JRuby 9.3.2.0 Released

Thursday, December 02 2021

The JRuby community is pleased to announce the release of JRuby 9.3.2.0

JRuby 9.3.x is compatible with Ruby 2.6.x and stays in sync with C Ruby. As always there is a mix of miscellaneous fixes so be sure to read the issue list below.

Security

  • Date-parsing methods have been modified to accept an input-size limit option. This addresses CVE-2021-41817. It was originally reported against Ruby’s C-based date extension, which JRuby does not use, but JRuby’s own implementation of date is also affected by the same issue.

    The fix is detailed in #6952. A workaround is provided, via patching the pure-Ruby date code in your own JRuby install. Rebuilding JRuby is not necessary.

  • In order to match Ruby behavior and permit interrupting these date-parsing regular expression matches, this release also enables interruptible regular expressions globally. This feature can be disabled using the “regexp.interruptible” JRuby option as described in the above PR.

Performance

  • The performance of Time#strftime has been greatly improved (3.5x-5.8x faster). (#6942, #6956)

Native Integration

  • The jffi library on MacOS has been updated to sign the native library, allowing it to load properly on Apple Silicon. This improves compatibility on Apple’s AArch64 systems (M1 and friends). (jnr/jffi#116, jnr/jnr-ffi#257)

Github Issues resolved for 9.3.2.0