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )