fix(deps): update dependency ruby to v3.4.10

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
ruby (source)		patch	3.4.9 → 3.4.10
ruby (source)	tools	patch	3.4.9 → 3.4.10

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

Ruby 3.4.10 Release (June 30, 2026)

This is a regular stable package release that primarily addresses bug fixes and security updates in bundled gems.

Major Changes:

• 26 Bug Fixes across various components including:
  • Critical stability issues (BasicObject#initialize segmentation fault fix)
  • YJIT improvements (local variable alignment with >256 variables)
  • Parser improvements (Prism parser fixes for pattern matching, lambda forwarding)
  • Memory management (Fiber machine stack release, TypedData heap-use-after-free fix)
  • Float precision corrections (Float#ceil, Array#sum optimization)
  • Thread safety enhancements (Thread.each_caller_location segfault fix, event hooks deadlock after fork)
  • Marshal serialization improvements

Security Fixes (via bundled net-imap v0.5.15):

• CVE-2026-47240 (Moderate): Command injection via non-synchronizing literal in 'raw' argument
• CVE-2026-47242 (Moderate): Command injection via unvalidated ID and ENABLE arguments
• CVE-2026-47241 (Low): Denial of service via incomplete 'raw' argument validation

Breaking Changes:

• None identified for the 3.4.9 → 3.4.10 patch update
• All changes are backward compatible bug fixes and security patches
• No API changes or deprecations in this patch release

🎯 Impact Scope Investigation

Ruby Usage in Codebase:

• Ruby runtime is one of 7 supported execution environments (internal/sandbox/runtime.go:21-27)
• Used exclusively for sandboxed code execution via nsjail
• Pre-installed gems are limited to: base64 (0.3.0), csv (3.3.5), fiddle (1.1.8)
• net-imap is NOT used in this codebase - it's a bundled standard library gem that doesn't affect the sandbox's functionality

Configuration Files:

• Dockerfile: Ruby version ARG updated from 3.4.9 → 3.4.10 (line 45)
• mise.toml: Ruby version updated from 3.4.9 → 3.4.10 (line 8)

Impact on Other Dependencies:

• No impact on other language runtimes (Node.js, Python, Go, Rust, Bash)
• No impact on Go module dependencies
• No impact on bundled Ruby gems (base64, csv, fiddle remain unchanged)
• No changes to nsjail configuration or resource limits

Testing Coverage:

• Comprehensive E2E test suite exists for Ruby runtime (e2e/tests/runtime/ruby.yml, ruby_stdin.yml)
• Security test coverage includes filesystem isolation, seccomp filtering, network restrictions
• All existing tests should pass without modification

Docker Build Impact:

• Single-layer change in Docker image (mise Ruby installation)
• No changes to base image, nsjail, or other runtime installations
• Build time impact: minimal (Ruby binary download only)

💡 Recommended Actions

Immediate Actions:

1. ✅ Safe to merge - This is a standard patch-level security update with no breaking changes
2. Run existing E2E test suite to validate: docker compose down && docker compose up --build -d && go test -tags e2e ./e2e/...
3. Verify Docker build completes successfully with new Ruby version

No Code Changes Required:

• Zero application code modifications needed
• No configuration adjustments necessary
• All existing runtime limits, bind mounts, and environment variables remain valid
• Gemfile/Gemfile.lock for bundled gems unchanged

Post-Merge Verification:

• Confirm all Ruby E2E tests pass (basic execution, stdin handling, bundler integration)
• Validate security tests continue to block malicious operations
• Monitor for any runtime behavior changes (unlikely for patch release)

Security Benefits:

• Addresses 3 CVEs in bundled net-imap gem (though not directly used by sandbox)
• Fixes critical segmentation faults and memory safety issues
• Improves overall runtime stability and correctness

🔗 Reference Links

• Ruby 3.4.10 Official Release
• Ruby 3.4.10 GitHub Release
• Net-IMAP v0.5.15 Security Fixes
• Ruby 3.4.10 Full Changelog
• CVE-2026-47240 Details
• Ruby 3.4 Changes Documentation

Generated by koki-develop/claude-renovate-review