diff --git a/download b/download
index 6016d323d5d0b38494c1e51de4270b2135718b8b..de30241f81ca32a0df9acbccc8a341736d526d8b 100644
--- a/download
+++ b/download
@@ -1,2 +1,2 @@
-a426258d48bccd0178525f9dd57e5543  ruby-2.7.6.tar.xz
+27af2c340d0524ab272d564ddfd733d9  ruby-2.7.8.tar.xz
 4f180a29897d2aee70a01205b36e5082  ruby-rubygems-bundler-v2.2.24.txz
diff --git a/fix-tests-with-Europe-Amsterdam-pre-1970-time.patch b/fix-tests-with-Europe-Amsterdam-pre-1970-time.patch
deleted file mode 100644
index 50380f7cf568683a1d58d3a3fbbabf569f33b1df..0000000000000000000000000000000000000000
--- a/fix-tests-with-Europe-Amsterdam-pre-1970-time.patch
+++ /dev/null
@@ -1,16 +0,0 @@
---- spec/ruby/core/time/shared/local.rb.orig	2022-09-26 10:44:47.789453721 +0800
-+++ spec/ruby/core/time/shared/local.rb	2022-09-26 10:46:10.090755075 +0800
-@@ -8,10 +8,10 @@
- 
-   platform_is_not :windows do
-     describe "timezone changes" do
--      it "correctly adjusts the timezone change to 'CEST' on 'Europe/Amsterdam'" do
-+      it "correctly adjusts the timezone change to 'CET' on 'Europe/Amsterdam'" do
-         with_timezone("Europe/Amsterdam") do
--          Time.send(@method, 1940, 5, 16).to_a.should ==
--            [0, 40, 1, 16, 5, 1940, 4, 137, true, "CEST"]
-+          Time.send(@method, 1970, 5, 16).to_a.should ==
-+            [0, 0, 0, 16, 5, 1970, 6, 136, false, "CET"]
-         end
-       end
-     end
diff --git a/ruby-2.8.0-remove-unneeded-gem-require-for-ipaddr.patch b/ruby-2.8.0-remove-unneeded-gem-require-for-ipaddr.patch
index ddd70e6955d45a6e9ff2845a8d6c23799da3c7a5..83751aa2e65d431b088e52b62f50ec07582f3f06 100644
--- a/ruby-2.8.0-remove-unneeded-gem-require-for-ipaddr.patch
+++ b/ruby-2.8.0-remove-unneeded-gem-require-for-ipaddr.patch
@@ -17,6 +17,6 @@ index 7c17cd54..f721f247 100644
    spec.required_ruby_version = ">= 2.3.0"
  
 -  spec.add_runtime_dependency "ipaddr"
-   spec.add_development_dependency "rake"
+   spec.add_development_dependency "rake", ">= 11.2.0"
    spec.add_development_dependency "rake-compiler"
    spec.add_development_dependency "test-unit", "~> 3.0"
diff --git a/ruby.spec b/ruby.spec
index 0f7daf08f400d0c516a5f8376a7b3fefd19bbf82..3e9f5f604e4193c69bfaf4dd73578f61aaccd14e 100644
--- a/ruby.spec
+++ b/ruby.spec
@@ -1,7 +1,7 @@
 %define anolis_release .0.1
 %global major_version 2
 %global minor_version 7
-%global teeny_version 6
+%global teeny_version 8
 %global major_minor_version %{major_version}.%{minor_version}
 
 %global ruby_version %{major_minor_version}.%{teeny_version}
@@ -23,8 +23,8 @@
 %endif
 
 
-%global release 138
-%{!?release_string:%define release_string %{?development_release:0.}%{release}%{?development_release:.%{development_release}}%{anolis_release}%{?dist}}
+%global release 139
+%{!?release_string:%define release_string %{?development_release:0.}%{release}%{?development_release:.%{development_release}}%{?dist}}
 
 # The RubyGems library has to stay out of Ruby directory tree, since the
 # RubyGems should be share by all Ruby implementations.
@@ -50,7 +50,7 @@
 %global irb_version 1.2.6
 %global json_version 2.3.0
 %global net_telnet_version 0.2.0
-%global openssl_version 2.1.3
+%global openssl_version 2.1.4
 %global psych_version 3.1.0
 %global racc_version 1.4.16
 %global rdoc_version 6.2.1.1
@@ -171,9 +171,6 @@ Patch22: rubygems-3.2.13-test-gem-message.patch
 # https://github.com/ruby/ruby/commit/c082c6eb7c786a432bea23cf78839f64585cb630
 Patch23: rubygems-3.2.22-fix-requirement-equals.patch
 
-# https://github.com/ruby/spec/pull/939/commits/63f899d00e9d38d7f5175bc028f218241262dc7a
-Patch1000: fix-tests-with-Europe-Amsterdam-pre-1970-time.patch
-
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}
 Suggests: rubypick
 Recommends: ruby(rubygems) >= %{rubygems_version}
@@ -597,8 +594,6 @@ cp -a %{_builddir}/rubygems/bundler/tool/bundler tool/bundler
 %patch22 -p1
 %patch23 -p1
 
-%patch1000 -p0
-
 # Provide an example of usage of the tapset:
 cp -a %{SOURCE3} .
 
@@ -1152,7 +1147,7 @@ MSPECOPTS="$MSPECOPTS -P 'File.utime allows Time instances in the far future to
 
 %files default-gems
 %{gem_dir}/specifications/default/benchmark-0.1.0.gemspec
-%{gem_dir}/specifications/default/cgi-0.1.0.1.gemspec
+%{gem_dir}/specifications/default/cgi-0.1.0.2.gemspec
 %{gem_dir}/specifications/default/csv-3.1.2.gemspec
 %{gem_dir}/specifications/default/date-3.0.3.gemspec
 %{gem_dir}/specifications/default/dbm-1.1.0.gemspec
@@ -1188,7 +1183,7 @@ MSPECOPTS="$MSPECOPTS -P 'File.utime allows Time instances in the far future to
 %{gem_dir}/specifications/default/strscan-1.0.3.gemspec
 %{gem_dir}/specifications/default/timeout-0.1.0.gemspec
 %{gem_dir}/specifications/default/tracer-0.1.0.gemspec
-%{gem_dir}/specifications/default/uri-0.10.0.gemspec
+%{gem_dir}/specifications/default/uri-0.10.0.2.gemspec
 %{gem_dir}/specifications/default/webrick-1.6.1.gemspec
 %{gem_dir}/specifications/default/yaml-0.1.0.gemspec
 %{gem_dir}/specifications/default/zlib-1.1.0.gemspec
@@ -1304,6 +1299,9 @@ MSPECOPTS="$MSPECOPTS -P 'File.utime allows Time instances in the far future to
 
 
 %changelog
+* Thu Jun 29 2023 Liwei Ge <liwei.glw@alibaba-inc.com> - 2.7.8-139
+- Update to 2.7.8 (CVE-2021-33621 CVE-2023-28755 CVE-2023-28756)
+
 * Mon Sep 26 2022 Bo Ren <rb01097748@alibaba-inc.com> - 2.7.6-138.0.1
 - fix tests with Europe/Amsterdam pre-1970 time