CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

Port details

lang/ruby404.0.7,1

Object-oriented interpreted scripting language

Maintainer
ruby@FreeBSD.org
Packages
ruby40 4.0.7,1
Upstream
Higher version available: 4.0.9
CPE
ruby-lang:ruby from the port
WWW
https://www.ruby-lang.org/en/
Links
cgit · VuXML

Unaddressed (0) · The CVE record lists this version as affected, no VuXML entry names the CVE

None. There is no CVE without a VuXML entry for this version.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (0)

No VuXML entries for this package.

Commits (14)

Po-Chuan Hsieh (sunpoet) · 4.0.7,1
lang/ruby40: Update to 4.0.7

Changes:	https://github.com/ruby/ruby/releases
		https://github.com/ruby/ruby/blob/master/NEWS.md
		https://www.ruby-lang.org/en/news/2026/09/15/ruby-4-0-7-released/
f69e9ee32c
Po-Chuan Hsieh (sunpoet)
lang/ruby40: Update to 4.0.6

Changes:	https://github.com/ruby/ruby/releases
		https://github.com/ruby/ruby/blob/master/NEWS.md
		https://www.ruby-lang.org/en/news/2026/07/14/ruby-4-0-6-released/
c7d9e22616
Robert Clausecker (fuz)
lang/ruby*: fix coroutines on armv7

Two ports, devel/rubygem-glib2 and graphics/rubygem-cairo, have been
broken on armv7 for a long time.  Recently, pkubaj fixed a problem with
Ruby's coroutine code on ppc64* (see 3bb0a9335) affecting the very same
ports.  This naturally raises the question if the armv7 problems are
related.

Turns out that due to an oversight, we use the generic ucontext.h-based
coroutine code on armv7.  Switching to the assembly-based code fixes
the ports!  Further digging suggests that there may be a problem in the
freebsd32 support for these calls on aarch64 causing the observed
issues.  We will investigate those separately.

Tested by:	fuz
Approved by:	portmgr (build fix blanket)
MFH:		2026Q2
b6686e6f88
Po-Chuan Hsieh (sunpoet)
lang/ruby40: Update to 4.0.5

- Remove USE_LOCALE workaround [1]

Changes:	https://github.com/ruby/ruby/releases
		https://github.com/ruby/ruby/blob/master/NEWS.md
		https://www.ruby-lang.org/en/news/2026/05/20/ruby-4-0-5-released/
Security:	CVE-2026-46727
Reference:	https://bugs.ruby-lang.org/issues/22065 [1]
ca2f7feeb9
Piotr Kubaj (pkubaj)
lang/ruby*: fix runtime on powerpc64*

The hand-written `coroutine_transfer` in `coroutine/ppc64le/Context.S`
lacks the ELFv2 ABI global entry prologue. When the function is reached
via the PLT (lazy resolution path), r2 (TOC pointer) is left pointing
at whatever the resolver had loaded — typically the dynamic linker's
own TOC — instead of libruby's TOC.

The wrong r2 propagates through the fiber switch into `fiber_entry`,
which jumps into `fiber_restore_thread` → `rb_current_ec_set`. The
first PLT thunk inside the new fiber (`__plt___tls_get_addr` for the
`ruby_current_ec` thread-local) computes its GOT entry as
`r2 + offset` and segfaults dereferencing the bogus address.

Fixes build of textproc/rubygem-nokogiri and devel/rubygem-glib2.
3bb0a93351
Po-Chuan Hsieh (sunpoet)
lang/ruby40: Update to 4.0.4

Changes:	https://github.com/ruby/ruby/releases
		https://github.com/ruby/ruby/blob/master/NEWS.md
		https://www.ruby-lang.org/en/news/2026/05/11/ruby-4-0-4-released/
81ce8cb5b0
Po-Chuan Hsieh (sunpoet)
lang/ruby40: Update to 4.0.3

Changes:	https://github.com/ruby/ruby/releases
		https://github.com/ruby/ruby/blob/master/NEWS.md
		https://www.ruby-lang.org/en/news/2026/04/21/ruby-4-0-3-released/
a5a7f09dcf
Po-Chuan Hsieh (sunpoet)
lang/ruby40: Update to 4.0.1

Changes:	https://github.com/ruby/ruby/releases
		https://github.com/ruby/ruby/blob/master/NEWS.md
		https://www.ruby-lang.org/en/news/2026/03/16/ruby-4-0-2-released/
3beed56b8e
Po-Chuan Hsieh (sunpoet)
lang/ruby40: Update to 4.0.1

Changes:	https://github.com/ruby/ruby/releases
		https://github.com/ruby/ruby/blob/master/NEWS.md
		https://www.ruby-lang.org/en/news/2026/01/13/ruby-4-0-1-released/
75264c4cad
Po-Chuan Hsieh (sunpoet)
Mk/Uses/ruby.mk: Remove RUBY_PORTREVISION

RUBY_PORTREVISION is only used for lang/ruby{32,33,34,40}. These ports can set
PORTREVISION directly rather than defined in the shared Mk/Uses/ruby.mk.
9697d03c07
Po-Chuan Hsieh (sunpoet)
lang/ruby40: Update to 4.0.0

Changes:	https://github.com/ruby/ruby/releases
		https://github.com/ruby/ruby/blob/master/NEWS.md
		https://www.ruby-lang.org/en/news/2025/12/25/ruby-4-0-0-released/
e4bfa7be1a
Po-Chuan Hsieh (sunpoet)
lang/ruby40: Update WWW

- Use LIB_DEPENDS for libffi
- Cosmetic change
6c1a9b2dab
Yasuhiro Kimura (yasu)
lang/ruby40: Update to 4.0.0-preview2

ReleaseNotes:	https://www.ruby-lang.org/en/news/2025/11/17/ruby-4-0-0-preview2-released/
90208b4729
Yasuhiro Kimura (yasu)
lang/ruby40: Rename from lang/ruby35

Upstrem changed version of master branch in their repository from 3.5
to 4.0.
9edd05a2af