disarm 0.14.1-aarch64-linux → 0.15.0-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 40d3335e15f74858ee0ae3ea3ce35093febb3cadcac08d62cd7a873cf0d14acd
-  data.tar.gz: 92a8dee4515698525dcbf550b0a794543f3595b6258966f16f82a3d13407878a
+  metadata.gz: affa6ae8c002469f386f0cc010093af423746f17b2b23f33cb8e5baeef7d460a
+  data.tar.gz: 8c04e95811cc9608f473a44c85815c2e37332c5c71d489963a236b83e1a405e4
 SHA512:
-  metadata.gz: 8ddcbc8bd78371985f105e6bd4f42b631e1c8edfcb951447785f804a0cdb1f7cc9587f3a1d62925113d59bed5c9e83751e44e04a852f0f6f5f6cb9f91b654a03
-  data.tar.gz: 6b55888ddad977c96ac7ddb4ac92941769c10bf298ca640d8706cd0841ac9ecea2625595de757e25609edddd8bd128bb8100ecd54513587c011f064578c38e0f
+  metadata.gz: 2102a383ea426986f32d6bbc2c1aa52970226e9e7ed135b5d6f0bd34102c060b5076dd12071985e695ccf3638499930ee4d2ad8b414f0fbc5d4871de38d82bbd
+  data.tar.gz: 70976043387c5e0d0cf23c5ced76e0bb58af9cae186f03937963ff08f98e225f90443e4077f93d4cb56e7a27d29812ca37bea3bc4a21fb9ac2f97ca2ec849cab

data/README.md

@@ -19,9 +19,10 @@ gem "disarm"
 gem install disarm
 ```
 
-Requires Ruby >= 3.1. `gem install disarm` pulls a precompiled platform gem
-(Linux x86_64/aarch64, macOS x86_64/arm64, Windows) when one is available, and
-falls back to compiling from source (needs a Rust toolchain) otherwise.
+Requires Ruby >= 3.1. Precompiled platform gems ship for Ruby 3.1 through 4.0
+(Linux x86_64/aarch64, macOS x86_64/arm64, Windows). On a supported Ruby with no
+matching platform gem, the source gem installs and compiles locally, which needs a
+Rust toolchain. Below 3.1 the gem does not install at all.
 
 ## Usage
 
@@ -49,7 +50,7 @@ Disarm.demojize("I ❤️ Ruby")                          # => "I red heart Ruby
 Disarm.demojize("👍🏽", strip_modifiers: true)
 
 # Security presets
-Disarm.strip_obfuscation("Ѕ𝗲𝗰𝗿𝗲𝘁  ​data")            # deobfuscated
+Disarm.strip_obfuscation("Ѕ𝗲𝗰𝗿𝗲𝘁  \u200bdata")            # deobfuscated
 Disarm.canonicalize("…")                           # homoglyph/bidi/zero-width clean
 
 # IDN / hostname spoof check (a false result is not a safety guarantee)

data/lib/disarm/version.rb

@@ -2,5 +2,5 @@
 
 module Disarm
   # Kept in lockstep with the Rust crate / Python package version.
-  VERSION = "0.14.1"
+  VERSION = "0.15.0"
 end

data/lib/disarm.rb

@@ -55,15 +55,22 @@ module Disarm
 
     # Fold cross-script confusables toward `target:` (:latin or :cyrillic).
     #
-    # `digit_policy:` selects how non-Latin DIGITS fold (#561). `:numeric` (default)
-    # sends them to the ASCII digit — `०` becomes `0` — which is right for prose, where
-    # a Devanagari zero really is a zero. `:tr39` uses upstream's targets, which send
-    # most of them to a Latin letter (`०` → `o`; three of the 45 rows fold to `.` or
-    # to the two characters `rn` instead); that is what an identifier *skeleton*
-    # wants, since its only job is to make two confusable identifiers collide. The two
-    # differ on 45 rows and agree everywhere else. Scoped to `target: :latin` — the
-    # override rows are generated from the Latin table and carry TR39's Latin-script
-    # targets, so with `target: :cyrillic` it is a no-op.
+    # `digit_policy:` selects how non-Latin DIGITS fold (#561).
+    #
+    # `:numeric` (default) sends them to the ASCII digit — `०` becomes `0` — which is
+    # right for prose, where a Devanagari zero really is a zero.
+    #
+    # `:tr39` uses upstream's targets, which send most of them to a Latin letter
+    # (`०` → `o`; three of the 45 rows fold to `.` or to the two characters `rn`
+    # instead). That is what an identifier *skeleton* wants, since its only job is to
+    # make two confusable identifiers collide. The two differ on 45 rows and agree
+    # everywhere else. Scoped to `target: :latin` — the override rows are generated from
+    # the Latin table and carry TR39's Latin-script targets, so with `target: :cyrillic`
+    # it is a no-op.
+    #
+    # `:preserve` leaves the digit alone (#648). The other two both yield a mixed-script
+    # numeral — `२०२४` becomes `२0२४` or `२o२४` — so neither keeps the script. Unlike
+    # `:tr39` it applies under every target script.
     def normalize_confusables(text, target: :latin, digit_policy: :numeric)
       translate_errors { _normalize_confusables(text, target.to_s, digit_policy.to_s) }
     end
@@ -109,6 +116,24 @@ module Disarm
       translate_errors { _demojize(text, strip_modifiers) }
     end
 
+    # Canonicalize, but raise rather than silently normalize a structural difference
+    # away — the half of the pair that lets a caller reject input instead of comparing
+    # a value the sender never wrote.
+    def canonicalize_strict(text)
+      translate_errors { _canonicalize_strict(text) }
+    end
+
+    # Strip the non-interchange and invisible classes while KEEPING the script.
+    #
+    # Unlike `canonicalize` it folds no confusables, so non-Latin text survives as
+    # itself. It cannot be rebuilt from the seven universal `strip_*` methods, and the
+    # difference runs both ways: this preserves the Private Use Area (icon fonts) and
+    # keeps the VS15/VS16 presentation selectors after a base, which the naive chain
+    # deletes, and it collapses TAB/LF to a space, which the primitives leave alone.
+    def strip_format(text)
+      _strip_format(text)
+    end
+
     # Remove obfuscation (zero-width, bidi, combining-mark abuse) while keeping
     # legible content.
     def strip_obfuscation(text)
@@ -119,6 +144,13 @@ module Disarm
     # control characters, and other spoofing vectors. The name describes the
     # mechanism (Unicode canonicalization for matching), not a safety guarantee —
     # this is not an output sanitizer; encode at the sink.
+    #
+    # Two steps introduce ASCII, not one (#719): the leading NFKC, and the confusable
+    # fold, which reaches characters NFKC leaves alone. U+2236 RATIO becomes ":", U+2044
+    # FRACTION SLASH becomes "/", U+2216 SET MINUS becomes "\\". A string that carried no
+    # delimiter can leave here carrying one. #inspect_anomalies reports it as :confusable
+    # WHEN the word also carries an ASCII letter, which is the gate that keeps ordinary
+    # non-Latin text from firing; a delimiter-only string is not reported.
     def canonicalize(text)
       translate_errors { _canonicalize(text) }
     end
@@ -208,14 +240,14 @@ module Disarm
     # confusable test flags essentially every non-Latin host), not a precise verdict;
     # branch on the granular signals plus your own policy. Keys: :suspicious,
     # :scripts, :mixed_script, :has_confusables, :bidi_conflict, :bidi_control,
-    # :has_invisible, :cross_label_script,
+    # :has_invisible, :compat_fold, :cross_label_script,
     # :label_scripts, :whole_script_confusable, :label_whole_script_confusable,
     # :canonical. `:whole_script_confusable` is a graded signal, NOT folded into
     # `:suspicious` (see #545).
     def analyze_hostname(host, contractions: false)
       suspicious, scripts, mixed_script, has_confusables, bidi_conflict,
-        bidi_control, has_invisible, cross_label_script, label_scripts,
-        whole_script_confusable, label_whole_script_confusable, canonical =
+        bidi_control, has_invisible, compat_fold, cross_label_script, label_scripts,
+        whole_script_confusable, (label_whole_script_confusable, canonical) =
         translate_errors { _analyze_hostname(host, contractions) }
       {
         suspicious:,
@@ -225,6 +257,7 @@ module Disarm
         bidi_conflict:,
         bidi_control:,
         has_invisible:,
+        compat_fold:,
         cross_label_script:,
         label_scripts:,
         whole_script_confusable:,
@@ -337,6 +370,12 @@ module Disarm
     # (default), :windows, or :posix; `preserve_extension:` keeps the final
     # extension when truncating to `max_length:`. Raises Disarm::InvalidArgument
     # on an unknown platform.
+    #
+    # A safe *filename*, not a safe URL path segment. "%" is legal in a filename, so one
+    # the caller typed is kept — sanitize_filename("..%2Fetc") returns "%2Fetc" — and a
+    # consumer that percent-decodes the result must validate AFTER decoding. What this
+    # will not do is manufacture one: "%" never appears in the output unless it appeared
+    # in the input (#721).
     def sanitize_filename(text, separator: "_", max_length: 255, platform: :universal,
                           lang: nil, preserve_extension: true)
       translate_errors do
@@ -415,6 +454,15 @@ module Disarm
       translate_errors { _has_bidi_conflict?(text) }
     end
 
+    # Whether `text` carries any of the twelve UAX #9 explicit formatting characters,
+    # with no context taken into account. The counterpart to `bidi_conflict?`, which
+    # reads strong-direction letters and is blind to these; the two are disjoint. The
+    # anomaly detector's `bidi` kind reports nine of the twelve, holding back LRM, RLM
+    # and ALM because a lone directional mark is ordinary in right-to-left text.
+    def bidi_control?(text)
+      _has_bidi_control?(text)
+    end
+
     # Explain how `lang: "auto"` detection resolves `text`: a hash with
     # `:script`, `:chosen_lang` (both nil if undetected), `:reason`, and
     # `:discriminators_hit`.
@@ -441,6 +489,20 @@ module Disarm
     # The Unicode `confusables.txt` release the bundled confusable tables were folded
     # from, e.g. "17.0.0". Not a Unicode version for the library as a whole — the
     # case-folding and width tables track different releases (see docs/provenance.md).
+    # The UCD release disarm's normalizer implements. Not a library-wide Unicode
+    # version — the bundled tables track different releases. This is the one integrators
+    # ask about: it decides whether disarm's normalization agrees with Ruby's.
+    def unicode_version
+      _unicode_version
+    end
+
+    # Whether a key stored under an earlier release still compares equal. A monotonic
+    # counter, not a version: two artifacts reporting the same value produce the same key
+    # for the same input. Meaningless in isolation, by design.
+    def key_schema_version
+      _key_schema_version
+    end
+
     def confusables_version
       translate_errors { _confusables_version }
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: disarm
 version: !ruby/object:Gem::Version
-  version: 0.14.1
+  version: 0.15.0
 platform: aarch64-linux
 authors:
 - Richard Quinn
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-08-28 00:00:00.000000000 Z
+date: 2026-09-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -98,6 +98,8 @@ files:
 - lib/disarm/3.1/disarm.so
 - lib/disarm/3.2/disarm.so
 - lib/disarm/3.3/disarm.so
+- lib/disarm/3.4/disarm.so
+- lib/disarm/4.0/disarm.so
 - lib/disarm/version.rb
 homepage: https://github.com/raeq/disarm
 licenses:
@@ -118,7 +120,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '3.1'
   - - "<"
     - !ruby/object:Gem::Version
-      version: 3.4.dev
+      version: 4.1.dev
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="