google-cloud-datastore 2.13.0 → 2.13.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 00f4895cedca98c329cdcccad6094e454ba6884afc5f18b2b765660c5df92da6
-  data.tar.gz: 500ab2a00f401e8a69da2e4edb838072da922a149340fb56ecd148bf5aabfa1a
+  metadata.gz: 96ae4fca8972cf097e7b6b10d73e709ecef3d409fc68c96cae5ebcb7058c2d1b
+  data.tar.gz: 43c974a4d78a4533403e854d4e6ead63b19307c390e1cd1ed87194562ddde1f0
 SHA512:
-  metadata.gz: 43730b11a7bbd83b69f2b495140fa752d8fee8deb6a729435fc99a7ff9e7d88f81628f209f7a852985d91b77cb3b9ca689edd09595ac9f71a49661bd57e0caef
-  data.tar.gz: 5a6d3307d349f0fcfeb115d73ead84a76f053f65b64b4398e943ee2d641a2a6e6dcb58c715bbee563fa48bb2f20e83b6fe71a78125019eac57c017eb5795ae8a
+  metadata.gz: ed233508a15ee0c5adeed09f82435be5c9517a045e3b48fe46bfc2503bac49f82863b085ea630a20419232ba852b785377572fbc61dc1ba6048c4bf54415347a
+  data.tar.gz: c79f29a8601d877a7f32860b173350977eb8c94a50a4cd2c2b3a1ae3145e90762b525a2603f949c98f6cc6cc96d54b1d4ac049e6f20a3538c64ae4f11bb1e32c

data/AUTHENTICATION.md

@@ -46,6 +46,12 @@ code.
 
 **Credentials** are discovered in the following order:
 
+> [!WARNING]
+> If you accept a credential configuration (JSON file or Hash) from an
+> external source for authentication to Google Cloud, you must validate it before
+> providing it to a Google API client library. Providing an unvalidated credential
+> configuration to Google APIs can compromise the security of your systems and data.
+
 1. Specify credentials in method arguments
 2. Specify credentials in configuration
 3. Discover credentials path in environment variables
@@ -100,11 +106,16 @@ The **Project ID** and the path to the **Credentials JSON** file can be configur
 instead of placing them in environment variables or providing them as arguments.
 
 ```ruby
+require "googleauth"
 require "google/cloud/datastore"
 
+credentials = ::Google::Auth::ServiceAccountCredentials.make_creds(
+  json_key_io: ::File.open("/path/to/keyfile.json")
+)
+
 Google::Cloud::Datastore.configure do |config|
   config.project_id  = "my-project-id"
-  config.credentials = "path/to/keyfile.json"
+  config.credentials = credentials
 end
 
 client = Google::Cloud::Datastore.new

data/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Release History
 
+### 2.13.1 (2025-11-04)
+
+#### Documentation
+
+* add warning about loading unvalidated credentials ([#32121](https://github.com/googleapis/google-cloud-ruby/issues/32121)) 
+
 ### 2.13.0 (2025-07-24)
 
 #### Features

data/OVERVIEW.md

@@ -14,11 +14,16 @@ your code or via environment variables. Read more about the options for
 connecting in the {file:AUTHENTICATION.md Authentication Guide}.
 
 ```ruby
+require "googleauth"
 require "google/cloud/datastore"
 
+credentials = ::Google::Auth::ServiceAccountCredentials.make_creds(
+  json_key_io: ::File.open("/path/to/keyfile.json")
+)
+
 datastore = Google::Cloud::Datastore.new(
   project_id: "my-todo-project",
-  credentials: "/path/to/keyfile.json"
+  credentials: credentials
 )
 
 task = datastore.find "Task", "sampleTask"

data/lib/google/cloud/datastore/version.rb

@@ -16,7 +16,7 @@
 module Google
   module Cloud
     module Datastore
-      VERSION = "2.13.0".freeze
+      VERSION = "2.13.1".freeze
     end
   end
 end

data/lib/google/cloud/datastore.rb

@@ -58,9 +58,27 @@ module Google
       #
       # @param [String] project_id Identifier for a Datastore project. If not
       #   present, the default project for the credentials is used.
-      # @param [String, Hash, Google::Auth::Credentials] credentials The path to
-      #   the keyfile as a String, the contents of the keyfile as a Hash, or a
-      #   Google::Auth::Credentials object. (See {Datastore::Credentials})
+      # @param [Google::Auth::Credentials] credentials A Google::Auth::Credentials
+      #   object. (See {Datastore::Credentials})
+      #   @note Warning: Passing a `String` to a keyfile path or a `Hash` of credentials
+      #     is deprecated. Providing an unvalidated credential configuration to
+      #     Google APIs can compromise the security of your systems and data.
+      #
+      #   @example
+      #
+      #     # The recommended way to provide credentials is to use the `make_creds` method
+      #     # on the appropriate credentials class for your environment.
+      #
+      #     require "googleauth"
+      #
+      #     credentials = ::Google::Auth::ServiceAccountCredentials.make_creds(
+      #       json_key_io: ::File.open("/path/to/keyfile.json")
+      #     )
+      #
+      #     datastore = Google::Cloud::Datastore.new(
+      #       project_id: "my-project-id",
+      #       credentials: credentials
+      #     )
       # @param [String, Array<String>] scope The OAuth 2.0 scopes controlling
       #   the set of resources and operations that the connection can access.
       #   See [Using OAuth 2.0 to Access Google

data/lib/google-cloud-datastore.rb

@@ -84,9 +84,25 @@ module Google
     #
     # @param [String] project_id Identifier for a Datastore project. If not
     #   present, the default project for the credentials is used.
-    # @param [String, Hash, Google::Auth::Credentials] credentials The path to
-    #   the keyfile as a String, the contents of the keyfile as a Hash, or a
-    #   Google::Auth::Credentials object. (See {Datastore::Credentials})
+    # @param [Google::Auth::Credentials] credentials A Google::Auth::Credentials
+    #   object. (See {Datastore::Credentials})
+    #   @note Warning: Passing a `String` to a keyfile path or a `Hash` of credentials
+    #     is deprecated. Providing an unvalidated credential configuration to
+    #     Google APIs can compromise the security of your systems and data.
+    #
+    #   @example
+    #
+    #     # The recommended way to provide credentials is to use the `make_creds` method
+    #     # on the appropriate credentials class for your environment.
+    #
+    #     credentials = ::Google::Auth::ServiceAccountCredentials.make_creds(
+    #       json_key_io: ::File.open("/path/to/keyfile.json")
+    #     )
+    #
+    #     datastore = Google::Cloud::Datastore.new(
+    #       project_id: "my-project-id",
+    #       credentials: credentials
+    #     )
     # @param [String, Array<String>] scope The OAuth 2.0 scopes controlling the
     #   set of resources and operations that the connection can access. See
     #   [Using OAuth 2.0 to Access Google

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: google-cloud-datastore
 version: !ruby/object:Gem::Version
-  version: 2.13.0
+  version: 2.13.1
 platform: ruby
 authors:
 - Mike Moore