Motivation for this change

CVE-2019-16255: A code injection vulnerability of Shell#[] and Shell#test
CVE-2019-16254: HTTP response splitting in WEBrick (Additional fix)
CVE-2019-15845: A NUL injection vulnerability of File.fnmatch and File.fnmatch?
CVE-2019-16201: Regular Expression Denial of Service vulnerability of WEBrick’s Digest access authentication

• 2.6.5 https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-6-5-released/
• 2.5.7 https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-5-7-released/
• 2.4.9
  • https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-4-8-released/
  • https://www.ruby-lang.org/en/news/2019/10/02/ruby-2-4-9-released/

note: I haven't included 2.4.8, because the released tarball doesn’t install under non-root user https://bugs.ruby-lang.org/issues/16197

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nix-review --run "nix-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

Notify maintainers

cc @