fix(deps): update dependency ruby to v3.4.10

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
ruby (source)		patch	3.4.9 → 3.4.10	3.4.11
ruby (source)	tools	patch	3.4.9 → 3.4.10	3.4.11

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

Ruby 3.4.10 Release Date: June 30, 2026

Primary Changes:

• 24 Bug Fixes addressing critical stability issues across various Ruby components
• Security Update: Bundled gem net-imap upgraded to v0.5.15 with critical security fixes
• Core Bug Fixes:
  • Segmentation fault fixes in BasicObject#initialize and Thread.each_caller_location
  • YJIT compiler improvements for local variable handling (>256 variables)
  • Fiber management improvements for proper machine stack release
  • Prism parser improvements for pattern matching and numeric literals
  • Float#ceil calculation corrections
  • Thread safety fixes for fork/signal/ensure scenarios
  • IO::Buffer locking mechanism corrections
  • Array#sum performance optimization for Float compensated summation

Security Fixes (via net-imap 0.5.15):

• CVE-2026-47242 (Command Injection): Fixed unvalidated ID and ENABLE arguments that could allow CRLF injection and arbitrary IMAP command execution
• CVE-2026-47240 (Command Injection): Fixed non-synchronizing literal parsing vulnerabilities
• CVE-2026-47241 (Denial of Service, CVSS 2.1): Fixed incomplete "raw" argument validation that could cause command continuation issues

Additional Improvements:

• syntax_suggest backport (v2.0.3)
• PStore ultra_safe mode fixes
• Marshal.load freeze option enhancements
• win32-resolv backport
• Out-of-source build support for bundle extensions

Breaking Changes: None. This is a patch release maintaining full backward compatibility with Ruby 3.4.x.

🎯 Impact Scope Investigation

Package Update Scope:

• Dockerfile: Ruby runtime version bump from 3.4.9 → 3.4.10 (ARG RUBY_VERSION)
• mise.toml: Development tool version alignment from 3.4.9 → 3.4.10

Ruby Usage in Codebase:

• Runtime Support: Ruby is one of seven supported runtimes in the sandbox (Dockerfile:238-239, runtime.go:232-294)
• Execution Model: Interpreted runtime (no compilation step), uses nsjail for isolation
• Pre-installed Gems: base64 (0.3.0), csv (3.3.5), fiddle (1.1.8) - versions pinned in Gemfile.lock
• Resource Limits: 1024 MiB VAS, 256 MiB physical memory, 32 PIDs max, 900ms/sec CPU throttle
• Test Coverage: 29 E2E tests in e2e/tests/runtime/ruby.yml covering core functionality, gems, and edge cases; Additional security tests across multiple threat scenarios

Dependency Impact:

• No Impact: The bundled gems used by this project (base64, csv, fiddle) are managed independently via the Gemfile.lock and are NOT affected by the net-imap security fixes
• Net-IMAP Not Used: The codebase does not use net-imap anywhere; the security fixes are preventive and eliminate potential attack vectors if net-imap were to be used in the future
• No API Changes: Ruby 3.4.9 → 3.4.10 maintains complete API compatibility

Configuration Impact:

• No changes required to nsjail configuration (configs/nsjail.cfg)
• No changes required to Seccomp-BPF policy (configs/seccomp.kafel)
• No changes required to runtime limits or environment variables

Build Impact:

• Docker image rebuild required to install Ruby 3.4.10
• No changes to build stages or compilation steps
• Mise tool will automatically install Ruby 3.4.10 during development setup

💡 Recommended Actions

Immediate Actions:

1. ✅ Merge this PR - This is a safe patch release with important security and stability fixes
2. ✅ Rebuild Docker image - Run docker compose down && docker compose up --build -d to deploy the update
3. ✅ Run E2E tests - Execute go test -tags e2e ./e2e/... to verify Ruby runtime functionality after rebuild

Post-Merge Verification:

1. Verify Ruby version in running container: docker compose exec sandbox /mise/installs/ruby/current/bin/ruby --version should show ruby 3.4.10
2. Confirm E2E test suite passes with Ruby 3.4.10
3. Monitor production logs for any unexpected Ruby runtime behavior (unlikely given patch nature)

No Manual Migration Required:

• No code changes needed
• No configuration updates needed
• No dependency version updates needed
• Full backward compatibility maintained

Note on Pending Update:

• Ruby 3.4.11 is pending. Monitor the next Renovate PR for that release once available.

🔗 Reference Links

Release Documentation:

• Ruby 3.4.10 Released (Official)
• Ruby 3.4.10 GitHub Release
• Ruby 3.4.10 on Heroku Dev Center

Security Advisories:

• CVE-2026-47242 - Command Injection via Unvalidated Arguments
• CVE-2026-42258 - Ruby Net::IMAP Command Injection
• CVE-2026-47241 - Denial of Service via Incomplete Validation
• Net-IMAP v0.5.15 Release

Comparison:

• Diff: v3.4.9...v3.4.10

Generated by koki-develop/claude-renovate-review