<p>We are excited to announce that Ruby’s official website, ruby-lang.org, has adopted Datadog for monitoring by <a href="https://opensource.datadoghq.com/projects/oss-program/">Datadog OSS community support</a>.</p>

<p>This allows us to effectively monitor the performance and availability of the site in real time for Ruby users. This key benefits of using Datadog include the following.</p>

<h2>CDN Visibility</h2>

<p>cache.ruby-lang.org provided by Fastly is most important infrastructure of Ruby ecosystem. Datadog enables monitoring of Content Delivery Network (CDN) performance. It tracks cache coverage, error rate, enhancing user experiences.</p>

<h2>Unified Data Visualization</h2>

<p>We have various web services for ruby-lang.org. Datadog allows to visualize log analytics data alongside metrics and application performance monitoring (APM) data in the same dashboards.</p>

<h2>JIT Trace Visibility</h2>

<p>By utilizing Datadog’s tracing capabilities, we can capture traces as requests flow through web servers and databases. This helps identify bottlenecks and problematic requests.</p>

<p>We published the <a href="https://p.ap1.datadoghq.com/sb/1271b83e-af90-11ee-9072-da7ad0900009-01633a8fa8c0b0c0051f1889afdf55dc">public dashboard</a> of our key metrics. We will update the dashboard as we continue to improve our monitoring especially YJIT performance.</p>

<p>We hope that this adoption of Datadog will contribute to improved site performance for the Ruby community. Please continue to use ruby-lang.org and enjoy an enhanced user experience.</p>

<p>Posted by hsbt on 30 May 2024</p>

Datadog provides OSS community support for ruby-lang.org

<p>Ruby 3.3.5 has been released.</p>

<p>This is a routine update that includes minor bug fixes.
We recommend upgrading your Ruby version at your earliest convenience.
For more details, please refer to the <a href="https://github.com/ruby/ruby/releases/tag/v3_3_5">GitHub release notes</a>.</p>

<h2>Release Schedule</h2>

<p>As previously <a href="https://www.ruby-lang.org/en/news/2024/07/09/ruby-3-3-4-released/">announced</a>, we intend to release the latest stable Ruby version (currently Ruby 3.3) every 2 months following a <code class="language-plaintext highlighter-rouge">.1</code> release.</p>

<p>We expect to release Ruby 3.3.6 on November 5th and Ruby 3.3.7 on January 7th. If any significant changes arise that impact a large number of users, we may release a new version earlier than scheduled.</p>

<h2>Download</h2>

<ul>
  <li>
    <p><a href="https://cache.ruby-lang.org/pub/ruby/3.3/ruby-3.3.5.tar.gz">https://cache.ruby-lang.org/pub/ruby/3.3/ruby-3.3.5.tar.gz</a></p>

    <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>SIZE: 22129139
SHA1: 59444476bbe9e789fc777d8fb4dd456bc057604f
SHA256: 3781a3504222c2f26cb4b9eb9c1a12dbf4944d366ce24a9ff8cf99ecbce75196
SHA512: 5c482059628ef9de5d8a6ad4751f8043f2fc2b159b768265be7f3ee0574ad51d9500ee4fc9146c5978fbd51313039c3de39e7b7a4dedc9bcd5d09a41a713f1a7
</code></pre></div>    </div>
  </li>
  <li>
    <p><a href="https://cache.ruby-lang.org/pub/ruby/3.3/ruby-3.3.5.tar.xz">https://cache.ruby-lang.org/pub/ruby/3.3/ruby-3.3.5.tar.xz</a></p>

    <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>SIZE: 16403660
SHA1: 692bc3188bdb9ec30b8672543961b011d699590a
SHA256: 51aec7ea89b46125a2c9adc6f36766b65023d47952b916b1aed300ddcc042359
SHA512: dd5c6a7f74854e143e0ca46b9d7c0d1983fc4886f5f733cd108345dbf4b21f61ad978ad6806e05a57b7af28fd9216dd38d7145808188bbb3695a7f3a4eda3883
</code></pre></div>    </div>
  </li>
  <li>
    <p><a href="https://cache.ruby-lang.org/pub/ruby/3.3/ruby-3.3.5.zip">https://cache.ruby-lang.org/pub/ruby/3.3/ruby-3.3.5.zip</a></p>

    <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>SIZE: 27020194
SHA1: ccb32746aef491ce05be42218301e2c47185e5fc
SHA256: d3c13e124707494935d00ebc5c7983b0252bc13de49223fd31104ba5467a057a
SHA512: bf83af835a74283aff21042538ee1f1eb70ff12dac1edd4672d787547cd29cb7b69a9299682f89c8499eb610737b10a7fc03eca038574cb4ba565205d96b0016
</code></pre></div>    </div>
  </li>
</ul>

<h2>Release Comment</h2>

<p>Many committers, developers, and users who provided bug reports helped us make this release.
Thanks for their contributions.</p>

<p>Posted by k0kubun on 3 Sep 2024</p>

Ruby 3.3.5 Released

<p>There is a DoS vulnerability in REXML gem. This vulnerability has been assigned the CVE identifier <a href="https://www.cve.org/CVERecord?id=CVE-2024-43398">CVE-2024-43398</a>. We strongly recommend upgrading the REXML gem.</p>

<h2>Details</h2>

<p>When parsing an XML that has many deep elements that have same local name attributes, REXML gem may take long time.</p>

<p>It’s only affected with the tree parser API. If you’re using <code class="language-plaintext highlighter-rouge">REXML::Document.new</code> to parse an XML, you may be affected.</p>

<p>Please update REXML gem to version 3.3.6 or later.</p>

<h2>Affected versions</h2>

<ul>
  <li>REXML gem 3.3.5 or prior</li>
</ul>

<h2>Credits</h2>

<p>Thanks to <a href="https://hackerone.com/l33thaxor">l33thaxor</a> for discovering this issue.</p>

<h2>History</h2>

<ul>
  <li>Originally published at 2024-08-22 03:00:00 (UTC)</li>
</ul>

<p>Posted by kou on 22 Aug 2024</p>

CVE-2024-43398: DoS vulnerability in REXML

<p>There are some DoS vulnerabilities in REXML gem. These vulnerabilities have been assigned the CVE identifier <a href="https://www.cve.org/CVERecord?id=CVE-2024-41123">CVE-2024-41123</a>. We strongly recommend upgrading the REXML gem.</p>

<h2>Details</h2>

<p>When parsing an XML document that has many specific characters such as whitespace character, <code class="language-plaintext highlighter-rouge">&gt;]</code> and <code class="language-plaintext highlighter-rouge">]&gt;</code>, REXML gem may take long time.</p>

<p>Please update REXML gem to version 3.3.3 or later.</p>

<h2>Affected versions</h2>

<ul>
  <li>REXML gem 3.3.2 or prior</li>
</ul>

<h2>Credits</h2>

<p>Thanks to <a href="https://hackerone.com/mprogrammer">mprogrammer</a> and <a href="https://hackerone.com/scyoon">scyoon</a> for discovering these issues.</p>

<h2>History</h2>

<ul>
  <li>Originally published at 2024-08-01 03:00:00 (UTC)</li>
</ul>

<p>Posted by kou on 1 Aug 2024</p>