[pull] master from ruby:master

.github/workflows/zjit-macos.yml

@@ -98,7 +98,7 @@ jobs:
           rustup install ${{ matrix.rust_version }} --profile minimal
           rustup default ${{ matrix.rust_version }}
 
-      - uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2
+      - uses: taiki-e/install-action@18b1216eba7f8039b0f8d131d5473787f0edce68 # v2.85.3
         with:
           tool: nextest@0.9
         if: ${{ matrix.test_task == 'zjit-check' }}

.github/workflows/zjit-ubuntu.yml

@@ -141,7 +141,7 @@ jobs:
           ruby-version: '3.1'
           bundler: none
 
-      - uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2
+      - uses: taiki-e/install-action@18b1216eba7f8039b0f8d131d5473787f0edce68 # v2.85.3
         with:
           tool: nextest@0.9
         if: ${{ matrix.test_task == 'zjit-check' }}

gc.c

@@ -1453,10 +1453,10 @@ rb_gc_obj_needs_cleanup_p(VALUE obj)
         return !(flags & RARRAY_EMBED_FLAG);
 
       case T_HASH:
-        return !(flags & RHASH_ST_TABLE_FLAG);
+        return (flags & RHASH_ST_TABLE_FLAG);
 
       case T_MATCH:
-        return !((flags & (RMATCH_ONIG | RMATCH_OFFSETS_EXTERNAL)) || USE_DEBUG_COUNTER);
+        return (flags & (RMATCH_ONIG | RMATCH_OFFSETS_EXTERNAL)) || USE_DEBUG_COUNTER;
 
       case T_BIGNUM:
         return !(flags & BIGNUM_EMBED_FLAG);

internal/variable.h

@@ -22,7 +22,6 @@ VALUE rb_search_class_path(VALUE);
 VALUE rb_attr_delete(VALUE, ID);
 void rb_autoload_str(VALUE mod, ID id, VALUE file);
 VALUE rb_autoload_at_p(VALUE, ID, int);
-void rb_autoload_copy_table_for_box(st_table *, const rb_box_t *);
 NORETURN(VALUE rb_mod_const_missing(VALUE,VALUE));
 rb_gvar_getter_t *rb_gvar_getter_function_of(ID);
 rb_gvar_setter_t *rb_gvar_setter_function_of(ID);

lib/bundler/cli.rb

@@ -462,6 +462,7 @@ def fund
     method_option "path", type: :string, banner: "Specify a different path than the system default, namely, $BUNDLE_PATH or $GEM_HOME (removed)."
     method_option "quiet", type: :boolean, banner: "Only output warnings and errors."
     method_option "frozen", type: :boolean, banner: "Do not allow the Gemfile.lock to be updated after this bundle cache operation's install (removed)"
+    method_option "cooldown", type: :numeric, banner: "Only consider gem versions published at least N days ago. Use 0 to disable."
     long_desc <<-D
       The cache command will copy the .gem files for every gem in the bundle into the
       directory ./vendor/cache. If you then check that directory into your source
@@ -643,6 +644,7 @@ def inject(*)
     method_option "strict", type: :boolean, banner: "If updating, do not allow any gem to be updated past latest --patch | --minor | --major"
     method_option "conservative", type: :boolean, banner: "If updating, use bundle install conservative update behavior and do not allow shared dependencies to be updated"
     method_option "bundler", type: :string, lazy_default: "> 0.a", banner: "Update the locked version of bundler"
+    method_option "cooldown", type: :numeric, banner: "Only consider gem versions published at least N days ago. Use 0 to disable."
     def lock
       require_relative "cli/lock"
       Lock.new(options).run

lib/bundler/cli/lock.rb

@@ -16,6 +16,9 @@ def run
 
       check_for_conflicting_options
 
+      Bundler::CLI::Common.validate_cooldown!(options[:cooldown])
+      Bundler.settings.set_command_option_if_given :cooldown, options[:cooldown]
+
       print = options[:print]
       previous_output_stream = Bundler.ui.output_stream
       Bundler.ui.output_stream = :stderr if print

lib/bundler/man/bundle-cache.1

@@ -17,6 +17,9 @@ Include gems for all platforms present in the lockfile, not only the current one
 \fB\-\-cache\-path=CACHE\-PATH\fR
 Specify a different cache path than the default (vendor/cache)\.
 .TP
+\fB\-\-cooldown=<number>\fR
+Only consider gem versions published at least \fInumber\fR days ago when resolving before caching\. Pass \fB0\fR to disable cooldown for this run, overriding any per\-source or global configuration\. See \fBcooldown\fR in bundle\-config(1)\.
+.TP
 \fB\-\-gemfile=GEMFILE\fR
 Use the specified gemfile instead of Gemfile\.
 .TP

lib/bundler/man/bundle-cache.1.ronn

@@ -21,6 +21,12 @@ use the gems in the cache in preference to the ones on `rubygems.org`.
 * `--cache-path=CACHE-PATH`:
   Specify a different cache path than the default (vendor/cache).
 
+* `--cooldown=<number>`:
+  Only consider gem versions published at least <number> days ago when
+  resolving before caching. Pass `0` to disable cooldown for this run,
+  overriding any per-source or global configuration. See `cooldown` in
+  bundle-config(1).
+
 * `--gemfile=GEMFILE`:
   Use the specified gemfile instead of Gemfile.
 

lib/bundler/man/bundle-config.1

@@ -139,7 +139,7 @@ Cooldown filtering depends on the gem server providing a per\-version \fBcreated
 .IP "\(bu" 4
 \fBlockfile\fR (\fBBUNDLE_LOCKFILE\fR): The path to the lockfile that bundler should use\. By default, Bundler adds \fB\.lock\fR to the end of the \fBgemfile\fR entry\. Can be set to \fBfalse\fR in the Gemfile to disable lockfile creation entirely (see gemfile(5))\.
 .IP "\(bu" 4
-\fBlockfile_checksums\fR (\fBBUNDLE_LOCKFILE_CHECKSUMS\fR): Whether Bundler should include a checksums section in new lockfiles, to protect from compromised gem sources\. Defaults to true\.
+\fBlockfile_checksums\fR (\fBBUNDLE_LOCKFILE_CHECKSUMS\fR): Whether Bundler should include a checksums section in new lockfiles, to protect from compromised gem sources\. Defaults to true\. Bundler's own checksum is only included when its \fB\.gem\fR file is cached, which may not be the case when Bundler is installed as a default gem\.
 .IP "\(bu" 4
 \fBno_build_extension\fR (\fBBUNDLE_NO_BUILD_EXTENSION\fR): Whether Bundler should skip building native extensions during installation\. When set, gems are installed without compiling their C extensions\. To build extensions later, unset this setting and run \fBbundle pristine <gem>\fR\.
 .IP "\(bu" 4

lib/bundler/man/bundle-config.1.ronn

@@ -230,6 +230,8 @@ learn more about their operation in [bundle install(1)](bundle-install.1.html).
    Gemfile to disable lockfile creation entirely (see gemfile(5)).
 * `lockfile_checksums` (`BUNDLE_LOCKFILE_CHECKSUMS`):
    Whether Bundler should include a checksums section in new lockfiles, to protect from compromised gem sources. Defaults to true.
+   Bundler's own checksum is only included when its `.gem` file is cached, which
+   may not be the case when Bundler is installed as a default gem.
 * `no_build_extension` (`BUNDLE_NO_BUILD_EXTENSION`):
    Whether Bundler should skip building native extensions during installation.
    When set, gems are installed without compiling their C extensions.

lib/bundler/man/bundle-lock.1

@@ -4,7 +4,7 @@
 .SH "NAME"
 \fBbundle\-lock\fR \- Creates / Updates a lockfile without installing
 .SH "SYNOPSIS"
-\fBbundle lock\fR [\-\-update] [\-\-bundler[=BUNDLER]] [\-\-local] [\-\-print] [\-\-lockfile=PATH] [\-\-full\-index] [\-\-gemfile=GEMFILE] [\-\-add\-checksums] [\-\-add\-platform] [\-\-remove\-platform] [\-\-normalize\-platforms] [\-\-patch] [\-\-minor] [\-\-major] [\-\-pre] [\-\-strict] [\-\-conservative]
+\fBbundle lock\fR [\-\-update] [\-\-bundler[=BUNDLER]] [\-\-local] [\-\-print] [\-\-lockfile=PATH] [\-\-full\-index] [\-\-gemfile=GEMFILE] [\-\-add\-checksums] [\-\-add\-platform] [\-\-remove\-platform] [\-\-normalize\-platforms] [\-\-patch] [\-\-minor] [\-\-major] [\-\-pre] [\-\-strict] [\-\-conservative] [\-\-cooldown=NUMBER]
 .SH "DESCRIPTION"
 Lock the gems specified in Gemfile\.
 .SH "OPTIONS"
@@ -59,6 +59,9 @@ If updating, do not allow any gem to be updated past latest \-\-patch | \-\-mino
 .TP
 \fB\-\-conservative\fR
 If updating, use bundle install conservative update behavior and do not allow shared dependencies to be updated\.
+.TP
+\fB\-\-cooldown=<number>\fR
+Only consider gem versions published at least \fInumber\fR days ago when resolving\. Pass \fB0\fR to disable cooldown for this run, overriding any per\-source or global configuration\. See \fBcooldown\fR in bundle\-config(1)\.
 .SH "UPDATING ALL GEMS"
 If you run \fBbundle lock\fR with \fB\-\-update\fR option without list of gems, bundler will ignore any previously installed gems and resolve all dependencies again based on the latest versions of all gems available in the sources\.
 .SH "UPDATING A LIST OF GEMS"

lib/bundler/man/bundle-lock.1.ronn

@@ -20,6 +20,7 @@ bundle-lock(1) -- Creates / Updates a lockfile without installing
               [--pre]
               [--strict]
               [--conservative]
+              [--cooldown=NUMBER]
 
 ## DESCRIPTION
 
@@ -84,6 +85,11 @@ Lock the gems specified in Gemfile.
 * `--conservative`:
   If updating, use bundle install conservative update behavior and do not allow shared dependencies to be updated.
 
+* `--cooldown=<number>`:
+  Only consider gem versions published at least <number> days ago when
+  resolving. Pass `0` to disable cooldown for this run, overriding any
+  per-source or global configuration. See `cooldown` in bundle-config(1).
+
 ## UPDATING ALL GEMS
 
 If you run `bundle lock` with `--update` option without list of gems, bundler will

spec/bundler/install/cooldown_spec.rb

@@ -115,6 +115,19 @@
         build_gem "fresh_gem", "0.3.2" do |s|
           s.date = now - (1 * 86_400)
         end
+
+        # the generic build is outside the window, but a platform-specific
+        # build of the same version was pushed inside it
+        build_gem "late_platform", "1.0.0" do |s|
+          s.date = now - (30 * 86_400)
+        end
+        build_gem "late_platform", "2.0.0" do |s|
+          s.date = now - (30 * 86_400)
+        end
+        build_gem "late_platform", "2.0.0" do |s|
+          s.platform = "x86_64-linux"
+          s.date = now - (1 * 86_400)
+        end
       end
     end
 
@@ -712,6 +725,85 @@
       expect(lockfile).not_to include("ripe_gem (2.0.0)")
     end
 
+    it "excludes a version on every platform when a platform-specific build of it is inside the window" do
+      # Exclusion is keyed on [name, version] and deliberately ignores
+      # platform: otherwise pushing a fresh platform-specific build under an
+      # already-ripe version number would slip new code past the cooldown.
+      gemfile <<-G
+        source "https://gem.repo3"
+        gem "late_platform"
+      G
+
+      bundle "install --cooldown 7", artifice: "compact_index_cooldown"
+
+      expect(the_bundle).to include_gems("late_platform 1.0.0")
+    end
+
+    it "selects the version with a late platform-specific build when --cooldown 0 bypasses the filter" do
+      gemfile <<-G
+        source "https://gem.repo3"
+        gem "late_platform"
+      G
+
+      bundle "install --cooldown 0", artifice: "compact_index_cooldown"
+
+      # On x86_64-linux hosts this resolves to the platform-specific build, so
+      # assert on the lockfile instead of the installed platform.
+      expect(lockfile).to include("late_platform (2.0.0")
+      expect(lockfile).not_to include("late_platform (1.0.0)")
+    end
+
+    it "applies CLI --cooldown on bundle lock --update" do
+      gemfile <<-G
+        source "https://gem.repo3"
+        gem "ripe_gem"
+      G
+
+      lockfile <<-L
+        GEM
+          remote: https://gem.repo3/
+          specs:
+            ripe_gem (1.0.0)
+
+        PLATFORMS
+          #{lockfile_platforms}
+
+        DEPENDENCIES
+          ripe_gem
+
+        BUNDLED WITH
+           #{Bundler::VERSION}
+      L
+
+      bundle "lock --update --cooldown 7", artifice: "compact_index_cooldown"
+
+      expect(lockfile).to include("ripe_gem (1.0.0)")
+      expect(lockfile).not_to include("ripe_gem (2.0.0)")
+    end
+
+    it "rejects a negative --cooldown value on bundle lock" do
+      gemfile <<-G
+        source "https://gem.repo3"
+        gem "ripe_gem"
+      G
+
+      bundle "lock --cooldown=-7", artifice: "compact_index_cooldown", raise_on_error: false
+
+      expect(err).to match(/non-negative integer/)
+    end
+
+    it "applies CLI --cooldown on bundle cache" do
+      gemfile <<-G
+        source "https://gem.repo3"
+        gem "ripe_gem"
+      G
+
+      bundle "cache --cooldown 7", artifice: "compact_index_cooldown"
+
+      expect(the_bundle).to include_gems("ripe_gem 1.0.0")
+      expect(bundled_app("vendor/cache/ripe_gem-1.0.0.gem")).to exist
+    end
+
     it "ignores cooldown and installs the locked version when frozen" do
       # Frozen installs read the lockfile instead of resolving, so cooldown has
       # no say. A version already locked inside the window must still install.

test/openssl/test_pkcs7.rb

@@ -238,8 +238,6 @@ def test_enveloped
     assert_equal(@ee2_cert.serial, recip[1].serial)
     assert_equal(data, p7.decrypt(@ee2_key, @ee2_cert))
 
-    assert_equal(data, p7.decrypt(@ee1_key))
-
     assert_raise(OpenSSL::PKCS7::PKCS7Error) {
       p7.decrypt(@ca_key, @ca_cert)
     }
@@ -250,6 +248,16 @@ def test_enveloped
     }
   end
 
+  def test_enveloped_decrypt_key_only
+    omit_on_fips # PKCS #1 v1.5 padding
+
+    data = "aaaaa\nbbbbb\nccccc\n"
+    cipher = "AES-128-CBC"
+
+    p7 = OpenSSL::PKCS7.encrypt([@ee1_cert], data, cipher, OpenSSL::PKCS7::BINARY)
+    assert_equal(data, p7.decrypt(@ee1_key))
+  end
+
   def test_enveloped_add_recipient
     omit_on_fips # PKCS #1 v1.5 padding
 

test/ruby/test_ractor.rb

@@ -419,6 +419,21 @@ def test_detailed_message_in_ractor
     RUBY
   end
 
+  def test_ractor_vm_once_dispatch
+    assert_ractor(<<~'RUBY', args: ["-W0"], timeout: 30)
+      vals = 10.times.map do
+        Ractor.new {
+          a = nil
+          /#{sleep 0.1; a = "set"}/o
+          a
+        }
+      end.map(&:value)
+      vals.compact!
+      assert_equal 1, vals.size
+      assert_equal "set", vals.first
+    RUBY
+  end
+
   def assert_make_shareable(obj)
     refute Ractor.shareable?(obj), "object was already shareable"
     Ractor.make_shareable(obj)

test/ruby/test_thread.rb

@@ -1016,26 +1016,23 @@ def test_thread_timer_and_interrupt
     cmd = 'Signal.trap(:INT, "DEFAULT"); pipe=IO.pipe; Thread.start {Thread.pass until Thread.main.stop?; puts; STDOUT.flush}; pipe[0].read'
     opt = {}
     opt[:new_pgroup] = true if /mswin|mingw/ =~ RUBY_PLATFORM
-    s, t, _err = EnvUtil.invoke_ruby(['-e', cmd], "", true, true, **opt) do |in_p, out_p, err_p, cpid|
+    s, err = EnvUtil.invoke_ruby(['-e', cmd], "", true, true, **opt) do |in_p, out_p, err_p, cpid|
       assert IO.select([out_p], nil, nil, 10), 'subprocess not ready'
       out_p.gets
       pid = cpid
-      t0 = Time.now.to_f
       Process.kill(:SIGINT, pid)
       begin
         Timeout.timeout(10) { Process.wait(pid) }
       rescue Timeout::Error
         EnvUtil.terminate(pid)
         raise
       end
-      t1 = Time.now.to_f
-      [$?, t1 - t0, err_p.read]
+      [$?, err_p.read]
     end
     assert_equal(pid, s.pid, bug5757)
     assert_equal([false, true, false, Signal.list["INT"]],
                  [s.exited?, s.signaled?, s.stopped?, s.termsig],
                  "[s.exited?, s.signaled?, s.stopped?, s.termsig]")
-    assert_include(0..2, t, bug5757)
   end
 
   def test_thread_join_in_trap

thread.c

@@ -5083,6 +5083,8 @@ rb_thread_atfork_internal(rb_thread_t *th, void (*atfork)(rb_thread_t *, const r
 
     /* may be held by any thread in parent */
     rb_native_mutex_initialize(&th->interrupt_lock);
+    rb_native_mutex_initialize(&vm->once_lock);
+    rb_native_cond_initialize(&vm->once_cond);
     ccan_list_head_init(&th->interrupt_exec_tasks);
 
     vm->fork_gen++;
@@ -5755,6 +5757,8 @@ Init_Thread_Mutex(void)
     rb_thread_t *th = GET_THREAD();
 
     rb_native_mutex_initialize(&th->vm->workqueue_lock);
+    rb_native_mutex_initialize(&th->vm->once_lock);
+    rb_native_cond_initialize(&th->vm->once_cond);
     rb_native_mutex_initialize(&th->interrupt_lock);
 }