Bump ruby to 4.0.9.

.github/workflows/brakeman-scan-core.yml

@@ -31,7 +31,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1
+        uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1
 
       - name: Setup Brakeman
         run: |

.github/workflows/crowdin.yml

@@ -45,7 +45,7 @@ jobs:
           ref: ${{ matrix.branch }}
           fetch-depth: 1
           token: ${{ secrets.OPENPROJECTCI_GH_CORE_PAT }}
-      - uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1
+      - uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1
         with:
           bundler-cache: true
       - name: "Set crowdin branch name"

.github/workflows/danger.yml

@@ -22,7 +22,7 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1
+      - uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1
         with:
           ruby-version: .ruby-version
           bundler-cache: true

.github/workflows/docs.yaml

@@ -21,7 +21,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1
+      - uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1
         with:
           bundler-cache: true
       - run: bundle exec ./script/docs/check_links
@@ -42,7 +42,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1
+      - uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1
         with:
           bundler-cache: true
       - run: script/docs/check_readme_yaml_header_syntax

.github/workflows/erb-lint-core.yml

@@ -21,7 +21,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Ruby
-        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1
+        uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1
         with:
           bundler-cache: true
       - name: Run ERB lint

.github/workflows/i18n-tasks.yml

@@ -34,7 +34,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1
+        uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1
 
       - name: Setup i18n-tasks
         run: |

.github/workflows/openapi.yaml

@@ -24,7 +24,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1
+      - uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1
         with:
           bundler-cache: false
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0

.github/workflows/rubocop-core.yml

@@ -19,7 +19,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Ruby
-        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1
+        uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1
       - name: Run RuboCop
         uses: reviewdog/action-rubocop@b6d5e953a5fc0bf3ab65254e77730ea2174d6d6d # v2
         with:

.github/workflows/seed-all-locales.yml

@@ -99,7 +99,7 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y libpq-dev
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1
+        uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1
         with:
           bundler-cache: true
 

.github/workflows/work-package-check.yml

@@ -30,7 +30,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1
+        uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1
 
       - name: Verify work package fields are set (linked version matches core version and Enterprise field is set)
         id: work-package-check

.ruby-version

@@ -1 +1 @@
-4.0.7
+4.0.9

AGENTS.md

@@ -7,7 +7,7 @@
 **OpenProject** is a web-based, open-source project management software written in Ruby on Rails with PostgreSQL for data persistence.
 
 - **Size**: Large monorepo (~840MB, ~1M+ lines of code)
-- **Backend**: Ruby 4.0.7, Rails ~8.1.3
+- **Backend**: Ruby 4.0.9, Rails ~8.1.3
 - **Frontend**: Node.js 24.x (>= 24.15.0), npm 11.x, TypeScript
 - **Database**: PostgreSQL (required)
 - **Architecture**: Server-rendered HTML with Hotwire (Turbo + Stimulus). Legacy Angular components exist and are being migrated to custom elements. Uses GitHub's Primer Design System via ViewComponent.
@@ -16,7 +16,7 @@
 ## Critical Setup Requirements
 
 **ALWAYS verify versions before building:**
-- Ruby: `4.0.7` (see `.ruby-version`)
+- Ruby: `4.0.9` (see `.ruby-version`)
 - Node: `^24.15.0` (see `package.json` engines)
 - Bundler: `4.0.21` (see `BUNDLED WITH` in `Gemfile.lock`)
 

docker/dev/backend/Dockerfile

@@ -1,4 +1,4 @@
-FROM ruby:4.0.7-trixie AS develop
+FROM ruby:4.0.9-trixie AS develop
 LABEL org.opencontainers.image.authors="operations@openproject.com"
 
 ARG DEV_UID=1000

docker/prod/Dockerfile

@@ -1,4 +1,4 @@
-ARG RUBY_VERSION="4.0.7"
+ARG RUBY_VERSION="4.0.9"
 ARG DEBIAN_BASE="trixie"
 # Add SBOM scan context for intermediate steps
 ARG BUILDKIT_SBOM_SCAN_CONTEXT=true

docs/development/development-environment/linux/README.md

@@ -40,10 +40,10 @@ sudo apt-get install git curl build-essential zlib1g-dev libyaml-dev libssl-dev
 Use [rbenv](https://github.com/rbenv/rbenv) and [ruby-build](https://github.com/rbenv/ruby-build#readme) to install
 Ruby.
 You can check available ruby versions with `rbenv install --list`.
-At the time of this writing, the latest stable version is `4.0.7`, which we also require.
+At the time of this writing, the latest stable version is `4.0.9`, which we also require.
 
 We suggest you install the version we require in [.ruby-version](https://github.com/opf/openproject/blob/dev/.ruby-version).
-Read the first line e.g. `4.0.7` and install that version.
+Read the first line e.g. `4.0.9` and install that version.
 
 #### Install rbenv and ruby-build
 
@@ -80,18 +80,18 @@ With both installed, we can now install ruby.
 You can check available ruby versions with `rbenv install --list`.
 
 We suggest you install the version we require in [.ruby-version](https://github.com/opf/openproject/blob/dev/.ruby-version).
-Read the first line e.g. `4.0.7` and install that version.
+Read the first line e.g. `4.0.9` and install that version.
 
 ```shell
 # Install the required version as read from the .ruby-version file
-rbenv install 4.0.7
+rbenv install 4.0.9
 ```
 
 This might take a while depending on whether ruby is built from source. After it is complete, you need to tell rbenv to
 globally activate this version
 
 ```shell
-rbenv global 4.0.7
+rbenv global 4.0.9
 rbenv rehash
 ```
 
@@ -181,7 +181,7 @@ You should now have an active ruby and node installation. Verify that it works w
 
 ```shell
 ruby --version
-ruby 4.0.7 (2026-09-15 revision 229531a6cf) +PRISM [arm64-darwin25]
+ruby 4.0.9 (2026-10-23 revision 3e93b23afc) +PRISM [arm64-darwin24]
 
 bundler --version
 4.0.21

docs/development/development-environment/macos/README.md

@@ -28,7 +28,7 @@ their homepage.
 Use [rbenv](https://github.com/rbenv/rbenv) and [ruby-build](https://github.com/rbenv/ruby-build#readme) to install
 Ruby. We always require the latest ruby versions, and you can check which version is required
 by [checking the Gemfile](https://github.com/opf/openproject/blob/dev/Gemfile#L31) for the `ruby "~> X.Y"` statement. At
-the time of writing, this version is "4.0.7"
+the time of writing, this version is "4.0.9"
 
 #### Install rbenv and ruby-build
 
@@ -48,18 +48,18 @@ With both installed, we can now install the actual ruby version.
 You can check available ruby versions with `rbenv install --list`.
 
 We suggest you install the version we require in [.ruby-version](https://github.com/opf/openproject/blob/dev/.ruby-version).
-Read the first line e.g. `4.0.7` and install that version.
+Read the first line e.g. `4.0.9` and install that version.
 
 ```shell
 # Install the required version as read from the .ruby-version file
-rbenv install 4.0.7
+rbenv install 4.0.9
 ```
 
 This might take a while depending on whether ruby is built from source. After it is complete, you need to tell rbenv to
 globally activate this version
 
 ```shell
-rbenv global 4.0.7
+rbenv global 4.0.9
 ```
 
 You also need to install [bundler](https://github.com/bundler/bundler/), the ruby gem bundler.
@@ -134,7 +134,7 @@ You should now have an active ruby and node installation. Verify that it works w
 
 ```shell
 $ ruby --version
-ruby 4.0.7 (2026-09-15 revision 229531a6cf) +PRISM [arm64-darwin25]
+ruby 4.0.9 (2026-10-23 revision 3e93b23afc) +PRISM [arm64-darwin24]
 
 $ bundler --version
 4.0.21

docs/installation-and-operations/installation/manual/README.md

@@ -106,19 +106,19 @@ Please be aware that the actual installation of a specific Ruby version takes so
 ```
 
 We suggest you install the version we require in [.ruby-version](https://github.com/opf/openproject/blob/dev/.ruby-version).
-Read the first line e.g. `4.0.7` and install that version.
+Read the first line e.g. `4.0.9` and install that version.
 
 ```shell
-[openproject@host] rbenv install 4.0.7
+[openproject@host] rbenv install 4.0.9
 [openproject@host] rbenv rehash
-[openproject@host] rbenv global 4.0.7
+[openproject@host] rbenv global 4.0.9
 ```
 
 To check our Ruby installation we run `ruby --version`. It should output
 something very similar to:
 
 ```text
-ruby 4.0.7 (2026-09-15 revision 229531a6cf) +PRISM [arm64-darwin25]
+ruby 4.0.9 (2026-09-15 revision 229531a6cf) +PRISM [arm64-darwin25]
 ```
 
 ## Installation of Node

frontend/package.json

@@ -110,7 +110,7 @@
     "@ngneat/content-loader": "^7.0.0",
     "@openproject/octicons-angular": "^19.37.0",
     "@openproject/op-blocknote-extensions": "^0.3.3",
-    "@openproject/primer-view-components": "^0.93.0",
+    "@openproject/primer-view-components": "^0.94.0",
     "@openproject/reactivestates": "^3.0.1",
     "@openproject/stimulus-elements": "^0.2.0",
     "@primer/behaviors": "^1.10.3",