From 01cc68835f0bcdd7ef16de477471c112adb417da Mon Sep 17 00:00:00 2001 From: Aaron Patterson Date: Wed, 31 Dec 2025 12:02:49 -0800 Subject: [PATCH 1/5] Move compilation after bundle install The Rakefile depends on gems being installed. Hopefully this will fix JRuby releases on trusted publishing --- .github/workflows/release.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1325988..10d91ed 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -44,12 +44,16 @@ jobs: sudo apt install default-jdk maven gem update --system gem install ruby-maven rake-compiler --no-document - rake compile if: matrix.ruby == 'jruby' - name: Install dependencies run: bundle install --jobs 4 --retry 3 + - name: Compile on JRuby + run: | + rake compile + if: matrix.ruby == 'jruby' + - name: Publish to RubyGems uses: rubygems/release-gem@v1 From 4d1d95b8ec624d0cf8ed1099402a7edd2f308da2 Mon Sep 17 00:00:00 2001 From: "T.J. Schuck" Date: Thu, 29 Jan 2026 10:12:24 -0500 Subject: [PATCH 2/5] Add TruffleRuby in CI Co-authored-by: Benoit Daloze --- .github/workflows/ruby.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ruby.yml b/.github/workflows/ruby.yml index c5fb94b..176faa0 100644 --- a/.github/workflows/ruby.yml +++ b/.github/workflows/ruby.yml @@ -27,6 +27,10 @@ jobs: - { os: ubuntu-latest, ruby: jruby-head } - { os: windows-latest, ruby: ucrt } - { os: windows-latest, ruby: mingw } + - { os: macos-latest, ruby: truffleruby } + - { os: ubuntu-latest, ruby: truffleruby } + - { os: macos-latest, ruby: truffleruby-head } + - { os: ubuntu-latest, ruby: truffleruby-head } steps: - uses: actions/checkout@v4 From 01f947a66ad8c5e20d8c89d9adbc7e3bd49afb70 Mon Sep 17 00:00:00 2001 From: Aaron Patterson Date: Wed, 18 Mar 2026 13:07:19 -0700 Subject: [PATCH 3/5] fix env url --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 10d91ed..3389e52 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,7 +15,7 @@ jobs: environment: name: rubygems.org - url: https://rubygems.org/gems/bcrypt-ruby + url: https://rubygems.org/gems/bcrypt permissions: contents: write From 5faa2748331d3edc661c127ef2fbb3afcb6b02a4 Mon Sep 17 00:00:00 2001 From: Kevin Farrell Date: Wed, 18 Mar 2026 16:43:13 +0000 Subject: [PATCH 4/5] Fix integer overflow in JRuby BCrypt rounds calculation [CVE-2026-33306] --- ext/jruby/bcrypt_jruby/BCrypt.java | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/ext/jruby/bcrypt_jruby/BCrypt.java b/ext/jruby/bcrypt_jruby/BCrypt.java index 86db91b..bf987d9 100644 --- a/ext/jruby/bcrypt_jruby/BCrypt.java +++ b/ext/jruby/bcrypt_jruby/BCrypt.java @@ -688,20 +688,21 @@ static long roundsForLogRounds(int log_rounds) { */ private byte[] crypt_raw(byte password[], byte salt[], int log_rounds, boolean sign_ext_bug, int safety) { - int rounds, i, j; + long rounds; + int i, j; int cdata[] = bf_crypt_ciphertext.clone(); int clen = cdata.length; byte ret[]; if (log_rounds < 4 || log_rounds > 31) throw new IllegalArgumentException ("Bad number of rounds"); - rounds = 1 << log_rounds; + rounds = roundsForLogRounds(log_rounds); if (salt.length != BCRYPT_SALT_LEN) throw new IllegalArgumentException ("Bad salt length"); init_key(); ekskey(salt, password, sign_ext_bug, safety); - for (i = 0; i < rounds; i++) { + for (long r = 0; r < rounds; r++) { key(password, sign_ext_bug, safety); key(salt, false, safety); } From 32e687ec5f62baad01a62e4634e41d97f8432a61 Mon Sep 17 00:00:00 2001 From: Aaron Patterson Date: Wed, 18 Mar 2026 15:42:34 -0700 Subject: [PATCH 5/5] bump version update changelog --- CHANGELOG | 3 +++ bcrypt.gemspec | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/CHANGELOG b/CHANGELOG index 1682923..a2c9982 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,3 +1,6 @@ +3.1.22 Mar 18 2026 + - [CVE-2026-33306] Fix integer overflow in Java extension + 3.1.21 Dec 31 2025 - Use constant time comparisons - Mark as Ractor safe diff --git a/bcrypt.gemspec b/bcrypt.gemspec index e35a402..b848c01 100644 --- a/bcrypt.gemspec +++ b/bcrypt.gemspec @@ -1,6 +1,6 @@ Gem::Specification.new do |s| s.name = 'bcrypt' - s.version = '3.1.21' + s.version = '3.1.22' s.summary = "OpenBSD's bcrypt() password hashing algorithm." s.description = <<-EOF