From 83212d548610cf90265e4ae3ebfea1baabfc7daa Mon Sep 17 00:00:00 2001
From: Daniel Martin <53006+etdsoft@users.noreply.github.com>
Date: Wed, 17 Jun 2026 17:33:08 +0800
Subject: [PATCH] Upgrade Ruby to 3.4.9 and drop resolved CVE ignores

3.4.9 ships the fixes for CVE-2025-61594 and CVE-2025-58767, so the
ruby-audit ignores for those are no longer needed.
---
 .github/workflows/ci.yml | 6 +++---
 .ruby-version            | 2 +-
 CHANGELOG                | 3 ++-
 Gemfile                  | 2 +-
 Gemfile.lock             | 2 +-
 5 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0473d45eb4..cf9432aef6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,9 +34,9 @@ jobs:
       - name: Security audit dependencies
         run: bundle exec bundler-audit --update --ignore CVE-2024-21510 CVE-2025-61921
       - name: Security audit ruby
-        # These ignores can be removed once the Ruby version is upgraded (>= 3.4.8 for the
-        # 2025 CVEs; >= 4.0.3 for CVE-2026-41316, whose bundled erb we already override).
-        run: bundle exec ruby-audit update && bundle exec ruby-audit check --ignore CVE-2025-61594 CVE-2025-58767 CVE-2026-41316
+        # This ignore can be removed once the Ruby version is upgraded to >= 4.0.3 for
+        # CVE-2026-41316, whose bundled erb we already override.
+        run: bundle exec ruby-audit update && bundle exec ruby-audit check --ignore CVE-2026-41316
       - name: Security audit application code
         run: bundle exec brakeman -q -w2
       - name: Lint changed files
diff --git a/.ruby-version b/.ruby-version
index 1cf8253024..7bcbb3808b 100644
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-3.4.6
+3.4.9
diff --git a/CHANGELOG b/CHANGELOG
index 7c79778d5f..1705c97331 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -32,7 +32,8 @@
 v5.1.0 (May 2026)
   - DataTables: add sticky table toolbar that tracks below the navigation bar when scrolling
   - Mail: add support for SMTP configuration via environment variables for Docker deployments; smtp.yml remains supported for VM deployments during the deprecation transition
-  - Show don't gate: 
+  - Ruby: Upgrade Ruby version to 3.4.9
+  - Show don't gate:
     - Node-level Methodologies
     - Projects
   - Upgraded gems:
diff --git a/Gemfile b/Gemfile
index d2511ec389..f6b074099a 100644
--- a/Gemfile
+++ b/Gemfile
@@ -2,7 +2,7 @@ source 'https://rubygems.org'
 
 git_source(:github) { |repo| "https://github.com/#{repo}.git" }
 
-ruby '3.4.6'
+ruby '3.4.9'
 
 # Bundle edge Rails instead: gem 'rails', github: 'rails/rails'
 gem 'rails', '~> 8.0.5'
diff --git a/Gemfile.lock b/Gemfile.lock
index d310930057..c36e16a768 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -708,7 +708,7 @@ DEPENDENCIES
   whenever
 
 RUBY VERSION
-   ruby 3.4.6p54
+   ruby 3.4.9p82
 
 BUNDLED WITH
    2.3.16