disarm 0.16.0 → 0.17.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0b0ec44307d78ca53394c2b8aa21522f3e2e9a486c83bd536abdb8afd2b0ea7e
-  data.tar.gz: e4e5edead5532bc809a8b2c3e4389b02177246d0d5c783bf5b24b641e32bb576
+  metadata.gz: 359f83c7f8f014a863c70caaa5bbea011530f5dc4866013bdd087ce6de77c7b4
+  data.tar.gz: 419a067a9dd9fde079844c8e5047b9be0b88cdb9a0f781a38c3f29a5e120ab10
 SHA512:
-  metadata.gz: 65a1b31c791a89e407a697af6d89b8f65e772803705e0cb12d3a8b458d4bae093c1dfc558dfa9749db10857dcafe521b221d28979e22f1a37d66326cd2d86fe6
-  data.tar.gz: a26f6cdfca9f10d678d5b8b56d243be22ac91a1d582d92a5fb6aee7d0f28b8abbe154da24e2bad1e924c1c5121f6c26baf937cba8f5caebc06cc954810d13458
+  metadata.gz: 9831ccfdd4b6fb49d8f5eb1df058226403fae7afc2ae933118f516fd1203a6e4dcd2c0d1dafd3ab5c63a081aa16013f95203c5df444a5bd8f1b6a5f479bb937a
+  data.tar.gz: a410e078c2b8092815673eaa244d1747a3dbff70e9ddcb789143c77f1617816715ea1dbe8f23fd1bf0231768c704da5c3dd7a197ed91c5af2fa3a7e157a6c741

data/README.md

@@ -19,10 +19,10 @@ gem "disarm"
 gem install disarm
 ```
 
-Requires Ruby >= 3.1. Precompiled platform gems ship for Ruby 3.1 through 4.0
+Requires Ruby >= 3.3. Precompiled platform gems ship for Ruby 3.3 through 4.0
 (Linux x86_64/aarch64, macOS x86_64/arm64, Windows). On a supported Ruby with no
 matching platform gem, the source gem installs and compiles locally, which needs a
-Rust toolchain. Below 3.1 the gem does not install at all.
+Rust toolchain. Below 3.3 the gem does not install at all.
 
 ## Usage
 

data/ext/disarm/Cargo.toml

@@ -13,7 +13,7 @@
 name = "disarm"
 version = "0.0.0"
 edition = "2021"
-rust-version = "1.81"
+rust-version = "1.88"
 license = "MIT"
 description = "Ruby bindings for disarm — Unicode confusable/text-security building blocks"
 publish = false
@@ -30,7 +30,7 @@ crate-type = ["cdylib"]
 # dep — not a path — so the gem is self-contained and the rb-sys-dock cross-gem
 # build (which mounts only this gem dir) can fetch it. Imported as `disarm_core`
 # because the package name `disarm` would otherwise clash with this crate.
-disarm_core = { package = "disarm", version = "0.16", default-features = false }
+disarm_core = { package = "disarm", version = "0.17", default-features = false }
 # magnus: ergonomic, safe Ruby<->Rust bindings over rb-sys. 0.8 supports Ruby >= 3.0
 # (the gem's required_ruby_version); rb-sys handles the platform glue.
 magnus = "0.8"

data/ext/disarm/src/lib.rs

@@ -34,7 +34,8 @@
 use std::collections::HashSet;
 
 use disarm_core::api;
-use magnus::{function, method, prelude::*, Error, RHash, Ruby};
+use magnus::encoding::EncodingCapable;
+use magnus::{function, kwargs, method, prelude::*, Error, RHash, RString, Ruby};
 
 /// Map a `disarm` error onto the closest standard Ruby exception:
 /// `InvalidArgument` → `ArgumentError`, everything else → `RuntimeError`. The
@@ -147,9 +148,30 @@ fn wtf8_to_utf8(bytes: &[u8]) -> String {
     out
 }
 
-/// A text argument decoded at the boundary with the WTF-8 → UTF-8 contract (#472).
-/// Used in place of `String` for every text parameter; `Deref<Target = str>` lets the
-/// existing `&text` call sites reach the core unchanged.
+/// A text argument decoded at the boundary by the encoding the String declares (#472,
+/// and R1 of `formal/bindings`). Used in place of `String` for every text parameter;
+/// `Deref<Target = str>` lets the existing `&text` call sites reach the core unchanged.
+///
+/// The contract, per `String#encoding`:
+///
+/// - **UTF-8**: the bytes as they are, with the WTF-8 scrub above for malformed input: a
+///   well-formed surrogate pair recombines, each lone surrogate or undecodable byte is
+///   one `U+FFFD`.
+/// - **US-ASCII**: the bytes as they are; a byte above `0x7F` is not US-ASCII and is one
+///   `U+FFFD`.
+/// - **ASCII-8BIT (BINARY)**: bytes with no declared encoding, read as UTF-8 under the
+///   same scrub as a UTF-8 String. `File.binread` and socket reads return BINARY for
+///   what is usually UTF-8, and the C ABI reads its bytes the same way (#1020).
+/// - **Any other encoding** (ISO-8859-1, Windows-1251, Shift_JIS, UTF-16LE, ...):
+///   transcoded to UTF-8 by Ruby's own `String#encode`, each invalid or unmappable
+///   sequence becoming one `U+FFFD`. An encoding Ruby cannot convert from at all (a
+///   dummy such as UTF-7) raises `Encoding::ConverterNotFoundError`, which the Ruby
+///   layer reports as `Disarm::InvalidArgument`.
+///
+/// Until R1 every String's bytes were read as UTF-8 whatever it declared, so an
+/// ISO-8859-1 `"caf\xE9"` transliterated to `"caf[?]"` and a Windows-1251 word to a row
+/// of `[?]`, while the plain `String` parameters of the same functions, which magnus
+/// converts, read the same bytes correctly.
 struct Wtf8Text(String);
 
 impl std::ops::Deref for Wtf8Text {
@@ -161,13 +183,43 @@ impl std::ops::Deref for Wtf8Text {
 
 impl magnus::TryConvert for Wtf8Text {
     fn try_convert(val: magnus::Value) -> Result<Self, Error> {
-        let s = magnus::RString::try_convert(val)?;
+        let s = RString::try_convert(val)?;
+        // GVL invariant: argument conversion runs inside a Ruby method callback.
+        #[allow(clippy::expect_used)]
+        let ruby = Ruby::get().expect("argument conversion runs while holding the Ruby GVL");
+        let encoding = s.enc_get();
+        let usascii = encoding == ruby.usascii_encindex();
+        let s =
+            if encoding == ruby.utf8_encindex() || usascii || encoding == ruby.ascii8bit_encindex()
+            {
+                s
+            } else {
+                let options = kwargs!(
+                    &ruby,
+                    "invalid" => ruby.to_symbol("replace"),
+                    "undef" => ruby.to_symbol("replace"),
+                    "replace" => "\u{FFFD}"
+                );
+                s.funcall::<_, _, RString>("encode", (ruby.utf8_encoding(), options))?
+            };
         // SAFETY: the bytes are copied out immediately; no Ruby API runs between
         // `as_slice` and `to_vec`, so the string cannot be moved or collected.
         let bytes = unsafe { s.as_slice().to_vec() };
         let decoded = match std::str::from_utf8(&bytes) {
-            Ok(valid) => valid.to_owned(),
-            Err(_) => wtf8_to_utf8(&bytes),
+            Ok(valid) if !usascii || valid.is_ascii() => valid.to_owned(),
+            // A US-ASCII String carrying a byte above 0x7F: each such byte is invalid in
+            // the encoding the String declares, and is one U+FFFD.
+            _ if usascii => bytes
+                .iter()
+                .map(|&b| {
+                    if b.is_ascii() {
+                        char::from(b)
+                    } else {
+                        '\u{FFFD}'
+                    }
+                })
+                .collect(),
+            _ => wtf8_to_utf8(&bytes),
         };
         Ok(Wtf8Text(decoded))
     }
@@ -191,6 +243,16 @@ fn transliterate_opts(
     scheme: String,
     lang: Option<String>,
 ) -> Result<String, Error> {
+    // `try_run` rejects an unknown `lang` (B2) and applies registered replacements.
+    transliterate_builder(&scheme, lang)?
+        .try_run(&text)
+        .map(std::borrow::Cow::into_owned)
+        .map_err(|e| map_err(&e))
+}
+
+/// The core's `Transliterate` builder for a scheme token and an optional `lang`; the
+/// `lang` is checked when the builder runs.
+fn transliterate_builder(scheme: &str, lang: Option<String>) -> Result<api::Transliterate, Error> {
     let mut builder = api::Transliterate::new();
     if scheme != "default" {
         let scheme: api::Scheme = scheme.parse().map_err(|e| map_err(&e))?;
@@ -199,7 +261,7 @@ fn transliterate_opts(
     if let Some(lang) = lang {
         builder = builder.lang(lang);
     }
-    Ok(builder.run(&text).into_owned())
+    Ok(builder)
 }
 
 // ── Confusables (TR39) ────────────────────────────────────────────────────────
@@ -310,7 +372,7 @@ fn slugify(
     decimal: bool,
     hexadecimal: bool,
     safe_chars: String,
-) -> String {
+) -> Result<String, Error> {
     let mut config = api::SlugConfig::default()
         .with_separator(separator)
         .with_lowercase(lowercase)
@@ -328,7 +390,8 @@ fn slugify(
     config.entities = entities;
     config.decimal = decimal;
     config.hexadecimal = hexadecimal;
-    api::slugify(&text, &config)
+    // `try_slugify` rejects an unknown `lang` rather than falling back (B2).
+    api::try_slugify(&text, &config).map_err(|e| map_err(&e))
 }
 
 /// `Disarm._replace_emoji(text, replacement)` — every emoji replaced, verbatim (#972).
@@ -336,7 +399,8 @@ fn replace_emoji(text: Wtf8Text, replacement: String) -> String {
     api::replace_emoji(&text, &replacement)
 }
 
-/// `Disarm._demojize(text, strip_modifiers)`.
+/// `Disarm._demojize(text, strip_modifiers)`. An emoji CLDR cannot name becomes `[?]`,
+/// as in every binding.
 fn demojize(text: Wtf8Text, strip_modifiers: bool) -> String {
     api::demojize(&text, strip_modifiers)
 }
@@ -401,9 +465,14 @@ fn catalog_key(
     strict_iso9: bool,
     digit_policy: String,
 ) -> Result<String, Error> {
-    api::catalog_key_with(&text, lang.as_deref(), strict_iso9, parse_policy(&digit_policy)?)
-        .map(std::borrow::Cow::into_owned)
-        .map_err(|e| map_err(&e))
+    api::catalog_key_with(
+        &text,
+        lang.as_deref(),
+        strict_iso9,
+        parse_policy(&digit_policy)?,
+    )
+    .map(std::borrow::Cow::into_owned)
+    .map_err(|e| map_err(&e))
 }
 
 /// `Disarm._skeleton_key(text, digit_policy)` — the TR39 identifier skeleton plus the two
@@ -628,16 +697,9 @@ fn find_untranslatable(
     scheme: String,
     lang: Option<String>,
 ) -> Result<Vec<(String, usize)>, Error> {
-    let mut builder = api::Transliterate::new();
-    if scheme != "default" {
-        let scheme: api::Scheme = scheme.parse().map_err(|e| map_err(&e))?;
-        builder = builder.scheme(scheme);
-    }
-    if let Some(lang) = lang {
-        builder = builder.lang(lang);
-    }
-    Ok(builder
-        .find_untranslatable(&text)
+    Ok(transliterate_builder(&scheme, lang)?
+        .try_find_untranslatable(&text)
+        .map_err(|e| map_err(&e))?
         .into_iter()
         .map(|u| (u.ch.to_string(), u.offset))
         .collect())
@@ -918,6 +980,12 @@ fn get_pipeline(profile: String) -> Result<Pipeline, Error> {
 fn init(ruby: &Ruby) -> Result<(), Error> {
     let module = ruby.define_module("Disarm")?;
 
+    // The zalgo defaults, read from the core so the Ruby layer never restates them: it
+    // kept a literal cap of 2 after #788 raised the core's to 3 (`formal/bindings`, B1).
+    // Defined before `lib/disarm.rb`'s method definitions read them as defaults.
+    module.const_set("DEFAULT_ZALGO_THRESHOLD", api::DEFAULT_ZALGO_THRESHOLD)?;
+    module.const_set("DEFAULT_ZALGO_MAX_MARKS", api::DEFAULT_ZALGO_MAX_MARKS)?;
+
     // Raw, `_`-prefixed shims wrapped by the idiomatic Ruby layer (#357).
     module.define_singleton_method("_transliterate", function!(transliterate, 1))?;
     module.define_singleton_method("_transliterate_opts", function!(transliterate_opts, 3))?;
@@ -948,10 +1016,7 @@ fn init(ruby: &Ruby) -> Result<(), Error> {
     // keeping `rescue Disarm::Error` exhaustive across the whole public surface.
     module.define_singleton_method("_strip_accents", function!(strip_accents, 1))?;
     module.define_singleton_method("_fold_case", function!(fold_case, 1))?;
-    module.define_singleton_method(
-        "_is_case_fold_stable?",
-        function!(is_case_fold_stable, 1),
-    )?;
+    module.define_singleton_method("_is_case_fold_stable?", function!(is_case_fold_stable, 1))?;
     module.define_singleton_method("_find_key_collisions", function!(find_key_collisions, 3))?;
     module.define_singleton_method("_suspicious_hostname?", function!(suspicious_hostname, 1))?;
     module.define_singleton_method("_analyze_hostname", function!(analyze_hostname, 2))?;
@@ -990,10 +1055,7 @@ fn init(ruby: &Ruby) -> Result<(), Error> {
         function!(reverse_transliterate, 2),
     )?;
     module.define_singleton_method("_find_untranslatable", function!(find_untranslatable, 3))?;
-    module.define_singleton_method(
-        "_unmapped_confusables",
-        function!(unmapped_confusables, 1),
-    )?;
+    module.define_singleton_method("_unmapped_confusables", function!(unmapped_confusables, 1))?;
     module.define_singleton_method(
         "_find_unmapped_confusables",
         function!(find_unmapped_confusables, 2),
@@ -1008,19 +1070,10 @@ fn init(ruby: &Ruby) -> Result<(), Error> {
     // Metadata introspection (#404 phase 3 parity backfill).
     module.define_singleton_method("_lang_info", function!(lang_info, 1))?;
     module.define_singleton_method("_script_info", function!(script_info, 1))?;
-    module.define_singleton_method(
-        "_confusable_coverage",
-        function!(confusable_coverage, 1),
-    )?;
-    module.define_singleton_method(
-        "_confusables_version",
-        function!(confusables_version, 0),
-    )?;
+    module.define_singleton_method("_confusable_coverage", function!(confusable_coverage, 1))?;
+    module.define_singleton_method("_confusables_version", function!(confusables_version, 0))?;
     module.define_singleton_method("_unicode_version", function!(unicode_version, 0))?;
-    module.define_singleton_method(
-        "_key_schema_version",
-        function!(key_schema_version, 0),
-    )?;
+    module.define_singleton_method("_key_schema_version", function!(key_schema_version, 0))?;
     module.define_singleton_method("_list_scripts", function!(list_scripts, 0))?;
     module.define_singleton_method("_list_context_langs", function!(list_context_langs, 0))?;
 

data/lib/disarm/version.rb

@@ -2,5 +2,5 @@
 
 module Disarm
   # Kept in lockstep with the Rust crate / Python package version.
-  VERSION = "0.16.0"
+  VERSION = "0.17.2"
 end

data/lib/disarm.rb

@@ -24,6 +24,13 @@ end
 # keyword arguments with the core's defaults, symbol tokens (:latin, :default, …),
 # a single transliterate(text, scheme:) entrypoint, and a Disarm::Error hierarchy.
 # Each method is still a thin wrapper over the pure-Rust `disarm` core.
+#
+# Text arguments are read by the encoding the String declares. UTF-8 and US-ASCII are
+# read as they are, and ASCII-8BIT (BINARY) is read as UTF-8, the way the C ABI reads
+# its bytes; any other encoding (ISO-8859-1, Windows-1251, UTF-16LE, ...) is transcoded
+# to UTF-8 first. A malformed or unmappable sequence becomes one U+FFFD, and so does a
+# lone surrogate, the contract every binding shares (#469). An encoding Ruby cannot
+# convert from at all raises Disarm::InvalidArgument.
 module Disarm
   # Base class for every error disarm raises, so consumers can `rescue
   # Disarm::Error`. The native shim raises Ruby's built-in ArgumentError /
@@ -38,7 +45,8 @@ module Disarm
     # Transliterate Unicode text to ASCII. `scheme:` selects the standard:
     # :default (the general-purpose scheme), :strict_iso9, or :gost7034. `lang:`
     # applies a language profile on top of the scheme (e.g. "uk" → Київ → "Kyiv",
-    # "de" → ü → "ue"); nil means no profile. Both accept a String or Symbol.
+    # "de" → ü → "ue"); nil means no profile. Both accept a String or Symbol. Raises
+    # Disarm::InvalidArgument on an unknown lang, as every binding does.
     def transliterate(text, scheme: :default, lang: nil)
       scheme = scheme.to_s
       lang = lang&.to_s
@@ -53,7 +61,8 @@ module Disarm
       end
     end
 
-    # Fold cross-script confusables toward `target:` (:latin or :cyrillic).
+    # Fold cross-script confusables toward `target:` (:latin, :cyrillic, :arabic or
+    # :hebrew).
     #
     # `digit_policy:` selects how non-Latin DIGITS fold (#561).
     #
@@ -61,9 +70,9 @@ module Disarm
     # right for prose, where a Devanagari zero really is a zero.
     #
     # `:tr39` uses upstream's targets, which send most of them to a Latin letter
-    # (`०` → `o`; three of the 45 rows fold to `.` or to the two characters `rn`
+    # (`०` → `o`; three of the 47 rows fold to `.` or to the two characters `rn`
     # instead). That is what an identifier *skeleton* wants, since its only job is to
-    # make two confusable identifiers collide. The two differ on 45 rows and agree
+    # make two confusable identifiers collide. The two differ on 47 rows and agree
     # everywhere else. Scoped to `target: :latin` — the override rows are generated from
     # the Latin table and carry TR39's Latin-script targets, so with `target: :cyrillic`
     # it is a no-op.
@@ -75,15 +84,16 @@ module Disarm
       translate_errors { _normalize_confusables(text, target.to_s, digit_policy.to_s) }
     end
 
-    # Whether `text` contains a character confusable with `target:` (:latin or
-    # :cyrillic).
+    # Whether `text` contains a character confusable with `target:` (:latin,
+    # :cyrillic, :arabic or :hebrew).
     def confusable?(text, target: :latin)
       translate_errors { _confusable?(text, target.to_s) }
     end
 
     # Generate a URL-safe slug. Mirrors the core's `SlugConfig` defaults; every
     # option past `text` is keyword-only. (`regex_pattern`/`replacements` are not
-    # surfaced yet — see ext/disarm/src/lib.rs.)
+    # surfaced yet — see ext/disarm/src/lib.rs.) Raises Disarm::InvalidArgument on an
+    # unknown `lang:`.
     def slugify(
       text,
       separator: "-",
@@ -111,7 +121,9 @@ module Disarm
     end
 
     # Replace emoji with their plain names (e.g. "👍" → "thumbs up").
-    # `strip_modifiers:` drops skin-tone / variation modifiers before naming.
+    # `strip_modifiers:` drops skin-tone / variation modifiers before naming. An emoji
+    # CLDR cannot name (a regional indicator or a Plane 14 tag character standing
+    # alone) becomes "[?]", the sentinel #transliterate writes, as in every binding.
     def demojize(text, strip_modifiers: false)
       translate_errors { _demojize(text, strip_modifiers) }
     end
@@ -122,7 +134,8 @@ module Disarm
     # +demojize+ asks what CLDR calls a character, so its domain is the name table, which
     # is wider than the emoji: <tt>demojize("x\u2122y")</tt> is "x trade mark y". This
     # asks whether the UCD calls it an emoji — Emoji_Presentation=Yes, an Emoji=Yes base
-    # carrying U+FE0F, and the ZWJ, modifier, keycap and flag sequences on those. Nothing
+    # carrying U+FE0F (not an Extended_Pictographic one, so a black star with a selector
+    # stays), and the ZWJ, modifier, keycap and flag sequences on those. Nothing
     # else moves.
     #
     # +replacement+ is inserted exactly as given: "" closes an intra-word split and " "
@@ -146,7 +159,7 @@ module Disarm
     # keeps the VS15/VS16 presentation selectors after a base, which the naive chain
     # deletes, and it collapses TAB/LF to a space, which the primitives leave alone.
     def strip_format(text)
-      _strip_format(text)
+      translate_errors { _strip_format(text) }
     end
 
     # Remove obfuscation (zero-width, bidi, combining-mark abuse) while keeping
@@ -219,7 +232,12 @@ module Disarm
     # `max_distance:` (#894). Reports; it does not decide. An exact match is reported with
     # distance 0, and ties go to the first candidate at the lowest distance.
     def nearest_match(value, candidates, max_distance: 1)
-      hit = translate_errors { _nearest_match(value, candidates.map(&:to_s), max_distance) }
+      hit = translate_errors do
+        # A non-collection is a wrong-typed argument, not a NoMethodError (N2).
+        raise ::TypeError, "candidates must be an Array or Enumerable" unless candidates.respond_to?(:map)
+
+        _nearest_match(value, candidates.map(&:to_s), max_distance)
+      end
       hit && { value: hit[0], distance: hit[1] }
     end
 
@@ -378,15 +396,18 @@ module Disarm
       translate_errors { _strip_pua(text) }
     end
 
-    # Strip "zalgo" combining-mark stacking, keeping at most `max_marks:` (2)
-    # combining marks per base character.
-    def strip_zalgo(text, max_marks: 2)
+    # Strip "zalgo" combining-mark stacking, keeping at most `max_marks:` marks of each
+    # combining class on one base character. The default is the core's,
+    # DEFAULT_ZALGO_MAX_MARKS (3), equal to #zalgo?'s threshold (#788), so this never
+    # strips from text #zalgo? declines to flag.
+    def strip_zalgo(text, max_marks: DEFAULT_ZALGO_MAX_MARKS)
       translate_errors { _strip_zalgo(text, max_marks) }
     end
 
     # Whether `text` looks like zalgo: any base character carries more than
-    # `threshold:` (3) combining marks.
-    def zalgo?(text, threshold: 3)
+    # `threshold:` marks of one combining class. The default is the core's,
+    # DEFAULT_ZALGO_THRESHOLD (3).
+    def zalgo?(text, threshold: DEFAULT_ZALGO_THRESHOLD)
       translate_errors { _zalgo?(text, threshold) }
     end
 
@@ -422,13 +443,16 @@ module Disarm
     # Turn arbitrary text into a safe filename. `platform:` is :universal
     # (default), :windows, or :posix; `preserve_extension:` keeps the final
     # extension when truncating to `max_length:`. Raises Disarm::InvalidArgument
-    # on an unknown platform.
+    # on an unknown platform, or on a `separator:` that is not printable, non-space
+    # ASCII, contains a character illegal on the platform, or contains a path
+    # separator ("/" or "\\"). An empty separator is allowed, and so is " " on its
+    # own.
     #
     # A safe *filename*, not a safe URL path segment. "%" is legal in a filename, so one
     # the caller typed is kept — sanitize_filename("..%2Fetc") returns "%2Fetc" — and a
     # consumer that percent-decodes the result must validate AFTER decoding. What this
-    # will not do is manufacture one: "%" never appears in the output unless it appeared
-    # in the input (#721).
+    # will not do is manufacture one: every "%" in the output is one the input
+    # contained, or part of the separator (#721).
     def sanitize_filename(text, separator: "_", max_length: 255, platform: :universal,
                           lang: nil, preserve_extension: true)
       translate_errors do
@@ -475,8 +499,9 @@ module Disarm
       end
     end
 
-    # ML/NLP normalization: NFKC → emoji→text → transliterate → strip accents →
-    # [case fold] → strip control → strip zero-width → collapse whitespace.
+    # ML/NLP normalization: resolve deletions → NFKC → emoji→text → transliterate →
+    # strip accents → emoji→text → [case fold] → strip control → strip zero-width →
+    # collapse whitespace → NFC.
     #
     # `fold_case:` defaults to true. Pass false in front of a CASED model — folding is
     # destructive, cannot be undone downstream, and an uncased evaluation harness cannot
@@ -513,7 +538,7 @@ module Disarm
     # anomaly detector's `bidi` kind reports nine of the twelve, holding back LRM, RLM
     # and ALM because a lone directional mark is ordinary in right-to-left text.
     def bidi_control?(text)
-      _has_bidi_control?(text)
+      translate_errors { _has_bidi_control?(text) }
     end
 
     # Explain how `lang: "auto"` detection resolves `text`: a hash with
@@ -674,13 +699,14 @@ module Disarm
     # whole surface. The original backtrace is preserved (passed as the third
     # `raise` argument) so the failing native call site stays visible. A bad
     # argument from the native layer can arrive as ArgumentError (an invalid
-    # scheme/target), TypeError (a non-String argument), or RangeError (e.g. a
-    # negative max_length) — all map to Disarm::InvalidArgument.
+    # scheme/target), TypeError (a non-String argument), RangeError (e.g. a
+    # negative max_length) or EncodingError (a String in an encoding Ruby cannot
+    # transcode to UTF-8) — all map to Disarm::InvalidArgument.
     def translate_errors
       yield
     rescue Error
       raise # already in our hierarchy — don't re-wrap
-    rescue ::ArgumentError, ::TypeError, ::RangeError => e
+    rescue ::ArgumentError, ::TypeError, ::RangeError, ::EncodingError => e
       raise InvalidArgument, e.message, e.backtrace
     rescue ::RuntimeError => e
       raise Error, e.message, e.backtrace

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: disarm
 version: !ruby/object:Gem::Version
-  version: 0.16.0
+  version: 0.17.2
 platform: ruby
 authors:
 - Richard Quinn
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-06 00:00:00.000000000 Z
+date: 2026-09-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rb_sys
@@ -130,7 +130,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.1.0
+      version: 3.3.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="