💎 ANN: oauth2 v2.0.10 released

#ruby #rails #security #supplychain

Photo (cropped) by Domino Studio on Unsplash

I've just released oauth2 v2.0.10. It's a big release with many new features, and many bug fixes. But I'll save all that for later... Right now I want to talk about Upgrading. I know it is scary to upgrade something that will break horribly if it goes wrong. It's likely user facing. It may be hard to test outside production.

This project sits underneath a large portion of the authorization systems on the internet. According to GitHub's project tracking, which I believe only reports on public projects, 100,000+ projects, and 500+ packages depend on this project. That is a lot of things to upgrade.

That means it is painful for the Ruby community when this gem forces updates to its runtime dependencies.

As a result, great care, and a lot of time, have been invested to ensure this gem is working with all the leading versions per each minor version of Ruby of all the runtime dependencies it can install with.

What does that mean specifically for the runtime dependencies?

100% test coverage of lines and branches, includes testing against the latest patch for each of the following minor versions:

MRI Ruby @ v2.3, v2.4, v2.5, v2.6, v2.7, v3.0, v3.1, v3.2, v3.3, v3.4, HEAD
- NOTE: This gem will still install on ruby v2.2, but vanilla GitHub Actions no longer supports testing against it, so YMMV.
JRuby @ v9.2, v9.3, v9.4, v10.0, HEAD
TruffleRuby @ v23.1, v23.2, HEAD
gem faraday @ v0, v1, v2, HEAD
gem jwt @ v1, v2, v3, HEAD
gem logger @ v1.2, v1.5, v1.7, HEAD
gem multi_xml @ v0.5, v0.6, v0.7, HEAD
gem rack @ v1.2, v1.6, v2, v3, HEAD
This gem follows a strict & correct (according to the maintainer of SemVer; more info) interpretation of SemVer.
- Dropping support for any of the runtime dependency versions above will be a major version bump.
- If you aren't on one of the minor versions above, make getting there a priority.
You should upgrade this gem with confidence*.
You should upgrade the dependencies of this gem with confidence*.
Please do upgrade, and then, when it goes smooth as butter please sponsor me. Thanks!

If you are thinking, "that list is missing two runtime dependencies", you are correct!
Both of them were extracted from this gem. They are part of the oauth-xx org,
and are developed in tight collaboration with this gem, so not much more needs to be said about them.

gem snaky_hash - https://gitlab.com/oauth-xx/snaky_hash
gem version_gem - https://gitlab.com/oauth-xx/version_gem

* MIT license; I am unable to make guarantees.

Continue to the end for the CHANGELOG.md notes.

We have 100% test coverage of lines and branches, and this test suite runs across a very large matrix.
It wouldn't be possible without appraisal2.

🚚 Amazing test matrix was brought to you by	🔎 appraisal2 🔎 and the color 💚 green 💚
👟 Check it out!	✨ github.com/appraisal-rb/appraisal2 ✨

Support & Funding Info

I am a full-time FLOSS maintainer. If you find my work valuable I ask that you become a sponsor. Every dollar helps!

🥰 Support FLOSS work 🥰	Get access	"Sponsors" channel	on Galtzo FLOSS	Discord 👇️

And now for the finer details...

2.0.10 - 2025-05-16

TAG: v2.0.10
COVERAGE: 100.00% -- 518/518 lines in 14 files
BRANCH COVERAGE: 100.00% -- 170/170 branches in 14 files
79.05% documented ### Added
gh!632 - Added funding.yml (@aboling0)
!635 - Added .gitlab-ci.yml (@jessieay)
#638 - Documentation of support for ILO Fundamental Principles of Rights at Work (@pboling)
!642 - 20-year certificate for signing gem releases, expires 2045-04-29 (@pboling)
- Gemspec metadata
  - funding_uri
  - news_uri
  - mailing_list_uri
- SHA256 and SHA512 Checksums for release
!643 - Add token_name option (@pboling)
- Specify the parameter name that identifies the access token
!645 - Add OAuth2::OAUTH_DEBUG constant, based on `ENV"OAUTH_DEBUG"
!646 - Add OAuth2.config.silence_extra_tokens_warning, default: false (@pboling)
!647 - Add IETF RFC 7009 Token Revocation compliant (@pboling)
- OAuth2::Client#revoke_token
- OAuth2::AccessToken#revoke
- See: https://datatracker.ietf.org/doc/html/rfc7009
gh!644, gh!645 - Added CITATION.cff (@aboling0)
!648 - Improved documentation (@pboling)
Changed
Default value of OAuth2.config.silence_extra_tokens_warning was false, now true (@pboling)
Gem releases are now cryptographically signed, with a 20-year cert (@pboling)
- Allow linux distros to build release without signing, as their package managers sign independently
!647 - OAuth2::AccessToken#refresh now supports block param pass through (@pboling)
!647 - OAuth2.config is no longer writable (@pboling)
!647 - Errors raised by OAuth2::AccessToken are now always OAuth2::Error and have better metadata (@pboling)
Fixed
#95 - restoring an access token via AccessToken#from_hash (@pboling)
- This was a 13 year old bug report. 😘
#619 - Internal options (like snaky, raise_errors, and parse) are no longer included in request (@pboling)
!633 - Spaces will now be encoded as %20 instead of + (@nov.matake)
!634 - CHANGELOG.md documentation fix (@skuwa229)
!638 - fix expired? when expires_in is 0 (@disep)
!639 - Only instantiate OAuth2::Error if raise_errors option is true (@glytch2)
#639 - AccessToken#to_hash is now serializable, just a regular Hash (@pboling)
!640 - README.md documentation fix (@martinezcoder)
!641 - Do not include sensitive information in the inspect (@manuelvanrijn)
#641 - Made default JSON response parser more resilient (@pboling)
#645 - Response no longer becomes a snaky hash (@pboling)
gh!646 - Change require to require_relative (improve performance) (@aboling0)