[ruby] Update Ruby 3.3.4 → 3.3.12

[depfu]

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

Release Notes

3.3.12

Posted by hsbt on 16 Jul 2026

      <p>Ruby 3.3.12 has been released.</p>

This release includes security fixes. Please check the topics below for details.

• CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / def_class

This release updates the default gem erb to 4.0.3.1 and the bundled gem net-imap to 0.4.25. The net-imap update fixes CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258, CVE-2026-47240, CVE-2026-47241 and CVE-2026-47242. Please see the release notes of net-imap v0.4.24 and net-imap v0.4.25 for the details of these fixes.

Please see the GitHub releases for further details.

3.3.11

Posted by hsbt on 26 Mar 2026

      <p>Ruby 3.3.11 has been released. This release includes <a href="https://www.ruby-lang.org/en/news/2026/03/05/buffer-overflow-zlib-cve-2026-27820/">an update to the zlib gem addressing CVE-2026-27820</a>, along with some bug fixes.</p>

Please see the GitHub releases for further details.

This is the last release of normal maintenance for the Ruby 3.3 series. After this release, Ruby 3.3 enters a security maintenance phase. During this phase, we will only backport security fixes and fixes for critical build issues, without any regular bug fixes.

The security maintenance phase is scheduled to last for one year, until the end of March 2027. At that point, official support for Ruby 3.3 will end. We recommend that you begin planning your migration to Ruby 3.4 or 4.0.

3.3.10

Posted by nagachika on 23 Oct 2025

Ruby 3.3.10 has been released.

This release includes an update to the uri gem addressing CVE-2025-61594, along with other bug fixes. Please refer to the release notes on GitHub for further details.

We recommend updating your version of the uri gem. This release has been made for the convenience of those who wish to continue using it as a default gem.

3.3.9

Posted by nagachika on 24 Jul 2025

Ruby 3.3.9 has been released.

This release includes the following security fix of default gems:

• CVE-2025-24294: Possible Denial of Service in resolv gem

and the following fixes for build issues:

• GCC 15.1
• Visual Studio 2022 Version 17.14

Please see the GitHub releases for further details.

3.3.8

Posted by nagachika on 9 Apr 2025

Ruby 3.3.8 has been released.

Please see the GitHub releases for further details.

3.3.7

Posted by k0kubun on 15 Jan 2025

Ruby 3.3.7 has been released.

This is a routine update that includes minor bug fixes. Please refer to the release notes on GitHub for further details.

3.3.6

Posted by k0kubun on 5 Nov 2024

Ruby 3.3.6 has been released.

This is a routine update that includes minor bug fixes. It also stops warning missing default gem dependencies that will be bundled gems in Ruby 3.5. For more details, please refer to the release notes on GitHub.

Release Schedule

As previously announced, we intend to release the latest stable Ruby version (currently Ruby 3.3) every 2 months following a .1 release.

We expect to release Ruby 3.3.7 on January 7th. If any significant changes arise that impact a large number of users, we may release a new version earlier than scheduled.

---

All Depfu comment commands

@​depfu refresh

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Pauses all engine updates and closes this PR