From 61e25faabee6f88f271a3738ee7c764a6bc4896d Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Fri, 23 Oct 2026 17:42:04 -0400
Subject: [PATCH] Ruby 3.4.12

Writebook ran Ruby 3.4.7, which lacks the Onigmo regexp fixes that
Ruby 3.4.12 carries. Move `.ruby-version`, both Dockerfiles and the
lockfile to 3.4.12 on the stock `ruby:3.4.12-slim` image, and bump
`ruby/setup-ruby` to v1.334.0, the first release that installs 3.4.12.

ref: https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/
---
 .github/workflows/ci.yml | 8 ++++----
 .ruby-version            | 2 +-
 Dockerfile               | 2 +-
 Dockerfile-export        | 2 +-
 Gemfile.lock             | 2 +-
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index eb3deb36..4f2785ff 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+        uses: ruby/setup-ruby@26e5b7d197ebf60545ee9667bcbace0be11ccaec # v1.334.0
         with:
           ruby-version: .ruby-version
           bundler-cache: true
@@ -40,7 +40,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+        uses: ruby/setup-ruby@26e5b7d197ebf60545ee9667bcbace0be11ccaec # v1.334.0
         with:
           ruby-version: .ruby-version
           bundler-cache: true
@@ -59,7 +59,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+        uses: ruby/setup-ruby@26e5b7d197ebf60545ee9667bcbace0be11ccaec # v1.334.0
         with:
           ruby-version: .ruby-version
           bundler-cache: true
@@ -107,7 +107,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+        uses: ruby/setup-ruby@26e5b7d197ebf60545ee9667bcbace0be11ccaec # v1.334.0
         with:
           ruby-version: .ruby-version
           bundler-cache: true
diff --git a/.ruby-version b/.ruby-version
index 2aa51319..25e86328 100644
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-3.4.7
+3.4.12
diff --git a/Dockerfile b/Dockerfile
index 02a9d584..6c257aab 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 # syntax = docker/dockerfile:1
 
 # Make sure RUBY_VERSION matches the Ruby version in .ruby-version and Gemfile
-ARG RUBY_VERSION=3.4.7
+ARG RUBY_VERSION=3.4.12
 FROM registry.docker.com/library/ruby:$RUBY_VERSION-slim as base
 
 # Rails app lives here
diff --git a/Dockerfile-export b/Dockerfile-export
index 05d892ff..5186306a 100644
--- a/Dockerfile-export
+++ b/Dockerfile-export
@@ -1,7 +1,7 @@
 # syntax = docker/dockerfile:1
 
 # Make sure it matches the Ruby version in .ruby-version and Gemfile
-ARG RUBY_VERSION=3.4.7
+ARG RUBY_VERSION=3.4.12
 FROM ruby:$RUBY_VERSION-slim as base
 
 # Install the tools we need
diff --git a/Gemfile.lock b/Gemfile.lock
index dbf29721..2846729b 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -411,7 +411,7 @@ DEPENDENCIES
   web-console
 
 RUBY VERSION
-   ruby 3.4.7p58
+   ruby 3.4.12p148
 
 BUNDLED WITH
    2.5.18