- ruby-talk - ml.ruby-lang.org

[ruby-talk:444082] [ANN] hoe 4.0.1 Released
by Ryan Davis 17 Dec '22

17 Dec '22

hoe version 4.0.1 has been released! * home: <http://www.zenspider.com/projects/hoe.html> * code: <https://github.com/seattlerb/hoe> * bugs: <https://github.com/seattlerb/hoe/issues> * rdoc: <http://docs.seattlerb.org/hoe/> * doco: <http://docs.seattlerb.org/hoe/Hoe.pdf> * clog: <https://github.com/seattlerb/hoe/blob/master/History.rdoc> * other: <http://github.com/jbarnette/hoe-plugin-examples> Hoe is a rake/rubygems helper for project Rakefiles. It helps you manage, maintain, and release your project and includes a dynamic plug-in system allowing for easy extensibility. Hoe ships with plug-ins for all your usual project tasks including rdoc generation, testing, packaging, deployment, and announcement. See class rdoc for help. Hint: `ri Hoe` or any of the plugins listed below. For extra goodness, see: http://docs.seattlerb.org/hoe/Hoe.pdf Changes: ### 4.0.1 / 2022-12-17 * 1 bug fix: * Add extra checks to release_sanity to ensure history file is updated before release.

1 0

[ruby-talk:444061] A simple question about arguments
by Henry R 17 Dec '22

17 Dec '22

Sorry for this newbie question. For arguments to ruby methods, what's difference between these two? method(x:y) method(x=>y) Thanks

2 2

[ruby-talk:444043] [ANN] rodauth-oauth 1.0.0 released
by Tiago Cardoso 15 Dec '22

15 Dec '22

rodauth-oauth 1.0.0 has been released. rodauth-oauth is a rack-compatible toolkit for building OAuth 2.0 authorization servers, as well as OpenID Authentication Providers. rodauth-oauth is certified <https://openid.net/certification/> for the following profiles of the OpenID Connect™ protocol: Basic OP, Implicit OP, Hybrid OP, Config OP, Dynamic OP, Form Post OP. # as simple as rodauth do enable :oauth_authorization_code_grant # or enable :oidc end Among its features, it supports: * Authorization Code Grant * Refresh Token Grant * Implicit Grant * Client Credentials Grant * Device Code Grant * Token Revocation * Token Introspection * Auth Server Metadata * PKCE * Resource Indicators * JWT Access Tokens * Assertion Framework * SAML 2.0 Bearer Assertion Grant * JWT Bearer Assertion Grant * JWT Secured authorization requests * Dynamic Client Registration * OpenID * OpenID Discovery * OpenID Multiple Response types * OpenID Connect Dynamic Client Registration * OpenID Relying Party Initiated Logout It can also be used with Rails (via the "rodauth-rails" gem). Website: https://honeyryderchuck.gitlab.io/rodauth-oauth/ Documentation: https://honeyryderchuck.gitlab.io/rodauth-oauth/rdoc/ Wiki: https://gitlab.com/honeyryderchuck/rodauth-oauth/wikis/home CI: https://gitlab.com/honeyryderchuck/rodauth-oauth/pipeline These are the release notes since the last update: ## 1.0.0 (15/12/2022) ## Highlights rodauth-oauth is now [OpenID certified](https://openid.net/certification/) for the following certification profiles: * Basic OP * Implicit OP * Hybrid OP * Config OP * Dynamic OP * Form Post OP and passes the conformance tests for RP-Initiated Logout OP. The OIDC server used to run the test can be found [here](https://gitlab.com/os85/rodauth-oauth/-/blob/master/examples/oidc/aut… and deployed [here](https://rodauth-oauth-oidc.onrender.com). ### Breaking changes The full description of breaking changes, and suggestions on how to make the migration smoother, can be found in the [migration guide](https://gitlab.com/os85/rodauth-oauth/-/blob/6465b8522a78cf0037a55d3…. A short list of the main highlights: * Ruby 2.5 or higher is required. * `oauth_http_mac` feature removed. * `oauth_tokens` table (and resource) were removed (only `oauth_applications` and `oauth_grants`, access and refresh tokens are now properties of the latter). * access and refresh tokens hashed by default when stored in the database. * default oauth response mode is `"form_post"`. * oauth specific features require explicit enablement of respective features (no more `enable :oauth`) * refresh token policy is "rotation" by default * homepage url is no longer a client application required property. * OIDC RP-initiated logout extracted into `oidc_rp_initiated_logout` feature. ### Features The following helpers are exposed in the `rodauth` object: * `current_oauth_account` - returns the dataset row for the `rodauth` account associated to an oauth access token in the "authorization" header. * `current_oauth_application` - returns the dataset row for the oauth application associated to an oauth access token in the "authorization" header. When used in `rails` via `rodauth-rails`, both are exposed directly as controller helpers. #### `oauth_resource_server` plugin This plugin can be used as a convenience when configuring resource servers. #### JAR support for request_uri query param The `oauth_jwt_secured_authorization_request` plugin now supports a `request_uri` query param as well. #### OIDC features * The `oidc` plugin supports [essential claims](https://openid.net/specs/openid-connect-core-1_0.html#ClaimsParamet…, via the `claims` authorization request query parameter. * id token built with `"c_hash"` and `"at_hash"` claims when they should. ### Improvements * `:oauth_introspect` plugin: OAuth introspection endpoint exposes the token's `"username"` claim. * endpoint client authentication supports "client credentials grant" access tokens. * `acr_values_supported` exposed in the openid configuration. * `oauth_request_object_signing_alg_allow_none` enables `"none"` as an accepted request object signing alg when `true` (`false` by default). * OIDC `offline_access` supported. ### Bugfixes * fixed `oidc` calculation of `"auth_time"` claim. * JWT: "sub" is now always a string. * `response_type` is now an authorization request required parameter (as per the RFC). * `state` is now passed along when redirecting from authorization requests with `error`; * access token can now be read from POST body or GET query params (as per the RFC). * id token no longer shipping with claims with `null` value; * id token no longer encoding claims by default (only when `response_type=id_token`, as per the RFC). * support "JWT without kid" when doing jwt decoding for JWT tokens not generated in the provider (such as request objects). * Set `iss` and `aud` claims in the Userinfo JWT response. * Make sure errors are also delivered via form POST, when `response_mode=form_post`. * Authorization request now shows an error page when `response_type` or `client_id` are missing, or `redirect_uri` is missing or invalid; a new `"authorize_error"` template is invoked in such cases. * oidc: nonce present in id token when using the "id_token token" response type. * error parameter delivered in URL fragment when failing an implicit grant autorization request.

1 0

[ruby-talk:444042] How much speedup is caused by dispatch chains
by Faraaz Ahmad 15 Dec '22

15 Dec '22

Hi everyone! I'm writing a talk on how dispatch chains cause more cache hits in the RubyVM using this great article by Matthew Alp: https://mattalp.com/blog/dispatch-chains/. However, I'm unable to find any benchmarks on how much speedup is gained. Can someone please help me find any data on this my talk is tomorrow and I'm kinda panicking now haha Regards, Faraaz

1 0

[ruby-talk:444038] package load error
by Henry R 15 Dec '22

15 Dec '22

Hi I have installed "bunny" (rabbitmq client) via gem. but this package can't be loaded. please see follows. $ sudo gem install bunny Successfully installed bunny-2.19.0 Parsing documentation for bunny-2.19.0 Done installing documentation for bunny after 1 seconds 1 gem installed $ irb irb(main):001:0> require "bunny" <internal:/snap/ruby/290/lib/ruby/3.1.0/rubygems/core_ext/kernel_require.rb>:85:in `require': cannot load such file -- bunny (LoadError) from <internal:/snap/ruby/290/lib/ruby/3.1.0/rubygems/core_ext/kernel_require.rb>:85:in `require' from (irb):1:in `<main>' from /snap/ruby/290/lib/ruby/gems/3.1.0/gems/irb-1.4.1/exe/irb:11:in `<top (required)>' from /snap/ruby/290/bin/irb:25:in `load' from /snap/ruby/290/bin/irb:25:in `<main>' My ruby version is ruby 3.1.3p185. Can you help? Thanks

3 3

[ruby-talk:444032] Processing a spreadsheet
by Matt Lawrence 13 Dec '22

13 Dec '22

Here's the task: I need to take an Excel spreadsheet from Sharepoint, slice & dice it, and write the output into a database Tools I have: Windows 10 laptop with WSL2 installed and I have admin rights, so I can install whatever. If I can't read from Sharepoint, then I can manually save a copy locally. Automation would be nice If I can't read the Excel spreadsheet, then I can manually open it and write a csv I can use what ever database I want that I can install, sqlite, mysql, mariadb, postgresql or even MongoDB, so not a problem I've done lots of slicing & dicing text files in a multitude of languages, I just plan to use Ruby because it's my favorite It's the first couple of steps that I would like to automate. Any suggestions? -- Matt

3 3

[ruby-talk:444036] [ANN] rails-html-sanitizer security update v1.4.4
by Mike Dalessio 13 Dec '22

13 Dec '22

rails-html-sanitizer v1.4.4 has been released. This is a security update which addresses multiple CVEs, and users are recommended to upgrade immediately. The release notes are reproduced below, for more information please read the linked GHSAs. --- 1.4.4 / 2022-12-13 - Address inefficient regular expression complexity with certain configurations of Rails::Html::Sanitizer. Fixes CVE-2022-23517. See GHSA-5x79-w82f-gw8w <https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-5x79…> for more information. - Address improper sanitization of data URIs. Fixes CVE-2022-23518 and #135. See GHSA-mcvf-2q2m-x72m <https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-mcvf…> for more information. - Address possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer. Fixes CVE-2022-23520. See GHSA-rrfc-7g8p-99q8 <https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rrfc…> for more information. - Address possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer. Fixes CVE-2022-23519. See GHSA-9h9g-93gc-623h <https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-9h9g…> for more information.

1 0

[ruby-talk:444035] [ANN] loofah security update v2.19.1
by Mike Dalessio 13 Dec '22

13 Dec '22

loofah v2.19.1 has been released. This a security update which addresses multiple CVEs, and users are recommended to upgrade immediately. The release notes <https://github.com/flavorjones/loofah/releases/tag/v2.19.1> are reproduced below, for more information please read the linked GHSAs. --- 2.19.1 / 2022-12-13Security - Address CVE-2022-23514, inefficient regular expression complexity. See GHSA-486f-hjj9-9vhh <https://github.com/flavorjones/loofah/security/advisories/GHSA-486f-hjj9-9v…> for more information. - Address CVE-2022-23515, improper neutralization of data URIs. See GHSA-228g-948r-83gx <https://github.com/flavorjones/loofah/security/advisories/GHSA-228g-948r-83…> for more information. - Address CVE-2022-23516, uncontrolled recursion. See GHSA-3x8r-x6xp-q4vm <https://github.com/flavorjones/loofah/security/advisories/GHSA-3x8r-x6xp-q4…> for more information.

1 0

[ruby-talk:444031] Re: Scope change for NotImplementedError exception class
by SHIBATA Hiroshi 11 Dec '22

11 Dec '22

>> [2] http://lists.ruby-lang.org/pipermail/ruby-core/ I migrate above list to the following site: https://ml.ruby-lang.org/mailman3/hyperkitty/list/ruby-core@ml.ruby-lang.or… On Wed, Nov 16, 2022 at 1:15 AM Michał Zając <ruby-lang.org(a)quintasan.pl> wrote: > > Hello, > > Long story short, I would like to propose to extend the usecase for > NotImplementedError to account for cases when the codepath has not been > implemented for some reason (similar to Python's NotImplementedError). I > did write a proposal on Redmine [1] but I think it wasn't seen yet. If > this is not the appropriate place to discuss such things then please let > me know where should I post this. I tried browsing archives of ruby-core > to see it it would be a better place but the archive link [2] gives a > 404 so I'm not really sure if that list is still alive. > > [1] https://bugs.ruby-lang.org/issues/18915 > [2] http://lists.ruby-lang.org/pipermail/ruby-core/ > > Unsubscribe: <mailto:ruby-talk-request@ruby-lang.org?subject=unsubscribe> > <http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-talk>

1 0

[ruby-talk:444030] [ANN] Nokogiri security update v1.13.10
by Mike Dalessio 07 Dec '22

07 Dec '22

Nokogiri v1.13.10 has been released with a security update for CRuby users. The release notes[1] are reproduced here for your convenience. [1]: https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.10 --- 1.13.10 / 2022-12-07Security - [CRuby] Address CVE-2022-23476, unchecked return value from xmlTextReaderExpand. See GHSA-qv4q-mr5r-qprj <https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-qv4q-mr5…> for more information. Improvements - [CRuby] XML::Reader#attribute_hash now returns nil on parse errors. This restores the behavior of #attributes from v1.13.7 and earlier. [ #2715 <https://github.com/sparklemotion/nokogiri/issues/2715>] ------------------------------ sha256 checksums: 777ce2e80f64772e91459b943e531dfef387e768f2255f9bc7a1655f254bbaa1 nokogiri-1.13.10-aarch64-linux.gem b432ff47c51386e07f7e275374fe031c1349e37eaef2216759063bc5fa5624aa nokogiri-1.13.10-arm64-darwin.gem 73ac581ddcb680a912e92da928ffdbac7b36afd3368418f2cee861b96e8c830b nokogiri-1.13.10-java.gem 916aa17e624611dddbf2976ecce1b4a80633c6378f8465cff0efab022ebc2900 nokogiri-1.13.10-x64-mingw-ucrt.gem 0f85a1ad8c2b02c166a6637237133505b71a05f1bb41b91447005449769bced0 nokogiri-1.13.10-x64-mingw32.gem 91fa3a8724a1ce20fccbd718dafd9acbde099258183ac486992a61b00bb17020 nokogiri-1.13.10-x86-linux.gem d6663f5900ccd8f72d43660d7f082565b7ffcaade0b9a59a74b3ef8791034168 nokogiri-1.13.10-x86-mingw32.gem 81755fc4b8130ef9678c76a2e5af3db7a0a6664b3cba7d9fe8ef75e7d979e91b nokogiri-1.13.10-x86_64-darwin.gem 51d5246705dedad0a09b374d09cc193e7383a5dd32136a690a3cd56e95adf0a3 nokogiri-1.13.10-x86_64-linux.gem d3ee00f26c151763da1691c7fc6871ddd03e532f74f85101f5acedc2d099e958 nokogiri-1.13.10.gem

1 0