Skip to content

[pull] master from ruby:master#1082

Merged
pull[bot] merged 16 commits into
turkdevops:masterfrom
ruby:master
Jun 5, 2026
Merged

[pull] master from ruby:master#1082
pull[bot] merged 16 commits into
turkdevops:masterfrom
ruby:master

Conversation

@pull
Copy link
Copy Markdown

@pull pull Bot commented Jun 5, 2026

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

peterzhu2118 and others added 16 commits June 5, 2026 09:51
Match C1 controls (U+0080-U+009F) as codepoints and only for valid UTF-8
text, so multibyte characters are preserved and other encodings are left
unchanged.

ruby/rubygems@c272a8b138

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Route the post-install message through Gem::Text#clean_text before
printing it so a crafted message cannot emit raw terminal control
sequences.

ruby/rubygems@cc62ee89ab

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Reword the comment to explain that the UTF-8 guard avoids splitting
multibyte sequences, and assert preservation with U+0400, whose
continuation byte falls in the C1 byte range.

ruby/rubygems@0db489ff2e

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…nitizing

post_install_message may be a non-String such as an array, so call to_s
before clean_text to avoid raising during install.

ruby/rubygems@95b6bfbd16

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Reject executables that are not plain basenames during pre-install checks.

ruby/rubygems@92198d209d

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Reject a bindir that resolves outside the gem directory during pre-install
checks.

ruby/rubygems@cd61a78b25

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ript

Escape the executable name interpolated into the generated wrapper so a
name containing quotes cannot change the generated Ruby.

ruby/rubygems@9f32631b77

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
… error

A non-String executable name or bindir previously raised TypeError from
File.basename or File.join. Guard the type so verify_spec raises
Gem::InstallError instead of aborting with an unexpected exception.

ruby/rubygems@89bf13a11b

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bumps the github-actions group with 2 updates in the / directory: [github/codeql-action](https://github.com/github/codeql-action) and [taiki-e/install-action](https://github.com/taiki-e/install-action).


Updates `github/codeql-action` from 4.36.1 to 4.36.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@87557b9...8aad20d)

Updates `taiki-e/install-action` from 2.81.3 to 2.81.5
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](taiki-e/install-action@25435dc...4bc351f)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: taiki-e/install-action
  dependency-version: 2.81.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
…path

Bulk-skip ASCII bytes that need no escaping via a 256-byte lookup
table, avoiding per-byte `rb_enc_precise_mbclen` and `rb_enc_mbc_to_codepoint`
calls. Eligible for well-formed strings (CR=7BIT, or UTF-8 VALID);
other strings fall through to the existing path unchanged.
… the cooldown window

bundle update and bundle outdated install a >= locked_version
prevent-downgrade floor, so resolution never moves a gem backwards. The
cooldown filter was excluding that same locked version, making
resolution impossible whenever the lockfile was written before cooldown
was enabled and still pins an in-cooldown release. Exempt the version
sitting exactly at the floor; gems updated explicitly carry an exact =
requirement and stay subject to cooldown.

ruby/rubygems#9598

ruby/rubygems@b456b2cdf6

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…cked versions

The previous tests only exercised a top-level locked gem. Add a
transitive dependency that resolves only through an in-cooldown version,
and a case where a cooldown-eligible version above the locked one still
gets picked up, so the full update behavior stays pinned down.

ruby/rubygems@5deac9f767

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Saves a String allocation and copy, as well as a pair of malloc+free.
However it is encoded in ASCII-8BIT, not with FS encoding.

Co-Authored-By: John Hawthorn <john@hawthorn.email>
@pull pull Bot locked and limited conversation to collaborators Jun 5, 2026
@pull pull Bot added the ⤵️ pull label Jun 5, 2026
@pull pull Bot merged commit 10f302f into turkdevops:master Jun 5, 2026
3 of 5 checks passed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants