brakeman 5.4.1 → 6.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 88049c2c49d114a2921ded02a16ae8be8cb9717976aa026d14a8386046668702
-  data.tar.gz: 2d3bbf4de0df432415432657e0ff658eddd7edb860a29def3d1ae707e968b143
+  metadata.gz: 7c7876c1e5abb094b22e78c96522c909b81ff3c525cd967335c0239023927b82
+  data.tar.gz: be69894779fafb1e33f1625c98f3b9c12b346c9f932b058d3478e1b8ea9aee08
 SHA512:
-  metadata.gz: 3910fabad6692126c5080485901629763cebd2355107fe821c2077af74fe2e1566cf936e7135e5d2c301bf43b8f95f6534c06cabfa56638a839e86a1202fbd40
-  data.tar.gz: d012ad0ee09eb897912350f399d0ff12589a2bf46f63a7dc9459f88dfa39c3aee9da6dd751c4636cd6e0b050781e0bef5e7471587da7a3446f66a196e81549c6
+  metadata.gz: 06ca1e3bbed1c7e8afc28887030d52e6c7ece859fc8a913108c43cdfe2812140d5a46c9b2e53fbfcb334b3e2eb842fe5ed1f7d01975198293e877203961ee8c5
+  data.tar.gz: 1b5e2b7c87a4cde55f036b238651958f7a051eaae9efbefd8d7fed1b2ecbeb8c059d1e268ad9216fc284bc75cf56412bb76e7538f3f0fca26c3308c10267ebdc

data/CHANGES.md

@@ -1,3 +1,40 @@
+# 6.1.2 - 2024-02-01
+
+* Update Highline to 3.0
+* Add EOL date for Ruby 3.3.0
+* Avoid copying Sexps that are too large
+* Avoid detecting `ViewComponentContrib::Base` as dynamic render paths (vividmuimui)
+* Remove deprecated use of `Kernel#open("|...")`
+* Remove `safe_yaml` gem dependency
+* Avoid detecting Phlex components as dynamic render paths (Máximo Mussini)
+
+# 6.1.1 - 2023-12-24
+
+* Handle racc as a default gem in Ruby 3.3.0
+
+# 6.1.0 - 2023-12-04
+
+* Add `--timing` to add timing duration for scan steps
+* Fix keyword splats in filter arguments
+* Add check for unfiltered search with Ransack
+* Fix class method lookup in parent classes
+* Handle `class << self`
+* Add `PG::Connection.escape_string` as a SQL sanitization method (Joévin Soulenq)
+
+# 6.0.1 - 2023-07-20
+
+* Accept strings for `load_defaults` version
+
+# 6.0.0 - 2023-05-24
+
+* Add obsolete fingerprints to comparison report
+* Warn about missing CSRF protection when defaults are not loaded (Chris Kruger)
+* Scan directories that include the word `public`
+* Raise minimum Ruby version to 3.0
+* Drop support for Ruby 1.8/1.9 syntax
+* Fix end-of-life dates for Ruby
+* Fix false positive with `content_tag` in newer Rails
+
 # 5.4.1 - 2023-02-21
 
 * Fix file/line location for EOL software warnings

data/README.md

@@ -66,7 +66,7 @@ Outside of Rails root (note that the output file is relative to path/to/rails/ap
 
 Brakeman should work with any version of Rails from 2.3.x to 7.x.
 
-Brakeman can analyze code written with Ruby 1.8 syntax and newer, but requires at least Ruby 2.5.0 to run.
+Brakeman can analyze code written with Ruby 2.0 syntax and newer, but requires at least Ruby 3.0.0 to run.
 
 # Basic Options
 
@@ -182,7 +182,7 @@ There is a [plugin available](http://brakemanscanner.org/docs/jenkins/) for Jenk
 
 For even more continuous testing, try the [Guard plugin](https://github.com/guard/guard-brakeman).
 
-There are a couple [Github Actions](https://github.com/marketplace?type=actions&query=brakeman) available.
+There are a couple [GitHub Actions](https://github.com/marketplace?type=actions&query=brakeman) available.
 
 # Building
 

data/bundle/load.rb

@@ -1,16 +1,14 @@
 path = File.expand_path('../..', __FILE__)
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/erubis-2.7.0/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/haml-5.2.2/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/highline-2.1.0/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/parallel-1.22.1/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/rexml-3.2.5/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/ruby2ruby-2.4.4/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/ruby_parser-3.19.2/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/ruby_parser-legacy-1.0.0/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/safe_yaml-1.0.5/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/sexp_processor-4.16.1/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/slim-4.1.0/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/temple-0.8.2/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/terminal-table-1.8.0/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/tilt-2.0.11/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/unicode-display_width-1.8.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.3.0/gems/erubis-2.7.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.3.0/gems/haml-5.2.2/lib"
+$:.unshift "#{path}/bundle/ruby/3.3.0/gems/highline-3.0.1/lib"
+$:.unshift "#{path}/bundle/ruby/3.3.0/gems/parallel-1.24.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.3.0/gems/rexml-3.2.6/lib"
+$:.unshift "#{path}/bundle/ruby/3.3.0/gems/ruby2ruby-2.4.4/lib"
+$:.unshift "#{path}/bundle/ruby/3.3.0/gems/ruby_parser-3.20.3/lib"
+$:.unshift "#{path}/bundle/ruby/3.3.0/gems/sexp_processor-4.17.1/lib"
+$:.unshift "#{path}/bundle/ruby/3.3.0/gems/slim-4.1.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.3.0/gems/temple-0.8.2/lib"
+$:.unshift "#{path}/bundle/ruby/3.3.0/gems/terminal-table-1.8.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.3.0/gems/tilt-2.0.11/lib"
+$:.unshift "#{path}/bundle/ruby/3.3.0/gems/unicode-display_width-1.8.0/lib"

data/bundle/ruby/{3.1.0/gems/highline-2.1.0 → 3.3.0/gems/highline-3.0.1}/Changelog.md

@@ -2,6 +2,24 @@
 
 Below is a complete listing of changes for each revision of HighLine.
 
+### 3.0.1 / 2024-01-20
+* PR #268 - Remove unused abbrev dependency (@zvkemp)
+
+### 3.0.0 / 2024-01-05
+* PR #265 - Change Readline for Reline for Ruby 3.3 compat (@abinoam)
+* PR #264 - Add abbrev gem as dependency (@mathieujobin)
+* PR #263 - Release 3.0.0.pre.1
+  * Raise minimum Ruby version requirement to 3.0
+* PR #262 - Do not call stty on non-tty (@kbrock)
+* PR #260 / I #43 - Ctrl-U (erase line) handling (@abinoam, issue by @gutenye)
+* PR #259 / I #236 - Handle Ctrl-C when Question#echo = false (@abinoam, @Fahhetah, issue by @aspyct)
+* PR #258 / I #246 - Add validation class support (@abinoam, issue by @Joshfindit)
+  * Make it dry-types compatible through the use of `#valid?`
+  * Solve the multiple answers in one line problem with a combination of custom coercion (parser) and custom validation
+* PR #257 / I #233 - Show Question#default hint for non String values (@abinoam, issue by @branch14)
+  * Add Question#default_hint_show to allow disabling it.
+* PR #256 / I #249 - Fix Array validation in Question#in (@abinoam, issue by @esotericpig)
+
 ### 2.1.0 / 2022-12-31
 * PR #255 - Change minimum Ruby version requirement to 2.3 (@abinoam)
 * PR #254 - Improve Github Actions file (@abinoam)

data/bundle/ruby/{3.1.0/gems/highline-2.1.0 → 3.3.0/gems/highline-3.0.1}/README.md

@@ -43,12 +43,48 @@ puts "You have answered: #{answer}"
 
 cli.ask("Company?  ") { |q| q.default = "none" }
 
+## Disable default value hint showing
+
+my_special_default_object = Object.new
+
+cli.ask("Question?  ") do |q|
+  q.default = my_special_default_object
+  q.default_hint_show = false
+end
+
 
 # Validation
 
 cli.ask("Age?  ", Integer) { |q| q.in = 0..105 }
 cli.ask("Name?  (last, first)  ") { |q| q.validate = /\A\w+, ?\w+\Z/ }
 
+## Validation with custom class
+class ZeroToTwentyFourValidator
+  def self.valid?(answer)
+    (0..24).include? answer.to_i
+  end
+
+  def self.inspect
+    "(0..24) rule"
+  end
+end
+
+cli.ask("What hour of the day is it?:  ", Integer) do |q|
+  q.validate = ZeroToTwentyFourValidator
+end
+
+## Validation with Dry::Types
+## `Dry::Types` provides a `valid?` method so it can be used effortlessly
+
+require 'dry-type'
+
+module Types
+  include Dry.Types
+end
+
+cli.ask("Type an integer:", Integer) do |q|
+  q.validate = Types::Coercible::Integer
+end
 
 # Type conversion for answers:
 
@@ -103,7 +139,7 @@ For more examples see the examples/ directory of this project.
 Requirements
 ------------
 
-HighLine from version >= 1.7.0 requires ruby >= 1.9.3
+HighLine from version >= 3.0.0 requires ruby >= 3.0.0
 
 Installing
 ----------

data/bundle/ruby/{3.1.0/gems/highline-2.1.0 → 3.3.0/gems/highline-3.0.1}/highline.gemspec

@@ -27,9 +27,11 @@ DESCRIPTION
 
   spec.extra_rdoc_files = %w[README.md TODO Changelog.md LICENSE]
 
-  spec.required_ruby_version = ">= 2.3"
+  spec.required_ruby_version = ">= 3.0"
 
   spec.add_development_dependency "bundler"
   spec.add_development_dependency "rake"
   spec.add_development_dependency "minitest"
+  spec.add_development_dependency "dry-types"
+  spec.add_development_dependency "reline"
 end

data/bundle/ruby/{3.1.0/gems/highline-2.1.0 → 3.3.0/gems/highline-3.0.1}/lib/highline/io_console_compatible.rb

@@ -13,7 +13,7 @@ require "tempfile"
 #
 
 module IOConsoleCompatible
-  def getch
+  def getch(min:nil, time:nil, intr: nil)
     getc
   end
 

data/bundle/ruby/{3.1.0/gems/highline-2.1.0 → 3.3.0/gems/highline-3.0.1}/lib/highline/question/answer_converter.rb

@@ -9,7 +9,7 @@ class HighLine
       extend Forwardable
 
       def_delegators :@question,
-                     :answer, :answer=, :check_range,
+                     :answer, :answer=,
                      :directory, :answer_type, :choices_complete
 
       # It should be initialized with a Question object.
@@ -26,10 +26,7 @@ class HighLine
       # it makes the conversion and returns the answer.
       # @return [Object] the converted answer.
       def convert
-        return unless answer_type
-
-        self.answer = convert_by_answer_type
-        check_range
+        self.answer = convert_by_answer_type if answer_type
         answer
       end
 

data/bundle/ruby/{3.1.0/gems/highline-2.1.0 → 3.3.0/gems/highline-3.0.1}/lib/highline/question.rb

@@ -56,6 +56,7 @@ class HighLine
       @completion  = @answer_type
 
       @echo         = true
+      @default_hint_show = true
       @whitespace   = :strip
       @case         = nil
       @in           = nil
@@ -115,7 +116,7 @@ class HighLine
     #
     attr_accessor :echo
     #
-    # Use the Readline library to fetch input.  This allows input editing as
+    # Use the Reline library to fetch input.  This allows input editing as
     # well as keeping a history.  In addition, tab will auto-complete
     # within an Array of choices or a file listing.
     #
@@ -124,6 +125,7 @@ class HighLine
     # specified _input_ stream.
     #
     attr_accessor :readline
+
     #
     # Used to control whitespace processing for the answer to this question.
     # See HighLine::Question.remove_whitespace() for acceptable settings.
@@ -136,10 +138,17 @@ class HighLine
     attr_accessor :case
     # Used to provide a default answer to this question.
     attr_accessor :default
+    # Set it to a truthy or falsy value to enable or disable showing the default
+    # value hint between vertical bars (pipes) when asking the question.
+    # Defaults to +true+
+    attr_accessor :default_hint_show
     #
     # If set to a Regexp, the answer must match (before type conversion).
     # Can also be set to a Proc which will be called with the provided
     # answer to validate with a +true+ or +false+ return.
+    # It's possible to use a custom validator class. It must respond to
+    # `#valid?`. The result of `#inspect` will be used in error messages.
+    # See README.md for details.
     #
     attr_accessor :validate
     # Used to control range checks for answer.
@@ -252,7 +261,7 @@ class HighLine
     #   Same as {#answer_type}.
 
     def build_responses(message_source = answer_type)
-      append_default if [::String, Symbol].include? default.class
+      append_default_to_template if default_hint_show
 
       new_hash = build_responses_new_hash(message_source)
       # Update our internal responses with the new hash
@@ -497,7 +506,8 @@ class HighLine
     def valid_answer?
       !validate ||
         (validate.is_a?(Regexp) && answer =~ validate) ||
-        (validate.is_a?(Proc)   && validate[answer])
+        (validate.is_a?(Proc)   && validate[answer]) ||
+        (validate.respond_to?(:valid?) && validate.valid?(answer))
     end
 
     #
@@ -571,11 +581,6 @@ class HighLine
       end
     end
 
-    # readline() needs to handle its own output, but readline only supports
-    # full line reading.  Therefore if question.echo is anything but true,
-    # the prompt will not be issued. And we have to account for that now.
-    # Also, JRuby-1.7's ConsoleReader.readLine() needs to be passed the prompt
-    # to handle line editing properly.
     # @param highline [HighLine] context
     # @return [void]
     def show_question(highline)
@@ -607,15 +612,20 @@ class HighLine
     # Trailing whitespace is preserved so the function of HighLine.say() is
     # not affected.
     #
-    def append_default
+    def append_default_to_template
+      return unless default.respond_to? :to_s
+
+      default_str = default.to_s
+      return if default_str.empty?
+
       if template =~ /([\t ]+)\Z/
-        template << "|#{default}|#{Regexp.last_match(1)}"
+        template << "|#{default_str}|#{Regexp.last_match(1)}"
       elsif template == ""
-        template << "|#{default}|  "
+        template << "|#{default_str}|  "
       elsif template[-1, 1] == "\n"
-        template[-2, 0] = "  |#{default}|"
+        template[-2, 0] = "  |#{default_str}|"
       else
-        template << "  |#{default}|"
+        template << "  |#{default_str}|"
       end
     end
 

data/bundle/ruby/{3.1.0/gems/highline-2.1.0 → 3.3.0/gems/highline-3.0.1}/lib/highline/question_asker.rb

@@ -24,13 +24,15 @@ class HighLine
     #
     # @return [String] answer
     def ask_once
-      question.show_question(@highline)
+      # If in readline mode, let reline take care of the prompt
+      question.show_question(@highline) unless question.readline
 
       begin
         question.get_response_or_default(@highline)
         raise NotValidQuestionError unless question.valid_answer?
 
         question.convert
+        question.check_range
 
         if question.confirm
           confirmation = @highline.send(:confirm, question)

data/bundle/ruby/{3.1.0/gems/highline-2.1.0 → 3.3.0/gems/highline-3.0.1}/lib/highline/terminal/io_console.rb

@@ -27,7 +27,7 @@ class HighLine
 
       # (see Terminal#get_character)
       def get_character
-        input.getch # from ruby io/console
+        input.getch(intr: true) # from ruby io/console
       rescue Errno::ENOTTY
         input.getc
       end

data/bundle/ruby/{3.1.0/gems/highline-2.1.0 → 3.3.0/gems/highline-3.0.1}/lib/highline/terminal/unix_stty.rb

@@ -20,7 +20,9 @@ class HighLine
         rescue LoadError
         end
 
-        if /solaris/ =~ RUBY_PLATFORM &&
+        if !@output.tty?
+          [80, 24]
+        elsif /solaris/ =~ RUBY_PLATFORM &&
            `stty` =~ /\brows = (\d+).*\bcolumns = (\d+)/
           [Regexp.last_match(2), Regexp.last_match(1)].map(&:to_i)
         elsif `stty size` =~ /^(\d+)\s(\d+)$/
@@ -32,13 +34,13 @@ class HighLine
 
       # (see Terminal#raw_no_echo_mode)
       def raw_no_echo_mode
-        @state = `stty -g`
-        system "stty raw -echo -icanon isig"
+        save_stty 
+        system "stty raw -echo -icanon isig" if input.tty?
       end
 
       # (see Terminal#restore_mode)
       def restore_mode
-        system "stty #{@state}"
+        restore_stty
         print "\r"
       end
 

data/bundle/ruby/{3.1.0/gems/highline-2.1.0 → 3.3.0/gems/highline-3.0.1}/lib/highline/terminal.rb

@@ -95,9 +95,9 @@ class HighLine
     # Get one line using #readline_read
     # @param (see #get_line)
     def get_line_with_readline(question, highline)
-      require "readline" # load only if needed
+      require "reline" # load only if needed
 
-      raw_answer = readline_read(question)
+      raw_answer = readline_read(question, highline)
 
       if !raw_answer && highline.track_eof?
         raise EOFError, "The input stream is exhausted."
@@ -109,7 +109,7 @@ class HighLine
     # Use readline to read one line
     # @param question [HighLine::Question] question from where to get
     #   autocomplete candidate strings
-    def readline_read(question)
+    def readline_read(question, highline)
       # prep auto-completion
       unless question.selection.empty?
         Readline.completion_proc = lambda do |str|
@@ -117,12 +117,14 @@ class HighLine
         end
       end
 
+      # TODO: Check if this is still needed after Reline
       # work-around ugly readline() warnings
       old_verbose = $VERBOSE
       $VERBOSE    = nil
 
       raw_answer  = run_preserving_stty do
-        Readline.readline("", true)
+        prompt = highline.render_and_ident_statement(question)
+        Readline.readline(prompt, true)
       end
 
       $VERBOSE = old_verbose
@@ -176,7 +178,7 @@ class HighLine
     # Saves terminal state using shell stty command.
     def save_stty
       @stty_save = begin
-                     `stty -g`.chomp
+                     `stty -g`.chomp if input.tty?
                    rescue StandardError
                      nil
                    end

data/bundle/ruby/{3.1.0/gems/highline-2.1.0 → 3.3.0/gems/highline-3.0.1}/lib/highline/version.rb

@@ -2,5 +2,5 @@
 
 class HighLine
   # The version of the installed library.
-  VERSION = "2.1.0".freeze
+  VERSION = "3.0.1".freeze
 end

data/bundle/ruby/{3.1.0/gems/highline-2.1.0 → 3.3.0/gems/highline-3.0.1}/lib/highline.rb

@@ -14,7 +14,6 @@ require "English"
 require "erb"
 require "optparse"
 require "stringio"
-require "abbrev"
 require "highline/terminal"
 require "highline/custom_errors"
 require "highline/question"
@@ -371,10 +370,8 @@ class HighLine
   #
   # @param statement [Statement, String] what to be said
   def say(statement)
-    statement = render_statement(statement)
-    return if statement.empty?
-
-    statement = (indentation + statement)
+    statement = render_and_ident_statement(statement)
+    return statement if statement.empty?
 
     # Don't add a newline if statement ends with whitespace, OR
     # if statement ends with whitespace before a color escape code.
@@ -386,6 +383,18 @@ class HighLine
     end
   end
 
+  # Renders and indents a statement.
+  #
+  # Note: extracted here to be used by readline to render its prompt.
+  #
+  # @param statement [String] The statement to be rendered and indented.
+  # @return [String] The rendered and indented statement.
+  def render_and_ident_statement(statement)
+    statement = render_statement(statement)
+    statement = (indentation + statement) unless statement.empty?
+    statement
+  end
+
   # Renders a statement using {HighLine::Statement}
   # @param statement [String] any string
   # @return [Statement] rendered statement
@@ -538,6 +547,7 @@ class HighLine
     terminal.raw_no_echo_mode_exec do
       loop do
         character = terminal.get_character
+        raise Interrupt if character == "\u0003"
         break unless character
         break if ["\n", "\r"].include? character
 
@@ -545,6 +555,9 @@ class HighLine
         if character == "\b" || character == "\u007F"
           chopped = line.chop!
           output_erase_char if chopped && question.echo
+        elsif character == "\cU"
+          line.size.times { output_erase_char } if question.echo
+          line = ""
         elsif character == "\e"
           ignore_arrow_key
         else

data/bundle/ruby/3.3.0/gems/parallel-1.24.0/lib/parallel/version.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+module Parallel
+  VERSION = Version = '1.24.0' # rubocop:disable Naming/ConstantName
+end

data/bundle/ruby/{3.1.0/gems/parallel-1.22.1 → 3.3.0/gems/parallel-1.24.0}/lib/parallel.rb

@@ -1,11 +1,8 @@
 # frozen_string_literal: true
 require 'rbconfig'
 require 'parallel/version'
-require 'parallel/processor_count'
 
 module Parallel
-  extend ProcessorCount
-
   Stop = Object.new.freeze
 
   class DeadWorker < StandardError
@@ -307,6 +304,49 @@ module Parallel
       map(*args, &block).flatten(1)
     end
 
+    def filter_map(*args, &block)
+      map(*args, &block).compact
+    end
+
+    # Number of physical processor cores on the current system.
+    def physical_processor_count
+      @physical_processor_count ||= begin
+        ppc =
+          case RbConfig::CONFIG["target_os"]
+          when /darwin[12]/
+            IO.popen("/usr/sbin/sysctl -n hw.physicalcpu").read.to_i
+          when /linux/
+            cores = {} # unique physical ID / core ID combinations
+            phy = 0
+            File.read("/proc/cpuinfo").scan(/^physical id.*|^core id.*/) do |ln|
+              if ln.start_with?("physical")
+                phy = ln[/\d+/]
+              elsif ln.start_with?("core")
+                cid = "#{phy}:#{ln[/\d+/]}"
+                cores[cid] = true unless cores[cid]
+              end
+            end
+            cores.count
+          when /mswin|mingw/
+            require 'win32ole'
+            result_set = WIN32OLE.connect("winmgmts://").ExecQuery(
+              "select NumberOfCores from Win32_Processor"
+            )
+            result_set.to_enum.collect(&:NumberOfCores).reduce(:+)
+          else
+            processor_count
+          end
+        # fall back to logical count if physical info is invalid
+        ppc > 0 ? ppc : processor_count
+      end
+    end
+
+    # Number of processors seen by the OS, used for process scheduling
+    def processor_count
+      require 'etc'
+      @processor_count ||= Integer(ENV['PARALLEL_PROCESSOR_COUNT'] || Etc.nprocessors)
+    end
+
     def worker_number
       Thread.current[:parallel_worker_number]
     end
@@ -600,10 +640,34 @@ module Parallel
     end
 
     def instrument_finish(item, index, result, options)
-      return unless on_finish = options[:finish]
+      return unless (on_finish = options[:finish])
+      return instrument_finish_in_order(item, index, result, options) if options[:finish_in_order]
       options[:mutex].synchronize { on_finish.call(item, index, result) }
     end
 
+    # yield results in the order of the input items
+    # needs to use `options` to store state between executions
+    # needs to use `done` index since a nil result would also be valid
+    def instrument_finish_in_order(item, index, result, options)
+      options[:mutex].synchronize do
+        # initialize our state
+        options[:finish_done] ||= []
+        options[:finish_expecting] ||= 0 # we wait for item at index 0
+
+        # store current result
+        options[:finish_done][index] = [item, result]
+
+        # yield all results that are now in order
+        break unless index == options[:finish_expecting]
+        index.upto(options[:finish_done].size).each do |i|
+          break unless (done = options[:finish_done][i])
+          options[:finish_done][i] = nil # allow GC to free this item and result
+          options[:finish].call(done[0], i, done[1])
+          options[:finish_expecting] += 1
+        end
+      end
+    end
+
     def instrument_start(item, index, options)
       return unless on_start = options[:start]
       options[:mutex].synchronize { on_start.call(item, index) }