@@ -47,8 +47,6 @@ jobs:
             os: macos-15
           - test_task: check
             os: macos-15-intel
-          - test_task: check
-            os: macos-14
       fail-fast: false
 
     env:
@@ -194,7 +192,7 @@ jobs:
   result:
     if: ${{ always() }}
     name: ${{ github.workflow }} result
-    runs-on: macos-latest
+    runs-on: ubuntu-latest
     needs: [make]
     steps:
       - run: exit 1
 
@@ -38,7 +38,7 @@ jobs:
       # default-gem stub.
       matrix:
         test_task: ${{ inputs.full-matrix && fromJSON('["check", "test-bundled-gems", "test-bundler-parallel"]') || fromJSON('["check"]') }}
-        os: ${{ inputs.full-matrix && fromJSON('["macos-26", "macos-15", "macos-14"]') || fromJSON('["macos-26"]') }}
+        os: ${{ inputs.full-matrix && fromJSON('["macos-26", "macos-15"]') || fromJSON('["macos-26"]') }}
         include: ${{ inputs.full-matrix && fromJSON('[{"os":"macos-15-intel", "test_task":"check", "prefix":"/tmp/ruby-prefix"}]') || fromJSON('[]') }}
       fail-fast: false
     runs-on: ${{ matrix.os }}
 
@@ -30,7 +30,7 @@ jobs:
   cargo:
     name: cargo test
 
-    runs-on: macos-14
+    runs-on: macos-15
 
     if: >-
       ${{!(false
@@ -72,7 +72,7 @@ jobs:
       RUN_OPTS: ${{ matrix.yjit_opts }}
       SPECOPTS: ${{ matrix.specopts }}
 
-    runs-on: macos-14
+    runs-on: macos-15
 
     if: >-
       ${{!(false
@@ -131,7 +131,7 @@ jobs:
         id: launchable
         uses: ./.github/actions/launchable/setup
         with:
-          os: macos-14
+          os: macos-15
           test-opts: ${{ matrix.configure }}
           launchable-token: ${{ secrets.LAUNCHABLE_TOKEN }}
           builddir: build
@@ -185,7 +185,7 @@ jobs:
   result:
     if: ${{ always() }}
     name: ${{ github.workflow }} result
-    runs-on: macos-14
+    runs-on: ubuntu-latest
     needs: [make]
     steps:
       - name: ${{ github.workflow }} jobs have failed
 
@@ -57,7 +57,7 @@ jobs:
       TESTOPTS: ${{ matrix.testopts }}
       ZJIT_RB_BUG: 1
 
-    runs-on: macos-14
+    runs-on: macos-15
 
     if: >-
       ${{!(false
@@ -144,7 +144,7 @@ jobs:
   result:
     if: ${{ always() }}
     name: ${{ github.workflow }} result
-    runs-on: macos-14
+    runs-on: ubuntu-latest
     needs: [make]
     steps:
       - run: exit 1
@@ -161,7 +161,7 @@ jobs:
             bench_opts: '--warmup=1 --bench=1'
             configure: '--enable-zjit=dev_nodebug' # --enable-zjit=dev is too slow
 
-    runs-on: macos-14
+    runs-on: macos-15
 
     if: >-
       ${{!(false
 
@@ -3834,6 +3834,9 @@ append_values_at_single(VALUE result, VALUE ary, long olen, VALUE idx)
     /* check if idx is Range */
     else if (rb_range_beg_len(idx, &beg, &len, olen, 1)) {
         if (len > 0) {
+            // rb_range_beg_len may run arbitrary code that modifies ary, so we
+            // need to re-calculate olen
+            const long olen = RARRAY_LEN(ary);
             const VALUE *const src = RARRAY_CONST_PTR(ary);
             const long end = beg + len;
             const long prevlen = RARRAY_LEN(result);
@@ -4715,7 +4718,7 @@ rb_ary_zip(int argc, VALUE *argv, VALUE ary)
     else {
         result = rb_ary_new_capa(len);
 
-        for (i=0; i<len; i++) {
+        for (i=0; i<RARRAY_LEN(ary); i++) {
             VALUE tmp = rb_ary_new_capa(argc+1);
 
             rb_ary_push(tmp, RARRAY_AREF(ary, i));
@@ -6629,7 +6632,7 @@ static VALUE
 flatten(VALUE ary, int level)
 {
     long i;
-    VALUE stack, result, tmp = 0, elt;
+    VALUE stack, result, tmp = Qnil, elt;
     VALUE memo = Qfalse;
 
     for (i = 0; i < RARRAY_LEN(ary); i++) {
@@ -6639,9 +6642,14 @@ flatten(VALUE ary, int level)
             break;
         }
     }
-    if (i == RARRAY_LEN(ary)) {
+    if (NIL_P(tmp)) {
         return ary;
     }
+    if (i > RARRAY_LEN(ary)) {
+        /* ary was shrunk while converting an element with #to_ary, so
+           the scanned elements may no longer exist in ary */
+        i = RARRAY_LEN(ary);
+    }
 
     result = ary_new(0, RARRAY_LEN(ary));
     ary_memcpy(result, 0, i, RARRAY_CONST_PTR(ary));
 
@@ -61,7 +61,6 @@ bool ruby_box_crashed = false; // extern, changed only in vm.c
 
 VALUE rb_resolve_feature_path(VALUE klass, VALUE fname);
 static VALUE rb_box_inspect(VALUE obj);
-static void cleanup_all_local_extensions(VALUE libmap);
 
 void
 rb_box_set_gem_flags(rb_box_gem_flags_t *flags)
@@ -273,6 +272,12 @@ free_classext_for_box(st_data_t key, st_data_t _value, st_data_t box_arg)
     VALUE obj = (VALUE)key;
     const rb_box_t *box = (const rb_box_t *)box_arg;
 
+    if (RB_TYPE_P(obj, T_NONE)) {
+        /* RUBY_FREE_AT_EXIT can free a class before the box that refers to
+         * it, and freeing a class already freed its classext for this box. */
+        return ST_CONTINUE;
+    }
+
     if (RB_TYPE_P(obj, T_CLASS) || RB_TYPE_P(obj, T_MODULE)) {
         ext = rb_class_unlink_classext(obj, box);
         rb_class_classext_free(obj, ext, false);
@@ -296,8 +301,6 @@ box_entry_free(void *ptr)
         st_foreach(box->classext_cow_classes, free_classext_for_box, (st_data_t)box);
     }
 
-    cleanup_all_local_extensions(box->ruby_dln_libmap);
-
     free_box_st_tables(ptr);
     xfree((void *)box);
 }
@@ -798,24 +801,48 @@ rb_box_cleanup_local_extension(VALUE cleanup)
     (void)p;
 }
 
-static int
-cleanup_local_extension_i(VALUE key, VALUE value, VALUE arg)
-{
 #if defined(_WIN32)
-    HMODULE h = (HMODULE)NUM2PTR(value);
-    WCHAR module_path[MAXPATHLEN];
-    DWORD len = GetModuleFileNameW(h, module_path, numberof(module_path));
+struct box_local_ext_list {
+    struct box_local_ext_list *next;
+    HMODULE handle;
+};
+static struct box_local_ext_list *box_local_exts;
+#endif
 
-    FreeLibrary(h);
-    if (len > 0 && len < numberof(module_path)) DeleteFileW(module_path);
+void
+rb_box_defer_unload_local_extension(void *handle)
+{
+#if defined(_WIN32)
+    /* A box-local copy of an extension DLL must stay loaded as long as
+     * objects created by it can be finalized; unloading is deferred to
+     * rb_box_unload_local_extensions after the objspace is destructed.
+     * The loaded copy cannot be deleted on Windows, so the file is also
+     * removed there instead of in box_ext_cleanup_free. */
+    struct box_local_ext_list *ext = malloc(sizeof(struct box_local_ext_list));
+    if (!ext) return;
+    ext->handle = (HMODULE)handle;
+    ext->next = box_local_exts;
+    box_local_exts = ext;
 #endif
-    return ST_DELETE;
 }
 
-static void
-cleanup_all_local_extensions(VALUE libmap)
+void
+rb_box_unload_local_extensions(void)
 {
-    rb_hash_foreach(libmap, cleanup_local_extension_i, 0);
+#if defined(_WIN32)
+    struct box_local_ext_list *ext = box_local_exts;
+    box_local_exts = NULL;
+    while (ext) {
+        struct box_local_ext_list *next = ext->next;
+        WCHAR module_path[MAXPATHLEN];
+        DWORD len = GetModuleFileNameW(ext->handle, module_path, numberof(module_path));
+
+        FreeLibrary(ext->handle);
+        if (len > 0 && len < numberof(module_path)) DeleteFileW(module_path);
+        free(ext);
+        ext = next;
+    }
+#endif
 }
 
 VALUE
 
@@ -299,6 +299,9 @@ class_duplicate_iclass_classext(VALUE iclass, rb_classext_t *mod_ext, const rb_b
 
     RCLASSEXT_BOX(ext) = box;
 
+    VM_ASSERT(FL_TEST_RAW(iclass, RCLASS_BOXABLE));
+    first_set = RCLASS_SET_BOX_CLASSEXT(iclass, box, ext);
+
     RCLASSEXT_SUPER(ext) = RCLASSEXT_SUPER(src);
 
     // See also: rb_include_class_new()
@@ -324,16 +327,13 @@ class_duplicate_iclass_classext(VALUE iclass, rb_classext_t *mod_ext, const rb_b
 
     RCLASSEXT_SET_INCLUDER(ext, iclass, RCLASSEXT_INCLUDER(src));
 
-    VM_ASSERT(FL_TEST_RAW(iclass, RCLASS_BOXABLE));
-
-    first_set = RCLASS_SET_BOX_CLASSEXT(iclass, box, ext);
     if (first_set) {
         RCLASS_SET_PRIME_CLASSEXT_WRITABLE(iclass, false);
     }
 }
 
 rb_classext_t *
-rb_class_duplicate_classext(rb_classext_t *orig, VALUE klass, const rb_box_t *box)
+rb_class_duplicate_classext(rb_classext_t *orig, VALUE klass, const rb_box_t *box, int *first_set)
 {
     VM_ASSERT(RB_TYPE_P(klass, T_CLASS) || RB_TYPE_P(klass, T_MODULE) || RB_TYPE_P(klass, T_ICLASS));
 
@@ -342,6 +342,10 @@ rb_class_duplicate_classext(rb_classext_t *orig, VALUE klass, const rb_box_t *bo
 
     RCLASSEXT_BOX(ext) = box;
 
+    /* Everything made below is reachable only through this classext, so put
+     * it where the GC can find it before allocating any of it. */
+    *first_set = RCLASS_SET_BOX_CLASSEXT(klass, box, ext);
+
     RCLASSEXT_SUPER(ext) = RCLASSEXT_SUPER(orig);
 
     RCLASSEXT_M_TBL(ext) = duplicate_classext_m_tbl(RCLASSEXT_M_TBL(orig), klass, dup_iclass);
@@ -1922,6 +1926,10 @@ ensure_origin(VALUE klass)
 {
     VALUE origin = RCLASS_ORIGIN(klass);
     if (origin == klass) {
+        /* Create the box-local classext before reading m_tbl, so that the
+         * origin shares the m_tbl with the box-local iclasses of klass,
+         * as rb_prepend_module relies on that identity. */
+        rb_class_ensure_writable(klass);
         origin = class_alloc(T_ICLASS, klass);
         RCLASS_SET_M_TBL(origin, RCLASS_M_TBL(klass));
         rb_class_set_super(origin, RCLASS_SUPER(klass));
 
@@ -75,6 +75,7 @@ HTMLOUT       = $(EXTOUT)/html
 CAPIOUT       = doc/capi
 INSTALL_DOC_OPTS = --rdoc-output="$(RDOCOUT)" --html-output="$(HTMLOUT)"
 RDOC_GEN_OPTS = --no-force-update \
+	--exclude '^lib/rubygems/core_ext/kernel_require\.rb$$' \
 	$(empty)
 
 INITOBJS      = dmyext.$(OBJEXT) dmyenc.$(OBJEXT)
 
@@ -1940,11 +1940,11 @@ DEFINE_ENUMFUNCS(one)
 }
 
 struct nmin_data {
+    VALUE buf;
+    VALUE limit;
     long n;
     long bufmax;
     long curlen;
-    VALUE buf;
-    VALUE limit;
     int (*cmpfunc)(const void *, const void *, void *);
     int rev: 1; /* max if 1 */
     int by: 1; /* min_by if 1 */
@@ -2065,13 +2065,10 @@ nmin_filter(struct nmin_data *data)
 }
 
 static VALUE
-nmin_i(RB_BLOCK_CALL_FUNC_ARGLIST(i, _data))
+nmin_i_ary(VALUE i, struct nmin_data *data, int argc)
 {
-    struct nmin_data *data = (struct nmin_data *)_data;
     VALUE cmpv;
 
-    ENUM_WANT_SVALUE();
-
     if (data->by)
         cmpv = enum_yield(argc, i);
     else
@@ -2098,6 +2095,14 @@ nmin_i(RB_BLOCK_CALL_FUNC_ARGLIST(i, _data))
     return Qnil;
 }
 
+static VALUE
+nmin_i(RB_BLOCK_CALL_FUNC_ARGLIST(i, data))
+{
+    ENUM_WANT_SVALUE();
+
+    return nmin_i_ary(i, MEMO_FOR(struct nmin_data, data), argc);
+}
+
 VALUE
 rb_nmin_run(VALUE obj, VALUE num, int by, int rev, int ary)
 {
@@ -2120,17 +2125,24 @@ rb_nmin_run(VALUE obj, VALUE num, int by, int rev, int ary)
                    nmin_cmp;
     data.rev = rev;
     data.by = by;
+
+    VALUE memo;
+    struct nmin_data *m = &data;
+    if (!ary || data.cmpfunc == nmin_block_cmp) {
+        *(m = NEW_PARTIAL_MEMO_FOR(struct nmin_data, memo, n)) = data;
+    }
     if (ary) {
         long i;
         for (i = 0; i < RARRAY_LEN(obj); i++) {
-            VALUE args[1];
-            args[0] = RARRAY_AREF(obj, i);
-            nmin_i(obj, (VALUE)&data, 1, args, Qundef);
+            nmin_i_ary(RARRAY_AREF(obj, i), m, 1);
         }
     }
     else {
-        rb_block_call(obj, id_each, 0, 0, nmin_i, (VALUE)&data);
+        rb_block_call(obj, id_each, 0, 0, nmin_i, memo);
     }
+    if (m != &data) data = *m;
+    RB_GC_GUARD(memo);
+
     nmin_filter(&data);
     result = data.buf;
     if (by) {
@@ -4744,7 +4756,7 @@ static VALUE
 enum_sum_i(RB_BLOCK_CALL_FUNC_ARGLIST(i, args))
 {
     ENUM_WANT_SVALUE();
-    sum_iter(i, (struct enum_sum_memo *) args);
+    sum_iter(i, MEMO_FOR(struct enum_sum_memo, args));
     return Qnil;
 }
 
@@ -4846,10 +4858,17 @@ enum_sum(int argc, VALUE* argv, VALUE obj)
     }
 
     if (RB_TYPE_P(obj, T_HASH) &&
-            rb_method_basic_definition_p(CLASS_OF(obj), id_each))
+        rb_method_basic_definition_p(CLASS_OF(obj), id_each)) {
         hash_sum(obj, &memo);
-    else
-        rb_block_call(obj, id_each, 0, 0, enum_sum_i, (VALUE)&memo);
+    }
+    else {
+        VALUE arg;
+        struct enum_sum_memo *m = NEW_PARTIAL_MEMO_FOR(struct enum_sum_memo, arg, n);
+        *m = memo;
+        rb_block_call(obj, id_each, 0, 0, enum_sum_i, arg);
+        memo = *m;
+        RB_GC_GUARD(arg);
+    }
 
     if (memo.float_value) {
         return DBL2NUM(memo.f + memo.c);