Dependency audit: pin upstream checkouts, drop obsolete and vulnerable 1.9-era code

.github/workflows/ci.yml

@@ -18,6 +18,14 @@ env:
   # the vendored Ruby half of prism in Src/StdLib belongs to; release.yml builds from the same
   # one. Move both together with Src/Prism/Generated when following prism.
   PRISM_REF: 30a255539e81842b2b7f12b4fd3c62a7b4d64165
+  # The DLR revision Build/dlr-patches applies to; release.yml builds from the same one, so a
+  # release can be rebuilt and an upstream change only arrives when this is moved on purpose.
+  # Move both together, after checking the patches still apply.
+  DLR_REF: 922753f8ccbf5186c15899116d5a407b6b1723fb
+  # ruby/spec and mspec for the spec job, pinned so a result moves only with IronRuby's own
+  # changes, not with whatever lands upstream on the day.
+  SPEC_REF: dda28d049100033a8b7050eacbb35957a2eb0c00
+  MSPEC_REF: b79c65ed28b00f0869ad82b0e3dceef0d943cd58
 
 jobs:
   build-and-test:
@@ -71,6 +79,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           repository: IronLanguages/dlr
+          ref: ${{ env.DLR_REF }}
           path: dlr
 
       # Pinned to the revision Src/Prism/Generated was generated from (Src/Prism/README.md), as
@@ -373,6 +382,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           repository: IronLanguages/dlr
+          ref: ${{ env.DLR_REF }}
           path: dlr
       - uses: actions/checkout@v7
         with:
@@ -382,10 +392,12 @@ jobs:
       - uses: actions/checkout@v7
         with:
           repository: ruby/spec
+          ref: ${{ env.SPEC_REF }}
           path: ironruby/spec
       - uses: actions/checkout@v7
         with:
           repository: ruby/mspec
+          ref: ${{ env.MSPEC_REF }}
           path: ironruby/mspec
 
       - name: Patch the DLR

.github/workflows/release.yml

@@ -32,6 +32,10 @@ env:
   # The prism revision Src/Prism/Generated was generated from (Src/Prism/README.md), the one
   # the vendored Ruby half of prism in Src/StdLib belongs to; ci.yml builds from the same one.
   PRISM_REF: 30a255539e81842b2b7f12b4fd3c62a7b4d64165
+  # The DLR revision Build/dlr-patches applies to; ci.yml builds from the same one, so a
+  # release can be rebuilt and an upstream change only arrives when this is moved on purpose.
+  # Move both together, after checking the patches still apply.
+  DLR_REF: 922753f8ccbf5186c15899116d5a407b6b1723fb
 
 jobs:
   package:
@@ -63,6 +67,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           repository: IronLanguages/dlr
+          ref: ${{ env.DLR_REF }}
           path: dlr
 
       - uses: actions/checkout@v7
@@ -159,7 +164,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 22
 

Build/dlr-patches/README.md

@@ -2,14 +2,16 @@
 
 IronRuby builds against the DLR sources from a sibling `dlr` checkout
 (`IronLanguages/dlr`). A few changes this tree needs are not upstream yet, so CI
-checks out upstream `main` and applies the patches in this directory, in name
+checks out the upstream revision pinned as `DLR_REF` in `.github/workflows/ci.yml` and
+`release.yml` and applies the patches in this directory, in name
 order, with `git apply`:
 
 ```sh
 for p in ironruby/Build/dlr-patches/*.patch; do git -C dlr apply "$p"; done
 ```
 
-Delete a patch once it lands upstream. If one stops applying, CI fails loudly at
+To follow upstream, move `DLR_REF` in both workflows together and check the patches still
+apply. Delete a patch once it lands upstream. If one stops applying, CI fails loudly at
 the apply step instead of with a confusing CS1061 deep inside IronRuby.
 
 | Patch | Why IronRuby needs it |

README.md

@@ -468,6 +468,8 @@ Requires the .NET SDK, plus Ruby and a C compiler to build prism.
 
 ```console
 $ git clone https://github.com/IronLanguages/dlr ../dlr          # modern DLR, referenced as source
+$ git -C ../dlr checkout <DLR_REF from .github/workflows/ci.yml>
+$ for p in Build/dlr-patches/*.patch; do git -C ../dlr apply "$PWD/$p"; done
 $ git clone https://github.com/ruby/prism ../prism
 $ (cd ../prism && ruby templates/template.rb && make shared)     # libprism.so
 $ (cd Src/Prism && ruby generate.rb)                             # C# nodes + loader

Src/Libraries/IronRuby.Libraries.csproj

@@ -17,9 +17,10 @@
     <!-- SQLite3 library (Src/Libraries/Sqlite3): Microsoft.Data.Sqlite brings
          SQLitePCLRaw, whose bundle_e_sqlite3 carries a native SQLite for
          linux-x64/win-x64 under runtimes/<rid>/native. -->
-    <PackageReference Include="Microsoft.Data.Sqlite" Version="8.0.10" />
-    <!-- ... but the SQLite in the SQLitePCLRaw 2.1.6 it brings is older than 3.50.2
-         (CVE-2025-6965, NU1903); SQLitePCLRaw 2.1.12 and later carry a fixed one. -->
+    <PackageReference Include="Microsoft.Data.Sqlite" Version="8.0.33" />
+    <!-- SQLitePCLRaw before 2.1.12 carries a SQLite older than 3.50.2 (CVE-2025-6965,
+         NU1903). Microsoft.Data.Sqlite 8.0.33 already depends on 2.1.13; the explicit
+         reference keeps the floor if Microsoft.Data.Sqlite is ever moved back. -->
     <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="2.1.13" />
     <!-- The HTML5 parser behind Nokogiri::HTML5 / Nokogiri::HTML4 (Src/Libraries/Nokogiri).
          AngleSharp implements the WHATWG tokenizer and tree-construction algorithm, which is