Any idea what version(s) the fixes for the "GitLab RCE Flaws" will make it into? ruby-lang.org/en/news/…/regexp-fixes-for-gitlab-cves On the server side, I see JRuby uses the joni port of onigama for regexp. the current jruby security policy is that 9.4.x is still being supported for security updates And they're definitely working on it on the joni side, but it's described as "potentially leading to DoS" rather than as an RCE.

I cannot speak for Perforce, but OpenVox shipped the Ruby 4.0.9 release hours after it was published, we also backport it to openvox 8 / Ruby 3.2 (thank you redhat for helping) and we will also ship the new jruby version as soon as it's available.

Not even waiting for a new JRuby version, builds with the

joni

2.2.7 release are heading into acceptance tests this morning 🙂

thank you both for the quick replies 🙂

I should also clarify that I'm talking about OpenVox builds as well. My tenure with Perforce ended at the beginning of the year, so I don't know what their plans are.

fair.. we're largely concerned with OpenVox too, for... reasons 😄

Aha. Status as of yesterday: • We've got

joni

upgraded to 2.2.8 in the server components, that passed tests. • RedHat showed up with a PR that backported patches for Ruby 3.2, we've got those merged in and heading towards tests today. Looking to do releases next week, Tuesday, that contains those fixes. The 9.2.1

openvox-agent

that went out last Friday is already patched via Ruby 4.0.9.