Hi all,

JFYI, latest Fedora 37 Ruby rebase broke a few Ruby package builds due to change in the URI gem.

recently I did a rebase for Ruby 3.1.4 to address 2 CVEs among other things.
For one of those CVEs (ReDoS vulnerability in URI [0]), upstream merged URI gem v0.12.0[1] and later to v0.12.1 [2] (full 3.1.3 -> 3.1.4 diff: [3]).

The 0.12.0 brought a change, where URI.parse now returns empty string instead of `nil` for empty host, this resulted in a few newly FTBFS packages.
I have hit this recently with vagrant-libvirt and found out it is more than that package, though not by much.

Looking at koschei [4] FTBFS for rubygems on Fedora 37, there aren't that many and some have been failing on F37 for longer time than Ruby 3.1.4 is in Fedora 37.
The current package set that is FTBFS in koschei on Fedora 37 for one reason or another:
rubygem-clockwork  rubygem-eventmachine         rubygem-excon
rubygem-hiredis    rubygem-loofah               rubygem-memfs
rubygem-multi_json rubygem-mysql2               rubygem-net-ssh
rubygem-nifti      rubygem-rails-html-sanitizer rubygem-rake-contrib
rubygem-rdoc       rubygem-redis                rubygem-rest-client
rubygem-ronn-ng    rubygem-rubyzip              rubygem-selenium-webdriver
rubygem-slim       rubygem-sprockets            rubygem-websocket-extensions

Regards,
Jarek


[0] https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/
[1] https://github.com/ruby/ruby/commit/da27583cf364c0d69c085db4abf358c334a8eca1
[2] https://github.com/ruby/ruby/commit/8ce4ab146498879b65e22f1be951b25eebb79300
[3] https://github.com/ruby/ruby/compare/v3_1_3...v3_1_4
[4] https://koschei.fedoraproject.org/search?q=rubygem-%2A&order_by=state-f37%2Crunning%2Cfailing%2Cname