Skip to content

Dependency audit: pin upstream checkouts, drop obsolete and vulnerable 1.9-era code - #29

Merged
Largo merged 4 commits into
masterfrom
claude/optimistic-thompson-jp0w0c
Oct 27, 2026
Merged

Dependency audit: pin upstream checkouts, drop obsolete and vulnerable 1.9-era code#29
Largo merged 4 commits into
masterfrom
claude/optimistic-thompson-jp0w0c

Conversation

@Largo

@Largo Largo commented Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

An audit of outdated third-party code. The only dependency left as is: the release still targets .NET 8, which reaches end of support on 10 Nov 2026 (separate change).

Build and supply chain

  • ci.yml / release.yml check out IronLanguages/dlr at a pinned DLR_REF (current main; all Build/dlr-patches apply to it, including master's new 0101-stack-guard.patch) instead of whatever main is on the day. ruby/spec and mspec are pinned as SPEC_REF / MSPEC_REF.
  • Microsoft.Data.Sqlite 8.0.10 → 8.0.33 (it already brings the fixed SQLitePCLRaw 2.1.13). actions/setup-node v4 → v6.
  • Removed committed binaries used only by the legacy Build.proj build: nuget.exe 2.8, CustomTasks.dll (rebuilt from its .cs), and Src/Scripts/Rewriter with its DLLs.

Src/StdLib/ruby/1.9.1 (shipped in every release, last on the load path)

  • Security: win32/sspi used 32-bit SecHandle layouts, so on 64-bit Windows it wrote past its buffers. The 1.9 cgi/cookie, cgi/core, cgi/html and cgi/session were still reachable even though Ruby 4.0 dropped them; they are affected by CVE-2021-41819 and CVE-2025-27219, and they also shadowed the cgi gem. The 1.9 rdoc carried jQuery 1.2.6.
  • Removed, because Ruby removed them (checked against stdgems.org's data) and nothing here requires them: xmlrpc, syck, dl, gserver, shell, net/telnet, sync, thwait, e2mmap, ubygems, cmath, scanf, mathn (+ ironruby/mathn), debug, tracer, profile, profiler, win32/registry, win32ole/property, and the 1.9 complex.rb/rational.rb shims. The shims were dead because the Loader already provides complex.so and rational.so.
    • Removing tracer.rb fixes irb's tracer extension, which died with NameError: CallTracer instead of saying the gem is missing.
    • The 1.9 debug.rb started an interactive debugger as soon as it was required.
  • Replaced: win32/resolv could never load because it needed dl, so on Windows Resolv ran without a hosts file or nameservers. Src/StdLib/ironruby/win32/resolv.rb is net/http over TLS: non-blocking SSLSocket, timeouts, and the context's CAs #28's version verbatim, so the two PRs add the same file and merge cleanly in either order.
  • Updated: kconv moved to ironruby/ and picked up nkf 0.2.0's String#kconv fix (a form_enc typo).
  • Kept for now: complex18/rational18 and pathname. The runtime builds Complex, Rational and Pathname on them at boot, so replacing them is engine work for its own PR.

Tests

  • Removed Tests/Libraries (Rails 3.0, Rack 1.1, Rake 0.8.7, RubyGems 1.3.7, …) and the irtests/utr harness, the only thing that used them. That harness ran ir.exe under Mono from a 2010 $DLR_ROOT layout, and nothing invokes it.

Verification

  • CI on 67ffecc0 is green: build and tests on Ubuntu and Windows for net8.0 and net10.0, ruby/spec on net8.0 and net10.0, and all three release packages (linux-x64, win-x64, osx-arm64).
  • To confirm nothing still reaches the removed files, I resolved every require in Src, Tests, Samples and Util against the load path (ironruby, ruby/4.0, site_ruby, 1.9.1); none do.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KPwZf7csSRV3oAVQ31sLDS

claude added 3 commits October 27, 2026 09:28
@claude
Pin the DLR, drop obsolete 1.9.1 libraries and committed binaries
e24eca1 
- CI and release check out IronLanguages/dlr at a pinned DLR_REF (current
  main, which all Build/dlr-patches apply to) instead of whatever main is
  on the day, so a release can be rebuilt and upstream changes arrive only
  when the pin is moved.
- Remove libraries from Src/StdLib/ruby/1.9.1 that CRuby dropped years ago
  and nothing outside that tree requires: xmlrpc, syck (and yaml/syck), dl,
  gserver, shell, net/telnet, sync, thwait, e2mmap, ubygems. Also remove
  the 1.9 rdoc, which ruby/4.0's rdoc 7 shadows and which carried
  jQuery 1.2.6. These shipped in every release.
- Remove committed binaries of the unused legacy build: Util/NuGet/nuget.exe
  (2.8), Build/CustomTasks/CustomTasks.dll (built from CustomTasks.cs by
  Bootstrap.targets) and Src/Scripts/Rewriter with its corapi/raw DLLs.
- Microsoft.Data.Sqlite 8.0.10 -> 8.0.33, the latest 8.0 patch.
- actions/setup-node v4 -> v6 in release.yml.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KPwZf7csSRV3oAVQ31sLDS
@claude
Replace or remove the remaining 1.9-era libraries, drop the dead harness
5ef5b72 
- win32/resolv: the 1.9 version needed dl and never loaded, so on Windows
  Resolv ran without a hosts file or nameservers. New ironruby/win32/resolv.rb
  answers get_hosts_path and get_resolv_info from System.Net.NetworkInformation.
  win32/registry (dl as well) goes with it.
- win32/sspi: laid SecHandle out as two 32-bit words, so on 64-bit Windows
  the SSPI calls wrote past their buffers. Removed; Net::HTTP already treats
  a missing win32/sspi as "no Negotiate proxy auth".
- debug, tracer, profile, profiler: 1.9's debug.rb started an interactive
  debugger on require, and tracer.rb loading made irb's tracer extension die
  on the missing CallTracer instead of reporting the gem as absent. CRuby 4.0
  ships none of them.
- kconv: moved to ironruby/ and given nkf 0.2.0's fix for String#kconv
  (form_enc typo, so the string's own encoding was never passed on).
- win32ole/property: unreferenced; IronRuby's win32ole.rb is its own.
- Tests/Libraries (Rails 3.0, Rack 1.1, Rake 0.8.7, RubyGems 1.3.7, ...)
  and the irtests/utr harness that alone used them; it ran ir.exe under Mono
  from a 2010 DLR_ROOT layout and nothing invokes it.
- CI pins ruby/spec and mspec as SPEC_REF / MSPEC_REF.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KPwZf7csSRV3oAVQ31sLDS
@claude
Drop the libraries CRuby removed to rubygems, and the 1.9 CGI
5a2d1fc 
Checked ruby/1.9.1 against stdgems' list of libraries Ruby removed from the
standard distribution (janlelis/stdgems, stdgems.json):

- cgi: Ruby 4.0 keeps only cgi/escape (ruby/4.0/cgi.rb says so), but
  cgi/cookie, cgi/core, cgi/html and cgi/session still resolved to the 2011
  copies, with their cookie parsing (CVE-2021-41819, CVE-2025-27219), and
  shadowed the cgi gem if one was installed. Removed.
- cmath, scanf (removed in 2.7) and mathn (2.5): removed, along with
  ironruby/mathn, which only mathn.rb loaded.
- complex.rb / rational.rb: the 1.9 "require 'complex'" shims, dead since
  the Loader provides complex.so and rational.so like MRI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KPwZf7csSRV3oAVQ31sLDS
@coderabbitai

coderabbitai Bot commented Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Walkthrough

Warning

Review details and warnings were omitted to fit the comment limit.

@claude
Merge origin/master: prism 30a25553 alongside the DLR/spec pins
67ffecc 
ironruby/win32/resolv.rb now takes #28's version verbatim, which
ran in that PR's CI, so the two PRs add the same file.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KPwZf7csSRV3oAVQ31sLDS
@Largo
Largo merged commit d65fe20 into master Oct 27, 2026
13 checks passed
Largo added a commit that referenced this pull request Oct 27, 2026
@Largo
Merge origin/master into fix/net-http-tls
96c720f 
win32/resolv.rb was added on both sides: master's (#29) is this branch's
earlier version; this branch's adds the configured SearchList, so it is kept.
Largo pushed a commit that referenced this pull request Nov 7, 2026
@claude
Regexp: byte escapes inside comments are not decoded
8307768 
Review finding (SHOULD, regression from b6a93b6): GetClrPatternSource/DecodeByteEscapes
decoded \xHH runs inside (?#...) groups and /x line comments, so
`Regexp.new("a(?#\\xff)b") =~ "ab"` and `Regexp.new("a # \\xff\nb", Regexp::EXTENDED) =~ "ab"`
raised RegexpError, and the literals /a#\xff/x and /a(?#\xff)/ were SyntaxErrors at parse
time (the literal path builds the same RubyRegex). Reproduced with review/bi2/cm.rb and
review/bi2/re1.rb #29/#30 against CRuby 4.0.9.

The decoder now steps over comments as Onigmo reads them: a (?#...) group up to the first
unescaped ")", and in extended mode - /x, or (?x) / (?x:...) for the rest of a group - a #
up to the end of the line outside a character class. RegexpTransformer's (?#...) skips an
escaped ")" too, as Onigmo does (`Regexp.new("a(?#\\)\\xff)b") =~ "ab"` is 0 in CRuby; it
was "unmatched close parenthesis" here).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KPwZf4gAJD4kdk9eEzGgYM
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Largo @claude