ruby:3.3 security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* resolv: Denial of Service in resolv gem (CVE-2025-24294)
* rexml: REXML denial of service (CVE-2025-58767)
* When using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked,
violating RFC3986 and making applications vulnerable to credential exposure. (CVE-2025-61594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2025-24294
The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name. This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.
CVE-2025-58767
REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.
CVE-2025-61594
When using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked,
violating RFC3986 and making applications vulnerable to credential exposure.

Modularity name: "ruby"
Stream name: "3.3"