From 58940377e6f27f39d5c3baa0faa15655fa873f2c Mon Sep 17 00:00:00 2001
From: eileencodes <eileencodes@gmail.com>
Date: Tue, 25 Nov 2025 14:17:03 -0500
Subject: [PATCH 1/6] [ruby/rubygems] Write gem files atomically

This change updates `write_binary` to use a new class,
`AtomicFileWriter.open` to write the gem's files. This implementation
is borrowed from Active Support's [`atomic_write`](https://github.com/rails/rails/blob/main/activesupport/lib/active_support/core_ext/file/atomic.rb).

Atomic write will write the files to a temporary file and then once
created, sets permissions and renames the file. If the file is corrupted
- ie on failed download, an error occurs, or for some other reason, the
real file will not be created. The changes made here make `verify_gz`
obsolete, we don't need to verify it if we have successfully created the
file atomically. If it exists, it is not corrupt. If it is corrupt, the
file won't exist on disk.

While writing tests for this functionality I replaced the
`RemoteFetcher` stub with `FakeFetcher` except for where we really do
need to overwrite the `RemoteFetcher`. The new test implementation is much
clearer on what it's trying to accomplish versus the prior test
implementation.

https://github.com/ruby/rubygems/commit/0cd4b54291
---
 lib/bundler/shared_helpers.rb            |   3 +-
 lib/rubygems.rb                          |  11 +-
 lib/rubygems/util/atomic_file_writer.rb  |  67 ++++++++++++
 test/rubygems/test_gem_installer.rb      |  34 +++---
 test/rubygems/test_gem_remote_fetcher.rb | 134 +++++++++++------------
 5 files changed, 158 insertions(+), 91 deletions(-)
 create mode 100644 lib/rubygems/util/atomic_file_writer.rb

diff --git a/lib/bundler/shared_helpers.rb b/lib/bundler/shared_helpers.rb
index 6419e4299760b7..2aa8abe0a078b0 100644
--- a/lib/bundler/shared_helpers.rb
+++ b/lib/bundler/shared_helpers.rb
@@ -105,7 +105,8 @@ def set_bundle_environment
     def filesystem_access(path, action = :write, &block)
       yield(path.dup)
     rescue Errno::EACCES => e
-      raise unless e.message.include?(path.to_s) || action == :create
+      path_basename = File.basename(path.to_s)
+      raise unless e.message.include?(path_basename) || action == :create
 
       raise PermissionError.new(path, action)
     rescue Errno::EAGAIN
diff --git a/lib/rubygems.rb b/lib/rubygems.rb
index 55e727425fbe4d..a66e5378436600 100644
--- a/lib/rubygems.rb
+++ b/lib/rubygems.rb
@@ -17,6 +17,7 @@ module Gem
 require_relative "rubygems/errors"
 require_relative "rubygems/target_rbconfig"
 require_relative "rubygems/win_platform"
+require_relative "rubygems/util/atomic_file_writer"
 
 ##
 # RubyGems is the Ruby standard for publishing and managing third party
@@ -833,14 +834,12 @@ def self.read_binary(path)
   end
 
   ##
-  # Safely write a file in binary mode on all platforms.
+  # Atomically write a file in binary mode on all platforms.
 
   def self.write_binary(path, data)
-    File.binwrite(path, data)
-  rescue Errno::ENOSPC
-    # If we ran out of space but the file exists, it's *guaranteed* to be corrupted.
-    File.delete(path) if File.exist?(path)
-    raise
+    Gem::AtomicFileWriter.open(path) do |file|
+      file.write(data)
+    end
   end
 
   ##
diff --git a/lib/rubygems/util/atomic_file_writer.rb b/lib/rubygems/util/atomic_file_writer.rb
new file mode 100644
index 00000000000000..7d1d6a74168f95
--- /dev/null
+++ b/lib/rubygems/util/atomic_file_writer.rb
@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+# Based on ActiveSupport's AtomicFile implementation
+# Copyright (c) David Heinemeier Hansson
+# https://github.com/rails/rails/blob/main/activesupport/lib/active_support/core_ext/file/atomic.rb
+# Licensed under the MIT License
+
+module Gem
+  class AtomicFileWriter
+    ##
+    # Write to a file atomically. Useful for situations where you don't
+    # want other processes or threads to see half-written files.
+
+    def self.open(file_name)
+      temp_dir = File.dirname(file_name)
+      require "tempfile" unless defined?(Tempfile)
+
+      Tempfile.create(".#{File.basename(file_name)}", temp_dir) do |temp_file|
+        temp_file.binmode
+        return_value = yield temp_file
+        temp_file.close
+
+        original_permissions = if File.exist?(file_name)
+          File.stat(file_name)
+        else
+          # If not possible, probe which are the default permissions in the
+          # destination directory.
+          probe_permissions_in(File.dirname(file_name))
+        end
+
+        # Set correct permissions on new file
+        if original_permissions
+          begin
+            File.chown(original_permissions.uid, original_permissions.gid, temp_file.path)
+            File.chmod(original_permissions.mode, temp_file.path)
+          rescue Errno::EPERM, Errno::EACCES
+            # Changing file ownership failed, moving on.
+          end
+        end
+
+        # Overwrite original file with temp file
+        File.rename(temp_file.path, file_name)
+        return_value
+      end
+    end
+
+    def self.probe_permissions_in(dir) # :nodoc:
+      basename = [
+        ".permissions_check",
+        Thread.current.object_id,
+        Process.pid,
+        rand(1_000_000),
+      ].join(".")
+
+      file_name = File.join(dir, basename)
+      File.open(file_name, "w") {}
+      File.stat(file_name)
+    rescue Errno::ENOENT
+      nil
+    ensure
+      begin
+        File.unlink(file_name) if File.exist?(file_name)
+      rescue SystemCallError
+      end
+    end
+  end
+end
diff --git a/test/rubygems/test_gem_installer.rb b/test/rubygems/test_gem_installer.rb
index 293fe1e823dd1a..0220a41f88a4f2 100644
--- a/test/rubygems/test_gem_installer.rb
+++ b/test/rubygems/test_gem_installer.rb
@@ -2385,25 +2385,31 @@ def test_leaves_no_empty_cached_spec_when_no_more_disk_space
     installer = Gem::Installer.for_spec @spec
     installer.gem_home = @gemhome
 
-    File.singleton_class.class_eval do
-      alias_method :original_binwrite, :binwrite
-
-      def binwrite(path, data)
+    assert_raise(Errno::ENOSPC) do
+      Gem::AtomicFileWriter.open(@spec.spec_file) do
         raise Errno::ENOSPC
       end
     end
 
-    assert_raise Errno::ENOSPC do
-      installer.write_spec
-    end
-
     assert_path_not_exist @spec.spec_file
-  ensure
-    File.singleton_class.class_eval do
-      remove_method :binwrite
-      alias_method :binwrite, :original_binwrite
-      remove_method :original_binwrite
-    end
+  end
+
+  def test_write_default_spec
+    @spec = setup_base_spec
+    @spec.files = %w[a.rb b.rb c.rb]
+
+    installer = Gem::Installer.for_spec @spec
+    installer.gem_home = @gemhome
+
+    installer.write_default_spec
+
+    assert_path_exist installer.default_spec_file
+
+    loaded = Gem::Specification.load installer.default_spec_file
+
+    assert_equal @spec.files, loaded.files
+    assert_equal @spec.name, loaded.name
+    assert_equal @spec.version, loaded.version
   end
 
   def test_dir
diff --git a/test/rubygems/test_gem_remote_fetcher.rb b/test/rubygems/test_gem_remote_fetcher.rb
index 5c1d89fad6934a..9badd75b427169 100644
--- a/test/rubygems/test_gem_remote_fetcher.rb
+++ b/test/rubygems/test_gem_remote_fetcher.rb
@@ -60,7 +60,7 @@ def test_cache_update_path
     uri = Gem::URI "http://example/file"
     path = File.join @tempdir, "file"
 
-    fetcher = util_fuck_with_fetcher "hello"
+    fetcher = fake_fetcher(uri.to_s, "hello")
 
     data = fetcher.cache_update_path uri, path
 
@@ -75,7 +75,7 @@ def test_cache_update_path_with_utf8_internal_encoding
       path = File.join @tempdir, "file"
       data = String.new("\xC8").force_encoding(Encoding::BINARY)
 
-      fetcher = util_fuck_with_fetcher data
+      fetcher = fake_fetcher(uri.to_s, data)
 
       written_data = fetcher.cache_update_path uri, path
 
@@ -88,7 +88,7 @@ def test_cache_update_path_no_update
     uri = Gem::URI "http://example/file"
     path = File.join @tempdir, "file"
 
-    fetcher = util_fuck_with_fetcher "hello"
+    fetcher = fake_fetcher(uri.to_s, "hello")
 
     data = fetcher.cache_update_path uri, path, false
 
@@ -97,103 +97,79 @@ def test_cache_update_path_no_update
     assert_path_not_exist path
   end
 
-  def util_fuck_with_fetcher(data, blow = false)
-    fetcher = Gem::RemoteFetcher.fetcher
-    fetcher.instance_variable_set :@test_data, data
-
-    if blow
-      def fetcher.fetch_path(arg, *rest)
-        # OMG I'm such an ass
-        class << self; remove_method :fetch_path; end
-        def self.fetch_path(arg, *rest)
-          @test_arg = arg
-          @test_data
-        end
+  def test_cache_update_path_overwrites_existing_file
+    uri = Gem::URI "http://example/file"
+    path = File.join @tempdir, "file"
 
-        raise Gem::RemoteFetcher::FetchError.new("haha!", "")
-      end
-    else
-      def fetcher.fetch_path(arg, *rest)
-        @test_arg = arg
-        @test_data
-      end
-    end
+    # Create existing file with old content
+    File.write(path, "old content")
+    assert_equal "old content", File.read(path)
+
+    fetcher = fake_fetcher(uri.to_s, "new content")
 
-    fetcher
+    data = fetcher.cache_update_path uri, path
+
+    assert_equal "new content", data
+    assert_equal "new content", File.read(path)
   end
 
   def test_download
-    a1_data = nil
-    File.open @a1_gem, "rb" do |fp|
-      a1_data = fp.read
-    end
+    a1_data = File.open @a1_gem, "rb", &:read
+    a1_url = "http://gems.example.com/gems/a-1.gem"
 
-    fetcher = util_fuck_with_fetcher a1_data
+    fetcher = fake_fetcher(a1_url, a1_data)
 
     a1_cache_gem = @a1.cache_file
     assert_equal a1_cache_gem, fetcher.download(@a1, "http://gems.example.com")
-    assert_equal("http://gems.example.com/gems/a-1.gem",
-                 fetcher.instance_variable_get(:@test_arg).to_s)
+    assert_equal a1_url, fetcher.paths.last
     assert File.exist?(a1_cache_gem)
   end
 
   def test_download_with_auth
-    a1_data = nil
-    File.open @a1_gem, "rb" do |fp|
-      a1_data = fp.read
-    end
+    a1_data = File.open @a1_gem, "rb", &:read
+    a1_url = "http://user:password@gems.example.com/gems/a-1.gem"
 
-    fetcher = util_fuck_with_fetcher a1_data
+    fetcher = fake_fetcher(a1_url, a1_data)
 
     a1_cache_gem = @a1.cache_file
     assert_equal a1_cache_gem, fetcher.download(@a1, "http://user:password@gems.example.com")
-    assert_equal("http://user:password@gems.example.com/gems/a-1.gem",
-                 fetcher.instance_variable_get(:@test_arg).to_s)
+    assert_equal a1_url, fetcher.paths.last
     assert File.exist?(a1_cache_gem)
   end
 
   def test_download_with_token
-    a1_data = nil
-    File.open @a1_gem, "rb" do |fp|
-      a1_data = fp.read
-    end
+    a1_data = File.open @a1_gem, "rb", &:read
+    a1_url = "http://token@gems.example.com/gems/a-1.gem"
 
-    fetcher = util_fuck_with_fetcher a1_data
+    fetcher = fake_fetcher(a1_url, a1_data)
 
     a1_cache_gem = @a1.cache_file
     assert_equal a1_cache_gem, fetcher.download(@a1, "http://token@gems.example.com")
-    assert_equal("http://token@gems.example.com/gems/a-1.gem",
-                 fetcher.instance_variable_get(:@test_arg).to_s)
+    assert_equal a1_url, fetcher.paths.last
     assert File.exist?(a1_cache_gem)
   end
 
   def test_download_with_x_oauth_basic
-    a1_data = nil
-    File.open @a1_gem, "rb" do |fp|
-      a1_data = fp.read
-    end
+    a1_data = File.open @a1_gem, "rb", &:read
+    a1_url = "http://token:x-oauth-basic@gems.example.com/gems/a-1.gem"
 
-    fetcher = util_fuck_with_fetcher a1_data
+    fetcher = fake_fetcher(a1_url, a1_data)
 
     a1_cache_gem = @a1.cache_file
     assert_equal a1_cache_gem, fetcher.download(@a1, "http://token:x-oauth-basic@gems.example.com")
-    assert_equal("http://token:x-oauth-basic@gems.example.com/gems/a-1.gem",
-                 fetcher.instance_variable_get(:@test_arg).to_s)
+    assert_equal a1_url, fetcher.paths.last
     assert File.exist?(a1_cache_gem)
   end
 
   def test_download_with_encoded_auth
-    a1_data = nil
-    File.open @a1_gem, "rb" do |fp|
-      a1_data = fp.read
-    end
+    a1_data = File.open @a1_gem, "rb", &:read
+    a1_url = "http://user:%25pas%25sword@gems.example.com/gems/a-1.gem"
 
-    fetcher = util_fuck_with_fetcher a1_data
+    fetcher = fake_fetcher(a1_url, a1_data)
 
     a1_cache_gem = @a1.cache_file
     assert_equal a1_cache_gem, fetcher.download(@a1, "http://user:%25pas%25sword@gems.example.com")
-    assert_equal("http://user:%25pas%25sword@gems.example.com/gems/a-1.gem",
-                 fetcher.instance_variable_get(:@test_arg).to_s)
+    assert_equal a1_url, fetcher.paths.last
     assert File.exist?(a1_cache_gem)
   end
 
@@ -235,8 +211,9 @@ def test_download_local_space
 
   def test_download_install_dir
     a1_data = File.open @a1_gem, "rb", &:read
+    a1_url = "http://gems.example.com/gems/a-1.gem"
 
-    fetcher = util_fuck_with_fetcher a1_data
+    fetcher = fake_fetcher(a1_url, a1_data)
 
     install_dir = File.join @tempdir, "more_gems"
 
@@ -245,8 +222,7 @@ def test_download_install_dir
     actual = fetcher.download(@a1, "http://gems.example.com", install_dir)
 
     assert_equal a1_cache_gem, actual
-    assert_equal("http://gems.example.com/gems/a-1.gem",
-                 fetcher.instance_variable_get(:@test_arg).to_s)
+    assert_equal a1_url, fetcher.paths.last
 
     assert File.exist?(a1_cache_gem)
   end
@@ -282,7 +258,12 @@ def test_download_read_only
       FileUtils.chmod 0o555, @a1.cache_dir
       FileUtils.chmod 0o555, @gemhome
 
-      fetcher = util_fuck_with_fetcher File.read(@a1_gem)
+      fetcher = Gem::RemoteFetcher.fetcher
+      def fetcher.fetch_path(uri, *rest)
+        File.read File.join(@test_gem_dir, "a-1.gem")
+      end
+      fetcher.instance_variable_set(:@test_gem_dir, File.dirname(@a1_gem))
+
       fetcher.download(@a1, "http://gems.example.com")
       a1_cache_gem = File.join Gem.user_dir, "cache", @a1.file_name
       assert File.exist? a1_cache_gem
@@ -301,19 +282,21 @@ def test_download_platform_legacy
     end
     e1.loaded_from = File.join(@gemhome, "specifications", e1.full_name)
 
-    e1_data = nil
-    File.open e1_gem, "rb" do |fp|
-      e1_data = fp.read
-    end
+    e1_data = File.open e1_gem, "rb", &:read
 
-    fetcher = util_fuck_with_fetcher e1_data, :blow_chunks
+    fetcher = Gem::RemoteFetcher.fetcher
+    def fetcher.fetch_path(uri, *rest)
+      @call_count ||= 0
+      @call_count += 1
+      raise Gem::RemoteFetcher::FetchError.new("error", uri) if @call_count == 1
+      @test_data
+    end
+    fetcher.instance_variable_set(:@test_data, e1_data)
 
     e1_cache_gem = e1.cache_file
 
     assert_equal e1_cache_gem, fetcher.download(e1, "http://gems.example.com")
 
-    assert_equal("http://gems.example.com/gems/#{e1.original_name}.gem",
-                 fetcher.instance_variable_get(:@test_arg).to_s)
     assert File.exist?(e1_cache_gem)
   end
 
@@ -592,6 +575,8 @@ def test_yaml_error_on_size
     end
   end
 
+  private
+
   def assert_error(exception_class = Exception)
     got_exception = false
 
@@ -603,4 +588,13 @@ def assert_error(exception_class = Exception)
 
     assert got_exception, "Expected exception conforming to #{exception_class}"
   end
+
+  def fake_fetcher(url, data)
+    original_fetcher = Gem::RemoteFetcher.fetcher
+    fetcher = Gem::FakeFetcher.new
+    fetcher.data[url] = data
+    Gem::RemoteFetcher.fetcher = fetcher
+  ensure
+    Gem::RemoteFetcher.fetcher = original_fetcher
+  end
 end

From 1e76b1f8b29e8824832170d0a7cedcac711f99c4 Mon Sep 17 00:00:00 2001
From: Peter Zhu <peter@peterzhu.ca>
Date: Sun, 14 Dec 2025 17:00:20 -0500
Subject: [PATCH 2/6] [DOC] Remove doc/reline

Reline has been moved to a bundled gem, so we don't need the docs anymore.
---
 doc/reline/face.md | 111 ---------------------------------------------
 1 file changed, 111 deletions(-)
 delete mode 100644 doc/reline/face.md

diff --git a/doc/reline/face.md b/doc/reline/face.md
deleted file mode 100644
index 1fa916123b5363..00000000000000
--- a/doc/reline/face.md
+++ /dev/null
@@ -1,111 +0,0 @@
-# Face
-
-With the `Reline::Face` class, you can modify the text color and text decorations in your terminal emulator.
-This is primarily used to customize the appearance of the method completion dialog in IRB.
-
-## Usage
-
-### ex: Change the background color of the completion dialog cyan to blue
-
-```ruby
-Reline::Face.config(:completion_dialog) do |conf|
-  conf.define :default, foreground: :white, background: :blue
-  #                                                     ^^^^^ `:cyan` by default
-  conf.define :enhanced, foreground: :white, background: :magenta
-  conf.define :scrollbar, foreground: :white, background: :blue
-end
-```
-
-If you provide the above code to an IRB session in some way, you can apply the configuration.
-It's generally done by writing it in `.irbrc`.
-
-Regarding `.irbrc`, please refer to the following link: [https://docs.ruby-lang.org/en/master/IRB.html](https://docs.ruby-lang.org/en/master/IRB.html)
-
-## Available parameters
-
-`Reline::Face` internally creates SGR (Select Graphic Rendition) code according to the block parameter of `Reline::Face.config` method.
-
-| Key         | Value             | SGR Code (numeric part following "\e[")|
-|:------------|:------------------|-----:|
-| :foreground | :black            | 30   |
-|             | :red              | 31   |
-|             | :green            | 32   |
-|             | :yellow           | 33   |
-|             | :blue             | 34   |
-|             | :magenta          | 35   |
-|             | :cyan             | 36   |
-|             | :white            | 37   |
-|             | :bright_black     | 90   |
-|             | :gray             | 90   |
-|             | :bright_red       | 91   |
-|             | :bright_green     | 92   |
-|             | :bright_yellow    | 93   |
-|             | :bright_blue      | 94   |
-|             | :bright_magenta   | 95   |
-|             | :bright_cyan      | 96   |
-|             | :bright_white     | 97   |
-| :background | :black            | 40   |
-|             | :red              | 41   |
-|             | :green            | 42   |
-|             | :yellow           | 43   |
-|             | :blue             | 44   |
-|             | :magenta          | 45   |
-|             | :cyan             | 46   |
-|             | :white            | 47   |
-|             | :bright_black     | 100  |
-|             | :gray             | 100  |
-|             | :bright_red       | 101  |
-|             | :bright_green     | 102  |
-|             | :bright_yellow    | 103  |
-|             | :bright_blue      | 104  |
-|             | :bright_magenta   | 105  |
-|             | :bright_cyan      | 106  |
-|             | :bright_white     | 107  |
-| :style      | :reset            | 0    |
-|             | :bold             | 1    |
-|             | :faint            | 2    |
-|             | :italicized       | 3    |
-|             | :underlined       | 4    |
-|             | :slowly_blinking  | 5    |
-|             | :blinking         | 5    |
-|             | :rapidly_blinking | 6    |
-|             | :negative         | 7    |
-|             | :concealed        | 8    |
-|             | :crossed_out      | 9    |
-
-- The value for `:style` can be both a Symbol and an Array
-    ```ruby
-      # Single symbol
-      conf.define :default, style: :bold
-      # Array
-      conf.define :default, style: [:bold, :negative]
-    ```
-- The availability of specific SGR codes depends on your terminal emulator
-- You can specify a hex color code to `:foreground` and `:background` color like `foreground: "#FF1020"`. Its availability also depends on your terminal emulator
-
-## Debugging
-
-You can see the current Face configuration by `Reline::Face.configs` method
-
-Example:
-
-```ruby
-irb(main):001:0> Reline::Face.configs
-=>
-{:default=>
-  {:default=>{:style=>:reset, :escape_sequence=>"\e[0m"},
-   :enhanced=>{:style=>:reset, :escape_sequence=>"\e[0m"},
-   :scrollbar=>{:style=>:reset, :escape_sequence=>"\e[0m"}},
- :completion_dialog=>
-  {:default=>{:foreground=>:white, :background=>:cyan, :escape_sequence=>"\e[0m\e[37;46m"},
-   :enhanced=>{:foreground=>:white, :background=>:magenta, :escape_sequence=>"\e[0m\e[37;45m"},
-   :scrollbar=>{:foreground=>:white, :background=>:cyan, :escape_sequence=>"\e[0m\e[37;46m"}}}
-```
-
-## 256-Color and TrueColor
-
-Reline will automatically detect if your terminal emulator supports truecolor with `ENV['COLORTERM] in 'truecolor' | '24bit'`. When this env is not set, Reline will fallback to 256-color.
-If your terminal emulator supports truecolor but does not set COLORTERM env, add this line to `.irbrc`.
-```ruby
-Reline::Face.force_truecolor
-```

From dd25fdcd4aa51d51615260662f75905d5f0896cf Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 15 Dec 2025 02:02:50 +0000
Subject: [PATCH 3/6] Bump actions/cache from 5.0.0 to 5.0.1

Bumps [actions/cache](https://github.com/actions/cache) from 5.0.0 to 5.0.1.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/a7833574556fa59680c1b7cb190c1735db73ebf0...9255dc7a253b0ccc959486e2bca901246202afeb)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/windows.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 1230af953e03c0..c19d9e4aa78577 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -88,7 +88,7 @@ jobs:
 
       - name: Restore vcpkg artifact
         id: restore-vcpkg
-        uses: actions/cache/restore@a7833574556fa59680c1b7cb190c1735db73ebf0 # v5.0.0
+        uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
         with:
           path: src\vcpkg_installed
           key: windows-${{ matrix.os }}-vcpkg-${{ hashFiles('src/vcpkg.json') }}
@@ -100,7 +100,7 @@ jobs:
         if: ${{ ! steps.restore-vcpkg.outputs.cache-hit }}
 
       - name: Save vcpkg artifact
-        uses: actions/cache/save@a7833574556fa59680c1b7cb190c1735db73ebf0 # v5.0.0
+        uses: actions/cache/save@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
         with:
           path: src\vcpkg_installed
           key: windows-${{ matrix.os }}-vcpkg-${{ hashFiles('src/vcpkg.json') }}

From 76f30030c922f420b1c10bc4138dc6ee67005fbc Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 15 Dec 2025 02:03:08 +0000
Subject: [PATCH 4/6] Bump msys2/setup-msys2 from 2.29.0 to 2.30.0

Bumps [msys2/setup-msys2](https://github.com/msys2/setup-msys2) from 2.29.0 to 2.30.0.
- [Release notes](https://github.com/msys2/setup-msys2/releases)
- [Changelog](https://github.com/msys2/setup-msys2/blob/main/CHANGELOG.md)
- [Commits](https://github.com/msys2/setup-msys2/compare/fb197b72ce45fb24f17bf3f807a388985654d1f2...4f806de0a5a7294ffabaff804b38a9b435a73bda)

---
updated-dependencies:
- dependency-name: msys2/setup-msys2
  dependency-version: 2.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/mingw.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/mingw.yml b/.github/workflows/mingw.yml
index 1a709d8344a290..8c3d16fbc9c120 100644
--- a/.github/workflows/mingw.yml
+++ b/.github/workflows/mingw.yml
@@ -81,7 +81,7 @@ jobs:
       )}}
 
     steps:
-      - uses: msys2/setup-msys2@fb197b72ce45fb24f17bf3f807a388985654d1f2 # v2.29.0
+      - uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2.30.0
         id: msys2
         with:
           msystem: ${{ matrix.msystem }}

From a2dc4d7faa61a80837f5ea80cfe02f82a489ca89 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 15 Dec 2025 02:03:01 +0000
Subject: [PATCH 5/6] Bump actions/upload-artifact from 5.0.0 to 6.0.0

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5.0.0 to 6.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/check_misc.yml | 2 +-
 .github/workflows/scorecards.yml | 2 +-
 .github/workflows/wasm.yml       | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/check_misc.yml b/.github/workflows/check_misc.yml
index d7b096a96d58ec..5cc891c477982c 100644
--- a/.github/workflows/check_misc.yml
+++ b/.github/workflows/check_misc.yml
@@ -103,7 +103,7 @@ jobs:
           }}
 
       - name: Upload docs
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6.0.0
         with:
           path: html
           name: ${{ steps.docs.outputs.htmlout }}
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index a321d14010cd69..c60709899729a9 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -64,7 +64,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: SARIF file
           path: results.sarif
diff --git a/.github/workflows/wasm.yml b/.github/workflows/wasm.yml
index b59e1d4c931ef7..9b9ea1841029d4 100644
--- a/.github/workflows/wasm.yml
+++ b/.github/workflows/wasm.yml
@@ -140,7 +140,7 @@ jobs:
       - run: tar cfz ../install.tar.gz -C ../install .
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: ruby-wasm-install
           path: ${{ github.workspace }}/install.tar.gz
@@ -168,7 +168,7 @@ jobs:
       - name: Save Pull Request number
         if: ${{ github.event_name == 'pull_request' }}
         run: echo "${{ github.event.pull_request.number }}" >> ${{ github.workspace }}/github-pr-info.txt
-      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         if: ${{ github.event_name == 'pull_request' }}
         with:
           name: github-pr-info

From 700487ce21f0991fb5d4042707d12b2966670f1e Mon Sep 17 00:00:00 2001
From: Kazuki Yamaguchi <k@rhe.jp>
Date: Sat, 13 Dec 2025 17:30:21 +0900
Subject: [PATCH 6/6] [ruby/net-http] Refactor HTTPS tests

This contains various improvements in tests for openssl integration:

  - Remove DHE parameters from test servers. OpenSSL is almost always
    compiled with ECC support nowadays and will prefer ECDHE over DHE.
  - Remove an outdated omission for a bug in OpenSSL 1.1.0h released in
    2018. None of our CI systems use this specific OpenSSL version.
  - Use top-level return to skip tests if openssl is unavailable.
  - Refactor tests for Net::HTTP#verify_callback.

https://github.com/ruby/net-http/commit/35c1745a26
---
 test/net/http/test_https.rb       | 66 +++++++++++--------------------
 test/net/http/test_https_proxy.rb | 16 ++------
 test/net/http/utils.rb            |  3 +-
 3 files changed, 26 insertions(+), 59 deletions(-)

diff --git a/test/net/http/test_https.rb b/test/net/http/test_https.rb
index e860c8745ed1f7..55b9eb317016aa 100644
--- a/test/net/http/test_https.rb
+++ b/test/net/http/test_https.rb
@@ -7,6 +7,8 @@
   # should skip this test
 end
 
+return unless defined?(OpenSSL::SSL)
+
 class TestNetHTTPS < Test::Unit::TestCase
   include TestNetHTTPUtils
 
@@ -19,7 +21,6 @@ def self.read_fixture(key)
   CA_CERT = OpenSSL::X509::Certificate.new(read_fixture("cacert.pem"))
   SERVER_KEY = OpenSSL::PKey.read(read_fixture("server.key"))
   SERVER_CERT = OpenSSL::X509::Certificate.new(read_fixture("server.crt"))
-  DHPARAMS = OpenSSL::PKey::DH.new(read_fixture("dhparams.pem"))
   TEST_STORE = OpenSSL::X509::Store.new.tap {|s| s.add_cert(CA_CERT) }
 
   CONFIG = {
@@ -29,25 +30,16 @@ def self.read_fixture(key)
     'ssl_enable' => true,
     'ssl_certificate' => SERVER_CERT,
     'ssl_private_key' => SERVER_KEY,
-    'ssl_tmp_dh_callback' => proc { DHPARAMS },
   }
 
   def test_get
     http = Net::HTTP.new(HOST, config("port"))
     http.use_ssl = true
     http.cert_store = TEST_STORE
-    certs = []
-    http.verify_callback = Proc.new do |preverify_ok, store_ctx|
-      certs << store_ctx.current_cert
-      preverify_ok
-    end
     http.request_get("/") {|res|
       assert_equal($test_net_http_data, res.body)
+      assert_equal(SERVER_CERT.to_der, http.peer_cert.to_der)
     }
-    # TODO: OpenSSL 1.1.1h seems to yield only SERVER_CERT; need to check the incompatibility
-    certs.zip([CA_CERT, SERVER_CERT][-certs.size..-1]) do |actual, expected|
-      assert_equal(expected.to_der, actual.to_der)
-    end
   end
 
   def test_get_SNI
@@ -55,18 +47,10 @@ def test_get_SNI
     http.ipaddr = config('host')
     http.use_ssl = true
     http.cert_store = TEST_STORE
-    certs = []
-    http.verify_callback = Proc.new do |preverify_ok, store_ctx|
-      certs << store_ctx.current_cert
-      preverify_ok
-    end
     http.request_get("/") {|res|
       assert_equal($test_net_http_data, res.body)
+      assert_equal(SERVER_CERT.to_der, http.peer_cert.to_der)
     }
-    # TODO: OpenSSL 1.1.1h seems to yield only SERVER_CERT; need to check the incompatibility
-    certs.zip([CA_CERT, SERVER_CERT][-certs.size..-1]) do |actual, expected|
-      assert_equal(expected.to_der, actual.to_der)
-    end
   end
 
   def test_get_SNI_proxy
@@ -78,11 +62,6 @@ def test_get_SNI_proxy
         http.ipaddr = "192.0.2.1"
         http.use_ssl = true
         http.cert_store = TEST_STORE
-        certs = []
-        http.verify_callback = Proc.new do |preverify_ok, store_ctx|
-          certs << store_ctx.current_cert
-          preverify_ok
-        end
         begin
           http.start
         rescue EOFError
@@ -114,11 +93,6 @@ def test_get_SNI_failure
       http.ipaddr = config('host')
       http.use_ssl = true
       http.cert_store = TEST_STORE
-      certs = []
-      http.verify_callback = Proc.new do |preverify_ok, store_ctx|
-        certs << store_ctx.current_cert
-        preverify_ok
-      end
       @log_tester = lambda {|_| }
       assert_raise(OpenSSL::SSL::SSLError){ http.start }
     end
@@ -135,10 +109,6 @@ def test_post
   end
 
   def test_session_reuse
-    # FIXME: The new_session_cb is known broken for clients in OpenSSL 1.1.0h.
-    # See https://github.com/openssl/openssl/pull/5967 for details.
-    omit if OpenSSL::OPENSSL_LIBRARY_VERSION.include?('OpenSSL 1.1.0h')
-
     http = Net::HTTP.new(HOST, config("port"))
     http.use_ssl = true
     http.cert_store = TEST_STORE
@@ -165,9 +135,6 @@ def test_session_reuse
   end
 
   def test_session_reuse_but_expire
-    # FIXME: The new_session_cb is known broken for clients in OpenSSL 1.1.0h.
-    omit if OpenSSL::OPENSSL_LIBRARY_VERSION.include?('OpenSSL 1.1.0h')
-
     http = Net::HTTP.new(HOST, config("port"))
     http.use_ssl = true
     http.cert_store = TEST_STORE
@@ -240,6 +207,21 @@ def test_certificate_verify_failure
     assert_match(/certificate verify failed/, ex.message)
   end
 
+  def test_verify_callback
+    http = Net::HTTP.new(HOST, config("port"))
+    http.use_ssl = true
+    http.cert_store = TEST_STORE
+    certs = []
+    http.verify_callback = Proc.new {|preverify_ok, store_ctx|
+      certs << store_ctx.current_cert
+      preverify_ok
+    }
+    http.request_get("/") {|res|
+      assert_equal($test_net_http_data, res.body)
+    }
+    assert_equal(SERVER_CERT.to_der, certs.last.to_der)
+  end
+
   def test_timeout_during_SSL_handshake
     bug4246 = "expected the SSL connection to have timed out but have not. [ruby-core:34203]"
 
@@ -275,9 +257,7 @@ def test_max_version
     http = Net::HTTP.new(HOST, config("port"))
     http.use_ssl = true
     http.max_version = :SSL2
-    http.verify_callback = Proc.new do |preverify_ok, store_ctx|
-      true
-    end
+    http.cert_store = TEST_STORE
     @log_tester = lambda {|_| }
     ex = assert_raise(OpenSSL::SSL::SSLError){
       http.request_get("/") {|res| }
@@ -286,7 +266,7 @@ def test_max_version
     assert_match(re_msg, ex.message)
   end
 
-end if defined?(OpenSSL::SSL)
+end
 
 class TestNetHTTPSIdentityVerifyFailure < Test::Unit::TestCase
   include TestNetHTTPUtils
@@ -300,7 +280,6 @@ def self.read_fixture(key)
   CA_CERT = OpenSSL::X509::Certificate.new(read_fixture("cacert.pem"))
   SERVER_KEY = OpenSSL::PKey.read(read_fixture("server.key"))
   SERVER_CERT = OpenSSL::X509::Certificate.new(read_fixture("server.crt"))
-  DHPARAMS = OpenSSL::PKey::DH.new(read_fixture("dhparams.pem"))
   TEST_STORE = OpenSSL::X509::Store.new.tap {|s| s.add_cert(CA_CERT) }
 
   CONFIG = {
@@ -310,7 +289,6 @@ def self.read_fixture(key)
     'ssl_enable' => true,
     'ssl_certificate' => SERVER_CERT,
     'ssl_private_key' => SERVER_KEY,
-    'ssl_tmp_dh_callback' => proc { DHPARAMS },
   }
 
   def test_identity_verify_failure
@@ -326,4 +304,4 @@ def test_identity_verify_failure
     re_msg = /certificate verify failed|hostname \"#{HOST_IP}\" does not match/
     assert_match(re_msg, ex.message)
   end
-end if defined?(OpenSSL::SSL)
+end
diff --git a/test/net/http/test_https_proxy.rb b/test/net/http/test_https_proxy.rb
index f4c6aa0b6a015d..237c16e64de295 100644
--- a/test/net/http/test_https_proxy.rb
+++ b/test/net/http/test_https_proxy.rb
@@ -5,14 +5,10 @@
 end
 require 'test/unit'
 
+return unless defined?(OpenSSL::SSL)
+
 class HTTPSProxyTest < Test::Unit::TestCase
   def test_https_proxy_authentication
-    begin
-      OpenSSL
-    rescue LoadError
-      omit 'autoload problem. see [ruby-dev:45021][Bug #5786]'
-    end
-
     TCPServer.open("127.0.0.1", 0) {|serv|
       _, port, _, _ = serv.addr
       client_thread = Thread.new {
@@ -50,12 +46,6 @@ def read_fixture(key)
   end
 
   def test_https_proxy_ssl_connection
-    begin
-      OpenSSL
-    rescue LoadError
-      omit 'autoload problem. see [ruby-dev:45021][Bug #5786]'
-    end
-
     TCPServer.open("127.0.0.1", 0) {|tcpserver|
       ctx = OpenSSL::SSL::SSLContext.new
       ctx.key = OpenSSL::PKey.read(read_fixture("server.key"))
@@ -91,4 +81,4 @@ def test_https_proxy_ssl_connection
       assert_join_threads([client_thread, server_thread])
     }
   end
-end if defined?(OpenSSL)
+end
diff --git a/test/net/http/utils.rb b/test/net/http/utils.rb
index 067cca02e31bff..0b9e440e7cbcbb 100644
--- a/test/net/http/utils.rb
+++ b/test/net/http/utils.rb
@@ -1,6 +1,5 @@
 # frozen_string_literal: false
 require 'socket'
-require 'openssl'
 
 module TestNetHTTPUtils
 
@@ -14,10 +13,10 @@ def initialize(config, &block)
       @procs = {}
 
       if @config['ssl_enable']
+        require 'openssl'
         context = OpenSSL::SSL::SSLContext.new
         context.cert = @config['ssl_certificate']
         context.key = @config['ssl_private_key']
-        context.tmp_dh_callback = @config['ssl_tmp_dh_callback']
         @ssl_server = OpenSSL::SSL::SSLServer.new(@server, context)
       end