Ruby 4.0.7

Release Date: September 15, 2026

Ruby 4.0.7 landed on September 15, 2026. Let's not get carried away: this is a bugfix release on the 4.0 branch, with 26 named issues in the changelog and no new language features. If you are on 4.0.6, that is exactly the point. Several of the fixes address crashes and performance collapses that were introduced or exposed in the last patch, which makes this less of an optional maintenance drop and more of a cleanup of the previous cleanup.

The Uncomfortable Part

A patch release that fixes regressions from the previous patch is a small admission. Two entries in this changelog describe problems that only appeared in 4.0.6: a performance regression when requiring aws-sdk-ec2, and a segmentation fault in method dispatch that showed up in Rails CI. If you upgraded to 4.0.6 and your build pipeline or application startup started behaving oddly, 4.0.7 is where you look.

The most consequential fix is a YJIT and Ractor interaction. The native method rb_yjit_invalidate_ep_is_bp took the VM lock during every Proc materialization, which stopped Ractors in their tracks. The reported impact is a multi-Ractor throughput collapse of up to roughly 150 times. That is not a rounding error, and it is the kind of regression that only shows up in workloads structured the way most teams do not test.

Crash and Memory Safety Fixes

SEGV in method dispatch (vm_call_iseq_setup_kwparm_nokwarg and def_iseq_ptr) on 4.0.6, reported from Rails CI.
Heap-use-after-free in fiber_switch when transfer-terminated async tasks are involved, first seen on 3.4.10.
Heap overflow in Kernel#system on win32. The most serious entry on the list for Windows users.
GC.auto_compact corruption. Compaction could corrupt a String or segfault from String#tr when used with dup or gsub.
Array buffer sharding. Arrays sharing a sharded buffer could segfault when concatenated with each other.
Struct accessor crashes in YJIT and ZJIT after setting an instance variable on a Struct that exactly fills the largest GC slot.
EncodingError while interpolating a symbol could crash the whole process instead of raising.
Coverage and TracePoint correctness. Coverage.line_stub clobbered already-collected data, and line TracePoint missed executed loop conditions after a guard.

Platform and Networking Caveats

Two fixes are platform specific and worth reading if you ship on more than Linux. On macOS 27, Socket.tcp with connect_timeout returned a phantom "connected" socket for a refused connection, because the kernel answers EISCONN on connect retry and the code never consulted SO_ERROR. On Windows, ENV.keys had an encoding bug, and addr2line failed to find symbols in binaries compiled with GCC LTO.

Behavior Changes to Watch

Most of this release is straightforward repair, but a few entries change semantics rather than fixing a crash. Process._fork behaves differently when it raises an exception during a fork with a block argument. ObjectSpace._id2ref could return a different object than the owner of the id when a stale table entry existed for objects with generic fields, which matters to anyone doing identity tracking through that API. Class#subclasses now includes clones of classes that include modules. Prepending a module to an already-included module no longer leaves stale super caches behind, which could silently change dispatch results in code that relied on the broken caching.

Housekeeping

Bundled ERB moved to 6.0.7. If your application vendors ERB or depends on a specific ERB patch level, check your lockfile before deploying.

The Verdict

Upgrade if you are on 4.0.6. The regression fixes alone justify it, and the Ractor lock issue is severe enough that parallel workloads should not stay on the previous patch. If you are still on 4.0.5 or earlier, you have skipped a release with a dispatch segfault in it, which is a good reason to move now rather than later.