[pull] master from ruby:master

.github/actions/launchable/setup/action.yml

@@ -95,15 +95,15 @@ runs:
     # Launchable CLI requires Python and Java.
     # https://www.launchableinc.com/docs/resources/cli-reference/
     - name: Set up Python
-      uses: actions/setup-python@871daa956ca9ea99f3c3e30acb424b7960676734 # v5.0.0
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: "3.x"
       if: >-
         ${{ steps.enable-launchable.outputs.enable-launchable
         && !endsWith(inputs.os, 'ppc64le') && !endsWith(inputs.os, 's390x') }}
 
     - name: Set up Java
-      uses: actions/setup-java@7a445ee88d4e23b52c33fdc7601e40278616c7f8 # v4.0.0
+      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
       with:
         distribution: 'temurin'
         java-version: '17'
@@ -112,7 +112,7 @@ runs:
         && !endsWith(inputs.os, 'ppc64le') && !endsWith(inputs.os, 's390x') }}
 
     - name: Set up Java ppc64le
-      uses: actions/setup-java@7a445ee88d4e23b52c33fdc7601e40278616c7f8 # v4.0.0
+      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
       with:
         distribution: 'semeru'
         architecture: 'ppc64le'
@@ -122,7 +122,7 @@ runs:
         && endsWith(inputs.os, 'ppc64le') }}
 
     - name: Set up Java s390x
-      uses: actions/setup-java@7a445ee88d4e23b52c33fdc7601e40278616c7f8 # v4.0.0
+      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
       with:
         distribution: 'semeru'
         architecture: 's390x'
@@ -270,7 +270,7 @@ runs:
         test_spec_report_dir: ${{ steps.global.outputs.test_spec_report_dir }}
 
     - name: Clean up test results in Launchable
-      uses: gacts/run-and-post-run@674528335da98a7afc80915ff2b4b860a0b3553a # v1.4.0
+      uses: gacts/run-and-post-run@81b6ce503cde93862cec047c54652e45c5dca991 # v1.4.3
       with:
         shell: bash
         working-directory: ${{ inputs.builddir }}
@@ -287,7 +287,7 @@ runs:
         test_spec_report_dir: ${{ steps.global.outputs.test_spec_report_dir }}
 
     - name: Record test results in Launchable
-      uses: gacts/run-and-post-run@674528335da98a7afc80915ff2b4b860a0b3553a # v1.4.0
+      uses: gacts/run-and-post-run@81b6ce503cde93862cec047c54652e45c5dca991 # v1.4.3
       with:
         shell: bash
         working-directory: ${{ inputs.builddir }}

.github/codeql/codeql-config.yml

@@ -0,0 +1,22 @@
+paths-ignore:
+  - benchmark
+  - sample
+  - spec/ruby/command_line/fixtures
+  - spec/ruby/core/enumerable/shared/inject.rb
+  - spec/ruby/core/exception/fixtures
+  - spec/ruby/core/proc/parameters_spec.rb
+  - spec/ruby/core/proc/ruby2_keywords_spec.rb
+  - spec/ruby/core/range/reverse_each_spec.rb
+  - spec/ruby/language/fixtures
+  - spec/ruby/language/lambda_spec.rb
+  - spec/ruby/language/method_spec.rb
+  - spec/ruby/language/string_spec.rb
+  - test/error_highlight/test_error_highlight.rb
+  - test/prism/result/named_capture_test.rb
+  - test/ruby/test_call.rb
+  - test/ruby/test_signal.rb
+  - test/ruby/test_super.rb
+  - test/ruby/test_syntax.rb
+  - test/ruby/test_unicode_escape.rb
+  - test/rubygems/specifications/foo-0.0.1-x86-mswin32.gemspec
+  - trace_point.rb

.github/workflows/check_sast.yml

@@ -82,6 +82,7 @@ jobs:
         with:
           languages: ${{ matrix.language }}
           build-mode: none
+          config-file: .github/codeql/codeql-config.yml
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1

.github/workflows/cygwin.yml

@@ -45,7 +45,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Cygwin
-        uses: cygwin/cygwin-install-action@master
+        uses: cygwin/cygwin-install-action@711d29f3da23c9f4a1798e369a6f01198c13b11a # v6.1
         with:
           packages: ruby gcc-core make autoconf libtool libssl-devel libyaml-devel libffi-devel zlib-devel rubygems
           site: |

.github/workflows/labeler.yml

@@ -2,6 +2,9 @@ name: "Pull Request Labeler"
 on:
 - pull_request_target
 
+permissions:
+  contents: read
+
 jobs:
   labeler:
     permissions:

.github/workflows/post_push.yml

@@ -4,6 +4,10 @@ on:
     branches:
       - master
       - 'ruby_*_*'
+
+permissions:
+  contents: read
+
 jobs:
   hooks:
     name: Post-push hooks

.github/workflows/pr-playground.yml

@@ -6,6 +6,10 @@ on:
     workflows: ["WebAssembly"]
     types: [completed]
 
+permissions:
+  contents: read
+  actions: read
+
 jobs:
   post-summary:
     name: Post Playground link

.github/workflows/publish.yml

@@ -11,6 +11,9 @@ on:
         required: true
         default: '3.3.4'
 
+permissions:
+  contents: read
+
 jobs:
   release:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -4,6 +4,9 @@ on:
     tags:
       - '*'
 
+permissions:
+  contents: read
+
 jobs:
   notify:
     runs-on: ubuntu-latest

.github/workflows/sync_default_gems.yml

@@ -19,6 +19,9 @@ on:
         description: 'Gem commit SHA after sync'
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   sync_default_gems:
     name: Sync default gem ${{ github.event.inputs.gem }}

.github/workflows/wsl.yml

@@ -14,6 +14,9 @@ on:
     # https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/troubleshooting-required-status-checks#handling-skipped-but-required-checks
   merge_group:
 
+permissions:
+  contents: read
+
 jobs:
   wsl:
     runs-on: windows-2025

.github/workflows/zjit-macos.yml

@@ -93,7 +93,7 @@ jobs:
           rustup install ${{ matrix.rust_version }} --profile minimal
           rustup default ${{ matrix.rust_version }}
 
-      - uses: taiki-e/install-action@e9e8e031bcd90cdbe8ac6bb1d376f8596e587fbf # v2.70.2
+      - uses: taiki-e/install-action@6ef672efc2b5aabc787a9e94baf4989aa02a97df # v2.70.3
         with:
           tool: nextest@0.9
         if: ${{ matrix.test_task == 'zjit-check' }}

.github/workflows/zjit-ubuntu.yml

@@ -119,7 +119,7 @@ jobs:
           ruby-version: '3.1'
           bundler: none
 
-      - uses: taiki-e/install-action@e9e8e031bcd90cdbe8ac6bb1d376f8596e587fbf # v2.70.2
+      - uses: taiki-e/install-action@6ef672efc2b5aabc787a9e94baf4989aa02a97df # v2.70.3
         with:
           tool: nextest@0.9
         if: ${{ matrix.test_task == 'zjit-check' }}

.github/zizmor.yml

@@ -10,20 +10,16 @@ rules:
   dependabot-cooldown:
     ignore:
       - dependabot.yml
-  excessive-permissions:
-    ignore:
-      - post_push.yml
-      - publish.yml
-      - release.yml
-      - wsl.yml
   misfeature:
     ignore:
       - mingw.yml
       - windows.yml
   unpinned-images:
     ignore:
       - compilers.yml
+  secrets-outside-env:
+    # All committers with write access are trusted; no need for environment-scoped secrets.
+    disable: true
   unpinned-uses:
     ignore:
-      - cygwin.yml
       - wsl.yml

class.c

@@ -743,7 +743,15 @@ class_associate_super(VALUE klass, VALUE super, bool init)
         // Include/prepend inserts ICLASSes into the super chain, but T_CLASS
         // subclass lists should track only the immutable T_CLASS→T_CLASS link.
         if (RB_TYPE_P(klass, T_CLASS) && RB_TYPE_P(super, T_CLASS)) {
-            class_switch_superclass(super, klass);
+            if (RCLASS_SINGLETON_P(klass)) {
+                // Instead of adding singleton classes to the subclass list,
+                // just set a flag so that method cache invalidation takes the
+                // tree path.
+                FL_SET_RAW(super, RCLASS_HAS_SUBCLASSES);
+            }
+            else {
+                class_switch_superclass(super, klass);
+            }
         }
     }
     if (init) {
@@ -1328,9 +1336,14 @@ static inline VALUE
 make_singleton_class(VALUE obj)
 {
     VALUE orig_class = METACLASS_OF(obj);
-    VALUE klass = class_boot_boxable(orig_class, FL_TEST_RAW(orig_class, RCLASS_BOXABLE));
-
+    VALUE klass = class_alloc0(T_CLASS, rb_cClass, FL_TEST_RAW(orig_class, RCLASS_BOXABLE));
     FL_SET(klass, FL_SINGLETON);
+    class_initialize_method_table(klass);
+    class_associate_super(klass, orig_class, true);
+    if (orig_class && !UNDEF_P(orig_class)) {
+        rb_class_set_initialized(klass);
+    }
+
     RBASIC_SET_CLASS(obj, klass);
     rb_singleton_class_attached(klass, obj);
     rb_yjit_invalidate_no_singleton_class(orig_class);

ext/pty/extconf.rb

@@ -21,6 +21,8 @@
       (util or have_func("openpty")) or
       have_func("_getpty") or
       have_func("ioctl")
+    have_macro("HAVE_FCHMOD") or have_func("fchmod")
+    have_macro("HAVE_FCHOWN") or have_func("fchown")
     create_makefile('pty')
   end
 end

ext/pty/pty.c

@@ -274,12 +274,23 @@ ptsname_r(int fd, char *buf, size_t buflen)
 # define HAVE_PTSNAME_R 1
 #endif
 
+#ifdef HAVE_FCHMOD
+# define change_mode(name, fd, mode) fchmod(fd, mode)
+#else
+# define change_mode(name, fd, mode) chmod(name, mode)
+#endif
+#ifdef HAVE_FCHOWN
+# define change_owner(name, fd, uid, gid) fchown(fd, uid, gid)
+#else
+# define change_owner(name, fd, uid, gid) chown(name, uid, gid)
+#endif
+
 #if defined(HAVE_POSIX_OPENPT) || defined(HAVE_OPENPTY) || defined(HAVE_PTSNAME_R)
 static int
-no_mesg(char *slavedevice, int nomesg)
+set_device_mode(const char *slavedevice, int fd, int nomesg)
 {
     if (nomesg)
-        return chmod(slavedevice, 0600);
+        return change_mode(slavedevice, fd, 0600);
     else
         return 0;
 }
@@ -340,8 +351,8 @@ get_device_once(int *master, int *slave, char SlaveName[DEVICELEN], int nomesg,
     if (unlockpt(masterfd) == -1) goto error;
     if (ptsname_r(masterfd, SlaveName, DEVICELEN) != 0) goto error;
     slavedevice = SlaveName;
-    if (no_mesg(slavedevice, nomesg) == -1) goto error;
     if ((slavefd = rb_cloexec_open(slavedevice, O_RDWR|O_NOCTTY, 0)) == -1) goto error;
+    if (set_device_mode(slavedevice, slavefd, nomesg) == -1) goto error;
     rb_update_max_fd(slavefd);
 
 #if defined(I_PUSH) && !defined(__linux__) && !defined(_AIX)
@@ -375,7 +386,9 @@ get_device_once(int *master, int *slave, char SlaveName[DEVICELEN], int nomesg,
     }
     rb_fd_fix_cloexec(*master);
     rb_fd_fix_cloexec(*slave);
-    if (no_mesg(SlaveName, nomesg) == -1) {
+    if (set_device_mode(SlaveName, *slave, nomesg) == -1) {
+        close(*master);
+        close(*slave);
         if (!fail) return -1;
         rb_raise(rb_eRuntimeError, "can't chmod slave pty");
     }
@@ -424,8 +437,8 @@ get_device_once(int *master, int *slave, char SlaveName[DEVICELEN], int nomesg,
     if(unlockpt(masterfd) == -1) goto error;
     if (ptsname_r(masterfd, SlaveName, DEVICELEN) != 0) goto error;
     slavedevice = SlaveName;
-    if (no_mesg(slavedevice, nomesg) == -1) goto error;
     if((slavefd = rb_cloexec_open(slavedevice, O_RDWR, 0)) == -1) goto error;
+    if (set_device_mode(slavedevice, slavefd, nomesg) == -1) goto error;
     rb_update_max_fd(slavefd);
 #if defined(I_PUSH) && !defined(__linux__) && !defined(_AIX)
     if(ioctl_I_PUSH(slavefd, "ptem") == -1) goto error;
@@ -478,8 +491,8 @@ get_device_once(int *master, int *slave, char SlaveName[DEVICELEN], int nomesg,
             if ((slavefd = rb_cloexec_open(SlaveName,O_RDWR,0)) >= 0) {
                 rb_update_max_fd(slavefd);
                 *slave = slavefd;
-                if (chown(SlaveName, getuid(), getgid()) != 0) goto error;
-                if (chmod(SlaveName, nomesg ? 0600 : 0622) != 0) goto error;
+                if (change_owner(slavefd, getuid(), getgid()) != 0) goto error;
+                if (change_mode(slavefd, nomesg ? 0600 : 0622) != 0) goto error;
                 return 0;
             }
             close(masterfd);

ext/strscan/extconf.rb

@@ -5,6 +5,8 @@
   have_func("onig_region_memsize(NULL)")
   have_func("rb_reg_onig_match", "ruby/re.h")
   have_func("rb_deprecate_constant")
+  have_func("rb_gc_location", "ruby.h") # RUBY_VERSION >= 2.7
+  have_const("RUBY_TYPED_EMBEDDABLE", "ruby.h") # RUBY_VERSION >= 3.3
   create_makefile 'strscan'
 else
   File.write('Makefile', dummy_makefile("").join)