[Snyk] Security upgrade ruby from 3.0-alpine to 3.4.8-alpine

[ayusuf-mq]

Snyk has created this PR to fix 2 vulnerabilities in the dockerfile dependencies of this project.

Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.

Snyk changed the following file(s):

• samples/server/petstore/ruby-sinatra/Dockerfile

We recommend upgrading to ruby:3.4.8-alpine, as this image has only 0 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	CVE-2025-26519 SNYK-ALPINE316-MUSL-8720632	614
	CVE-2025-26519 SNYK-ALPINE316-MUSL-8720632	614
	Out-of-bounds Write SNYK-ALPINE316-BUSYBOX-6913410	514
	Out-of-bounds Write SNYK-ALPINE316-BUSYBOX-6913410	514

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Out-of-bounds Write

[ayusuf-mq]

This is a major version upgrade from Ruby 3.0 to 3.4, which introduces a significant number of breaking changes and new features across multiple releases. Key areas of impact include changes to YAML parsing, keyword argument delegation, new language syntax, and a new default parser.

Highlights:

• YAML Parsing: As of Ruby 3.1, Psych.load defaults to safe_load, which can cause errors when parsing YAML containing aliases or complex objects. Calls may need to be updated to Psych.unsafe_load. [3, 10]
• Keyword Arguments: Since Ruby 3.2, methods that delegate keyword arguments using *args must be explicitly marked with ruby2_keywords to avoid breaking behavior. [14]
• New Syntax: Ruby 3.4 introduces it as the default reference for the first block parameter, which will break existing code that uses it as a method call within a block. [5, 7, 8]

Source: Ruby documentation
Recommendation: This upgrade requires careful testing. It is highly recommended to upgrade incrementally (3.0 → 3.1 → 3.2, etc.) to isolate and address breaking changes from each version individually. Pay close attention to deprecation warnings during testing.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.