[pull] master from ruby:master - #1322
Merged
Merged
Conversation
Credentials coming from `bundle config` are injected into the remote URI only in `configured_uri`, so filtering command strings and git output against the original URI never matched and left them visible in `GitCommandError` messages. Memoize `configured_uri` since it is now consulted on every git invocation. ruby/rubygems@b8a6244189 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Previously, only empty arrays were taking the gen_new_array fastpath. Now, if an array can be embedded it will take the fastpath.
…or Gem::SafeMarshal. A crafted payload using the UserDefined (u:) format for a permitted class such as Date, which normally serializes as UserMarshal (U:), can result in Date._load to invoke rb_marshal_load on attacker-controlled bytes, bypassing SafeMarshal's allowlists. HackerOne report 3915697, triaged as hardening. ruby/rubygems@2fe0a5e5fa Co-Authored-By: Sonnet 4.6 (1M context) <noreply@anthropic.com>
…spec spec.platform.to_s is interpolated into Gem::Specification#full_name, which Gem::Installer uses to build the gem and extension directories it removes and then extracts into, so a platform carrying path separators lands outside the gems directory. Neither entry point normalizes it: Gem::Platform is restored from gem metadata without going through #initialize, and its String parser keeps the cpu part verbatim. Replace the newline-only check with the same kind of allowed-character pattern already used for the gem name. ruby/rubygems@7cde597e47
Auto-clean after install was deferred to Bundler 5 in ruby/rubygems@c314d7b25156, and clean_after_install? checks bundler_5_mode?, but the man page still said Bundler 4. ruby/rubygems@e7be51e53b Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )