diff --git a/Gemfile.lock b/Gemfile.lock index 8a3c17ccaa..10d89d516a 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -5,7 +5,7 @@ GEM addressable (2.8.7) public_suffix (>= 2.0.2, < 7.0) afm (0.2.2) - async (2.23.0) + async (2.23.1) console (~> 1.29) fiber-annotation io-event (~> 1.9) @@ -15,12 +15,12 @@ GEM bigdecimal (3.1.9) colorator (1.1.0) concurrent-ruby (1.3.5) - console (1.29.2) + console (1.30.2) fiber-annotation fiber-local (~> 1.1) json crass (1.0.6) - csv (3.3.2) + csv (3.3.3) em-websocket (0.5.3) eventmachine (>= 0.12.9) http_parser.rb (~> 0) @@ -43,26 +43,26 @@ GEM fiber-storage fiber-storage (1.0.0) forwardable-extended (2.6.0) - google-protobuf (4.29.3) + google-protobuf (4.30.2) bigdecimal rake (>= 13) - google-protobuf (4.29.3-aarch64-linux) + google-protobuf (4.30.2-aarch64-linux) bigdecimal rake (>= 13) - google-protobuf (4.29.3-arm64-darwin) + google-protobuf (4.30.2-arm64-darwin) bigdecimal rake (>= 13) - google-protobuf (4.29.3-x86-linux) + google-protobuf (4.30.2-x86-linux) bigdecimal rake (>= 13) - google-protobuf (4.29.3-x86_64-darwin) + google-protobuf (4.30.2-x86_64-darwin) bigdecimal rake (>= 13) - google-protobuf (4.29.3-x86_64-linux) + google-protobuf (4.30.2-x86_64-linux) bigdecimal rake (>= 13) hashery (2.1.2) - html-proofer (5.0.9) + html-proofer (5.0.10) addressable (~> 2.3) async (~> 2.1) nokogiri (~> 1.13) @@ -74,7 +74,7 @@ GEM http_parser.rb (0.8.0) i18n (1.14.7) concurrent-ruby (~> 1.0) - io-event (1.9.0) + io-event (1.10.0) jekyll (4.4.1) addressable (~> 2.4) base64 (~> 0.2) @@ -98,7 +98,7 @@ GEM sass-embedded (~> 1.75) jekyll-watch (2.2.1) listen (~> 3.0) - json (2.10.1) + json (2.10.2) kramdown (2.5.1) rexml (>= 3.3.9) kramdown-parser-gfm (1.1.0) @@ -108,27 +108,27 @@ GEM rb-fsevent (~> 0.10, >= 0.10.3) rb-inotify (~> 0.9, >= 0.9.10) mercenary (0.4.0) - metrics (0.12.1) + metrics (0.12.2) mini_portile2 (2.8.8) - minitest (5.25.4) - nokogiri (1.18.3) + minitest (5.25.5) + nokogiri (1.18.7) mini_portile2 (~> 2.8.2) racc (~> 1.4) - nokogiri (1.18.3-aarch64-linux-gnu) + nokogiri (1.18.7-aarch64-linux-gnu) racc (~> 1.4) - nokogiri (1.18.3-aarch64-linux-musl) + nokogiri (1.18.7-aarch64-linux-musl) racc (~> 1.4) - nokogiri (1.18.3-arm-linux-gnu) + nokogiri (1.18.7-arm-linux-gnu) racc (~> 1.4) - nokogiri (1.18.3-arm-linux-musl) + nokogiri (1.18.7-arm-linux-musl) racc (~> 1.4) - nokogiri (1.18.3-arm64-darwin) + nokogiri (1.18.7-arm64-darwin) racc (~> 1.4) - nokogiri (1.18.3-x86_64-darwin) + nokogiri (1.18.7-x86_64-darwin) racc (~> 1.4) - nokogiri (1.18.3-x86_64-linux-gnu) + nokogiri (1.18.7-x86_64-linux-gnu) racc (~> 1.4) - nokogiri (1.18.3-x86_64-linux-musl) + nokogiri (1.18.7-x86_64-linux-musl) racc (~> 1.4) paint (2.3.0) pathutil (0.16.2) @@ -150,39 +150,37 @@ GEM rouge (4.5.1) ruby-rc4 (0.1.5) safe_yaml (1.0.5) - sass-embedded (1.85.0) - google-protobuf (~> 4.29) + sass-embedded (1.86.1) + google-protobuf (~> 4.30) rake (>= 13) - sass-embedded (1.85.0-aarch64-linux-android) - google-protobuf (~> 4.29) - sass-embedded (1.85.0-aarch64-linux-gnu) - google-protobuf (~> 4.29) - sass-embedded (1.85.0-aarch64-linux-musl) - google-protobuf (~> 4.29) - sass-embedded (1.85.0-arm-linux-androideabi) - google-protobuf (~> 4.29) - sass-embedded (1.85.0-arm-linux-gnueabihf) - google-protobuf (~> 4.29) - sass-embedded (1.85.0-arm-linux-musleabihf) - google-protobuf (~> 4.29) - sass-embedded (1.85.0-arm64-darwin) - google-protobuf (~> 4.29) - sass-embedded (1.85.0-riscv64-linux-android) - google-protobuf (~> 4.29) - sass-embedded (1.85.0-riscv64-linux-gnu) - google-protobuf (~> 4.29) - sass-embedded (1.85.0-riscv64-linux-musl) - google-protobuf (~> 4.29) - sass-embedded (1.85.0-x86_64-cygwin) - google-protobuf (~> 4.29) - sass-embedded (1.85.0-x86_64-darwin) - google-protobuf (~> 4.29) - sass-embedded (1.85.0-x86_64-linux-android) - google-protobuf (~> 4.29) - sass-embedded (1.85.0-x86_64-linux-gnu) - google-protobuf (~> 4.29) - sass-embedded (1.85.0-x86_64-linux-musl) - google-protobuf (~> 4.29) + sass-embedded (1.86.1-aarch64-linux-android) + google-protobuf (~> 4.30) + sass-embedded (1.86.1-aarch64-linux-gnu) + google-protobuf (~> 4.30) + sass-embedded (1.86.1-aarch64-linux-musl) + google-protobuf (~> 4.30) + sass-embedded (1.86.1-arm-linux-androideabi) + google-protobuf (~> 4.30) + sass-embedded (1.86.1-arm-linux-gnueabihf) + google-protobuf (~> 4.30) + sass-embedded (1.86.1-arm-linux-musleabihf) + google-protobuf (~> 4.30) + sass-embedded (1.86.1-arm64-darwin) + google-protobuf (~> 4.30) + sass-embedded (1.86.1-riscv64-linux-android) + google-protobuf (~> 4.30) + sass-embedded (1.86.1-riscv64-linux-gnu) + google-protobuf (~> 4.30) + sass-embedded (1.86.1-riscv64-linux-musl) + google-protobuf (~> 4.30) + sass-embedded (1.86.1-x86_64-darwin) + google-protobuf (~> 4.30) + sass-embedded (1.86.1-x86_64-linux-android) + google-protobuf (~> 4.30) + sass-embedded (1.86.1-x86_64-linux-gnu) + google-protobuf (~> 4.30) + sass-embedded (1.86.1-x86_64-linux-musl) + google-protobuf (~> 4.30) slop (4.10.1) spidr (0.7.2) base64 (~> 0.1) @@ -212,7 +210,7 @@ GEM rexml (~> 3.2) webrick (1.9.1) yell (2.2.2) - zeitwerk (2.7.1) + zeitwerk (2.7.2) PLATFORMS aarch64-linux @@ -253,4 +251,4 @@ DEPENDENCIES validate-website (~> 1.6) BUNDLED WITH - 2.6.4 + 2.6.6 diff --git a/_data/branches.yml b/_data/branches.yml index 864193a135..57cf7f9159 100644 --- a/_data/branches.yml +++ b/_data/branches.yml @@ -8,6 +8,11 @@ # date: date of first stable release (YYYY-MM-DD) # eol_date: date of EOL (YYYY-MM-DD) +- name: 3.5 + status: preview + date: + eol_date: + - name: 3.4 status: normal maintenance date: 2024-12-25 @@ -21,18 +26,17 @@ expected_eol_date: 2027-03-31 - name: 3.2 - status: normal maintenance + status: security maintenance date: 2022-12-25 - security_maintenance_date: + security_maintenance_date: 2025-04-01 eol_date: expected_eol_date: 2026-03-31 - name: 3.1 - status: security maintenance + status: eol date: 2021-12-25 security_maintenance_date: 2024-04-01 - eol_date: - expected_eol_date: 2025-03-31 + eol_date: 2025-03-26 - name: 3.0 status: eol diff --git a/_data/downloads.yml b/_data/downloads.yml index 36a817ddd9..866046866c 100644 --- a/_data/downloads.yml +++ b/_data/downloads.yml @@ -4,22 +4,22 @@ # optional preview: + - 3.5.0-preview1 stable: - - 3.4.2 - - 3.3.7 - - 3.2.7 + - 3.4.3 + - 3.3.8 + - 3.2.8 # optional security_maintenance: - - 3.1.6 # optional eol: - - 3.0.7 + - 3.1.7 stable_snapshots: @@ -44,13 +44,6 @@ stable_snapshots: zip: https://cache.ruby-lang.org/pub/ruby/snapshot/snapshot-ruby_3_2.zip version: '3.2' - - branch: ruby_3_1 - url: - gz: https://cache.ruby-lang.org/pub/ruby/snapshot/snapshot-ruby_3_1.tar.gz - xz: https://cache.ruby-lang.org/pub/ruby/snapshot/snapshot-ruby_3_1.tar.xz - zip: https://cache.ruby-lang.org/pub/ruby/snapshot/snapshot-ruby_3_1.zip - version: '3.1' - nightly_snapshot: url: diff --git a/_data/locales/bg.yml b/_data/locales/bg.yml index 0020ebd753..431df55eca 100644 --- a/_data/locales/bg.yml +++ b/_data/locales/bg.yml @@ -3,7 +3,7 @@ ruby: Ruby slogan: най-добрият приятел на програмиста sitelinks: -- text: Home +- text: Начало url: /bg home: true - text: За сваляне diff --git a/_data/releases.yml b/_data/releases.yml index 8274b32d57..b111482216 100644 --- a/_data/releases.yml +++ b/_data/releases.yml @@ -19,8 +19,63 @@ # In order to get the release listed on the downloads page, # you also need to add an entry to `_data/downloads.yml'. +# 3.5 series + +- version: 3.5.0-preview1 + date: 2025-04-18 + post: /en/news/2025/04/18/ruby-3-5-0-preview1-released/ + tag: v3_5_0_preview1 + stats: + files_changed: 2065 + insertions: 36581 + deletions: 203037 + url: + gz: https://cache.ruby-lang.org/pub/ruby/3.5/ruby-3.5.0-preview1.tar.gz + zip: https://cache.ruby-lang.org/pub/ruby/3.5/ruby-3.5.0-preview1.zip + xz: https://cache.ruby-lang.org/pub/ruby/3.5/ruby-3.5.0-preview1.tar.xz + size: + gz: 23146162 + zip: 28548713 + xz: 17443928 + sha1: + gz: ee0fcfe1342116f05060279ff0c9eb1e215db0b9 + zip: bd0c32bc84ac1ce9edbc9c0a50e8c72e56b1229d + xz: 8a78a9189afa20cde42207a466bcf7d421ee144b + sha256: + gz: ecf09c7eb902e91cdaf9cc553cd00cca9b848b3fc0e14297850f9ab08cdd46f0 + zip: 3e1d9df578c69976a01a69b961819d00c4e8942f8b5fe4fb8e135fca4f7e7e5e + xz: c6cc1e9f23fe4719b024b8305345ca0cff4e1bc159f3ebff86cb5b87969863aa + sha512: + gz: d718973648705636eff5933a0919132fd1f6b9afea432e09cce1265c6e0125e11cc94dbff84cba1caefc03190c48d8af4a27337d2af031f3f1660ca3a3531211 + zip: 47057e1615b2b59d5bbd0d6629e1320ed74f3d70748f1db4e8b88d6c8a3ecd255eacc7dac0cccd01923fae4b4dff9e6b9457a9858c81dab81c1ab9ee514b15fa + xz: 835bd0b65d546722c83b0ab454256357b48898a0de9aa8e38966f53d2370a6e99552eeaff76a0b680aefbbe7491e701e5e7357797e50f063c53e79d9561c1dac + # 3.4 series +- version: 3.4.3 + date: 2025-04-14 + post: /en/news/2025/04/14/ruby-3-4-3-released/ + url: + gz: https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.3.tar.gz + zip: https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.3.zip + xz: https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.3.tar.xz + size: + gz: 23194448 + zip: 28356998 + xz: 17230984 + sha1: + gz: c269cd122ab9d4620a1e0e6a8f4de378deec3799 + zip: 87cb747a766660cf487a2e9dbbc7a18a8f6b65d9 + xz: d0d86fdfe6bcf9f2eb3b450f3209f655ceda86da + sha256: + gz: 55a4cd1dcbe5ca27cf65e89a935a482c2bb2284832939266551c0ec68b437f46 + zip: 06b8bf2ddf2642327c992d30f5d414ffa5a5df0c4c706d7b2507b42509fb5055 + xz: 174dcd8c516694f833fd3c93ea227fa6c3321464577a3882a6fc7e4fe20237fd + sha512: + gz: 7019889939713c3e649003fed4d973dced36239fc354cfdee2d01dbdeb7e8512881a31b00efc3d5017f08cd492aed7914d15927bc8d076c0cae7534273e471e9 + zip: b25289c899318ce5071b075fc1b75f602e0a543faeefa44df7e8064933500f9c357685fe21d09abc4034d481c22c89491c841f596d07e1cd269d800e6266cc24 + xz: b30aad675cdcc1bdfe9e5fffe9d1925db3b3ac854a5e34180c368bc6e66f73e29ba5d802fea249353b7d799c01384c58bdd763fd1b679303158baa7824b9c08e + - version: 3.4.2 date: 2025-02-14 post: /en/news/2025/02/14/ruby-3-4-2-released/ @@ -187,6 +242,30 @@ # 3.3 series +- version: 3.3.8 + date: '2025-04-09' + post: "/en/news/2025/04/09/ruby-3-3-8-released/" + url: + gz: https://cache.ruby-lang.org/pub/ruby/3.3/ruby-3.3.8.tar.gz + xz: https://cache.ruby-lang.org/pub/ruby/3.3/ruby-3.3.8.tar.xz + zip: https://cache.ruby-lang.org/pub/ruby/3.3/ruby-3.3.8.zip + size: + gz: 22197497 + xz: 16435924 + zip: 27628937 + sha1: + gz: 71b8362d413f58ed5aef2ecd132769210c45f058 + xz: 9ee07098fd930744d8df5d4945b5f99d2fecb9ef + zip: 4c0d938d2791ab696e921557aec19613bb364a67 + sha256: + gz: 5ae28a87a59a3e4ad66bc2931d232dbab953d0aa8f6baf3bc4f8f80977c89cab + xz: 44ae70fee043da3ce48289b7a52618ebe32dc083253993d486211c7e445c8642 + zip: 389b8deae02849e769855dea892c921d3387b6548209189837a00f1cdf353797 + sha512: + gz: c5005ba4019fbae19650a9a9ce139e13608345065da9e2277dbeac9d0ac9e3b07b666816afe7be690088080c8c9cf88a8c372971d429479dcebea80d6c2e3883 + xz: 71c2f3ac9955e088fa885fd2ff695e67362a770a5d33e5160081eda3dd298ca2c692e299b03d757caecfbc94043fedc4ad093de84c505585d480cb36bbf978b9 + zip: 1aa6a0412760d0d1f423cd5f02533696b7c952c04f567b89aa875997e1d53a548c294c0b771a9e06e666daab038e3481a6251e361163449f92b02ab3a89a6373 + - version: 3.3.7 date: 2025-01-15 post: /en/news/2025/01/15/ruby-3-3-7-released/ @@ -503,6 +582,29 @@ # 3.2 series +- version: 3.2.8 + date: '2025-03-26' + post: "/en/news/2025/03/26/ruby-3-2-8-released/" + url: + gz: https://cache.ruby-lang.org/pub/ruby/3.2/ruby-3.2.8.tar.gz + xz: https://cache.ruby-lang.org/pub/ruby/3.2/ruby-3.2.8.tar.xz + zip: https://cache.ruby-lang.org/pub/ruby/3.2/ruby-3.2.8.zip + size: + gz: 20549999 + xz: 15130380 + zip: 25134315 + sha1: + gz: 419ecff4a0f8e805ddb1314344ffad33afde91d8 + xz: 570b529a10784fc16bb0339e6d37408adf9cd31d + zip: c80bf2e90b3bbfbedc9c8b65d401ce4bd0ed4263 + sha256: + gz: 77acdd8cfbbe1f8e573b5e6536e03c5103df989dc05fa68c70f011833c356075 + xz: 1cccd3100155275293ae5d4ea0a1a1068f5de69e71732220f144acce26327a3c + zip: c8ca517937c05e03ae52c41dad16ccf12ffae323365e73f3720142421f3aa2c7 + sha512: + gz: 342d9ce337936cdbaa5d63a4d393edf0594e431add8cec3b6f17b884075bfdc5aa7a843c03f4ee3bece01700dfa4707bba653715a628d9dcb230762dbd3e5ac8 + xz: 19ff96619945d907e509803b85ecf21750ffa4ae033045272feb43c183ab180d0033b98cf47c18804e448f01bc1928e3b833c61c98446dbe6be31fb9ea6b059d + zip: e248bc2a37b32edca0508df3016ac933089170deba6eec5479d8fb45a3d022c4c9532de2b5486863d30233bd276b14335e8d5ee97c371746b26d64f4864e80d3 - version: 3.2.7 date: 2025-02-04 post: /en/news/2025/02/04/ruby-3-2-7-released/ @@ -818,6 +920,29 @@ # 3.1 series +- version: 3.1.7 + date: '2025-03-26' + post: "/en/news/2025/03/26/ruby-3-1-7-released/" + url: + gz: https://cache.ruby-lang.org/pub/ruby/3.1/ruby-3.1.7.tar.gz + xz: https://cache.ruby-lang.org/pub/ruby/3.1/ruby-3.1.7.tar.xz + zip: https://cache.ruby-lang.org/pub/ruby/3.1/ruby-3.1.7.zip + size: + gz: 20811481 + xz: 15196628 + zip: 25555673 + sha1: + gz: c2023f05989241d1f21409b980ffbda83b1cbe7b + xz: 1437e9ec92f2c166f5b04dbb0c21ac299aca0542 + zip: c2eeaba7ebdabc84ca7b77a14a1f83b16397c87e + sha256: + gz: 0556acd69f141ddace03fa5dd8d76e7ea0d8f5232edf012429579bcdaab30e7b + xz: 658acc455b6bda87ac6cc1380e86552b9c1af87055e7a127589c5bf7ed80b035 + zip: ab91106d0686cd30c375c309c58a5b96e68ac56e96c453c1d4f3fbb6c548dec7 + sha512: + gz: a8432aaeaee4f48027ab30b7870bc61350840761b9d72b0b399d8fdfa96acb3c8f1ebe63663bcd8d835dd89b21128a07ef8f0c0c47eb41b942c169954ccb7edd + xz: 44e013f6e8d159a49125d24eaf02f58e02997fcd7bd4f4370250248c2d3264fb45183e33797638a7d9a2907fb48fe1b46f5f45514d60a800f96bce2c10baca82 + zip: febc49a0350558a8f3ad0d683c94321fc3437201c1adafdaa4e1a454234eef857d324e6ee1f95f5998d96fafce7f3a6c39483b3251a4a9ed4f64d80a1f73964e - version: 3.1.6 date: 2024-05-29 post: "/en/news/2024/05/29/ruby-3-1-6-released/" diff --git a/en/about/website/index.md b/en/about/website/index.md index d83fcfecfc..1b1057542e 100644 --- a/en/about/website/index.md +++ b/en/about/website/index.md @@ -50,8 +50,6 @@ Also many thanks to the organizations that support us: Heroku -[IBM][ibm] (hosting) - [Fastly][fastly] (CDN) Fastly @@ -77,7 +75,6 @@ Also many thanks to the organizations that support us: [github-wiki]: https://github.com/ruby/www.ruby-lang.org/wiki [rubyassociation]: http://www.ruby.or.jp [heroku]: https://www.heroku.com/ -[ibm]: https://www.ibm.com [fastly]: http://www.fastly.com [hatena]: http://hatenacorp.jp/ [mackerel]: https://mackerel.io/ diff --git a/en/documentation/faq/2/index.md b/en/documentation/faq/2/index.md index c1efec2c51..04577bdc1f 100644 --- a/en/documentation/faq/2/index.md +++ b/en/documentation/faq/2/index.md @@ -56,7 +56,7 @@ argument automagically becomes a reference to the receiver. Ruby is a pure OO language that can masquerade as a procedural one. It has no functions, only method calls. In a Ruby method the receiver, also called `self`, is a hidden argument like `this` in C++. A `def` statement outside of -a class definition, which is a function in Python, is actually a method call +a class definition, which defines a function in Python, actually defines a method in Ruby. These ersatz functions become private methods of class Object, the root of the Ruby class hierarchy. Procedural programming is neatly solved from the other direction---everything is an object. If the user doesn't grok diff --git a/en/news/_posts/2025-03-26-ruby-3-1-7-released.md b/en/news/_posts/2025-03-26-ruby-3-1-7-released.md new file mode 100644 index 0000000000..e84a3c6eae --- /dev/null +++ b/en/news/_posts/2025-03-26-ruby-3-1-7-released.md @@ -0,0 +1,46 @@ +--- +layout: news_post +title: "Ruby 3.1.7 Released" +author: hsbt +translator: +date: 2025-03-26 04:44:27 +0000 +lang: en +--- + +Ruby 3.1.7 has been released. This release includes [CVE-2025-27219, CVE-2025-27220 and CVE-2025-27221 fixes](https://www.ruby-lang.org/en/news/2025/02/26/security-advisories/) and update bundled REXML and RSS gems. + +Please see the [GitHub releases](https://github.com/ruby/ruby/releases/tag/v3_1_7) for further details. + +This version is a final release of Ruby 3.1 series. We will not provide any further updates including security fixes for Ruby 3.1 series. + +We recommend you to upgrade to Ruby 3.3 or 3.4 series. + +## Download + +{% assign release = site.data.releases | where: "version", "3.1.7" | first %} + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## Release Comment + +Many committers, developers, and users who provided bug reports helped us make this release. +Thanks for their contributions. diff --git a/en/news/_posts/2025-03-26-ruby-3-2-8-released.md b/en/news/_posts/2025-03-26-ruby-3-2-8-released.md new file mode 100644 index 0000000000..8acf005161 --- /dev/null +++ b/en/news/_posts/2025-03-26-ruby-3-2-8-released.md @@ -0,0 +1,46 @@ +--- +layout: news_post +title: "Ruby 3.2.8 Released" +author: hsbt +translator: +date: 2025-03-26 04:45:01 +0000 +lang: en +--- + +Ruby 3.2.8 has been released. This release includes [CVE-2025-27219, CVE-2025-27220 and CVE-2025-27221 fixes](https://www.ruby-lang.org/en/news/2025/02/26/security-advisories/). + +Please see the [GitHub releases](https://github.com/ruby/ruby/releases/tag/v3_2_8) for further details. + +This version is a last version of normal maintenance for Ruby 3.2 series. We will fix only security issues for Ruby 3.2 series until end of March 2026. + +Please consider upgrading to Ruby 3.3 or 3.4 series. + +## Download + +{% assign release = site.data.releases | where: "version", "3.2.8" | first %} + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## Release Comment + +Many committers, developers, and users who provided bug reports helped us make this release. +Thanks for their contributions. diff --git a/en/news/_posts/2025-04-09-ruby-3-3-8-released.md b/en/news/_posts/2025-04-09-ruby-3-3-8-released.md new file mode 100644 index 0000000000..7ca452a3e7 --- /dev/null +++ b/en/news/_posts/2025-04-09-ruby-3-3-8-released.md @@ -0,0 +1,42 @@ +--- +layout: news_post +title: "Ruby 3.3.8 Released" +author: nagachika +translator: +date: 2025-04-09 11:00:00 +0000 +lang: en +--- + +Ruby 3.3.8 has been released. + +Please see the [GitHub releases](https://github.com/ruby/ruby/releases/tag/v3_3_8) for further details. + +## Download + +{% assign release = site.data.releases | where: "version", "3.3.8" | first %} + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## Release Comment + +Many committers, developers, and users who provided bug reports helped us make this release. +Thanks for their contributions. diff --git a/en/news/_posts/2025-04-14-ruby-3-4-3-released.md b/en/news/_posts/2025-04-14-ruby-3-4-3-released.md new file mode 100644 index 0000000000..d2a160d9cf --- /dev/null +++ b/en/news/_posts/2025-04-14-ruby-3-4-3-released.md @@ -0,0 +1,50 @@ +--- +layout: news_post +title: "Ruby 3.4.3 Released" +author: k0kubun +translator: +date: 2025-04-14 08:06:57 +0000 +lang: en +--- + +Ruby 3.4.3 has been released. + +This is a routine update that includes bug fixes. Please refer to the +[release notes on GitHub](https://github.com/ruby/ruby/releases/tag/v3_4_3) for further details. + +## Release Schedule + +We intend to release the latest stable Ruby version (currently Ruby 3.4) every 2 months. +Ruby 3.4.4 will be released in June, 3.4.5 in August, 3.4.6 in October, and 3.4.7 in December. + +If there's any change that affects a considerable amount of people, those versions may be released earlier than expected. + +## Download + +{% assign release = site.data.releases | where: "version", "3.4.3" | first %} + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## Release Comment + +Many committers, developers, and users who provided bug reports helped us make this release. +Thanks for their contributions. diff --git a/en/news/_posts/2025-04-18-ruby-3-5-0-preview1-released.md b/en/news/_posts/2025-04-18-ruby-3-5-0-preview1-released.md new file mode 100644 index 0000000000..3a14de85d3 --- /dev/null +++ b/en/news/_posts/2025-04-18-ruby-3-5-0-preview1-released.md @@ -0,0 +1,110 @@ +--- +layout: news_post +title: "Ruby 3.5.0 preview1 Released" +author: "naruse" +translator: +date: 2025-04-18 00:00:00 +0000 +lang: en +--- + +{% assign release = site.data.releases | where: "version", "3.5.0-preview1" | first %} +We are pleased to announce the release of Ruby {{ release.version }}. Ruby 3.5 updates its Unicode version to 15.1.0, and so on. + +## Language changes + +* `*nil` no longer calls `nil.to_a`, similar to how `**nil` does + not call `nil.to_hash`. [[Feature #21047]] + +## Core classes updates + +Note: We're only listing notable updates of Core class. + +* Binding + + * `Binding#local_variables` does no longer include numbered parameters. + Also, `Binding#local_variable_get` and `Binding#local_variable_set` reject to handle numbered parameters. + [[Bug #21049]] + +* IO + + * `IO.select` accepts +Float::INFINITY+ as a timeout argument. + [[Feature #20610]] + +* String + + * Update Unicode to Version 15.1.0 and Emoji Version 15.1. [[Feature #19908]] + (also applies to Regexp) + + +## Standard Library updates + +Note: We're only listing notable updates of Standard librarires. + +* ostruct 0.6.1 +* pstore 0.2.0 +* benchmark 0.4.0 +* logger 1.7.0 +* rdoc 6.13.1 +* win32ole 1.9.2 +* irb 1.15.2 +* reline 0.6.1 +* readline 0.0.4 +* fiddle 1.1.6 + +## Compatibility issues + +Note: Excluding feature bug fixes. + + + +## Standard library compatibility issues + + +## C API updates + + + +## Miscellaneous changes + + + +See [NEWS](https://github.com/ruby/ruby/blob/{{ release.tag }}/NEWS.md) +or [commit logs](https://github.com/ruby/ruby/compare/v3_4_0...{{ release.tag }}) +for more details. + +With those changes, [{{ release.stats.files_changed }} files changed, {{ release.stats.insertions }} insertions(+), {{ release.stats.deletions }} deletions(-)](https://github.com/ruby/ruby/compare/v3_3_0...{{ release.tag }}#file_bucket) +since Ruby 3.4.0! + +## Download + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## What is Ruby + +Ruby was first developed by Matz (Yukihiro Matsumoto) in 1993, +and is now developed as Open Source. It runs on multiple platforms +and is used all over the world especially for web development. + +[Feature #21047]: https://bugs.ruby-lang.org/issues/21047 +[Bug #21049]: https://bugs.ruby-lang.org/issues/21049 +[Feature #20610]: https://bugs.ruby-lang.org/issues/20610 +[Feature #19908]: https://bugs.ruby-lang.org/issues/19908 diff --git a/en/news/_posts/2025-04-28-dos-net-imap-cve-2025-43857.md b/en/news/_posts/2025-04-28-dos-net-imap-cve-2025-43857.md new file mode 100644 index 0000000000..7183d72188 --- /dev/null +++ b/en/news/_posts/2025-04-28-dos-net-imap-cve-2025-43857.md @@ -0,0 +1,35 @@ +--- +layout: news_post +title: "CVE-2025-43857: DoS vulnerability in net-imap" +author: "nevans" +translator: +date: 2025-04-28 16:02:04 +0000 +tags: security +lang: en +--- + +There is a possibility for DoS by in the net-imap gem. This vulnerability has been assigned the CVE identifier [CVE-2025-43857]. We recommend upgrading the net-imap gem. + +## Details + +A malicious server can send can send a "literal" byte count which is automatically read by the client's receiver thread. The response reader immediately allocates memory for the number of bytes indicated by the server response. This should not be an issue when securely connecting to trusted IMAP servers that are well-behaved. It affects insecure connections and buggy, untrusted, or compromised servers (for example, connecting to a user supplied hostname). + +Please update net-imap gem to version 0.2.5, 0.3.9, 0.4.20, 0.5.7, or later. + +When connecting to untrusted servers or using an insecure connection, `max_response_size` and response handlers must be configured appropriately to limit memory consumption. See [GHSA-j3g3-5qv5-52mj] for more details. + +## Affected versions + +net-imap gem versions <= 0.2.4, 0.3.0 to 0.3.8, 0.4.0 to 0.4.19, and 0.5.0 to 0.5.6. + +## Credits + +Thanks to [Masamune] for discovering this issue. + +## History + +* Originally published at 2025-04-28 16:02:04 (UTC) + +[CVE-2025-43857]: https://www.cve.org/CVERecord?id=CVE-2025-43857 +[GHSA-j3g3-5qv5-52mj]: https://github.com/ruby/net-imap/security/advisories/GHSA-j3g3-5qv5-52mj +[Masamune]: https://hackerone.com/masamune_ diff --git a/es/news/_posts/2025-02-04-ruby-3-2-7-released.md b/es/news/_posts/2025-02-04-ruby-3-2-7-released.md index 50e3c59227..a4af8d1358 100644 --- a/es/news/_posts/2025-02-04-ruby-3-2-7-released.md +++ b/es/news/_posts/2025-02-04-ruby-3-2-7-released.md @@ -39,7 +39,7 @@ Por favor vea detalles en la ## Comentarios de la versión -Muchas contribuyentes, desarrolladores y usuarios que proveyeron +Muchos contribuyentes, desarrolladores y usuarios que proveyeron reportes de fallas nos ayudaron a producir esta versión. Gracias por sus contribuciones. diff --git a/es/news/_posts/2025-02-10-dos-net-imap-cve-2025-25186.md b/es/news/_posts/2025-02-10-dos-net-imap-cve-2025-25186.md new file mode 100644 index 0000000000..eb51e46abf --- /dev/null +++ b/es/news/_posts/2025-02-10-dos-net-imap-cve-2025-25186.md @@ -0,0 +1,38 @@ +--- +layout: news_post +title: "CVE-2025-25186: vulnerabilidad de dengación de servicio en net-imap" +author: "nevans" +translator: vtamara +date: 2025-02-10 03:00:00 +0000 +tags: security +lang: es +--- + +Hay posibilidad de un ataque de denegación de servicio (DoS) en la +gema net-imap. A esta vulnerabilidad se la ha asignado el identificador +[CVE-2025-25186](https://www.cve.org/CVERecord?id=CVE-2025-25186). +Recomendamos actualizar la gema net-imap. + +## Detalles + +Un servidor malicioso puede enviar un conjunto de datos uid altamente +comprimido que es leído automáticamente por el hilo receptor del cliente. +El analizador de la respuesta usa Range#to_a para convertir el conjunto +de datos uid a un arreglo de enteros, sin limite en el tamaño de los +rangos expandidos. + +Por favor actualizar la gema net-imap a la versión 0.3.8, 0.4.19, 0.5.6 +o posterior. + +## Versiones afectadas + +* Gema net-imap versiones 0.3.2 to 0.3.7, 0.4.0 to 0.4.18, y + 0.5.0 a 0.5.5 (incluida). + +## Créditos + +Gracias a [manun](https://hackerone.com/manun) por descubrir este problema. + +## Historia + +* Publicado originalmente el 2025-02-10 03:00:00 (UTC) diff --git a/es/news/_posts/2025-02-14-ruby-3-4-2-released.md b/es/news/_posts/2025-02-14-ruby-3-4-2-released.md new file mode 100644 index 0000000000..dbae879927 --- /dev/null +++ b/es/news/_posts/2025-02-14-ruby-3-4-2-released.md @@ -0,0 +1,56 @@ +--- +layout: news_post +title: "Publicado Ruby 3.4.2" +author: k0kubun +translator: vtamara +date: 2025-02-14 21:55:17 +0000 +lang: es +--- + +Ruby 3.4.2 ha sido publicado + +Esta es una actualización rutinaria que incluye correciones a fallas. +Por favor vea detalles en las +[notas de publicación en GitHub](https://github.com/ruby/ruby/releases/tag/v3_4_2) + +## Calendario de publicaciones + +Queremos publicar la versión de Ruby estable más recieente (acutalmente +Ruby 3.4) cada 2 meses. +Ruby 3.4.3 será publicado en Abril, 3.4.4 en Junio, 3.4.5 en Agosto, +3.4.6 en Octubre, y 3.4.7 en Diciembre. + +Si hay algún cambio que afecte a un número considerabl de personas, +esas versiones sera publicadas más pronto de lo esperado. + +## Descargas + +{% assign release = site.data.releases | where: "version", "3.4.2" | first %} + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## Comentario de la versión + +Muchos contribuidores, desarrolladores y usuarios que proveyeron reportes de +fallas nos ayudaron a producir esta versión. + +Gracias por sus contribuciones. diff --git a/es/news/_posts/2025-02-26-security-advisories.md b/es/news/_posts/2025-02-26-security-advisories.md new file mode 100644 index 0000000000..6371bc0367 --- /dev/null +++ b/es/news/_posts/2025-02-26-security-advisories.md @@ -0,0 +1,102 @@ +--- +layout: news_post +title: "Avisos de seguridad: CVE-2025-27219, CVE-2025-27220 y CVE-2025-27221" +author: "hsbt" +translator: vtamara +date: 2025-02-26 07:00:00 +0000 +tags: security +lang: es +--- + +Publicamos avisos de seguridad para CVE-2025-27219, CVE-2025-27220 y +CVE-2025-27221. Por favor vea detalles a continuación. + +## CVE-2025-27219: Denegación de Servicio en `CGI::Cookie.parse`. + +Hay posibilidad de una DoS por la gema cgi. A esta vulnerabilidad se +le ha asignado el identificador +[CVE-2025-27219](https://www.cve.org/CVERecord?id=CVE-2025-27219). +Recomendamos actualizar la gema cgi. + +### Detalles + +`CGI::Cookie.parse` tomaba tiempo super-lineal para analizar una +cadena con una cookie en algunos casos. +Suministrar una cadena de cookie manipulada a ese método podría +conducir a una Denegación de Servicio. + +Por favor actualice la gema CGI a la versión 0.3.5.1, 0.3.7, 0.4.2 o +posterior. + +### Versiones afectadas + +* Gema cgi versiones <= 0.3.5, 0.3.6, 0.4.0 y 0.4.1. + +### Créditos + +Agradecemos a [lio346](https://hackerone.com/lio346) por descubrir +este problema. También agradecemos a +[mame](https://github.com/mame) por corregirlo. + +## CVE-2025-27220: ReDoS en `CGI::Util#escapeElement`. + +Hay posibilidad de una Denegación de Servicio por Expresión Regular (ReDoS) +por parte de la gema cgi. +A esta vulnerabilidad se le ha asignado el identificador +[CVE-2025-27220](https://www.cve.org/CVERecord?id=CVE-2025-27220). +Recomendamos actualizar la gema cgi. + +### Detalles + +La expresión regular usada en `CGI::Util#escapeElement` es +vulnerable a ReDoS. Una entrada diseñada podría conducir a un alto +consumo de CPU. + +Esta vulnerabilidad sólo afecta a Ruby 3.1 y 3.2. Si usa estas versiones, +por favor actualice la gema CGI a la versión 0.3.5.1, 0.3.7, 0.4.2 o posterior. + +### Versiones afectadas + +* Gema cgi versiones <= 0.3.5, 0.3.6, 0.4.0 y 0.4.1. + +### Créditos + +Gracias a [svalkanov](https://hackerone.com/svalkanov) por descubrir +el problma. También gracias a [nobu](https://github.com/nobu) por +corregir esta vulnerabilidad. + +## CVE-2025-27221: fuga de información del usuario en `URI#join`, +`URI#merge` y `URI#+`. + +Hay posibilidad de que se fugue información con la gema uri. A esta +vulnerabilidad se le ha asignado el identificador +[CVE-2025-27221](https://www.cve.org/CVERecord?id=CVE-2025-27221). +Recomendamos actualizar la gema uri. + +### Detalles + +Los métodos `URI#join`, `URI#merge`, y `URI#+` retienen información +del usuario, tales como `user:password`, incluso aún después de que +la máquina es reemplazada. Cuando genera un URL para una máquina +maliciosa a partir de una URL que contenga información de usuario +secreta usando este método, y teniendo que alguien accede a la URL, +podría ocurrir una fuga de datos no intencionada. + +Por favor actualizar la gema URI a las versiones 0.11.3, 0.12.4, 0.13.2, 1.0.3 +o posterior. + +### Versiones Afectadas + +* Gema uri versions < 0.11.3, 0.12.0 to 0.12.3, 0.13.0, 0.13.1 y + 1.0.0 a 1.0.2. + +### Créditos + +Agradecemos a [Tsubasa Irisawa (lambdasawa)](https://hackerone.com/lambdasawa) +por descubrir este problema. También agradecemos a +[nobu](https://github.com/nobu) por correcciones adicionales +para esta vulnerabilidad. + +## Historia + +* Publicado originalmente el 2025-02-26 7:00:00 (UTC) diff --git a/es/news/_posts/2025-03-26-ruby-3-1-7-released.md b/es/news/_posts/2025-03-26-ruby-3-1-7-released.md new file mode 100644 index 0000000000..d03f74557c --- /dev/null +++ b/es/news/_posts/2025-03-26-ruby-3-1-7-released.md @@ -0,0 +1,52 @@ +--- +layout: news_post +title: "Publicado Ruby 3.1.7" +author: hsbt +translator: vtamara +date: 2025-03-26 04:44:27 +0000 +lang: es +--- + +Ruby 3.1.7 ha sido publicado. Esta versión incluye +[correcciones a las fallas CVE-2025-27219, CVE-2025-27220 y CVE-2025-27221](https://www.ruby-lang.org/es/news/2025/02/26/security-advisories/) +y actualiza las gemas incluidas REXML y RSS. + +Por favor vea más detalles en la [publicación en GitHub](https://github.com/ruby/ruby/releases/tag/v3_1_7). + +Esta versión es una versión final de la serie Ruby 3.1. +No proveeremos más actualizaciones ni siquiera de seguridad para la serie +Ruby 3.1. + +Le recomendamos actualizar a las series Ruby 3.3 o 3.4. + +## Descargas + +{% assign release = site.data.releases | where: "version", "3.1.7" | first %} + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## Comentario de la versión + +Muchos contribuyentes, desarrolladores y usuarios que proveyeron reportes de +fallas nos ayudaron a producir esta versión. + +Gracias por sus contribuciones. diff --git a/es/news/_posts/2025-03-26-ruby-3-2-8-released.md b/es/news/_posts/2025-03-26-ruby-3-2-8-released.md new file mode 100644 index 0000000000..5ef0b01d97 --- /dev/null +++ b/es/news/_posts/2025-03-26-ruby-3-2-8-released.md @@ -0,0 +1,51 @@ +--- +layout: news_post +title: "Publicado Ruby 3.2.8" +author: hsbt +translator: vtamara +date: 2025-03-26 04:45:01 +0000 +lang: es +--- + +Ruby 3.2.8 ha sido publicado. Esta version incluye +[correcciones a las fallas CVE-2025-27219, CVE-2025-27220 y CVE-2025-27221](https://www.ruby-lang.org/es/news/2025/02/26/security-advisories/). + +Por favor ver más detalles en la [publicación en GitHub](https://github.com/ruby/ruby/releases/tag/v3_2_8). + +Esta versión es la última versión del mantenimiento normal para la serie +Ruby 3.2. Corregiremos sólo fallas de seguridad para la serie Ruby 3.2 hasta +Marzo de 2026. + +Por favor considere actualizar a la serie Ruby 3.3 o 3.4. + +## Descargas + +{% assign release = site.data.releases | where: "version", "3.2.8" | first %} + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## Comentarios de la versión + +Muchos contribuyentes, desarrolladores y usuarios que proveyeron reportes de +fallas nos ayudaron a producir esta versión. + +Gracias por sus contribuciones. diff --git a/es/news/_posts/2025-04-09-ruby-3-3-8-released.md b/es/news/_posts/2025-04-09-ruby-3-3-8-released.md new file mode 100644 index 0000000000..4244e5f8f7 --- /dev/null +++ b/es/news/_posts/2025-04-09-ruby-3-3-8-released.md @@ -0,0 +1,44 @@ +--- +layout: news_post +title: "Publicado Ruby 3.3.8" +author: nagachika +translator: vtamara +date: 2025-04-09 11:00:00 +0000 +lang: es +--- + +Ruby 3.3.8 ha sido publicado. + +Por favor vea detalles en la [publicación en GitHub](https://github.com/ruby/ruby/releases/tag/v3_3_8). + +## Descargas + +{% assign release = site.data.releases | where: "version", "3.3.8" | first %} + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## Comentario de la versión + +Muchos contribuyentes, desarrolladores y usuarios que proveyeron reportes de +fallas nos ayudaron a producir esta versión. + +Gracias por sus contribuciones. diff --git a/ja/news/_posts/2025-02-18-kansai-rubykaigi-registration-is-open.md b/ja/news/_posts/2025-02-18-kansai-rubykaigi-registration-is-open.md new file mode 100644 index 0000000000..3993a0ab20 --- /dev/null +++ b/ja/news/_posts/2025-02-18-kansai-rubykaigi-registration-is-open.md @@ -0,0 +1,26 @@ +--- +layout: news_post +title: "関西Ruby会議08の参加登録が開始されました" +author: "Yudai Takada（@ydah）" +translator: +date: 2025-02-18 14:30:00 +0000 +lang: ja +--- + +日本Rubyの会が後援する、[地域Ruby会議(RegionalRubyKaigi)][1]の1つである[関西Ruby会議08](https://regional.rubykaigi.org/kansai08/)の参加登録が開始されました。 + +* 開催日: 2025年6月28日(土) 10:00 〜 18:00（時刻は変更となる場合があります） +* 会場: [先斗町 歌舞練場](https://maps.app.goo.gl/tf7ucg1ijkSjVjTr9) +* 主催: Ruby関西(るびーかんさい)、Kyoto.rb(きょうとあーるびー)、Kobe.rb(こうべあーるびー)、Kyobashi.rb(きょうばしあーるびー)、Ruby Tuesday(るびーちゅーずでー)、Ruby舞鶴(るびーまいづる)、AKASHI.rb(あかしあーるびー)、Shinosaka.rb(しんおおさかあーるびー)、naniwa.rb(なにわあーるびー) +* 参加費: 無料 +* 公式タグ: [#kanrk08](https://twitter.com/search?q=kanrk08&src=typd&f=realtime) + +## 参加登録 + +Tito にて申し込みを受け付けています。 + +* [イベントサイト](https://regional.rubykaigi.org/kansai08/) +* [参加受付](https://ti.to/kansairubykaigi/08) +* [発表者募集](https://forms.gle/ijBZ6WM63XJ4rdc58) + +[1]: http://regional.rubykaigi.org/ diff --git a/ja/news/_posts/2025-04-09-ruby-3-3-8-released.md b/ja/news/_posts/2025-04-09-ruby-3-3-8-released.md new file mode 100644 index 0000000000..b2781d2c78 --- /dev/null +++ b/ja/news/_posts/2025-04-09-ruby-3-3-8-released.md @@ -0,0 +1,42 @@ +--- +layout: news_post +title: "Ruby 3.3.8 リリース" +author: nagachika +translator: GaTo-Rfc +date: 2025-04-09 11:00:00 +0000 +lang: ja +--- + +Ruby 3.3.8 がリリースされました。 + +詳しくは [GitHub releases](https://github.com/ruby/ruby/releases/tag/v3_3_8) を参照してください。 + +## ダウンロード + +{% assign release = site.data.releases | where: "version", "3.3.8" | first %} + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## リリースコメント + +Ruby 開発者の皆様、バグや脆弱性を報告してくれたユーザーの皆様のご協力により本リリースは行われています。 +皆様のご協力に感謝します。 diff --git a/ja/news/_posts/2025-04-14-ruby-3-4-3-released.md b/ja/news/_posts/2025-04-14-ruby-3-4-3-released.md new file mode 100644 index 0000000000..57f4fd445c --- /dev/null +++ b/ja/news/_posts/2025-04-14-ruby-3-4-3-released.md @@ -0,0 +1,50 @@ +--- +layout: news_post +title: "Ruby 3.4.3 リリース" +author: k0kubun +translator: shia +date: 2025-04-14 08:06:57 +0000 +lang: ja +--- + +Ruby 3.4.3がリリースされました。 + +これは定期的なアップデートであり、バグ修正を含みます。 +詳しくは[GitHub release notes](https://github.com/ruby/ruby/releases/tag/v3_4_3)を参照してください。 + +## リリーススケジュール + +最新の安定版Ruby（現在はRuby 3.4）を2ヶ月おきにリリースする予定です。 +Ruby 3.4.4は6月にリリースされ、3.4.5は8月、3.4.6は10月、3.4.7は12月にリリースされます。 + +多くのユーザーに影響を与えるような変更があった場合、予定よりも早く新しいバージョンをリリースすることがあります。 + +## ダウンロード + +{% assign release = site.data.releases | where: "version", "3.4.3" | first %} + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## リリースコメント + +Ruby 開発者の皆様、バグや脆弱性を報告してくれたユーザーの皆様のご協力により本リリースは行われています。 +皆様のご協力に感謝します。 diff --git a/ja/news/_posts/2025-04-18-ruby-3-5-0-preview1-released.md b/ja/news/_posts/2025-04-18-ruby-3-5-0-preview1-released.md new file mode 100644 index 0000000000..0af36bffb6 --- /dev/null +++ b/ja/news/_posts/2025-04-18-ruby-3-5-0-preview1-released.md @@ -0,0 +1,104 @@ +--- +layout: news_post +title: "Ruby 3.5.0 preview1 リリース" +author: "naruse" +translator: +date: 2025-04-18 00:00:00 +0000 +lang: ja +--- + +{% assign release = site.data.releases | where: "version", "3.5.0-preview1" | first %} +Ruby {{ release.version }} が公開されました。Ruby 3.5では、Unicodeバージョンの15.1.0へのアップデートなど様々な改善が行われています。 + + + +## 言語機能の変更 + + + +* `*nil` no longer calls `nil.to_a`, similar to how `**nil` does + not call `nil.to_hash`. [[Feature #21047]] + +## コアクラスのアップデート + +注: 複数のアップデートの中から注目すべきアップデートのみを掲載しています。 + +* Binding + + * `Binding#local_variables` does no longer include numbered parameters. + Also, `Binding#local_variable_get` and `Binding#local_variable_set` reject to handle numbered parameters. + [[Bug #21049]] + +* IO + + * `IO.select` accepts +Float::INFINITY+ as a timeout argument. + [[Feature #20610]] + +* String + + * Update Unicode to Version 15.1.0 and Emoji Version 15.1. [[Feature #19908]] + (also applies to Regexp) + + +## 標準ライブラリのアップデート + +注: 複数のアップデートの中から注目すべき標準ライブラリのアップデートのみを掲載しています。 + + + +## 互換性に関する変更 + +注: 不具合修正を除きます。 + + + +## 標準ライブラリの互換性の変更 + + + +## C API のアップデート + + + +## その他の変更点 + + + +より詳細な情報は [NEWS](https://github.com/ruby/ruby/blob/{{ release.tag }}/NEWS.md) +か [commit logs](https://github.com/ruby/ruby/compare/v3_4_0...{{ release.tag }}) を参照してください。 + + +これらの変更により、Ruby 3.4.0から [{{ release.stats.files_changed }} ファイルが変更され、 {{ release.stats.insertions }} 行が追加され、 {{ release.stats.deletions }} 行が削除されました!deletions(-)](https://github.com/ruby/ruby/compare/v3_4_0...{{ release.tag }}#file_bucket) + + +## Download + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## What is Ruby + +Rubyはまつもとゆきひろ (Matz) によって1993年に開発が始められ、今もオープンソースソフトウェアとして開発が続けられています。Rubyは様々なプラットフォームで動き、世界中で、特にWebアプリケーション開発のために使われています。 + +[Feature #21047]: https://bugs.ruby-lang.org/issues/21047 +[Bug #21049]: https://bugs.ruby-lang.org/issues/21049 +[Feature #20610]: https://bugs.ruby-lang.org/issues/20610 +[Feature #19908]: https://bugs.ruby-lang.org/issues/19908 diff --git a/ko/about/website/index.md b/ko/about/website/index.md index a3215c8ce2..a3d0d4622f 100644 --- a/ko/about/website/index.md +++ b/ko/about/website/index.md @@ -52,8 +52,6 @@ lang: ko Heroku -[IBM][ibm] (호스팅) - [Fastly][fastly] (CDN) Fastly @@ -79,7 +77,6 @@ lang: ko [github-wiki]: https://github.com/ruby/www.ruby-lang.org/wiki [rubyassociation]: http://www.ruby.or.jp [heroku]: https://www.heroku.com/ -[ibm]: https://www.ibm.com [fastly]: http://www.fastly.com [hatena]: http://hatenacorp.jp/ [mackerel]: https://mackerel.io/ diff --git a/ko/documentation/faq/2/index.md b/ko/documentation/faq/2/index.md index e8b5e322be..3f204b4dbe 100644 --- a/ko/documentation/faq/2/index.md +++ b/ko/documentation/faq/2/index.md @@ -55,7 +55,7 @@ Python은 하이브리드 언어입니다. 절차적 프로그래밍을 위한 Ruby는 절차적 언어로 가장할 수 있는 순수한 객체 지향 언어입니다. 함수는 없고 메서드 호출만 있습니다. Ruby 메서드에서 `self`라고도 하는 수신자는 C++의 `this`와 같은 숨겨진 인수입니다. 클래스 정의 밖의 `def` 문은 Python에서는 -함수지만 Ruby에서 실제로는 메서드 호출입니다. 이러한 가짜 함수는 Ruby 클래스 +함수 정의이지만 Ruby에서 실제로는 메서드 정의입니다. 이러한 가짜 함수는 Ruby 클래스 계층 구조의 루트인 Object 클래스의 private 메서드가 됩니다. 절차적 프로그래밍은 다른 방향에서 깔끔하게 해결됩니다. 모든 것이 객체입니다. 사용자가 아직 객체를 이해하지 못했어도 `def`가 함수 정의인 것처럼 동작해서 문제없이 사용할 수 있습니다. diff --git a/ko/documentation/installation/index.md b/ko/documentation/installation/index.md index 60998f0a07..8c4982926e 100644 --- a/ko/documentation/installation/index.md +++ b/ko/documentation/installation/index.md @@ -346,7 +346,7 @@ UNIX 계열 운영체제와 Windows를 지원합니다. ### rbenv {: #rbenv} -[rbenv][rbenv]는 여러 종류의 Ruby를 설치할 수 있게 합니다. +[rbenv][rbenv]는 여러 버전의 Ruby를 설치할 수 있게 합니다. rbenv 자체는 Ruby 설치를 지원하지 않습니다만, [ruby-build](#ruby-build)라는 유명한 플러그인에서 Ruby를 설치할 수 있습니다. rbenv, ruby-build 모두 macOS, Linux나 다른 UNIX-계열 운영체제에서 사용가능합니다. @@ -355,7 +355,7 @@ rbenv, ruby-build 모두 macOS, Linux나 다른 UNIX-계열 운영체제에서 ### rbenv for Windows {: #rbenv-for-windows} -[rbenv for Windows][rbenv-for-windows]는 Windows에서 여러 종류의 Ruby를 +[rbenv for Windows][rbenv-for-windows]는 Windows에서 여러 버전의 Ruby를 설치하고 관리할 수 있도록 합니다. 이는 PowerShell로 작성되었으므로 Windows에서 Ruby를 이용하는 사용자들에게 자연스러운 수단을 제공합니다. 또한 커맨드 라인 인터페이스는 UNIX 계열 @@ -365,7 +365,7 @@ Windows에서 Ruby를 이용하는 사용자들에게 자연스러운 수단을 ### RVM ("Ruby Version Manager") {: #rvm} -[RVM][rvm]은 시스템에 여러 종류의 Ruby를 설치하고 관리할 수 있게 해줍니다. +[RVM][rvm]은 시스템에 여러 버전의 Ruby를 설치하고 관리할 수 있게 해줍니다. RVM은 다른 gemset도 관리해 줍니다. macOS, Linux나 다른 UNIX-계열 운영체제에서만 사용 가능합니다. @@ -373,7 +373,7 @@ macOS, Linux나 다른 UNIX-계열 운영체제에서만 사용 가능합니다. ### RVM 4 Windows {: #rvm-windows} -[RVM 4 Windows][rvm-windows]는 Windows에서 여러 종류의 Ruby를 설치하고 +[RVM 4 Windows][rvm-windows]는 Windows에서 여러 버전의 Ruby를 설치하고 관리할 수 있게 해줍니다. 이는 오리지널 RVM의 복제로, 오리지널 RVM과 동일한 커맨드 라인 인터페이스를 제공하며, 기존 커맨드 라인 인터페이스와 PowerShell을 모두 지원합니다. diff --git a/ko/documentation/quickstart/2/index.md b/ko/documentation/quickstart/2/index.md index 434771da22..a8b304bd20 100644 --- a/ko/documentation/quickstart/2/index.md +++ b/ko/documentation/quickstart/2/index.md @@ -65,7 +65,7 @@ Hello Matz! ## 문자열의 중간에 자리를 잡아두기 -`#\{name}` 부분은 무엇이냐구요? Ruby에서 문자열 중간에 무엇을 삽입하는 방법입니다. +`#{name}` 부분은 무엇이냐구요? Ruby에서 문자열 중간에 무엇을 삽입하는 방법입니다. 중괄호 사이의 부분이 문자열로 변환되어 (이미 문자열이 아니라면) 전체 문자열의 그 지점에 삽입되는 것이지요. 사람 이름의 첫 글자를 대문자로 만들어주는 것도 가능합니다. diff --git a/ko/documentation/quickstart/4/index.md b/ko/documentation/quickstart/4/index.md index f951d5bdaf..6295c7ad73 100644 --- a/ko/documentation/quickstart/4/index.md +++ b/ko/documentation/quickstart/4/index.md @@ -64,7 +64,7 @@ end 매개 변수입니다. 여기서 일어나고 있는 것은 리스트의 각 원소가 `name` 변수에 넘겨져서, 그 `name`을 -가지고 `puts “Hello#\{name}!”` 코드가 실행되고 있는 거랍니다. +가지고 `puts "Hello #{name}!"` 코드가 실행되고 있는 거랍니다. 대부분의 다른 프로그래밍 언어에서는 보통 `for` 반복문을 사용해서 리스트의 내용물을 처리하게 되지요. C 코드로는 다음과 같겠죠. diff --git a/ko/libraries/index.md b/ko/libraries/index.md index 2e6b7eacf5..c63d0cab53 100644 --- a/ko/libraries/index.md +++ b/ko/libraries/index.md @@ -35,15 +35,15 @@ list`를 사용합니다. 좀 더 정보가 필요하시면 아래 내용을 좀 소스코드는 GitHub에서 볼 수 있습니다. [**The Ruby Toolbox**][6]는 오픈소스이며 Ruby 프로젝트를 검색하기 쉽게 하기 위한 -프로젝트입니다. 다양한 종류의 일반적인 개발 작업을 카테고리로 릴리스나 커밋의 -활발함, 라이브러리의 의존관계 등 각 프로젝트의 다양한 정보를 모았습니다. 또 RubyGems.org와 -GitHub의 인기를 바탕으로 프로젝트의 순위를 매깁니다. 검색을 하면 원하는 것을 쉽게 찾으실 -수 있을 것입니다. +프로젝트입니다. 다양한 개발 작업을 위한 카테고리를 가지고 있으며, +릴리스, 커밋 활동 혹은 의존성과 같이 프로젝트에 관한 많은 정보를 수집합니다. +또한 RubyGems.org와 GitHub에서의 인기도를 기반으로 프로젝트를 평가합니다. +검색을 통해 웹 프레임워크, 문서화 도구, 코드 품질 라이브러리 등 문제 해결을 위한 gem을 쉽게 찾으실 수 있을 것입니다. ### RubyGems에 대한 보충 설명 -많이 쓰이는 `gem` 명령어를 가볍게 보시려면, 이 패키지 관리시스템의 전반에 -대한 [좀 더 자세한 문서][7]도 있습니다. +다음은 일상적인 사용을 위한 `gem` 명령어에 대한 간략한 리뷰입니다. +이 패키징 시스템의 모든 기능을 다루는 [더 상세한 문서][7]도 있습니다. #### gem 찾기 @@ -71,7 +71,7 @@ gem을 설치하려면 **install** 명령을 사용하면 됩니다. 예를 들 $ gem install rails {% endhighlight %} -`--version` / `-v` 플래그를 이용하면 특정 버전을 지칭해서 설치할 수도 있습니다. +`--version` / `-v` 플래그를 이용하면 특정 버전을 지정해서 설치할 수도 있습니다. {% highlight sh %} $ gem install rails --version 5.0 diff --git a/ko/news/_posts/2015-08-18-ruby-2-0-0-p647-released.md b/ko/news/_posts/2015-08-18-ruby-2-0-0-p647-released.md index 7e7e284e1b..ebd1eb0e64 100644 --- a/ko/news/_posts/2015-08-18-ruby-2-0-0-p647-released.md +++ b/ko/news/_posts/2015-08-18-ruby-2-0-0-p647-released.md @@ -12,7 +12,7 @@ lang: ko 이 릴리스에는 RubyGems 도메인 이름 확인 취약점에 관한 보안 수정이 포함됩니다. 더 자세한 내용은 밑의 내용을 보세요. -* [CVE-2015-3900 RubyGems 2.4.6 이전의 요청 가로채기 취약점](http://ruby-korea.github.io/rubygems-blog/2015/05/14/CVE-2015-3900.html) +* [CVE-2015-3900 RubyGems 2.4.6 이전의 요청 가로채기 취약점](https://rubykr.github.io/rubygems-blog/2015/05/14/CVE-2015-3900.html) 그리고 이 릴리스에는 lib/resolv.rb의 회귀에 대한 수정도 포함됩니다. diff --git a/ko/news/_posts/2015-08-18-ruby-2-1-7-released.md b/ko/news/_posts/2015-08-18-ruby-2-1-7-released.md index 42356aa7e6..afbc8e4421 100644 --- a/ko/news/_posts/2015-08-18-ruby-2-1-7-released.md +++ b/ko/news/_posts/2015-08-18-ruby-2-1-7-released.md @@ -12,7 +12,7 @@ lang: ko 이 릴리스에는 RubyGems 도메인 이름 확인 취약점에 관한 보안 수정이 포함됩니다. 더 자세한 내용은 밑의 내용을 보세요. -* [CVE-2015-3900 RubyGems 2.4.6 이전의 요청 가로채기 취약점](http://ruby-korea.github.io/rubygems-blog/2015/05/14/CVE-2015-3900.html) +* [CVE-2015-3900 RubyGems 2.4.6 이전의 요청 가로채기 취약점](https://rubykr.github.io/rubygems-blog/2015/05/14/CVE-2015-3900.html) 또한 많은 버그가 수정되었습니다. 자세한 내용은 [티켓](https://bugs.ruby-lang.org/projects/ruby-21/issues?set_filter=1&status_id=5)과 diff --git a/ko/news/_posts/2015-08-18-ruby-2-2-3-released.md b/ko/news/_posts/2015-08-18-ruby-2-2-3-released.md index c1c8f7959d..4d71bcfbba 100644 --- a/ko/news/_posts/2015-08-18-ruby-2-2-3-released.md +++ b/ko/news/_posts/2015-08-18-ruby-2-2-3-released.md @@ -12,7 +12,7 @@ lang: ko 이 릴리스에는 RubyGems 도메인 이름 확인 취약점에 관한 보안 수정이 포함됩니다. -* [CVE-2015-3900 RubyGems 2.4.6 이전의 요청 가로채기 취약점](http://ruby-korea.github.io/rubygems-blog/2015/05/14/CVE-2015-3900.html) +* [CVE-2015-3900 RubyGems 2.4.6 이전의 요청 가로채기 취약점](https://rubykr.github.io/rubygems-blog/2015/05/14/CVE-2015-3900.html) 버그 수정도 조금 있었습니다. 자세한 내용은 diff --git a/ko/news/_posts/2025-03-26-ruby-3-1-7-released.md b/ko/news/_posts/2025-03-26-ruby-3-1-7-released.md new file mode 100644 index 0000000000..51a22a3847 --- /dev/null +++ b/ko/news/_posts/2025-03-26-ruby-3-1-7-released.md @@ -0,0 +1,46 @@ +--- +layout: news_post +title: "Ruby 3.1.7 릴리스" +author: hsbt +translator: shia +date: 2025-03-26 04:44:27 +0000 +lang: ko +--- + +Ruby 3.1.7이 릴리스되었습니다. 이 릴리스에는 [CVE-2025-27219, CVE-2025-27220 및 CVE-2025-27221 수정 사항](https://www.ruby-lang.org/ko/news/2025/02/26/security-advisories/)이 포함되어 있고, 내장된 REXML 및 RSS gem이 업데이트되었습니다. + +자세한 사항은 [GitHub 릴리스](https://github.com/ruby/ruby/releases/tag/v3_1_7)를 확인해 주세요. + +이 버전은 Ruby 3.1 버전대의 최종 릴리스입니다. Ruby 3.1 버전대에 대한 보안 수정을 포함한 추가 업데이트는 제공되지 않습니다. + +Ruby 3.3 또는 3.4 버전대로 업그레이드하는 것을 권장합니다. + +## 다운로드 + +{% assign release = site.data.releases | where: "version", "3.1.7" | first %} + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## 릴리스 코멘트 + +많은 커미터, 개발자, 버그를 보고해 준 사용자들이 이 릴리스를 만드는 데 도움을 주었습니다. +그들의 기여에 감사드립니다. diff --git a/ko/news/_posts/2025-03-26-ruby-3-2-8-released.md b/ko/news/_posts/2025-03-26-ruby-3-2-8-released.md new file mode 100644 index 0000000000..aed1e2ba99 --- /dev/null +++ b/ko/news/_posts/2025-03-26-ruby-3-2-8-released.md @@ -0,0 +1,46 @@ +--- +layout: news_post +title: "Ruby 3.2.8 릴리스" +author: hsbt +translator: shia +date: 2025-03-26 04:45:01 +0000 +lang: ko +--- + +Ruby 3.2.8이 릴리스되었습니다. 이 릴리스에는 [CVE-2025-27219, CVE-2025-27220 및 CVE-2025-27221 수정 사항](https://www.ruby-lang.org/ko/news/2025/02/26/security-advisories/)이 포함되어 있습니다. + +자세한 사항은 [GitHub 릴리스](https://github.com/ruby/ruby/releases/tag/v3_2_8)를 확인해 주세요. + +이 버전은 Ruby 3.2 버전대의 일반 유지보수 마지막 버전입니다. Ruby 3.2 버전대는 2026년 3월 말까지 보안 문제만 수정될 것입니다. + +Ruby 3.3 또는 3.4 버전대로 업그레이드하는 것을 권장합니다. + +## 다운로드 + +{% assign release = site.data.releases | where: "version", "3.2.8" | first %} + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## 릴리스 코멘트 + +많은 커미터, 개발자, 버그를 보고해 준 사용자들이 이 릴리스를 만드는 데 도움을 주었습니다. +그들의 기여에 감사드립니다. diff --git a/ko/news/_posts/2025-04-09-ruby-3-3-8-released.md b/ko/news/_posts/2025-04-09-ruby-3-3-8-released.md new file mode 100644 index 0000000000..7edd5c7872 --- /dev/null +++ b/ko/news/_posts/2025-04-09-ruby-3-3-8-released.md @@ -0,0 +1,42 @@ +--- +layout: news_post +title: "Ruby 3.3.8 릴리스" +author: nagachika +translator: shia +date: 2025-04-09 11:00:00 +0000 +lang: ko +--- + +Ruby 3.3.8이 릴리스되었습니다. + +자세한 내용은 [GitHub 릴리스 노트](https://github.com/ruby/ruby/releases/tag/v3_3_8)를 참조하세요. + +## 다운로드 + +{% assign release = site.data.releases | where: "version", "3.3.8" | first %} + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## 릴리스 코멘트 + +많은 커미터, 개발자, 버그를 보고해 준 사용자들이 이 릴리스를 만드는 데 도움을 주었습니다. +그들의 기여에 감사드립니다. diff --git a/ko/news/_posts/2025-04-14-ruby-3-4-3-released.md b/ko/news/_posts/2025-04-14-ruby-3-4-3-released.md new file mode 100644 index 0000000000..27989b7a5e --- /dev/null +++ b/ko/news/_posts/2025-04-14-ruby-3-4-3-released.md @@ -0,0 +1,50 @@ +--- +layout: news_post +title: "Ruby 3.4.3 릴리스" +author: k0kubun +translator: "shia" +date: 2025-04-14 08:06:57 +0000 +lang: ko +--- + +Ruby 3.4.3이 릴리스되었습니다. + +이번 릴리스는 일반적인 업데이트로, 사소한 버그 수정이 포함되어 있습니다. +자세한 내용은 [GitHub 릴리스 노트](https://github.com/ruby/ruby/releases/tag/v3_4_3)를 참조하세요. + +## 릴리스 일정 + +Ruby의 최신 안정 버전(현재 Ruby 3.4)을 2개월마다 릴리스할 계획입니다. +Ruby 3.4.4는 6월에 릴리스될 예정이며, 3.4.5는 8월, 3.4.6은 10월, 3.4.7은 12월에 릴리스될 예정입니다. + +만약 많은 사람들에게 영향을 미치는 변경 사항이 있을 경우, 해당 버전은 예상보다 빨리 릴리스될 수 있습니다. + +## 다운로드 + +{% assign release = site.data.releases | where: "version", "3.4.3" | first %} + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## 릴리스 코멘트 + +많은 커미터, 개발자, 버그를 보고해 준 사용자들이 이 릴리스를 만드는 데 도움을 주었습니다. +그들의 기여에 감사드립니다. diff --git a/ko/news/_posts/2025-04-18-ruby-3-5-0-preview1-released.md b/ko/news/_posts/2025-04-18-ruby-3-5-0-preview1-released.md new file mode 100644 index 0000000000..50c084aeb5 --- /dev/null +++ b/ko/news/_posts/2025-04-18-ruby-3-5-0-preview1-released.md @@ -0,0 +1,110 @@ +--- +layout: news_post +title: "Ruby 3.5.0-preview1 릴리스" +author: "naruse" +translator: "shia" +date: 2025-04-18 00:00:00 +0000 +lang: ko +--- + +{% assign release = site.data.releases | where: "version", "3.5.0-preview1" | first %} +Ruby {{ release.version }} 릴리스를 알리게 되어 기쁩니다. Ruby 3.5는 유니코드 버전을 15.1.0으로 업데이트했으며, 더 많은 것들이 있습니다. + +## 언어 변경 + +* `**nil`이 `nil.to_hash`를 호출하지 않는 것과 비슷하게 `*nil`은 더 이상 `nil.to_a`를 호출하지 않습니다. + [[Feature #21047]] + +## 코어 클래스 변경 + +주의: 눈에 띄는 코어 클래스 변경만을 포함합니다. + +* Binding + + * `Binding#local_variables`는 더 이상 번호가 매겨진 매개변수를 포함하지 않습니다. + 또한, `Binding#local_variable_get`과 `Binding#local_variable_set`은 번호가 매겨진 매개변수를 처리하지 않습니다. + [[Bug #21049]] + +* IO + + * `IO.select`는 타임아웃 인수로 +Float::INFINITY+를 허용합니다. + [[Feature #20610]] + +* String + + * 유니코드 15.1.0 및 이모지 버전 15.1로 업데이트합니다. [[Feature #19908]] + (Regexp에도 적용됩니다) + + +## 표준 라이브러리 변경 + +주의: 눈에 띄는 표준 라이브러리 변경만을 포함합니다. + +* ostruct 0.6.1 +* pstore 0.2.0 +* benchmark 0.4.0 +* logger 1.7.0 +* rdoc 6.13.1 +* win32ole 1.9.2 +* irb 1.15.2 +* reline 0.6.1 +* readline 0.0.4 +* fiddle 1.1.6 + +## 호환성 문제 + +주의: 기능 버그 수정은 포함되어 있지 않습니다. + + + +## 표준 라이브러리 호환성 문제 + + +## C API 변경 + + + +## 그 이외의 변경 + + + +더 자세한 내용은 [NEWS](https://github.com/ruby/ruby/blob/{{ release.tag }}/NEWS.md)나 +[커밋 로그](https://github.com/ruby/ruby/compare/v3_4_0...{{ release.tag }})를 +확인해 주세요. + +이러한 변경사항에 따라, Ruby 3.4.0 이후로 [파일 {{ release.stats.files_changed }}개 수정, {{ release.stats.insertions }}줄 추가(+), {{ release.stats.deletions }}줄 삭제(-)](https://github.com/ruby/ruby/compare/v3_4_0...{{ release.tag }}#file_bucket)가 +이루어졌습니다! + +## 다운로드 + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## Ruby는 + +Ruby는 1993년에 Matz(마츠모토 유키히로) 씨가 처음 개발했고, +현재는 오픈 소스로서 개발되고 있습니다. 여러 플랫폼에서 동작하며, +특히 웹 개발에서 전 세계적으로 이용되고 있습니다. + +[Feature #21047]: https://bugs.ruby-lang.org/issues/21047 +[Bug #21049]: https://bugs.ruby-lang.org/issues/21049 +[Feature #20610]: https://bugs.ruby-lang.org/issues/20610 +[Feature #19908]: https://bugs.ruby-lang.org/issues/19908 diff --git a/ko/news/_posts/2025-04-28-dos-net-imap-cve-2025-43857.md b/ko/news/_posts/2025-04-28-dos-net-imap-cve-2025-43857.md new file mode 100644 index 0000000000..1ddf6e44a2 --- /dev/null +++ b/ko/news/_posts/2025-04-28-dos-net-imap-cve-2025-43857.md @@ -0,0 +1,35 @@ +--- +layout: news_post +title: "CVE-2025-43857: net-imap의 DoS 취약점" +author: "nevans" +translator: "shia" +date: 2025-04-28 16:02:04 +0000 +tags: security +lang: ko +--- + +net-imap gem에서 DoS 취약점이 발견되었습니다. 이 취약점은 CVE 번호 [CVE-2025-43857](https://www.cve.org/CVERecord?id=CVE-2025-43857)로 등록되었습니다. net-imap gem을 업그레이드하기를 추천합니다. + +## 세부 내용 + +악의적인 서버가 "문자 그대로" 바이트 수를 보낼 수 있으며, 클라이언트의 수신 스레드는 이 데이터를 자동으로 읽습니다. 응답 리더는 서버 응답에 의해 표시된 바이트 수에 대한 메모리를 즉시 할당합니다. 신뢰할 수 있는 IMAP 서버에 안전하게 연결할 때는 문제가 되지 않습니다. 그러나 보안 연결을 사용하지 않거나, 버그가 있거나, 신뢰할 수 없거나, 오염된 서버(예: 사용자가 제공한 호스트 이름에 연결하는 경우)에서는 문제가 발생할 수 있습니다. + +net-imap gem 0.2.5, 0.3.9, 0.4.20, 0.5.7 이상으로 업데이트하세요. + +신뢰할 수 없는 서버에 연결하거나 보안 연결을 사용하고 있지 않다면, `max_response_size`와 응답 핸들러를 적절히 설정하여 메모리 소비를 제한해야 합니다. 자세한 내용은 [GHSA-j3g3-5qv5-52mj]를 참조하세요. + +## 해당 버전 + +net-imap gem 0.2.4 이하, 0.3.0부터 0.3.8까지, 0.4.0부터 0.4.19까지, 0.5.0부터 0.5.6까지 + +## 도움을 준 사람 + +이 문제를 발견해 준 [Masamune]에게 감사를 표합니다. + +## 수정 이력 + +* 2025-04-28 16:02:04 (UTC) 최초 공개 + +[CVE-2025-43857]: https://www.cve.org/CVERecord?id=CVE-2025-43857 +[GHSA-j3g3-5qv5-52mj]: https://github.com/ruby/net-imap/security/advisories/GHSA-j3g3-5qv5-52mj +[Masamune]: https://hackerone.com/masamune_ diff --git a/pt/news/_posts/2025-02-26-security-advisories.md b/pt/news/_posts/2025-02-26-security-advisories.md new file mode 100644 index 0000000000..8e7c9c9646 --- /dev/null +++ b/pt/news/_posts/2025-02-26-security-advisories.md @@ -0,0 +1,69 @@ +--- +layout: news_post +title: "Avisos de segurança: CVE-2025-27219, CVE-2025-27220 e CVE-2025-27221" +author: "hsbt" +translator: nbluis +date: 2025-02-26 07:00:00 +0000 +tags: security +lang: pt +--- + +Publicamos avisos de segurança para CVE-2025-27219, CVE-2025-27220 e CVE-2025-27221. Por favor, leia os detalhes abaixo. + +## CVE-2025-27219: Negação de Serviço em `CGI::Cookie.parse`. + +Há uma possibilidade de DoS na gem cgi. Esta vulnerabilidade foi identificada com o CVE [CVE-2025-27219](https://www.cve.org/CVERecord?id=CVE-2025-27219). Recomendamos atualizar a gem cgi. + +### Detalhes + +`CGI::Cookie.parse` levava tempo super-linear para analisar uma string de cookie em alguns casos. Alimentar uma string de cookie maliciosamente criada no método poderia levar a uma Negação de Serviço. + +Por favor, atualize a gem CGI para a versão 0.3.5.1, 0.3.7, 0.4.2 ou posterior. + +### Versões afetadas + +* Versões da gem cgi <= 0.3.5, 0.3.6, 0.4.0 e 0.4.1. + +### Créditos + +Obrigado a [lio346](https://hackerone.com/lio346) por descobrir este problema. Também agradecemos a [mame](https://github.com/mame) por corrigir esta vulnerabilidade. + +## CVE-2025-27220: ReDoS em `CGI::Util#escapeElement`. + +Há uma possibilidade de Negação de Serviço por expressão regular (ReDoS) na gem cgi. Esta vulnerabilidade foi identificada com o CVE [CVE-2025-27220](https://www.cve.org/CVERecord?id=CVE-2025-27220). Recomendamos atualizar a gem cgi. + +### Detalhes + +A expressão regular usada em `CGI::Util#escapeElement` é vulnerável a ReDoS. A entrada criada poderia levar a um alto consumo de CPU. + +Esta vulnerabilidade afeta apenas Ruby 3.1 e 3.2. Se você estiver usando essas versões, por favor, atualize a gem CGI para a versão 0.3.5.1, 0.3.7, 0.4.2 ou posterior. + +### Versões afetadas + +* Versões da gem cgi <= 0.3.5, 0.3.6, 0.4.0 e 0.4.1. + +### Créditos + +Obrigado a [svalkanov](https://hackerone.com/svalkanov) por descobrir este problema. Também agradecemos a [nobu](https://github.com/nobu) por corrigir esta vulnerabilidade. + +## CVE-2025-27221: vazamento de informações de usuário em `URI#join`, `URI#merge` e `URI#+`. + +Há uma possibilidade de vazamento de informações de usuário na gem uri. Esta vulnerabilidade foi identificada com o CVE [CVE-2025-27221](https://www.cve.org/CVERecord?id=CVE-2025-27221). Recomendamos atualizar a gem uri. + +### Detalhes + +Os métodos `URI#join`, `URI#merge` e `URI#+` mantinham informações de usuário, como `user:password`, mesmo após o host ser substituído. Ao gerar uma URL para um host malicioso a partir de uma URL contendo informações de usuário secretas usando esses métodos, e fazer alguém acessar essa URL, poderia ocorrer um vazamento não intencional de informações de usuário. + +Por favor, atualize a gem URI para a versão 0.11.3, 0.12.4, 0.13.2, 1.0.3 ou posterior. + +### Versões afetadas + +* Versões da gem uri < 0.11.3, 0.12.0 a 0.12.3, 0.13.0, 0.13.1 e 1.0.0 a 1.0.2. + +### Créditos + +Obrigado a [Tsubasa Irisawa (lambdasawa)](https://hackerone.com/lambdasawa) por descobrir este problema. Também agradecemos a [nobu](https://github.com/nobu) por correções adicionais desta vulnerabilidade. + +## Histórico + +* Publicado originalmente em 2025-02-26 7:00:00 (UTC) diff --git a/zh_cn/news/_posts/2025-02-26-security-advisories.md b/zh_cn/news/_posts/2025-02-26-security-advisories.md new file mode 100644 index 0000000000..f9422f9da0 --- /dev/null +++ b/zh_cn/news/_posts/2025-02-26-security-advisories.md @@ -0,0 +1,71 @@ +--- +layout: news_post +title: "安全建议: CVE-2025-27219，CVE-2025-27220 和 CVE-2025-27221" +author: "hsbt" +translator: "GAO Jun" +date: 2025-02-26 07:00:00 +0000 +tags: security +lang: zh_cn +--- + +针对 CVE-2025-27219，CVE-2025-27220 和 CVE-2025-27221，我们发布下列安全建议。 + +## CVE-2025-27219: `CGI::Cookie.parse` 中的拒绝服务（Denial of Service，DoS）。 + +`cgi` gem 中存在 DoS 可能。此漏洞的 CVE 编号为 [CVE-2025-27219](https://www.cve.org/CVERecord?id=CVE-2025-27219)。我们建议您更新 `cgi` gem。 + +### 详情 + +在某些情况下，`CGI::Cookie.parse` 解析 cookie 字符串的时间超过线性增长。向该方法传入恶意构造的 cookie 字符串可能会导致拒绝服务（DoS）。 + +请更新 `cgi` gem 至 0.3.5.1，0.3.7，0.4.2 或更新版本。 + +### 受影响版本 + +* `cgi` gem 版本 <= 0.3.5，0.3.6，0.4.0 和 0.4.1。 + +### 致谢 + +感谢 [lio346](https://hackerone.com/lio346) 发现此漏洞。同样感谢 [mame](https://github.com/mame) 修补此漏洞。 + +## CVE-2025-27220: `CGI::Util#escapeElement` 中的正则表达式拒绝服务（Regular Expression Denail of Service, ReDoS）漏洞。 + +`cgi` gem 中存在 ReDoS 可能。此漏洞的 CVE 编号为 [CVE-2025-27220](https://www.cve.org/CVERecord?id=CVE-2025-27220)。我们建议您更新 `cgi` gem。 + +### 详情 + +`CGI::Util#escapeElement` 中使用的正则表达式可能受到 ReDoS 攻击。特定的输入可能会导致 CPU 高负载。 + +此漏洞仅影响 Ruby 3.1 和 3.2。如果您正在使用这些版本，请更新 `cgi` gem 至 0.3.5.1，0.3.7，0.4.2 或更新版本。 + +### 受影响版本 + +* `cgi` gem 版本 <= 0.3.5，0.3.6，0.4.0 和 0.4.1。 + +### 致谢 + +感谢 [svalkanov](https://hackerone.com/svalkanov) 发现此漏洞。同样感谢 [nobu](https://github.com/nobu) 修补此漏洞。 + + +## CVE-2025-27221: `URI#join`， `URI#merge` 和 `URI#+` 中的用户信息泄漏。 + +`uri` gem 可能会泄漏用户信息。此漏洞的 CVE 编号为 [CVE-2025-27221](https://www.cve.org/CVERecord?id=CVE-2025-27221)。我们建议您更新 `uri` gem。 + +### 详情 + +`URI#join`，`URI#merge` 和 `URI#+` 方法会保留用户信息，如 `user:password`。即使替换了主机也会保留。 +当基于用户隐私信息，使用了这些方法生成了一个指向恶意主机的 URL 后，如果有人访问了该 URL，可能会发生用户信息泄漏。 + +请更新 `uri` gem 至 0.11.3，0.12.4，0.13.2，1.0.3 或更新版本。 + +### 受影响版本 + +* `uri` gem 版本 < 0.11.3，0.12.0 至 0.12.3，0.13.0，0.13.1，1.0.0 至 1.0.2。 + +### 致谢 + +感谢 [Tsubasa Irisawa (lambdasawa)](https://hackerone.com/lambdasawa) 发现此漏洞。同样感谢 [nobu](https://github.com/nobu) 修补此漏洞。 + +## 历史 + +* 最初发布于 2025-02-26 7:00:00 (UTC) diff --git a/zh_cn/news/_posts/2025-03-26-ruby-3-1-7-released.md b/zh_cn/news/_posts/2025-03-26-ruby-3-1-7-released.md new file mode 100644 index 0000000000..869d7a996d --- /dev/null +++ b/zh_cn/news/_posts/2025-03-26-ruby-3-1-7-released.md @@ -0,0 +1,47 @@ +--- +layout: news_post +title: "Ruby 3.1.7 已发布" +author: hsbt +translator: "GAO Jun" +date: 2025-03-26 04:44:27 +0000 +lang: zh_cn +--- + +Ruby 3.1.7 已发布。此版本包括 [CVE-2025-27219，CVE-2025-27220 和 CVE-2025-27221 的补丁](https://www.ruby-lang.org/zh_cn/news/2025/02/26/security-advisories/) +并更新了绑定的 REXML 和 RSS gems. + +详细信息可参考 [GitHub 发布说明](https://github.com/ruby/ruby/releases/tag/v3_1_7)。 + +此版本是 Ruby 3.1 系列的最终版本。我们不会再发布 Ruby 3.1 系列的后续版本，包括安全补丁。 + +我们建议您更新到 Ruby 3.3 或 3.4 系列版本。 + +## 下载 + +{% assign release = site.data.releases | where: "version", "3.1.7" | first %} + +* <{{ release.url.gz }}> + + 文件大小: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + 文件大小: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + 文件大小: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## 发布说明 + +许多提交者、开发人员以及用户提供了问题报告，帮助我们完成了此版本。 +感谢他们的贡献。 diff --git a/zh_cn/news/_posts/2025-03-26-ruby-3-2-8-released.md b/zh_cn/news/_posts/2025-03-26-ruby-3-2-8-released.md new file mode 100644 index 0000000000..bf40ff3f58 --- /dev/null +++ b/zh_cn/news/_posts/2025-03-26-ruby-3-2-8-released.md @@ -0,0 +1,46 @@ +--- +layout: news_post +title: "Ruby 3.2.8 已发布" +author: hsbt +translator: "GAO Jun" +date: 2025-03-26 04:45:01 +0000 +lang: zh_cn +--- + +Ruby 3.2.8已发布。此版本包括 [CVE-2025-27219，CVE-2025-27220 和 CVE-2025-27221 的补丁](https://www.ruby-lang.org/zh_cn/news/2025/02/26/security-advisories/)。 + +详细信息可参考 [GitHub 发布说明](https://github.com/ruby/ruby/releases/tag/v3_2_8)。 + +此版本是 Ruby 3.2 系列的最后普通维护版本。今后，直到 2026 年 3 月，我们仅会为 Ruby 3.2 系列提供安全补丁。 + +请考虑更新到 Ruby 3.3 或 3.4 系列版本。 + +## 下载 + +{% assign release = site.data.releases | where: "version", "3.2.8" | first %} + +* <{{ release.url.gz }}> + + 文件大小: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + 文件大小: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + 文件大小: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## 发布说明 + +许多提交者、开发人员以及用户提供了问题报告，帮助我们完成了此版本。 +感谢他们的贡献。 diff --git a/zh_cn/news/_posts/2025-04-09-ruby-3-3-8-released.md b/zh_cn/news/_posts/2025-04-09-ruby-3-3-8-released.md new file mode 100644 index 0000000000..8be944d49f --- /dev/null +++ b/zh_cn/news/_posts/2025-04-09-ruby-3-3-8-released.md @@ -0,0 +1,42 @@ +--- +layout: news_post +title: "Ruby 3.3.8 已发布" +author: nagachika +translator: "GAO Jun" +date: 2025-04-09 11:00:00 +0000 +lang: zh_cn +--- + +Ruby 3.3.8 已发布。 + +更多信息可以参考 [GitHub 发布说明](https://github.com/ruby/ruby/releases/tag/v3_3_8)。 + +## 下载 + +{% assign release = site.data.releases | where: "version", "3.3.8" | first %} + +* <{{ release.url.gz }}> + + 文件大小: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + 文件大小: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + 文件大小: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## 发布说明 + +许多提交者、开发人员以及用户提供了问题报告，帮助我们完成了此版本。 +感谢他们的贡献。 diff --git a/zh_cn/news/_posts/2025-04-14-ruby-3-4-3-released.md b/zh_cn/news/_posts/2025-04-14-ruby-3-4-3-released.md new file mode 100644 index 0000000000..9e51564afb --- /dev/null +++ b/zh_cn/news/_posts/2025-04-14-ruby-3-4-3-released.md @@ -0,0 +1,50 @@ +--- +layout: news_post +title: "Ruby 3.4.3 已发布" +author: k0kubun +translator: "GAO Jun" +date: 2025-04-14 08:06:57 +0000 +lang: zh_cn +--- + +Ruby 3.4.3 已发布。 + +此版本是包含了若干问题修正的定期更新版本。 +详细信息可参考 [GitHub 发布说明](https://github.com/ruby/ruby/releases/tag/v3_4_3)。 + +## 发布计划 + +我们计划每2个月发布最新的 Ruby 版本（目前是 Ruby 3.4）。 +Ruby 3.4.4 将发布于六月，3.4.5 将发布于八月，3.4.6 将发布于十月，3.4.7 将发布于十二月。 + +如果存在会影响到大量用户的更改，我们可能会提前发布新版本。 + +## 下载 + +{% assign release = site.data.releases | where: "version", "3.4.3" | first %} + +* <{{ release.url.gz }}> + + 文件大小: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + 文件大小: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + 文件大小: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## 发布说明 + +许多提交者、开发人员以及用户提供了问题报告，帮助我们完成了此版本。 +感谢他们的贡献。 diff --git a/zh_cn/news/_posts/2025-04-18-ruby-3-5-0-preview1-released.md b/zh_cn/news/_posts/2025-04-18-ruby-3-5-0-preview1-released.md new file mode 100644 index 0000000000..34a017c404 --- /dev/null +++ b/zh_cn/news/_posts/2025-04-18-ruby-3-5-0-preview1-released.md @@ -0,0 +1,106 @@ +--- +layout: news_post +title: "Ruby 3.5.0 preview1 已发布" +author: "naruse" +translator: "GAO Jun" +date: 2025-04-18 00:00:00 +0000 +lang: zh_cn +--- + +{% assign release = site.data.releases | where: "version", "3.5.0-preview1" | first %} +我们很高兴地宣布 Ruby {{ release.version }} 已发布。Ruby 3.5 除了将 Unicode 版本更新到 15.1.0外，还有一些其他变更。 + +## 语言变化 + +* `*nil` 不再调用 `nil.to_a`，就像 `**nil` 不再调用 `nil.to_hash`。 [[Feature #21047]] + +## 核心类更新 + +注意：我们只列出了重要的核心类更新。 + +* Binding + + * `Binding#local_variables` 不再包含引用数字参数（如 `_1`, `_2`）。 + 同样， `Binding#local_variable_get` 和 `Binding#local_variable_set` 也会拒绝处理引用数字参数。 + [[Bug #21049]] + +* IO + + * `IO.select` 允许使用 `Float::INFINITY` 作为超时参数。 + [[Feature #20610]] + +* String + + * 更新 Unicode 版本至 15.1.0，更新 Emoji 版本至 15.1。 [[Feature #19908]] + （同样适用于 Regexp） + + +## 标准库更新 + +注意：我们只列出了重要的标准库更新。 + +* ostruct 0.6.1 +* pstore 0.2.0 +* benchmark 0.4.0 +* logger 1.7.0 +* rdoc 6.13.1 +* win32ole 1.9.2 +* irb 1.15.2 +* reline 0.6.1 +* readline 0.0.4 +* fiddle 1.1.6 + +## 兼容性问题 + +注意：不包括错误问题修正。 + + + +## 标准库兼容性问题 + + +## C API 更新 + + + +## 其他变化 + + + +更多详情，可参见 [NEWS](https://github.com/ruby/ruby/blob/{{ release.tag }}/NEWS.md) +或 [提交日志](https://github.com/ruby/ruby/compare/v3_4_0...{{ release.tag }})。 + +自 Ruby 3.4.0 以来，这些变化共导致 [{{ release.stats.files_changed }} 个文件被更改，新增 {{ release.stats.insertions }} 行(+)，删除 {{ release.stats.deletions }} deletions(-)](https://github.com/ruby/ruby/compare/v3_3_0...{{ release.tag }}#file_bucket)！ + +## 下载 + +* <{{ release.url.gz }}> + + 文件大小: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + 文件大小: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + 文件大小: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## Ruby 是什么 + +Ruby 最初由 Matz （松本行弘，Yukihiro Matsumoto） 于 1993 年开发， +现在以开源软件的形式开发。它可以在多个平台上运行，并在全球得到广泛使用，尤其是 Web 开发领域。 + +[Feature #21047]: https://bugs.ruby-lang.org/issues/21047 +[Bug #21049]: https://bugs.ruby-lang.org/issues/21049 +[Feature #20610]: https://bugs.ruby-lang.org/issues/20610 +[Feature #19908]: https://bugs.ruby-lang.org/issues/19908 diff --git a/zh_cn/news/_posts/2025-04-28-dos-net-imap-cve-2025-43857.md b/zh_cn/news/_posts/2025-04-28-dos-net-imap-cve-2025-43857.md new file mode 100644 index 0000000000..9b1444e69c --- /dev/null +++ b/zh_cn/news/_posts/2025-04-28-dos-net-imap-cve-2025-43857.md @@ -0,0 +1,38 @@ +--- +layout: news_post +title: "CVE-2025-43857: net-imap 中的 DoS 漏洞" +author: "nevans" +translator: "GAO Jun" +date: 2025-04-28 16:02:04 +0000 +tags: security +lang: zh_cn +--- + +在 `net-imap` gem 中存在一个可能造成 DoS 的漏洞。此漏洞的 CVE 编号为 [CVE-2025-43857]。我们建议您更新 `net-imap` gem。 + +## 详情 + +恶意服务器可以发送一个 “特定的” 字节数信息，这个数字会被客户端的接收线程自动读取。 +读取后，客户端会立即根据服务器告知的这个字节数分配内存。在安全地连接可信 IMAP 服务器时，这不是一个问题。 +但当使用不安全连接，或连接到有缺陷、不可信或已被入侵的服务器（例如，连接到用户提供的主机名）时，就可能导致 DoS。 + +请将 `net-imap` gem 更新到 0.2.5、0.3.9、0.4.20、0.5.7 或更高版本。 + +当连接不可信的服务器或使用不安全连接时，必须适当设置 `max_response_size` 参数，并在响应处理中进行适当调整以限制内存消耗。 +更多详细信息请参阅 [GHSA-j3g3-5qv5-52mj]。 + +## 受影响版本 + +`net-imap` gem 版本 <= 0.2.4，0.3.0 至 0.3.8，0.4.0 至 0.4.19，以及 0.5.0 至 0.5.6。 + +## 致谢 + +感谢 [Masamune] 发现此问题。 + +## 历史 + +* 最初发布于 2025-04-28 16:02:04 (UTC) + +[CVE-2025-43857]: https://www.cve.org/CVERecord?id=CVE-2025-43857 +[GHSA-j3g3-5qv5-52mj]: https://github.com/ruby/net-imap/security/advisories/GHSA-j3g3-5qv5-52mj +[Masamune]: https://hackerone.com/masamune_ diff --git a/zh_tw/about/website/index.md b/zh_tw/about/website/index.md index 789c69403c..a1c931e0e5 100644 --- a/zh_tw/about/website/index.md +++ b/zh_tw/about/website/index.md @@ -47,8 +47,6 @@ lang: zh_tw Heroku -[IBM][ibm] (網站托管) - [Fastly][fastly] (CDN) Fastly @@ -74,7 +72,6 @@ lang: zh_tw [github-wiki]: https://github.com/ruby/www.ruby-lang.org/wiki [rubyassociation]: http://www.ruby.or.jp [heroku]: https://www.heroku.com/ -[ibm]: https://www.ibm.com [fastly]: http://www.fastly.com [hatena]: http://hatenacorp.jp/ [mackerel]: https://mackerel.io/ diff --git a/zh_tw/news/_posts/2025-02-26-security-advisories.md b/zh_tw/news/_posts/2025-02-26-security-advisories.md new file mode 100644 index 0000000000..9a19bc83bc --- /dev/null +++ b/zh_tw/news/_posts/2025-02-26-security-advisories.md @@ -0,0 +1,79 @@ +--- +layout: news_post +title: "安全性公告：CVE-2025-27219、CVE-2025-27220 和 CVE-2025-27221" +author: "hsbt" +translator: "Bear Su" +date: 2025-02-26 07:00:00 +0000 +tags: security +lang: zh_tw +--- + +我們發布了安全性公告 CVE-2025-27219、CVE-2025-27220 和 CVE-2025-27221。 +請閱讀以下風險細節。 + +## CVE-2025-27219：`CGI::Cookie.parse` 中發生服務阻斷。 + +在 cgi gem 中可能會發生服務阻斷。該漏洞的 CVE 編號為 [CVE-2025-27219](https://www.cve.org/CVERecord?id=CVE-2025-27219)。 +我們強烈建議您升級 cgi gem。 + +### 風險細節 + +在某些情況下 `CGI::Cookie.parse` 解析 cookie 字串會花費超級線性時間。 +將刻意的 cookie 字串傳入該方法可能會導致服務阻斷。 + +請更新 CGI gem 至 0.3.5.1、0.3.7、0.4.2 或較新版本。 + +### 受影響版本 + +* cgi gem 版本 <= 0.3.5、0.3.6、0.4.0 和 0.4.1。 + +### 致謝 + +感謝 [lio346](https://hackerone.com/lio346) 發現此問題。同樣感謝 [mame](https://github.com/mame) 修復此漏洞。 + +## CVE-2025-27220：`CGI::Util#escapeElement` 中發生正規表示式服務阻斷(ReDoS)。 + +在 cgi gem 中可能會發生正規表示式服務阻斷(ReDoS)。 +該漏洞的 CVE 編號為 [CVE-2025-27220](https://www.cve.org/CVERecord?id=CVE-2025-27220)。 +我們強烈建議您升級 cgi gem。 + +### 風險細節 + +`CGI::Util#escapeElement` 使用的正規表示式容易受到 ReDos 的攻擊。 +特別設計的輸入資料可能會導致高 CPU 用量。 + +此漏洞只影響 Ruby 3.1 和 3.2。如果您使用這些版本，請更新 CGI gem 至 0.3.5.1、0.3.7、0.4.2 或較新版本。 + +### 受影響版本 + +* cgi gem 版本 <= 0.3.5、0.3.6、0.4.0 和 0.4.1。 + +### 致謝 + +感謝 [svalkanov](https://hackerone.com/svalkanov) 發現此問題。同樣感謝 [nobu](https://github.com/nobu) 修復此漏洞。 + + +## CVE-2025-27221：`URI#join`、`URI#merge` 和 `URI#+` 中發生使用者資訊外洩。 + +在 uri gem 中可能會發生使用者資訊外洩。 +該漏洞的 CVE 編號為 [CVE-2025-27221](https://www.cve.org/CVERecord?id=CVE-2025-27221)。 +我們強烈建議您升級 uri gem。 + +### 風險細節 + +`URI#join`、`URI#merge`、和 `URI#+` 方法會保留使用者資訊，例如 `user:password`，即使替換掉主機位址也仍保留著。 +當使用這些方法從包含機敏使用者資訊的 URL 產生指向惡意主機的 URL 時，並讓某些使用者存取該 URL，就會導致非預期的使用者資訊外洩。 + +請更新 URI gem 至 0.11.3、0.12.4、0.13.2、1.0.3 或較新版本。 + +### 受影響版本 + +* uri gem 版本 < 0.11.3、0.12.0 至 0.12.3、0.13.0、0.13.1 和 1.0.0 至 1.0.2。 + +### 致謝 + +感謝 [Tsubasa Irisawa (lambdasawa)](https://hackerone.com/lambdasawa) 發現此問題。同樣感謝 [nobu](https://github.com/nobu) 修復此漏洞。 + +## 歷史 + +* 最初發布於 2025-02-26 7:00:00 (UTC) diff --git a/zh_tw/news/_posts/2025-03-26-ruby-3-1-7-released.md b/zh_tw/news/_posts/2025-03-26-ruby-3-1-7-released.md new file mode 100644 index 0000000000..8908ec8434 --- /dev/null +++ b/zh_tw/news/_posts/2025-03-26-ruby-3-1-7-released.md @@ -0,0 +1,47 @@ +--- +layout: news_post +title: "Ruby 3.1.7 發布" +author: hsbt +translator: "Bear Su" +date: 2025-03-26 04:44:27 +0000 +lang: zh_tw +--- + +Ruby 3.1.7 已經發布了。 本次發布版本包含 [CVE-2025-27219、CVE-2025-27220 和 CVE-2025-27221 修復](https://www.ruby-lang.org/en/news/2025/02/26/security-advisories/) 以及更新 bundled REXML 和 RSS gems。 + +詳細的變動請參閱 [GitHub releases](https://github.com/ruby/ruby/releases/tag/v3_1_7)。 + +此為 Ruby 3.1 系列的最後版本。 +我們將不會為 Ruby 3.1 系列發布任何包含安全性修復的更新。 + +我們建議升級至 Ruby 3.3 或 3.4 系列。 + + +## 下載 + +{% assign release = site.data.releases | where: "version", "3.1.7" | first %} + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## 發布紀錄 + +許多提交者、開發者和漏洞回報者幫助了此版本的發布，在此感謝所有人的貢獻。 diff --git a/zh_tw/news/_posts/2025-03-26-ruby-3-2-8-released.md b/zh_tw/news/_posts/2025-03-26-ruby-3-2-8-released.md new file mode 100644 index 0000000000..9f7f486c92 --- /dev/null +++ b/zh_tw/news/_posts/2025-03-26-ruby-3-2-8-released.md @@ -0,0 +1,46 @@ +--- +layout: news_post +title: "Ruby 3.2.8 發布" +author: hsbt +translator: "Bear Su" +date: 2025-03-26 04:45:01 +0000 +lang: zh_tw +--- + +Ruby 3.2.8 已經發布了。 本次發布版本包含 [CVE-2025-27219、CVE-2025-27220 和 CVE-2025-27221 修復](https://www.ruby-lang.org/en/news/2025/02/26/security-advisories/)。 + +詳細的變動請參閱 [GitHub releases](https://github.com/ruby/ruby/releases/tag/v3_2_8)。 + +此為 Ruby 3.2 系列最後的常規維護版本。 +我們將只修復 Ruby 3.2 系列的安全性漏洞直到 2026 年 3 月底。 + +請考慮升級至 Ruby 3.3 或 3.4 系列。 + +## 下載 + +{% assign release = site.data.releases | where: "version", "3.2.8" | first %} + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## 發布紀錄 + +許多提交者、開發者和漏洞回報者幫助了此版本的發布，在此感謝所有人的貢獻。 diff --git a/zh_tw/news/_posts/2025-04-09-ruby-3-3-8-released.md b/zh_tw/news/_posts/2025-04-09-ruby-3-3-8-released.md new file mode 100644 index 0000000000..a3f3be68e0 --- /dev/null +++ b/zh_tw/news/_posts/2025-04-09-ruby-3-3-8-released.md @@ -0,0 +1,41 @@ +--- +layout: news_post +title: "Ruby 3.3.8 發布" +author: nagachika +translator: "Bear Su" +date: 2025-04-09 11:00:00 +0000 +lang: zh_tw +--- + +Ruby 3.3.8 已經發布了。 + +詳細的變動請參閱 [GitHub 發布](https://github.com/ruby/ruby/releases/tag/v3_3_8)。 + +## 下載 + +{% assign release = site.data.releases | where: "version", "3.3.8" | first %} + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## 發布紀錄 + +許多提交者、開發者和漏洞回報者幫助了此版本的發布，在此感謝所有人的貢獻。 diff --git a/zh_tw/news/_posts/2025-04-14-ruby-3-4-3-released.md b/zh_tw/news/_posts/2025-04-14-ruby-3-4-3-released.md new file mode 100644 index 0000000000..cbc4f782f6 --- /dev/null +++ b/zh_tw/news/_posts/2025-04-14-ruby-3-4-3-released.md @@ -0,0 +1,49 @@ +--- +layout: news_post +title: "Ruby 3.4.3 發布" +author: k0kubun +translator: "Bear Su" +date: 2025-04-14 08:06:57 +0000 +lang: zh_tw +--- + +Ruby 3.4.3 已經發布了。 + +這是包括修復小型錯誤的例行更新。 +詳細的變動請參閱 [GitHub 發布](https://github.com/ruby/ruby/releases/tag/v3_4_3)。 + +## 發布時程 + +我們打算每 2 個月發布一次最新的穩定 Ruby 版本（目前為 Ruby 3.4）。 +我們預計 Ruby 3.4.4 於 6 月發布、Ruby 3.4.5 於 8 月發布、Ruby 3.4.6 於 10 月發布、Ruby 3.4.7 於 12 月發布。 + +如果有任何變更影響到相當多的人，我們可能會比預期更早發布新版本。 + +## 下載 + +{% assign release = site.data.releases | where: "version", "3.4.3" | first %} + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## 發布紀錄 + +許多提交者、開發者和漏洞回報者幫助了此版本的發布，在此感謝所有人的貢獻。 diff --git a/zh_tw/news/_posts/2025-04-18-ruby-3-5-0-preview1-released.md b/zh_tw/news/_posts/2025-04-18-ruby-3-5-0-preview1-released.md new file mode 100644 index 0000000000..f2c1ee8aab --- /dev/null +++ b/zh_tw/news/_posts/2025-04-18-ruby-3-5-0-preview1-released.md @@ -0,0 +1,100 @@ +--- +layout: news_post +title: "Ruby 3.5.0 preview1 發布" +author: "naruse" +translator: "Bear Su" +date: 2025-04-18 00:00:00 +0000 +lang: zh_tw +--- + +{% assign release = site.data.releases | where: "version", "3.5.0-preview1" | first %} +我們很高興宣布 Ruby {{ release.version }} 發布了。 +Ruby 3.5 的 Unicode 版本升級為 15.1.0 與其他更新。 + +## 語法變更 + +* `*nil` 不再呼叫 `nil.to_a`，就跟 `**nil` 不呼叫 `nil.to_hash` 一樣。[[Feature #21047]] + +## 核心類別更新 + +注意：我們只列出特別的類別更新。 + +* Binding + + * `Binding#local_variables` 不再包含編號參數。 + 並且，`Binding#local_variable_get` 和 `Binding#local_variable_set` 拒絕處理編號參數。 + [[Bug #21049]] + +* IO + + * `IO.select` 同意 +Float::INFINITY+ 作為逾時參數。 + [[Feature #20610]] + +* String + + * 更新 Unicode 至版本 15.1.0 和 Emoji 版本 15.1. [[Feature #19908]] + (也套用至 Regexp) + + +## 標準函式庫更新 + +注意：我們只列出特別的標準函式庫更新。 + +* ostruct 0.6.1 +* pstore 0.2.0 +* benchmark 0.4.0 +* logger 1.7.0 +* rdoc 6.13.1 +* win32ole 1.9.2 +* irb 1.15.2 +* reline 0.6.1 +* readline 0.0.4 +* fiddle 1.1.6 + +## 相容性問題 + +注意：不包含功能問題的修正。 + +## 標準函式庫相容性問題 + +## C API 更新 + +## 其他變更 + +參見 [NEWS](https://github.com/ruby/ruby/blob/{{ release.tag }}/NEWS.md) +和 [commit logs](https://github.com/ruby/ruby/compare/v3_4_0...{{ release.tag }}) +來了解更多。 + +自 Ruby 3.4.0 以來，計 [{{ release.stats.files_changed }} 檔案變更，{{ release.stats.insertions }} 行新增（+），{{ release.stats.deletions }} 行刪減（-）](https://github.com/ruby/ruby/compare/v3_3_0...{{ release.tag }}#file_bucket)! + +## 下載 + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## Ruby 是什麼 + +Ruby 最初由 Matz（Yukihiro Matsumoto）於 1993 年開發的開源軟體。可以在許多平台上執行。使用者來自世界各地，特別活躍於網路開發領域。 + +[Feature #21047]: https://bugs.ruby-lang.org/issues/21047 +[Bug #21049]: https://bugs.ruby-lang.org/issues/21049 +[Feature #20610]: https://bugs.ruby-lang.org/issues/20610 +[Feature #19908]: https://bugs.ruby-lang.org/issues/19908 diff --git a/zh_tw/news/_posts/2025-04-28-dos-net-imap-cve-2025-43857.md b/zh_tw/news/_posts/2025-04-28-dos-net-imap-cve-2025-43857.md new file mode 100644 index 0000000000..e9b9f091da --- /dev/null +++ b/zh_tw/news/_posts/2025-04-28-dos-net-imap-cve-2025-43857.md @@ -0,0 +1,45 @@ +--- +layout: news_post +title: "CVE-2025-43857: net-imap DoS 漏洞" +author: "nevans" +translator: "Bear Su" +date: 2025-04-28 16:02:04 +0000 +tags: security +lang: zh_tw +--- + +在 net-imap gem 發現可能會造成 DoS 的漏洞。 + +該漏洞的 CVE 編號為 [CVE-2025-43857]。 + +我們建議您升級 net-imap gem。 + +## 風險細節 + +一個惡意伺服器可以發送一個會自動被客戶端的接收者執行緒讀取的 "literal" 位元組大小。 + +客戶端的接收者會立即為伺服器回應中指示的位元組大小分配記憶體。 + +在正確使用安全連接到受信任的 IMAP 伺服器時不會造成問題。 + +這只會影響到不安全的連接和有錯誤的、不受信任的或被攻擊的伺服器（例如，連接到使用者提供的主機名稱）。 + +請升級 net-imap gem 至版本 0.2.5、0.3.9、0.4.20、0.5.7、或更新版本。 + +當連接至不受信任的伺服器或使用不安全的連接時，`max_response_size` 和回應處理必須適當配置以限制記憶體使用量。請參見 [GHSA-j3g3-5qv5-52mj] 來了解更多。 + +## 受影響版本 + +net-imap gem 版本 <= 0.2.4、0.3.0 至 0.3.8、0.4.0 至 0.4.19、和 0.5.0 至 0.5.6。 + +## 致謝 + +感謝 [Masamune] 發現此問題。 + +## 歷史 + +* 最初發布於 2025-04-28 16:02:04 (UTC) + +[CVE-2025-43857]: https://www.cve.org/CVERecord?id=CVE-2025-43857 +[GHSA-j3g3-5qv5-52mj]: https://github.com/ruby/net-imap/security/advisories/GHSA-j3g3-5qv5-52mj +[Masamune]: https://hackerone.com/masamune_