Update version to 4.0.0RC4.

Co-authored-by: Claude <noreply@anthropic.com>

.github/dependabot.yml

@@ -29,3 +29,5 @@ updates:
       pre-commit-hooks:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7

.github/workflows/build.yml

@@ -31,7 +31,7 @@ jobs:
       LD: ${{ matrix.cc }}
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Ruby version
@@ -46,13 +46,13 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Ruby version
         run: ruby -v
       - name: Cache cosmocc
-        uses: actions/cache@v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         id: cache-cosmocc
         with:
           path: ~/cosmo
@@ -74,7 +74,7 @@ jobs:
       MRUBY_CONFIG: ci/msvc
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Ruby version

.github/workflows/codeql-analysis.yml

@@ -18,7 +18,7 @@ jobs:
         language: ["actions"]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Initialize CodeQL

.github/workflows/coverage.yml

@@ -19,7 +19,7 @@ jobs:
       LDFLAGS: --coverage
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Ruby version
@@ -39,7 +39,7 @@ jobs:
             echo \`\`\`
           } > "$GITHUB_STEP_SUMMARY"
       - name: Upload coverage report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: coverage-${{ github.sha }}
           path: coverage/

.github/workflows/labeler.yml

@@ -9,7 +9,7 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@v6
+      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
           sync-labels: true

.github/workflows/ls-lint.yml

@@ -11,9 +11,9 @@ jobs:
     name: Run ls-lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - uses: ls-lint/action@v2.3.1
+      - uses: ls-lint/action@02e380fe8733d499cbfc9e22276de5085508a5bd # v2.3.1
         with:
           config: .github/linters/.ls-lint.yml

.github/workflows/oss-fuzz.yml

@@ -20,7 +20,7 @@ jobs:
           fuzz-seconds: 600
           dry-run: false
       - name: Upload Crash
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: failure()
         with:
           name: artifacts

.github/workflows/pre-commit-manual.yml

@@ -12,10 +12,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - uses: j178/prek-action@v2
+      - uses: j178/prek-action@53276d8b0d10f8b6672aa85b4588c6921d0370cc # v2.0.1
         with:
           install-only: true
       - name: Run manual pre-commit hooks

.github/workflows/pre-commit.yml

@@ -12,9 +12,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - uses: j178/prek-action@v2
+      - uses: j178/prek-action@53276d8b0d10f8b6672aa85b4588c6921d0370cc # v2.0.1
         with:
           extra-args: --all-files

.github/workflows/release.yml

@@ -19,7 +19,7 @@ jobs:
       fail-fast: false
     steps:
       - name: "Checkout ${{ github.ref_name }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Builds

.github/workflows/super-linter.yml

@@ -15,13 +15,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           # Full git history is needed to get a proper list of changed files within `super-linter`
           fetch-depth: 0
           persist-credentials: false
       - name: Lint Code Base
-        uses: super-linter/super-linter/slim@v8.5.0
+        uses: super-linter/super-linter/slim@9e863354e3ff62e0727d37183162c4a88873df41 # v8.6.0
         env:
           # VALIDATE_BASH_EXEC: true
           VALIDATE_DOCKERFILE_HADOLINT: true

.pre-commit-config.yaml

@@ -85,7 +85,7 @@ repos:
         args: [--whitespaces-count, "2"]
         exclude: Makefile$
   - repo: https://github.com/rhysd/actionlint
-    rev: v1.7.11
+    rev: v1.7.12
     hooks:
       - id: actionlint
         name: run actionlint

NEWS.md

@@ -340,6 +340,9 @@ Other optimizations:
 - [#6762](https://github.com/mruby/mruby/pull/6762) Write generated test C files atomically to avoid build race condition
 - [#6765](https://github.com/mruby/mruby/pull/6765) Fix `Lazy#flat_map` to handle non-enumerable block return values
 - [#6767](https://github.com/mruby/mruby/pull/6767) Allow compound statement in parenthesized argument context
+- [#6780](https://github.com/mruby/mruby/pull/6780) Fix `String#prepend` with self-referencing arguments
+- [#6781](https://github.com/mruby/mruby/pull/6781) Protect `sprintf` format string from mutation during callbacks
+- [#6783](https://github.com/mruby/mruby/pull/6783) Pin GitHub Actions workflows to commit hashes
 
 # Security Fixes
 
@@ -359,4 +362,6 @@ Other optimizations:
 - Integer overflow in Integer#lcm ([070bef24](https://github.com/mruby/mruby/commit/070bef24))
 - Heap buffer overflow in `#method_missing` ([550d10a](https://github.com/mruby/mruby/commit/550d10a))
 - Out-of-bounds read and divide-by-zero in `Array#product` ([8441eaf](https://github.com/mruby/mruby/commit/8441eaf))
+- Heap buffer overflow in `String#prepend` with self-referencing arguments ([18ba026](https://github.com/mruby/mruby/commit/18ba026))
+- Use-after-free in `sprintf` via `to_s` callback mutating format string ([48fc422](https://github.com/mruby/mruby/commit/48fc422))
 - Multiple memory leak fixes in bigint, Set, Array, and Task gems

README.md

@@ -51,6 +51,8 @@ To get mruby, you can download the stable version 4.0.0 from the official mruby
 GitHub repository or clone the trunk of the mruby source tree with the "git
 clone" command. You can also install and compile mruby using [ruby-install](https://github.com/postmodern/ruby-install), [ruby-build](https://github.com/rbenv/ruby-build), [rvm](https://github.com/rvm/rvm), [conda](https://anaconda.org/channels/conda-forge/packages/mruby/overview) or [Homebrew](https://formulae.brew.sh/formula/mruby).
 
+The release candidate version 4.0.0 of mruby can be downloaded via the following URL: [https://github.com/mruby/mruby/archive/4.0.0-rc3.zip](https://github.com/mruby/mruby/archive/4.0.0-rc3.zip)
+
 The latest development version of mruby can be downloaded via the following URL: [https://github.com/mruby/mruby/zipball/master](https://github.com/mruby/mruby/zipball/master)
 
 The trunk of the mruby source tree can be checked out with the

include/mruby/version.h

@@ -57,7 +57,7 @@ MRB_BEGIN_DECL
 /*
  * Patch level string. (optional)
  */
-#define MRUBY_PATCHLEVEL_STR ""
+#define MRUBY_PATCHLEVEL_STR "RC4"
 
 #ifndef MRUBY_PATCHLEVEL_STR
 # if MRUBY_PATCHLEVEL < 0
@@ -80,7 +80,7 @@ MRB_BEGIN_DECL
 /*
  * Release year.
  */
-#define MRUBY_RELEASE_YEAR 2025
+#define MRUBY_RELEASE_YEAR 2026
 
 /*
  * Release month.
@@ -90,7 +90,7 @@ MRB_BEGIN_DECL
 /*
  * Release day.
  */
-#define MRUBY_RELEASE_DAY 20
+#define MRUBY_RELEASE_DAY 13
 
 /*
  * Release date as a string.

mrbgems/mruby-socket/mrblib/socket.rb

@@ -701,13 +701,11 @@ class UDPSocket < IPSocket
   #   data, addr = sock.recvfrom_nonblock(1024)
   #
   def recvfrom_nonblock(*args)
-    s = self
     begin
       self._setnonblock(true)
       self.recvfrom(*args)
     ensure
-      # XXX: self is a SystemcallException here! (should be bug)
-      s._setnonblock(false)
+      self._setnonblock(false)
     end
   end
 

mrbgems/mruby-sprintf/src/sprintf.c

@@ -380,6 +380,13 @@ mrb_str_format(mrb_state *mrb, mrb_int argc, const mrb_value *argv, mrb_value fm
   argc++;
   argv--;
   mrb_ensure_string_type(mrb, fmt);
+  /* Duplicate the format string so that to_s/inspect callbacks invoked
+     during the loop cannot invalidate p/end by mutating the original
+     via String#replace or similar. mrb_str_dup shares the underlying
+     buffer, so this is O(1); String#replace on the original goes
+     through str_replace which decrements the shared refcount, leaving
+     our copy's buffer intact. */
+  fmt = mrb_str_dup(mrb, fmt);
   p = RSTRING_PTR(fmt);
   end = p + RSTRING_LEN(fmt);
   blen = 0;

mrbgems/mruby-sprintf/test/sprintf.rb

@@ -90,3 +90,19 @@ assert("String#% invalid format") do
     "%?" % ""
   end
 end
+
+assert("sprintf with to_s mutating format string") do
+  # The to_s callback must not be able to invalidate sprintf's internal
+  # iteration pointers by mutating the format string.
+  fmt = "%s" + "B" * 200
+  mutator = Object.new
+  $sprintf_test_fmt = fmt
+  def mutator.to_s
+    $sprintf_test_fmt.replace("Z")
+    "ok"
+  end
+  result = sprintf(fmt, mutator)
+  assert_equal 202, result.length
+  assert_equal "ok", result[0, 2]
+  assert_equal "B" * 200, result[2..]
+end

mrbgems/mruby-string-ext/src/string.c

@@ -2201,15 +2201,27 @@ str_prepend(mrb_state *mrb, mrb_value self)
 
   char *p = RSTRING_PTR(self);
 
-  /* Move original content to the end */
+  /* Move original content to the end. The original self data now lives
+     at p + total_prepend_len, which we use as the source for any
+     self-referencing arguments (e.g., s.prepend(s, s)) to avoid reading
+     data that has already been overwritten by earlier copies. */
   memmove(p + total_prepend_len, p, self_len);
 
   /* Copy prepended strings in order */
   mrb_int offset = 0;
   for (mrb_int i = 0; i < argc; i++) {
-    mrb_int arg_len = RSTRING_LEN(argv[i]);
+    const char *src;
+    mrb_int arg_len;
+    if (mrb_obj_eq(mrb, self, argv[i])) {
+      src = p + total_prepend_len;
+      arg_len = self_len;
+    }
+    else {
+      src = RSTRING_PTR(argv[i]);
+      arg_len = RSTRING_LEN(argv[i]);
+    }
     if (arg_len > 0) {
-      memcpy(p + offset, RSTRING_PTR(argv[i]), arg_len);
+      memcpy(p + offset, src, arg_len);
       offset += arg_len;
     }
   }

mrbgems/mruby-string-ext/test/string.rb

@@ -492,6 +492,21 @@ assert('String#prepend') do
   g = "world"
   assert_equal "hello world", g.prepend("", "hello ", "")
   assert_equal "hello world", g
+
+  # Self-referencing arguments (GHSA-3hgj-g76g-878c)
+  h = "A" * 100
+  h.prepend(h, h)
+  assert_equal 300, h.length
+  assert_equal "A" * 300, h
+
+  # Mixed self-reference and literal
+  i = "AB"
+  i.prepend("XYZ", i)
+  assert_equal "XYZABAB", i
+
+  j = "AB"
+  j.prepend(j, "X", j)
+  assert_equal "ABXABAB", j
 end
 
 assert('String#ljust') do

src/vm.c

@@ -134,19 +134,29 @@ static inline void
 envadjust(mrb_state *mrb, mrb_value *oldbase, mrb_value *newbase)
 {
   mrb_callinfo *ci = mrb->c->cibase;
-  ptrdiff_t delta = newbase - oldbase;
+  /*
+   * Byte-level calculation to avoid truncation when allocator alignment is
+   * smaller than sizeof(mrb_value).
+   * eg: MRB_NO_BOXING + MRB_INT64 with MRB_32BIT => sizeof(mrb_value)=16
+   *     And when memory allocator's alignment is 8 bytes
+   * Pointer subtraction on mrb_value* would truncate (8/16 -> 0).
+   * So, we use char* for pointer calculation to get the correct offset in bytes,
+   * then apply that offset to mrb_value* pointers.
+   */
+  ptrdiff_t off = (char *)newbase - (char *)oldbase;
 
-  if (delta == 0) return;
+  if (off == 0) return;
   while (ci <= mrb->c->ci) {
     struct REnv *e = mrb_vm_ci_env(ci);
 
+    mrb_value *new_stack = (mrb_value *)((char *)ci->stack + off);
+
     if (e) {
       mrb_assert(e->cxt == mrb->c && MRB_ENV_ONSTACK_P(e));
       mrb_assert(e->stack == ci->stack);
-
-      e->stack += delta;
+      e->stack = new_stack;
     }
-    ci->stack += delta;
+    ci->stack = new_stack;
     ci++;
   }
 }