Set the tested Ruby runtime floor - #387
Open
ryanduguid wants to merge 2 commits into
Open
Conversation
Author
|
Interaction note from the queue audit: this runtime-floor change shares xero-ruby.gemspec with licence metadata PR #384 and depends on hosted matrix evidence from CI PR #385. Recommended order is #384, then #385, then rebase and rerun this PR against both results. I am keeping it draft until those gates are available. |
ryanduguid
marked this pull request as ready for review
August 18, 2026 15:07
…p target Raising required_ruby_version from ">= 2.3" to ">= 3.2" drops every consumer on Ruby 2.3 through 3.1, but version.rb stays on the non-major 18.1.0 line and the change carried no changelog entry. RubyGems resolves an unsupported consumer to the newest release they satisfy, so an app on 3.1 running `bundle update xero-ruby` is silently held at 18.1.0 with no error to signal it. Added CHANGELOG.md (the repo had none) recording the breaking change, what happens to consumers on the dropped versions, and a maintainer note that the next release must be cut as 19.0.0. Did not bump lib/xero-ruby/version.rb. It is OpenAPI-Generator-owned and its version is stamped by the "Releasing X.Y.Z (OAS: N.N.N)" commit from the codegen pipeline rather than by feature PRs, and .github/workflows/publish.yml publishes whatever that file carries, so hand-bumping here would collide with the release pipeline. The major bump is recorded as a release requirement instead. Also raised TargetRubyVersion in .rubocop.yml from 2.4 to 3.2. It contradicted the new gemspec floor, so an endless method definition or `...` argument forwarding, both legal on 3.2, would fail the CI "Lint Code" step with a Lint/Syntax offence on valid code.
ryanduguid
added a commit
to ryanduguid/xero-ruby
that referenced
this pull request
Aug 19, 2026
…oor gap The pin comment claimed v4.2.2, but 11d5960a326750d5838078e36cf38b85af677262 is tag v4.4.0. Verified with `gh api repos/actions/checkout/git/ref/tags/v4.2.2`, which resolves to 11bd71901bbe5b1630ceea73d27597364c9af683, and with `gh api repos/actions/checkout/commits/11d5960a...`, which is the v4.4.0 "backport fixes to releases-v4" commit dated 2026-07-16. Corrected the comment rather than repinning to v4.2.2: the pinned SHA is the newer release, so repinning down would drop roughly 21 months of fixes to keep a stale comment true. The ruby/setup-ruby pin was checked the same way and its v1.321.0 comment is correct. Also recorded the Ruby floor dependency in the matrix. The matrix starts at 3.2 while xero-ruby.gemspec still declares required_ruby_version ">= 2.3", so on its own this workflow ships a gem advertising 2.3 through 3.1 with no CI coverage there. PR XeroAPI#387 raises the gemspec floor and should land with or before this.
ryanduguid
added a commit
to ryanduguid/xero-ruby
that referenced
this pull request
Aug 19, 2026
The refresh cleared the advisories only in Gemfile.lock. The lock is not packaged (s.files is lib/**/* plus README.md) and does not bind consumers, so the shipped constraints still admitted every vulnerable version. faraday '>= 2.0' -> '>= 2.14.3' GHSA-98m9-hrrm-r99r (high, uncontrolled recursion in NestedParamsEncoder, stack exhaustion DoS) affects >= 2.0.0, <= 2.14.2, patched 2.14.3. GHSA-5rv5-xj5j-3484 (low, incomplete fix for the SSRF below) affects >= 2.0.0, <= 2.14.1, patched 2.14.2. GHSA-33mh-2634-fwr2 (medium, SSRF via protocol-relative host override in build_exclusive_url) affects >= 2.0.0, <= 2.14.0, patched 2.14.1. json '>= 2.1.0' -> '>= 2.21.2' A 2.3.0 floor would clear GHSA-jphg-qwrw-7w9g (high, unsafe object creation) but leave four later advisories reachable: GHSA-9m3q-rhmv-5q44 (high, OOB read, patched 2.10.2), GHSA-3m6g-2423-7cp3 (high, format string injection, patched 2.19.2 on the 2.18+ line), GHSA-x2f5-4prf-w687 (low, generator heap overflow, patched 2.19.9) and GHSA-9hj4-r449-hfvc (low, freed buffer deref, patched 2.21.2). 2.21.2 clears all five and matches the lock. json-jwt '>= 1.16.3' -> '>= 1.16.6' GHSA-c8v6-786g-vjx6 (medium, sign/encryption confusion allowing bypass of identity checks) affects >= 1.16.0, < 1.16.6, patched 1.16.6. This SDK verifies OAuth2 id_tokens and access_tokens through json-jwt. Also removed x64-mingw-ucrt from PLATFORMS. It was a side effect of regenerating the lock on Windows, unrelated to the refresh, and forces future `bundle lock` runs to satisfy a platform the project neither tests nor supports. Recorded the Ruby floor contradiction in the Gemfile: activesupport 8.1.3.1, connection_pool 3.0.2 and minitest 6.0.6 each require Ruby >= 3.2 and faraday 2.14.3 requires >= 3.0, so the lock cannot install on Ruby 3.1.x while the gemspec still declares ">= 2.3". PR XeroAPI#387 raises that floor and must land with or before this. Advisory ranges verified with `gh api /advisories?ecosystem=rubygems&affects=<gem>`; versions and required_ruby_version verified against the RubyGems API. Nothing was executed: no Ruby toolchain is installed on this machine.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
>= 2.3Ruby claim with>= 3.2Why
The committed lockfile requires Bundler 2.5.11, whose own Ruby requirement is
>= 3.0. The repository had no execution proof for Ruby 2.3, while the companion matrix runs the package on Ruby 3.2. This PR intentionally makes the contract no broader than the tested floor.Validation
git diff --checkThe PR remains draft until #385 produces exact-head hosted Linux and Windows evidence at Ruby 3.2.