Оффлайн
- Регистрация
- 1 Мар 2015
- Сообщения
- 1,481
- Баллы
- 155
Photo (cropped) by on
I've just released oauth2 v2.0.10. It's a big release with many new features, and many bug fixes. But I'll save all that for later... Right now I want to talk about Upgrading. I know it is scary to upgrade something that will break horribly if it goes wrong. It's likely user facing. It may be hard to test outside production.
This project sits underneath a large portion of the authorization systems on the internet. According to GitHub's project tracking, which I believe only reports on public projects, , and depend on this project. That is a lot of things to upgrade.
That means it is painful for the Ruby community when this gem forces updates to its runtime dependencies.
As a result, great care, and a lot of time, have been invested to ensure this gem is working with all the leading versions per each minor version of Ruby of all the runtime dependencies it can install with.
What does that mean specifically for the runtime dependencies?
We have 100% test coverage of lines and branches, and this test suite runs across a large matrix covering the latest patch for each of the following minor versions:
If you are thinking, "that list is missing two runtime dependencies", you are correct!
Both of them were extracted from this gem. They are part of the oauth-xx org,
and are developed in tight collaboration with this gem, so not much more needs to be said about them.
* MIT license; I am unable to make guarantees.
And now for the finer details...
- 2025-05-16
Discuss this post on
I've just released oauth2 v2.0.10. It's a big release with many new features, and many bug fixes. But I'll save all that for later... Right now I want to talk about Upgrading. I know it is scary to upgrade something that will break horribly if it goes wrong. It's likely user facing. It may be hard to test outside production.
This project sits underneath a large portion of the authorization systems on the internet. According to GitHub's project tracking, which I believe only reports on public projects, , and depend on this project. That is a lot of things to upgrade.
That means it is painful for the Ruby community when this gem forces updates to its runtime dependencies.
As a result, great care, and a lot of time, have been invested to ensure this gem is working with all the leading versions per each minor version of Ruby of all the runtime dependencies it can install with.
What does that mean specifically for the runtime dependencies?
We have 100% test coverage of lines and branches, and this test suite runs across a large matrix covering the latest patch for each of the following minor versions:
- MRI Ruby @ v2.3, v2.4, v2.5, v2.6, v2.7, v3.0, v3.1, v3.2, v3.3, v3.4, HEAD
- NOTE: This gem will still install on ruby v2.2, but vanilla GitHub Actions no longer supports testing against it, so YMMV.
- JRuby @ v9.2, v9.3, v9.4, v10.0, HEAD
- TruffleRuby @ v23.1, v23.2, HEAD
- gem faraday @ v0, v1, v2, HEAD
- gem jwt @ v1, v2, v3, HEAD
- gem logger @ v1.2, v1.5, v1.7, HEAD
- gem multi_xml @ v0.5, v0.6, v0.7, HEAD
gem rack @ v1.2, v1.6, v2, v3, HEAD
This gem follows a strict & correct (according to the maintainer of SemVer; ) interpretation of SemVer.
- Dropping support for any of the runtime dependency versions above will be a major version bump.
- If you aren't on one of the minor versions above, make getting there a priority.
You should upgrade this gem with confidence*.
You should upgrade the dependencies of this gem with confidence*.
Please do upgrade, and then, when it goes smooth as butter . Thanks!
If you are thinking, "that list is missing two runtime dependencies", you are correct!
Both of them were extracted from this gem. They are part of the oauth-xx org,
and are developed in tight collaboration with this gem, so not much more needs to be said about them.
- gem snaky_hash -
- gem version_gem -
* MIT license; I am unable to make guarantees.
| ? Test matrix brought to you by | ? appraisal++ |
|---|---|
| Adds back support for old Rubies |  |
| Adds support for eval_gemfile | |
| Please review | my PRs! |
And now for the finer details...
- 2025-05-16
- TAG:
- COVERAGE: 100.00% -- 518/518 lines in 14 files
- BRANCH COVERAGE: 100.00% -- 170/170 branches in 14 files
- 79.05% documented ### Added
- - Added funding.yml (@Aboling0)
- - Added .gitlab-ci.yml ()
- - Documentation of support for ILO Fundamental Principles of Rights at Work (@pboling)
- - 20-year certificate for signing gem releases, expires 2045-04-29 (@pboling)
- Gemspec metadata
- funding_uri
- news_uri
- mailing_list_uri
- SHA256 and SHA512 Checksums for release
- Gemspec metadata
- - Add token_name option (@pboling)
- Specify the parameter name that identifies the access token
- - Add OAuth2::OAUTH_DEBUG constant, based on `ENV
- - Add OAuth2.config.silence_extra_tokens_warning, default: false (@pboling)
- - Add IETF RFC 7009 Token Revocation compliant (@pboling)
- OAuth2::Client#revoke_token
- OAuth2::AccessToken#revoke
- See:
- , - Added CITATION.cff (@Aboling0)
- - Improved documentation (@pboling)
Changed - Default value of OAuth2.config.silence_extra_tokens_warning was false, now true (@pboling)
- Gem releases are now cryptographically signed, with a 20-year cert (@pboling)
- Allow linux distros to build release without signing, as their package managers sign independently
- - OAuth2::AccessToken#refresh now supports block param pass through (@pboling)
- - OAuth2.config is no longer writable (@pboling)
- - Errors raised by OAuth2::AccessToken are now always OAuth2::Error and have better metadata (@pboling)
Fixed - - restoring an access token via AccessToken#from_hash (@pboling)
- This was a 13 year old bug report. ?
- - Internal options (like snaky, raise_errors, and parse) are no longer included in request (@pboling)
- - Spaces will now be encoded as %20 instead of + (@nov.matake)
- - CHANGELOG.md documentation fix (@skuwa229)
- - fix expired? when expires_in is 0 (@disep)
- - Only instantiate OAuth2::Error if raise_errors option is true (@glytch2)
- - AccessToken#to_hash is now serializable, just a regular Hash (@pboling)
- - README.md documentation fix (@martinezcoder)
- - Do not include sensitive information in the inspect (@manuelvanrijn)
- - Made default JSON response parser more resilient (@pboling)
- - Response no longer becomes a snaky hash (@pboling)
- - Change require to require_relative (improve performance) (@Aboling0)
Discuss this post on