From eccb2d6c914da9f127f04069f985394e4bb752d9 Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Fri, 23 Oct 2026 18:34:43 -0400
Subject: [PATCH] Upgrade runtime to Ruby 4.0.9 (#381)

* Upgrade runtime to Ruby 4.0.9

Ruby 4.0.9 fixes the Regexp compilation bug behind GitLab's
CVE-2026-110264. Move `.ruby-version`, `Dockerfile` and
`Dockerfile-export` to it.

ref: https://www.ruby-lang.org/en/news/2026/10/23/ruby-4-0-9-released/

* Bump setup-ruby to v1.334.0 for Ruby 4.0.9

The pinned v1.327.0 and v1.324.0 did not know Ruby 4.0.9, so every CI
job failed at Ruby setup. v1.334.0 is the first release that does.
---
 .github/workflows/ci.yml | 10 +++++-----
 .ruby-version            |  2 +-
 Dockerfile               |  2 +-
 Dockerfile-export        |  2 +-
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e7da9705..bf505d26 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,7 +21,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        uses: ruby/setup-ruby@26e5b7d197ebf60545ee9667bcbace0be11ccaec # v1.334.0
         with:
           ruby-version: .ruby-version
           bundler-cache: true
@@ -40,7 +40,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        uses: ruby/setup-ruby@26e5b7d197ebf60545ee9667bcbace0be11ccaec # v1.334.0
         with:
           ruby-version: .ruby-version
           bundler-cache: true
@@ -63,7 +63,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1.324.0
+        uses: ruby/setup-ruby@26e5b7d197ebf60545ee9667bcbace0be11ccaec # v1.334.0
         with:
           ruby-version: .ruby-version
           bundler-cache: true
@@ -110,7 +110,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        uses: ruby/setup-ruby@26e5b7d197ebf60545ee9667bcbace0be11ccaec # v1.334.0
         env:
           REDIS_URL: redis://localhost:6379/0
         with:
@@ -143,7 +143,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        uses: ruby/setup-ruby@26e5b7d197ebf60545ee9667bcbace0be11ccaec # v1.334.0
         env:
           REDIS_URL: redis://localhost:6379/0
         with:
diff --git a/.ruby-version b/.ruby-version
index 43beb400..7919852f 100644
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-4.0.7
+4.0.9
diff --git a/Dockerfile b/Dockerfile
index 195fd224..57eef208 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 # syntax = docker/dockerfile:1
 
 # Make sure it matches the Ruby version in .ruby-version and Gemfile
-ARG RUBY_VERSION=4.0.7
+ARG RUBY_VERSION=4.0.9
 FROM docker.io/library/ruby:$RUBY_VERSION-slim AS base
 
 # Rails app lives here
diff --git a/Dockerfile-export b/Dockerfile-export
index c1a87a08..528b24c0 100644
--- a/Dockerfile-export
+++ b/Dockerfile-export
@@ -1,7 +1,7 @@
 # syntax = docker/dockerfile:1
 
 # Make sure it matches the Ruby version in .ruby-version and Gemfile
-ARG RUBY_VERSION=4.0.7
+ARG RUBY_VERSION=4.0.9
 FROM ruby:$RUBY_VERSION-slim as base
 
 # Install the tools we need