From 48a265cc1db47050944580014d953c13763ff33d Mon Sep 17 00:00:00 2001 From: Shia Date: Sat, 24 Oct 2026 09:42:27 +0900 Subject: [PATCH 1/4] cp {en,ko}/news/_posts/2026-10-23-regexp-fixes-for-gitlab-cves.md --- ...2026-10-23-regexp-fixes-for-gitlab-cves.md | 63 +++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 ko/news/_posts/2026-10-23-regexp-fixes-for-gitlab-cves.md diff --git a/ko/news/_posts/2026-10-23-regexp-fixes-for-gitlab-cves.md b/ko/news/_posts/2026-10-23-regexp-fixes-for-gitlab-cves.md new file mode 100644 index 0000000000..0ab96500f7 --- /dev/null +++ b/ko/news/_posts/2026-10-23-regexp-fixes-for-gitlab-cves.md @@ -0,0 +1,63 @@ +--- +layout: news_post +title: "Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264" +author: "k0kubun" +translator: +date: 2026-10-23 03:11:22 +0000 +lang: en +--- + +We have released Ruby 4.0.9, 3.4.12 and 3.3.13. They fix several bugs in Ruby's regular expression engine (Onigmo) that GitLab found could be used for remote code execution on GitLab servers. GitLab published four CVEs for these issues, and the Ruby releases contain the fixes for the underlying bugs in Ruby. + +## Background + +GitLab compiles regular expressions supplied by its users, such as patterns in CI configuration, with `Regexp.new`. GitLab found that specially crafted patterns could corrupt memory while Ruby compiles them, and that this could be turned into remote code execution on GitLab servers. GitLab addressed these issues in its own releases by patching the Ruby it ships, and assigned the following CVE identifiers: + +* [CVE-2026-89078](https://www.cve.org/CVERecord?id=CVE-2026-89078): Double Free issue in Regular Expression Parser ([GitLab 19.4.1](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/)) +* [CVE-2026-93577](https://www.cve.org/CVERecord?id=CVE-2026-93577): Integer Overflow issue in Regular Expression Compiler ([GitLab 19.4.1](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/)) +* [CVE-2026-97229](https://www.cve.org/CVERecord?id=CVE-2026-97229): Integer Overflow issue in CI/CD Regular Expression Compiler ([GitLab 19.4.2](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/)) +* [CVE-2026-110264](https://www.cve.org/CVERecord?id=CVE-2026-110264): Integer Overflow issue in Regular Expression Compiler ([GitLab 19.5.1](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/)) + +## Fixes in Ruby + +The following table shows the change in Ruby that fixes the bug behind each CVE, and the first release of each series that contains it. + +| GitLab CVE | Bug in Ruby | Change | Ruby 4.0 | Ruby 3.4 | Ruby 3.3 | +|---|---|---|---|---|---| +| CVE-2026-89078 | Double free when parsing a pattern fails after an alternation | [#13332](https://github.com/ruby/ruby/pull/13332) | 4.0.0 | 3.4.12 | 3.3.13 | +| CVE-2026-93577, CVE-2026-97229 | Integer overflow in the size of a compiled pattern | [#19020](https://github.com/ruby/ruby/pull/19020) | 4.0.8 | 3.4.12 | 3.3.13 | +| CVE-2026-110264 | Overflow of internal IDs in a pattern with many repeats | [#16801](https://github.com/ruby/ruby/pull/16801) | 4.0.9 | 3.4.12 | 3.3.13 | + +Ruby 4.0.9, 3.4.12 and 3.3.13 contain all of these fixes. + +## Who is affected + +These bugs are reached only when an application compiles a regular expression from a string that an attacker controls, for example by passing it to `Regexp.new`, `Regexp.union` or `Regexp.compile`, or by interpolating it into a regexp literal such as `/#{input}/`. Applications that only use regular expressions written by their own developers are not affected. + +`Regexp.timeout` does not protect against these bugs. Limiting the length of patterns does not reliably protect against them either, because some of them can be triggered by short patterns. + +## Recommended action + +We recommend upgrading to Ruby 4.0.9, 3.4.12 or 3.3.13 or later. + +If you cannot upgrade, please avoid compiling regular expressions from untrusted input. + +Ruby 3.3 is in the security maintenance phase, in which we normally release only fixes for vulnerabilities. Ruby 3.3.13 includes these fixes as an exception, because GitLab assigned CVEs to issues that rely on them. + +## About CVE identifiers + +We have not requested CVE identifiers in Ruby for these fixes, at least for now. + +Ruby has generally considered it unsafe to compile and use a regular expression created from untrusted input. We stated this in the advisory for [CVE-2022-28738]({% link en/news/_posts/2022-04-12-double-free-in-regexp-compilation-cve-2022-28738.md %}), where we nevertheless treated a double free in Regexp compilation as a vulnerability after a comprehensive assessment. We did the same for [CVE-2024-27282]({% link en/news/_posts/2024-04-23-arbitrary-memory-address-read-regexp-cve-2024-27282.md %}). + +However, the [Regexp documentation](https://docs.ruby-lang.org/en/master/Regexp.html#class-Regexp-label-Timeouts) currently discusses untrusted patterns only in terms of denial of service, and recommends a timeout for them. It does not clearly say whether compiling an untrusted pattern is a use case that Ruby supports. We plan to discuss how to document this, and whether we treat this kind of issue as a vulnerability in Ruby, including whether to request CVE identifiers for these fixes. If we request any, we will update this page. + +In the meantime, please refer to GitLab's CVE identifiers listed above when you track these issues, for example in a security scanner. + +## Credits + +Thanks to Johan Carlsson ([joaxcar](https://github.com/joaxcar)) for discovering the integer overflow fixed by [#19020](https://github.com/ruby/ruby/pull/19020) through GitLab's bug bounty program, and to GitLab for reporting these issues to us and coordinating the fixes. + +## History + +* Originally published at 2026-10-23 03:11:22 (UTC) From b0a196a1867a9dac538687d95efcdea0100be721 Mon Sep 17 00:00:00 2001 From: Shia Date: Sat, 24 Oct 2026 09:42:27 +0900 Subject: [PATCH 2/4] cp {en,ko}/news/_posts/2026-10-23-ruby-4-0-9-released.md --- .../_posts/2026-10-23-ruby-4-0-9-released.md | 47 +++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 ko/news/_posts/2026-10-23-ruby-4-0-9-released.md diff --git a/ko/news/_posts/2026-10-23-ruby-4-0-9-released.md b/ko/news/_posts/2026-10-23-ruby-4-0-9-released.md new file mode 100644 index 0000000000..6dba399e0c --- /dev/null +++ b/ko/news/_posts/2026-10-23-ruby-4-0-9-released.md @@ -0,0 +1,47 @@ +--- +layout: news_post +title: "Ruby 4.0.9 Released" +author: k0kubun +translator: +date: 2026-10-23 03:11:22 +0000 +lang: en +--- + +Ruby 4.0.9 has been released. + +This release includes a fix for a bug in Regexp compilation that GitLab's CVE-2026-110264 relies on. +Please see the topic below for details. + +* [Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264]({% link en/news/_posts/2026-10-23-regexp-fixes-for-gitlab-cves.md %}) + +Please see the [GitHub releases](https://github.com/ruby/ruby/releases/tag/v4.0.9) for further details. + +## Download + +{% assign release = site.data.releases | where: "version", "4.0.9" | first %} + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## Release Comment + +Many committers, developers, and users who provided bug reports helped us make this release. +Thanks for their contributions. From 599cebef2461b60dcc48705716b6c9d1e7277b6a Mon Sep 17 00:00:00 2001 From: Shia Date: Sat, 24 Oct 2026 09:43:03 +0900 Subject: [PATCH 3/4] Translate "Regexp compilation fixes related to GitLab's CVEs" (ko) Co-Authored-By: Claude Opus 5.5 --- ...2026-10-23-regexp-fixes-for-gitlab-cves.md | 66 +++++++++---------- 1 file changed, 33 insertions(+), 33 deletions(-) diff --git a/ko/news/_posts/2026-10-23-regexp-fixes-for-gitlab-cves.md b/ko/news/_posts/2026-10-23-regexp-fixes-for-gitlab-cves.md index 0ab96500f7..4b0afb182c 100644 --- a/ko/news/_posts/2026-10-23-regexp-fixes-for-gitlab-cves.md +++ b/ko/news/_posts/2026-10-23-regexp-fixes-for-gitlab-cves.md @@ -1,63 +1,63 @@ --- layout: news_post -title: "Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264" +title: "GitLab의 CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264와 관련된 정규표현식 컴파일 수정" author: "k0kubun" -translator: +translator: "shia" date: 2026-10-23 03:11:22 +0000 -lang: en +lang: ko --- -We have released Ruby 4.0.9, 3.4.12 and 3.3.13. They fix several bugs in Ruby's regular expression engine (Onigmo) that GitLab found could be used for remote code execution on GitLab servers. GitLab published four CVEs for these issues, and the Ruby releases contain the fixes for the underlying bugs in Ruby. +Ruby 4.0.9, 3.4.12, 3.3.13을 릴리스했습니다. 이번 릴리스에서는 Ruby의 정규표현식 엔진(Onigmo)에 있는 여러 버그를 수정했습니다. GitLab은 이 버그들을 악용하면 GitLab 서버에서 원격 코드를 실행할 수 있다는 것을 발견했습니다. GitLab은 이 문제들에 대해 CVE 4건을 공개했으며, 이번 Ruby 릴리스에는 그 원인이 된 Ruby 버그의 수정이 포함되어 있습니다. -## Background +## 배경 -GitLab compiles regular expressions supplied by its users, such as patterns in CI configuration, with `Regexp.new`. GitLab found that specially crafted patterns could corrupt memory while Ruby compiles them, and that this could be turned into remote code execution on GitLab servers. GitLab addressed these issues in its own releases by patching the Ruby it ships, and assigned the following CVE identifiers: +GitLab은 CI 설정의 패턴 등 사용자가 제공한 정규표현식을 `Regexp.new`로 컴파일합니다. GitLab은 의도적으로 조작된 패턴을 Ruby가 컴파일하는 도중 메모리가 손상될 수 있고, 이를 악용하면 GitLab 서버에서 원격 코드를 실행할 수 있다는 것을 발견했습니다. GitLab은 자체 배포하는 Ruby에 패치를 적용한 릴리스로 이 문제들에 대응했으며, 다음 CVE 번호를 할당했습니다. -* [CVE-2026-89078](https://www.cve.org/CVERecord?id=CVE-2026-89078): Double Free issue in Regular Expression Parser ([GitLab 19.4.1](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/)) -* [CVE-2026-93577](https://www.cve.org/CVERecord?id=CVE-2026-93577): Integer Overflow issue in Regular Expression Compiler ([GitLab 19.4.1](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/)) -* [CVE-2026-97229](https://www.cve.org/CVERecord?id=CVE-2026-97229): Integer Overflow issue in CI/CD Regular Expression Compiler ([GitLab 19.4.2](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/)) -* [CVE-2026-110264](https://www.cve.org/CVERecord?id=CVE-2026-110264): Integer Overflow issue in Regular Expression Compiler ([GitLab 19.5.1](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/)) +* [CVE-2026-89078](https://www.cve.org/CVERecord?id=CVE-2026-89078): 정규표현식 파서의 중복 할당 해제 문제([GitLab 19.4.1](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/)) +* [CVE-2026-93577](https://www.cve.org/CVERecord?id=CVE-2026-93577): 정규표현식 컴파일러의 정수 오버플로 문제([GitLab 19.4.1](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/)) +* [CVE-2026-97229](https://www.cve.org/CVERecord?id=CVE-2026-97229): CI/CD 정규표현식 컴파일러의 정수 오버플로 문제([GitLab 19.4.2](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/)) +* [CVE-2026-110264](https://www.cve.org/CVERecord?id=CVE-2026-110264): 정규표현식 컴파일러의 정수 오버플로 문제([GitLab 19.5.1](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/)) -## Fixes in Ruby +## Ruby에서의 수정 -The following table shows the change in Ruby that fixes the bug behind each CVE, and the first release of each series that contains it. +다음 표는 각 CVE의 원인이 된 버그를 수정한 Ruby의 변경 사항과, 버전대별로 그 수정이 처음 포함된 릴리스를 정리한 것입니다. -| GitLab CVE | Bug in Ruby | Change | Ruby 4.0 | Ruby 3.4 | Ruby 3.3 | +| GitLab CVE | Ruby의 버그 | 변경 사항 | Ruby 4.0 | Ruby 3.4 | Ruby 3.3 | |---|---|---|---|---|---| -| CVE-2026-89078 | Double free when parsing a pattern fails after an alternation | [#13332](https://github.com/ruby/ruby/pull/13332) | 4.0.0 | 3.4.12 | 3.3.13 | -| CVE-2026-93577, CVE-2026-97229 | Integer overflow in the size of a compiled pattern | [#19020](https://github.com/ruby/ruby/pull/19020) | 4.0.8 | 3.4.12 | 3.3.13 | -| CVE-2026-110264 | Overflow of internal IDs in a pattern with many repeats | [#16801](https://github.com/ruby/ruby/pull/16801) | 4.0.9 | 3.4.12 | 3.3.13 | +| CVE-2026-89078 | 선택(alternation) 이후 패턴 파싱에 실패할 때 발생하는 중복 할당 해제 | [#13332](https://github.com/ruby/ruby/pull/13332) | 4.0.0 | 3.4.12 | 3.3.13 | +| CVE-2026-93577, CVE-2026-97229 | 컴파일된 패턴 크기의 정수 오버플로 | [#19020](https://github.com/ruby/ruby/pull/19020) | 4.0.8 | 3.4.12 | 3.3.13 | +| CVE-2026-110264 | 반복이 많은 패턴에서 발생하는 내부 ID 오버플로 | [#16801](https://github.com/ruby/ruby/pull/16801) | 4.0.9 | 3.4.12 | 3.3.13 | -Ruby 4.0.9, 3.4.12 and 3.3.13 contain all of these fixes. +Ruby 4.0.9, 3.4.12, 3.3.13은 이 수정을 모두 포함하고 있습니다. -## Who is affected +## 영향을 받는 경우 -These bugs are reached only when an application compiles a regular expression from a string that an attacker controls, for example by passing it to `Regexp.new`, `Regexp.union` or `Regexp.compile`, or by interpolating it into a regexp literal such as `/#{input}/`. Applications that only use regular expressions written by their own developers are not affected. +이 버그들은 애플리케이션이 공격자가 조작할 수 있는 문자열로 정규표현식을 컴파일하는 경우에만 발생합니다. 예를 들어 그 문자열을 `Regexp.new`, `Regexp.union`, `Regexp.compile`에 넘기거나, `/#{input}/`과 같은 정규표현식 리터럴에 삽입하는 경우입니다. 개발자가 직접 작성한 정규표현식만 사용하는 애플리케이션은 영향을 받지 않습니다. -`Regexp.timeout` does not protect against these bugs. Limiting the length of patterns does not reliably protect against them either, because some of them can be triggered by short patterns. +`Regexp.timeout`으로는 이 버그들을 막을 수 없습니다. 일부 버그는 짧은 패턴으로도 일으킬 수 있으므로, 패턴 길이를 제한하는 것도 확실한 대책이 되지 못합니다. -## Recommended action +## 권장 조치 -We recommend upgrading to Ruby 4.0.9, 3.4.12 or 3.3.13 or later. +Ruby 4.0.9, 3.4.12, 3.3.13 또는 그 이후 버전으로 업그레이드하는 것을 권장합니다. -If you cannot upgrade, please avoid compiling regular expressions from untrusted input. +업그레이드할 수 없다면, 신뢰할 수 없는 입력으로 정규표현식을 컴파일하지 마세요. -Ruby 3.3 is in the security maintenance phase, in which we normally release only fixes for vulnerabilities. Ruby 3.3.13 includes these fixes as an exception, because GitLab assigned CVEs to issues that rely on them. +Ruby 3.3은 보안 유지보수 단계로, 보통은 취약점 수정만 릴리스합니다. 하지만 GitLab이 이 버그들에 기반한 문제에 CVE를 할당했으므로, 예외적으로 Ruby 3.3.13에 이 수정들을 포함했습니다. -## About CVE identifiers +## CVE 번호에 대해 -We have not requested CVE identifiers in Ruby for these fixes, at least for now. +적어도 현재로서는 이 수정들에 대해 Ruby에서 CVE 번호를 요청하지 않았습니다. -Ruby has generally considered it unsafe to compile and use a regular expression created from untrusted input. We stated this in the advisory for [CVE-2022-28738]({% link en/news/_posts/2022-04-12-double-free-in-regexp-compilation-cve-2022-28738.md %}), where we nevertheless treated a double free in Regexp compilation as a vulnerability after a comprehensive assessment. We did the same for [CVE-2024-27282]({% link en/news/_posts/2024-04-23-arbitrary-memory-address-read-regexp-cve-2024-27282.md %}). +Ruby는 일반적으로 신뢰할 수 없는 입력으로 만든 정규표현식을 컴파일하고 사용하는 것을 안전하지 않다고 간주해 왔습니다. 이는 [CVE-2022-28738]({% link ko/news/_posts/2022-04-12-double-free-in-regexp-compilation-cve-2022-28738.md %})의 보안 권고에서도 밝힌 바 있지만, 당시에는 종합적인 평가 끝에 정규표현식 컴파일의 중복 할당 해제를 취약점으로 다루었습니다. [CVE-2024-27282]({% link ko/news/_posts/2024-04-23-arbitrary-memory-address-read-regexp-cve-2024-27282.md %})도 마찬가지였습니다. -However, the [Regexp documentation](https://docs.ruby-lang.org/en/master/Regexp.html#class-Regexp-label-Timeouts) currently discusses untrusted patterns only in terms of denial of service, and recommends a timeout for them. It does not clearly say whether compiling an untrusted pattern is a use case that Ruby supports. We plan to discuss how to document this, and whether we treat this kind of issue as a vulnerability in Ruby, including whether to request CVE identifiers for these fixes. If we request any, we will update this page. +그러나 현재 [Regexp 문서](https://docs.ruby-lang.org/en/master/Regexp.html#class-Regexp-label-Timeouts)는 신뢰할 수 없는 패턴을 서비스 거부 관점에서만 다루며, 타임아웃 설정을 권장하고 있습니다. 신뢰할 수 없는 패턴을 컴파일하는 것을 Ruby가 지원하는지는 명확히 밝히고 있지 않습니다. 이를 어떻게 문서화할지, 이런 종류의 문제를 Ruby의 취약점으로 다룰지, 그리고 이 수정들에 대해 CVE 번호를 요청할지를 논의할 예정입니다. CVE 번호를 요청하게 되면 이 페이지를 갱신하겠습니다. -In the meantime, please refer to GitLab's CVE identifiers listed above when you track these issues, for example in a security scanner. +그때까지는 보안 스캐너 등에서 이 문제들을 추적할 때 위에 나열한 GitLab의 CVE 번호를 사용해 주세요. -## Credits +## 도움을 준 사람 -Thanks to Johan Carlsson ([joaxcar](https://github.com/joaxcar)) for discovering the integer overflow fixed by [#19020](https://github.com/ruby/ruby/pull/19020) through GitLab's bug bounty program, and to GitLab for reporting these issues to us and coordinating the fixes. +GitLab의 버그 바운티 프로그램을 통해 [#19020](https://github.com/ruby/ruby/pull/19020)에서 수정된 정수 오버플로를 발견해 준 Johan Carlsson([joaxcar](https://github.com/joaxcar))과, 이 문제들을 보고하고 수정을 조율해 준 GitLab에 감사를 표합니다. -## History +## 수정 이력 -* Originally published at 2026-10-23 03:11:22 (UTC) +* 2026-10-23 03:11:22 (UTC) 최초 공개 From c38e2338891e38b7d7ae936a62d04388f932ee1f Mon Sep 17 00:00:00 2001 From: Shia Date: Sat, 24 Oct 2026 09:43:03 +0900 Subject: [PATCH 4/4] Translate "Ruby 4.0.9 Released" (ko) Co-Authored-By: Claude Opus 5.5 --- .../_posts/2026-10-23-ruby-4-0-9-released.md | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/ko/news/_posts/2026-10-23-ruby-4-0-9-released.md b/ko/news/_posts/2026-10-23-ruby-4-0-9-released.md index 6dba399e0c..e19634f9bf 100644 --- a/ko/news/_posts/2026-10-23-ruby-4-0-9-released.md +++ b/ko/news/_posts/2026-10-23-ruby-4-0-9-released.md @@ -1,22 +1,22 @@ --- layout: news_post -title: "Ruby 4.0.9 Released" +title: "Ruby 4.0.9 릴리스" author: k0kubun -translator: +translator: "shia" date: 2026-10-23 03:11:22 +0000 -lang: en +lang: ko --- -Ruby 4.0.9 has been released. +Ruby 4.0.9가 릴리스되었습니다. -This release includes a fix for a bug in Regexp compilation that GitLab's CVE-2026-110264 relies on. -Please see the topic below for details. +이번 릴리스는 GitLab의 CVE-2026-110264의 원인이 된 정규표현식 컴파일 버그 수정을 포함합니다. +자세한 내용은 아래 항목을 참조하세요. -* [Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264]({% link en/news/_posts/2026-10-23-regexp-fixes-for-gitlab-cves.md %}) +* [GitLab의 CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264와 관련된 정규표현식 컴파일 수정]({% link ko/news/_posts/2026-10-23-regexp-fixes-for-gitlab-cves.md %}) -Please see the [GitHub releases](https://github.com/ruby/ruby/releases/tag/v4.0.9) for further details. +자세한 내용은 [GitHub 릴리스](https://github.com/ruby/ruby/releases/tag/v4.0.9)를 참조하세요. -## Download +## 다운로드 {% assign release = site.data.releases | where: "version", "4.0.9" | first %} @@ -41,7 +41,7 @@ Please see the [GitHub releases](https://github.com/ruby/ruby/releases/tag/v4.0. SHA256: {{ release.sha256.zip }} SHA512: {{ release.sha512.zip }} -## Release Comment +## 릴리스 코멘트 -Many committers, developers, and users who provided bug reports helped us make this release. -Thanks for their contributions. +많은 커미터, 개발자, 버그를 보고해 준 사용자들이 이 릴리스를 만드는 데 도움을 주었습니다. +그들의 기여에 감사드립니다.