From 6d922f2d4688d5f3c5a09fc5bee68209b6f8e35c Mon Sep 17 00:00:00 2001
From: Chris Zetter <253059100+zetter-rpf@users.noreply.github.com>
Date: Sat, 24 Oct 2026 10:37:02 +0100
Subject: [PATCH] Upgrade to Ruby 4.0.9

This is to reduce the risk of regex related CVEs

https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/
---
 .github/workflows/ci.yml | 4 ++--
 .tool-versions           | 2 +-
 Dockerfile               | 2 +-
 Gemfile.lock             | 3 ++-
 4 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 46eeb04d0..bd6bd2110 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,7 +28,7 @@ jobs:
 
 
       - name: Set up Ruby and bundle cache
-        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+        uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1.335.0
         with:
           ruby-version: .tool-versions
           bundler-cache: true
@@ -130,7 +130,7 @@ jobs:
         uses: browser-actions/setup-firefox@0bc507ddf224827e3b1af68e014d5e42ab93e795 # v1.7.2
 
       - name: Set up Ruby and bundle cache
-        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+        uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1.335.0
         with:
           ruby-version: .tool-versions
           bundler-cache: true
diff --git a/.tool-versions b/.tool-versions
index aac7389b8..df8599074 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1 +1 @@
-ruby 4.0.5
+ruby 4.0.9
diff --git a/Dockerfile b/Dockerfile
index 0fc698486..692bef6bc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM ruby:4.0.5-slim-trixie AS base
+FROM ruby:4.0.9-slim-trixie AS base
 RUN gem install bundler \
   && apt-get update \
   && apt-get upgrade --yes \
diff --git a/Gemfile.lock b/Gemfile.lock
index 1a6eac12d..966e29237 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -562,6 +562,7 @@ PLATFORMS
   aarch64-linux
   arm64-darwin-24
   arm64-darwin-25
+  arm64-darwin-27
   x86_64-linux
 
 DEPENDENCIES
@@ -638,7 +639,7 @@ DEPENDENCIES
   webmock
 
 RUBY VERSION
-  ruby 4.0.5
+  ruby 4.0.9
 
 BUNDLED WITH
   4.0.13