leptris 1.9.360.0-arm-linux → 1.9.361.1-arm-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5447d0963d769677ad9156eb3adf78feba1cd21e83fded7d770697d98b06e42b
-  data.tar.gz: 85862ef4d8124b3749763d30aefc2783c1478044546005d113dd00eccf0248f4
+  metadata.gz: 62b22d9381c5d319e49dad015e2ff067de8b582f0572d1a950cde8bc7cbaf84f
+  data.tar.gz: baa7eaa60f9168c4e50a0514429731cbb7b958a71f5441a8f4bfa8f4a7c9a3cc
 SHA512:
-  metadata.gz: 801829bbd4c6f0f8677ef2ce1929f29e2c3f02a9c906343207701f04fc562eb240b32b2c6773ab535b359573c2254b550800146c7ca637bbfe8672a4450cd83a
-  data.tar.gz: 015b53393470552bdd8d6aae4613db9768f68e8b3c891457dd0a3df70865d4fa0e881e586c9fadb84637a2feb427e9b327d39feb09e08d43db12d00d06813a08
+  metadata.gz: 259a2ec63050d803356e4208131c438559344714ad23012d3bb3f1b2b5a28e7eaa2f0c307fba8b761084aa500b959c9e903bf95068dcca185d0af5caffc48775
+  data.tar.gz: e004e9f4504604bad292f098eab5e111ba80d50ebfb08d4627f008b5a4aa32f5aff93b75165145fb4a745455ef924dbf894cf756a55ff4eda08308362dfc249d

data/Rakefile

@@ -8,7 +8,7 @@ RSpec::Core::RakeTask.new(:spec)
 # Pin for `rake compile` and the platform-gem builds. Keep in lockstep
 # with .github/workflows/build.yml (which calls `rake compile`) and the
 # CHANGELOG when libleptris releases.
-LIBLEPTRIS_VERSION = "1.9.359"
+LIBLEPTRIS_VERSION = "1.9.361"
 # Vendored alongside libleptris for fn:normalize-unicode (TODO
 # .restructure/20): built per platform with a RELOCATABLE @rpath
 # install name, loaded by ffi.rb before libleptris so the
@@ -292,13 +292,14 @@ task :compile do
     Dir.chdir(ext_dir) do
       sh "ruby extconf.rb"
       if RUBY_PLATFORM =~ /darwin/
-        # Link the bundle ourselves: setup-ruby's custom rubies
-        # make mkmf link libruby by absolute runner path no matter
-        # which RbConfig entries are cleared, and any libruby
-        # LC_LOAD_DYLIB is unresolvable on user machines. Compile
-        # via the Makefile, link with pure -undefined
-        # dynamic_lookup (Ruby symbols resolve from the loading
-        # interpreter) and a conservative deployment target.
+        # Link the bundle ourselves: mkmf snapshots LIBRUBYARG from
+        # RbConfig at require time, so setup-ruby's shared-libruby
+        # rubies record their absolute hostedtoolcache path in the
+        # bundle (shipped broken through 1.9.36x, #1739) and no
+        # post-require clearing can stop it. Compile via the
+        # Makefile, link with pure -undefined dynamic_lookup (Ruby
+        # symbols resolve from the loading interpreter) and a
+        # conservative deployment target.
         sh "make native.o"
         sh "cc -dynamic -bundle -undefined dynamic_lookup " \
            "-mmacosx-version-min=#{ENV['MACOSX_DEPLOYMENT_TARGET'] || '11.0'} " \
@@ -312,10 +313,11 @@ task :compile do
         # their symbols via -rdynamic, like any extension .so).
         sh "make native.o"
         sh "#{RbConfig::CONFIG['CC']} -shared -fPIC -o native.so native.o"
-        # Guard the contract in the build log.
-        sh "if strings native.so | grep -q libruby; then " \
-           "echo 'ERROR: native.so links libruby (#207)'; exit 1; fi"
       end
+      # Guard the linkage contract at the build chokepoint (#1739):
+      # no libruby reference, allowlisted load commands on darwin.
+      sh "#{RbConfig.ruby} ../../check_bundle_linkage.rb " \
+         "#{RUBY_PLATFORM =~ /darwin/ ? 'native.bundle' : 'native.so'}"
     end
     bundle = Dir.glob("#{ext_dir}/native.{bundle,so,dll}").first
     if bundle.nil?
@@ -337,6 +339,18 @@ task :compile do
       cp(bundle, "#{dest}.new")
       mv("#{dest}.new", dest)
       sign_darwin_binaries(dest)
+      # Per-minor twin (ruby#476): the loader prefers
+      # native_<minor>.{bundle,so}; dev builds run same-minor, so
+      # the copy is byte-identical and keeps `rake compile` +
+      # `rake spec` working without a full release matrix.
+      unless Gem.win_platform?
+        minor = RUBY_VERSION[/\A\d+\.\d+/].tr('.', '_')
+        ext = RUBY_PLATFORM.include?('darwin') ? '.bundle' : '.so'
+        twin = "lib/leptris/xml/native_#{minor}#{ext}"
+        cp(dest, "#{twin}.new")
+        mv("#{twin}.new", twin)
+        sign_darwin_binaries(twin)
+      end
       puts "Vendored native layer (#{File.basename(bundle)}) into lib/leptris/xml/"
     end
   end
@@ -412,11 +426,19 @@ namespace :audit do
   # leptris_version() equals the gem's engine pin (a half-bumped
   # lockstep state can no longer package). Negative proof lives
   # in spec/audit_codesign_spec.rb.
-  desc "Fail on unsigned/tampered macOS artifacts or engine-version drift"
+  desc "Fail on unsigned/tampered macOS artifacts, engine-version drift, or libruby-linked native layers"
   task :artifacts do
+    # Linkage contract over EVERY shipped native layer, per-minor
+    # twins included (#1739) — every platform: the 1.9.36x trains
+    # packaged runner-absolute libruby loads in native_3_2/3_4
+    # artifacts that audit:symbols/audit:artifacts never opened.
+    bundles = Dir.glob("lib/leptris/xml/native*.{bundle,so}")
+    bundles.each do |b|
+      sh "#{RbConfig.ruby} ext/check_bundle_linkage.rb #{b}"
+    end
     unless RUBY_PLATFORM =~ /darwin/
-      puts "audit:artifacts: skipped off-darwin (codesign gates " \
-           "the macOS packaging legs)"
+      puts "audit:artifacts: #{bundles.size} native layers linkage-clean; " \
+           "codesign gates skip off-darwin"
       next
     end
     abort "audit:artifacts: codesign unavailable" \
@@ -439,8 +461,8 @@ namespace :audit do
       abort "audit:artifacts: engine-version drift — vendored " \
             "#{vendored.inspect} != pin #{pinned.inspect}"
     end
-    puts "audit:artifacts: #{libs.size} macOS artifacts verify " \
-         "strictly and engine-synced (#{pinned})"
+    puts "audit:artifacts: #{libs.size} macOS artifacts + #{bundles.size} native " \
+         "layers verify strictly, linkage-clean and engine-synced (#{pinned})"
   end
 
   # Packaging doctrine (#271): every BUILT gem carries the engine
@@ -563,14 +585,18 @@ platforms.each do |platform|
     spec.files += Dir.glob("vendor-src/**/*")
     spec.files += %w[ext/leptris/native/extconf.rb
                      ext/leptris/native/native.c]
-    if platform.include?("mingw")
-      # #207/#227: per-Ruby-minor DLLs (PE must bind its Ruby).
-      # DOT-FREE names — MRI derives the init symbol from the
-      # basename cut at the first dot (native_3_3.so ->
-      # Init_native_3_3; the dotted form made Ruby look for
-      # "Init_native-3", which cannot exist).
-      spec.files += Dir.glob("lib/leptris/xml/native_*.so")
-    else
+    # #207/#227 + ruby#476: per-Ruby-minor bundles on EVERY
+    # platform (the ext's compiled-in RString layout changed in
+    # 3.2 — one CI-built bundle segfaults 3.1). DOT-FREE names —
+    # MRI derives the init symbol from the basename cut at the
+    # first dot (native_3_3.so -> Init_native_3_3; the dotted form
+    # made Ruby look for "Init_native-3", which cannot exist).
+    spec.files += Dir.glob("lib/leptris/xml/native_*.so")
+    spec.files += Dir.glob("lib/leptris/xml/native_*.bundle")
+    if !platform.include?("mingw")
+      # The unversioned bundle rides for toolchains that only run
+      # rake compile's single build (native_layer prefers the
+      # per-minor variant and never loads a wrong-ABI file).
       spec.files += Dir.glob("lib/leptris/xml/native.{bundle,so,dll}")
     end
     task = Gem::PackageTask.new(spec)

data/ext/build_native_per_minor.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+# Builds the native read layer bundle for the CURRENT Ruby and
+# installs it under its minor-versioned name
+# (lib/leptris/xml/native_<major>_<minor>.bundle on darwin, .so on
+# Linux).
+#
+# ruby#476: the ext's compiled-in RString layout changed in Ruby
+# 3.2 — a bundle built by a newer minor reads garbage pointers and
+# lengths under 3.1 (the parse segfaulted inside the engine's
+# correctly-bounded NEON text counter). One bundle per supported
+# minor therefore ships in the darwin/Linux platform gems — the
+# same contract the Windows gems have had since #207/#227 — and
+# native_layer picks by RUBY_VERSION at require, falling back to
+# the FFI surface when the variant for the running minor is
+# absent. A WRONG-ABI load is never attempted.
+#
+# The name is DOT-FREE: MRI derives a C extension's init symbol
+# from the require feature's basename cut at the first dot, so
+# native_3_1.bundle resolves Init_native_3_1 (exported by
+# native.c).
+
+require "rbconfig"
+require "fileutils"
+
+root = File.expand_path("..", __dir__)
+ext_dir = File.join(root, "ext", "leptris", "native")
+minor = RUBY_VERSION[/\A\d+\.\d+/]
+minor_us = minor.tr(".", "_")
+ext = RUBY_PLATFORM.include?("darwin") ? ".bundle" : ".so"
+
+Dir.chdir(ext_dir) do
+  # Force a clean compile on every invocation (stale objects from
+  # a failed earlier attempt ship silent wrong-ABI builds).
+  FileUtils.rm_f(Dir.glob("#{ext_dir}/native.{o,so,bundle}"))
+  system(RbConfig.ruby, "extconf.rb") or abort "extconf failed under #{RUBY_VERSION}"
+  # Link WITHOUT libruby (#1739): mkmf's Makefile rule records the
+  # building ruby's libruby — for setup-ruby builds by absolute
+  # hostedtoolcache path — in every LC_LOAD_DYLIB / DT_NEEDED, which
+  # dlopen-fails on any other machine. Compile via the Makefile,
+  # link exactly like rake compile's native branch: pure
+  # dynamic_lookup, rb_* resolve from the loading interpreter.
+  system("make native.o") or abort "make native.o failed under #{RUBY_VERSION}"
+  cc = RbConfig::CONFIG["CC"]
+  link =
+    if ext == ".bundle"
+      "#{cc} -dynamic -bundle -undefined dynamic_lookup " \
+        "-mmacosx-version-min=#{ENV['MACOSX_DEPLOYMENT_TARGET'] || '11.0'} " \
+        "-o native.bundle native.o"
+    else
+      "#{cc} -shared -fPIC -o native.so native.o"
+    end
+  system(link) or abort "native link failed under #{RUBY_VERSION}: #{link}"
+  built = Dir.glob("native.{so,bundle}").first
+  abort "native bundle not produced under #{RUBY_VERSION}" unless built
+
+  # Linkage gate: no libruby reference, and (darwin) only
+  # allowlisted load commands — enforced HERE so a violated bundle
+  # never reaches packaging (the 1.9.36x trains shipped exactly
+  # this shape, #1739).
+  system(RbConfig.ruby, File.join(root, "ext", "check_bundle_linkage.rb"),
+         File.expand_path(built)) or
+    abort "linkage gate failed under #{RUBY_VERSION}"
+
+  # Functional gate: dlopen the built bundle and resolve the
+  # MINOR-SUFFIXED init symbol — only a real lookup proves
+  # require "leptris/xml/native_<minor>" will resolve.
+  begin
+    require "fiddle"
+    Fiddle.dlopen(File.expand_path(built))["Init_native_#{minor_us}"]
+  rescue LoadError => e
+    warn "fiddle unavailable under #{RUBY_VERSION} (#{e.message}) — skipping"
+  rescue Fiddle::DLError => e
+    abort "#{built} does not export Init_native_#{minor_us} — refusing to " \
+          "install a bundle that would fail at require (#{e.message})"
+  end
+
+  dest = File.join(root, "lib", "leptris", "xml", "native_#{minor_us}#{ext}")
+  FileUtils.cp(built, dest)
+  puts "Installed native layer for Ruby #{minor} -> #{dest}"
+end

data/ext/build_windows_native.rb

@@ -29,14 +29,17 @@ Dir.chdir(ext_dir) do
   # because make reused a stale native.obj from a failed earlier
   # attempt (the log shows "creating Makefile -> linking" with no
   # compile). Force a clean compile on every invocation.
-  FileUtils.rm_f(Dir.glob("#{ext_dir}/native.{o,obj,so,dll}"))
-  FileUtils.rm_f("#{ext_dir}/leptris/xml/native.so")
+  # The globs cover both spellings of the mkmf target: the
+  # unversioned name and the per-minor name extconf now creates
+  # the Makefile for (#476 source-install parity).
+  FileUtils.rm_f(Dir.glob("#{ext_dir}/native*.{o,obj,so,dll}"))
+  FileUtils.rm_f(Dir.glob("#{ext_dir}/leptris/xml/native*.so"))
   system(RbConfig.ruby, "extconf.rb") or abort "extconf failed under #{RUBY_VERSION}"
   # mkmf's link binds the CURRENT Ruby's runtime DLL — exactly
   # what the versioned naming is for.
   success = system("make")
   abort "make failed under #{RUBY_VERSION}" unless success
-  so = Dir.glob("native.{so,dll}").first
+  so = Dir.glob("native*.so").first
   abort "native bundle not produced under #{RUBY_VERSION}" unless so
   # Functional export gate: dlopen the built DLL and resolve the
   # MINOR-SUFFIXED init symbol. A PE DLL can carry the symbol in its

data/ext/check_bundle_linkage.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+# Linkage contract for shipped native layers (#1739 / ruby#481): a
+# Ruby extension resolves rb_* symbols from the LOADING interpreter,
+# so the artifact must never link libruby — mkmf records the
+# building ruby's absolute path (setup-ruby's hostedtoolcache
+# location), which dlopen-fails on every other machine and silently
+# degrades the whole install to FFI. On darwin the check is
+# stricter: every load command must stay inside the loader
+# allowlist. Windows PE DLLs are exempt — binding the build
+# runtime is the documented contract there (#227).
+#
+# Runnable as a script over any number of artifacts (exit 1 on the
+# first violated contract batch) or required for the pure checks in
+# spec/check_bundle_linkage_spec.rb.
+module CheckBundleLinkage
+  ALLOWED_PREFIXES = %w[@rpath/ @loader_path/ @executable_path/ /usr/lib/ /System/].freeze
+
+  # The LC_LOAD_DYLIB paths otool -L lists that fall outside the
+  # allowlist. +otool_output+ is the raw stdout of `otool -L <file>`;
+  # entries are the tab-indented "<install name> (compatibility
+  # version X, current version Y)" lines.
+  def self.load_command_violations(otool_output)
+    otool_output.lines.grep(/^\t.*\(compatibility version/)
+                .filter_map { |l| l.split.first }
+                .reject { |path| ALLOWED_PREFIXES.any? { |p| path.start_with?(p) } }
+  end
+
+  # The libruby sonames a strings(1) dump reveals — the ELF-side
+  # tripwire for DT_NEEDED entries and RUNPATH spellings alike.
+  def self.libruby_references(strings_output)
+    strings_output.scan(/libruby[\w.]*/).uniq
+  end
+end
+
+if $PROGRAM_NAME == __FILE__
+  require "shellwords"
+
+  status = 0
+  ARGV.each do |path|
+    next if path.end_with?(".dll")
+
+    bad = CheckBundleLinkage.libruby_references(`strings #{Shellwords.escape(path)} 2>/dev/null`)
+    unless bad.empty?
+      warn "ERROR: #{path} references #{bad.join(', ')} — Ruby symbols must " \
+           "resolve from the loading interpreter, never a linked libruby " \
+           "(#1739); link with -undefined dynamic_lookup / plain -shared"
+      status = 1
+    end
+    next unless RUBY_PLATFORM.include?("darwin")
+
+    viol = CheckBundleLinkage.load_command_violations(`otool -L #{Shellwords.escape(path)} 2>/dev/null`)
+    next if viol.empty?
+
+    warn "ERROR: #{path} carries load commands outside the loader " \
+         "allowlist (#{CheckBundleLinkage::ALLOWED_PREFIXES.join(' ')}): " \
+         "#{viol.join(', ')} (#1739)"
+    status = 1
+  end
+  exit status
+end

data/ext/leptris/native/extconf.rb

@@ -28,6 +28,19 @@ unless %w[ruby truffleruby].include?(RUBY_ENGINE)
        "installing without the compiled native layer"
   exit 0
 end
+# Never link libruby: a Ruby extension resolves rb_* symbols from
+# the LOADING interpreter, and mkmf records the building ruby's
+# libruby (for setup-ruby, an absolute hostedtoolcache path) into
+# the bundle otherwise — dlopen-failing on every other machine
+# (#1739). mkmf snapshots $LIBRUBYARG* from RbConfig at require
+# time, so this MUST precede `require "mkmf"`; a later clearing is
+# a silent no-op (exactly how the 1.9.36x trains shipped broken).
+if RUBY_PLATFORM =~ /darwin/
+  %w[LIBRUBYARG LIBRUBYARG_SHARED LIBRUBYARG_STATIC].each do |key|
+    RbConfig::CONFIG[key] = ""
+    RbConfig::MAKEFILE_CONFIG[key] = ""
+  end
+end
 require "mkmf"
 
 # A prebuilt libleptris in lib/ (dev checkout after rake compile,
@@ -106,18 +119,25 @@ if RUBY_PLATFORM =~ /darwin/
   [$LDFLAGS, $DLDFLAGS].each do |var|
     var << lookup unless var.include?("dynamic_lookup")
   end
-  # setup-ruby builds carry the RUNNER's absolute libruby path in
-  # LIBRUBYARG_SHARED — recorded as an LC_LOAD_DYLIB in the
-  # bundle, unresolvable on user machines. A Ruby extension
-  # resolves Ruby symbols from the loading interpreter; never
-  # link libruby.
-  # BOTH maps: mkmf's Makefile interpolates from MAKEFILE_CONFIG,
-  # not CONFIG — clearing only CONFIG is a silent no-op (caught via
-  # the build-log otool on the runner).
-  RbConfig::CONFIG["LIBRUBYARG_SHARED"] = ""
-  RbConfig::CONFIG["LIBRUBYARG_STATIC"] = ""
-  RbConfig::MAKEFILE_CONFIG["LIBRUBYARG_SHARED"] = ""
-  RbConfig::MAKEFILE_CONFIG["LIBRUBYARG_STATIC"] = ""
+  # ruby#476: newer ld64 defaults BUNDLES to two-level namespace —
+  # with -undefined dynamic_lookup a two-level bind records the
+  # symbol as expected from the MAIN EXECUTABLE ("main-executable"),
+  # and interpreters that don't re-export every ruby symbol from
+  # their binary abort at first call ("dyld missing symbol called",
+  # hit at Init_native's first import). -flat_namespace is the
+  # classic C-extension pattern: dynamic_lookup symbols search all
+  # loaded images at call time and resolve from libruby.
+  flat = " -Wl,-flat_namespace"
+  [$LDFLAGS, $DLDFLAGS].each do |var|
+    var << flat unless var.include?("flat_namespace")
+  end
+  # Belt for the require-time snapshot: RbConfig was cleared BEFORE
+  # `require "mkmf"` (top of file), and the module globals mkmf
+  # captured then are zeroed here too — a Ruby extension resolves
+  # Ruby symbols from the loading interpreter; never link libruby.
+  $LIBRUBYARG = ""
+  $LIBRUBYARG_SHARED = ""
+  $LIBRUBYARG_STATIC = ""
 end
 if Gem.win_platform?
   # Windows names the artifact per Ruby minor, DOT-FREE (#227
@@ -137,4 +157,12 @@ if Gem.win_platform?
   win_def = " #{def_path.tr('/', '\\\\')}"
   $DLDFLAGS << win_def unless $DLDFLAGS.include?("native_exports.def")
 end
-create_makefile("leptris/xml/native")
+# Name the artifact per Ruby minor EVERYWHERE (#476): the loader
+# requires native_<minor> and deliberately has NO unversioned
+# fallback (loading a bundle built by another minor is the 3.1
+# wrong-ABI segfault class), so a source install must produce the
+# per-minor name itself. mkmf derives Init_native_<minor> from the
+# same basename — exported by native.c and pinned in the Windows
+# .def above.
+minor_us = RUBY_VERSION[/\A\d+\.\d+/].tr(".", "_")
+create_makefile("leptris/xml/native_#{minor_us}")

data/ext/leptris/native/native.c

@@ -157,6 +157,19 @@ static node_xpath_fn f_node_xpath;
 static elem_copy_fn f_elem_copy;
 static parse_str_fn f_parse_str;
 static parse_frag_fn f_parse_frag;
+/* LeptrisParseOptions mirror (frozen layout since 1.9.0: flags,
+ * strict_mode, max_depth, recover — the FFI ParseOptionsStruct
+ * shape). Only recover is ever set: the recover-default parse
+ * (ruby#465) routes through the ex face on the C side. */
+struct leptris_parse_opts_mirror {
+    int flags;
+    int strict_mode;
+    int max_depth;
+    int recover;
+};
+typedef void *(*parse_str_ex_fn)(const char *, size_t,
+                                 struct leptris_parse_opts_mirror *, void *);
+static parse_str_ex_fn f_parse_str_ex;
 static last_err_fn f_last_err;
 static status_str_fn f_status_str;
 static set_root_fn f_set_root;
@@ -173,6 +186,13 @@ static ID id_iv_nn_content, id_iv_nn_content_ver;
 static ID id_iv_nn_attrs, id_iv_nn_attrs_ver;
 static ID id_child_klasses;
 static VALUE c_use_after_free_error;
+/* ruby#476: rb_cObject / rb_e* are DATA symbols — under the newer
+ * macOS linker's chained fixups a -undefined dynamic_lookup DATA
+ * import binds at LOAD and fails ("Symbol not found: _rb_cObject")
+ * on interpreters whose main executable does not re-export them
+ * (mise builds). Function imports bind lazily and always resolve,
+ * so these four resolve at INIT via rb_path2class into statics. */
+static VALUE c_object, c_arg_error, c_type_error, c_runtime_error;
 
 static VALUE native_cache_of(VALUE document);
 static void resolve_binding_classes(void);
@@ -236,7 +256,7 @@ static void resolve_symbols(const char *lib_path)
 {
     void *h = lib_open(lib_path);
     if (!h)
-        rb_raise(rb_eRuntimeError, "cannot load library %s", lib_path);
+        rb_raise(c_runtime_error, "cannot load library %s", lib_path);
     f_elem_name = (elem_name_fn)lib_sym(h, "leptris_element_name");
     f_text_content = (text_content_fn)lib_sym(h, "leptris_text_node_get_content");
     f_attr = (attr_fn)lib_sym(h, "leptris_element_attribute");
@@ -304,6 +324,7 @@ static void resolve_symbols(const char *lib_path)
     f_node_xpath = (node_xpath_fn)lib_sym(h, "leptris_node_get_xpath");
     f_elem_copy = (elem_copy_fn)lib_sym(h, "leptris_element_copy");
     f_parse_str = (parse_str_fn)lib_sym(h, "leptris_parse_string");
+    f_parse_str_ex = (parse_str_ex_fn)lib_sym(h, "leptris_parse_string_ex");
     f_parse_frag = (parse_frag_fn)lib_sym(h, "leptris_parse_fragment");
     f_last_err = (last_err_fn)lib_sym(h, "leptris_last_error");
     f_status_str = (status_str_fn)lib_sym(h, "leptris_status_string");
@@ -326,7 +347,7 @@ static void resolve_symbols(const char *lib_path)
         !f_text_set_content || !f_node_unlink ||
         !f_node_traverse || !f_node_visit || !f_free_str ||
         !f_node_xpath || !f_elem_copy || !f_parse_str ||
-        !f_parse_frag || !f_last_err || !f_status_str ||
+        !f_parse_frag || !f_parse_str_ex || !f_last_err || !f_status_str ||
         !f_doc_free || !f_sax_parse || !f_sax_create || !f_sax_feed ||
         !f_sax_pfree || !f_sax_set_flags ||
         !f_elem_prefix || !f_xp_count || !f_xp_nodes_ex ||
@@ -335,7 +356,7 @@ static void resolve_symbols(const char *lib_path)
         !f_elem_ns_count || !f_elem_ns ||
         !f_attr_next || !f_attr_name || !f_attr_value ||
         !f_node_line || !f_node_offset)
-        rb_raise(rb_eRuntimeError, "libleptris symbols missing");
+        rb_raise(c_runtime_error, "libleptris symbols missing");
 }
 
 static VALUE nn_name(VALUE self)
@@ -487,7 +508,7 @@ static VALUE nn_install_child_klasses(VALUE self, VALUE map)
     Check_Type(map, T_ARRAY);
     len = RARRAY_LEN(map);
     if (len > 5)
-        rb_raise(rb_eArgError,
+        rb_raise(c_arg_error,
                  "child klasses: Array of classes/nil indexed by "
                  "node kind (element, text, comment, cdata, pi)");
     for (i = 0; i < len; i++) {
@@ -495,7 +516,7 @@ static VALUE nn_install_child_klasses(VALUE self, VALUE map)
         if (!NIL_P(k) &&
             !(RB_TYPE_P(k, T_CLASS) &&
               RTEST(rb_class_inherited_p(k, c_native_node))))
-            rb_raise(rb_eTypeError,
+            rb_raise(c_type_error,
                      "child klasses entries must be nil or a "
                      "Leptris::XML::NativeNode subclass");
     }
@@ -685,7 +706,7 @@ static void *doc_ptr_of(VALUE document)
 {
     VALUE addr = rb_ivar_get(document, id_iv_c_address);
     if (NIL_P(addr))
-        rb_raise(rb_eRuntimeError, "document has been freed");
+        rb_raise(c_runtime_error, "document has been freed");
     return (void *)(uintptr_t)NUM2ULL(addr);
 }
 
@@ -730,7 +751,7 @@ static VALUE nf_register_doc_klasses(VALUE self, VALUE document, VALUE map)
     Check_Type(map, T_ARRAY);
     len = RARRAY_LEN(map);
     if (len > 5)
-        rb_raise(rb_eArgError,
+        rb_raise(c_arg_error,
                  "wrapper klasses: Array of classes/nil indexed by "
                  "node kind (element, text, comment, cdata, pi)");
     for (i = 0; i < len; i++) {
@@ -738,7 +759,7 @@ static VALUE nf_register_doc_klasses(VALUE self, VALUE document, VALUE map)
         if (!NIL_P(k) &&
             !(RB_TYPE_P(k, T_CLASS) &&
               RTEST(rb_class_inherited_p(k, c_native_node))))
-            rb_raise(rb_eTypeError,
+            rb_raise(c_type_error,
                      "wrapper klasses entries must be nil or a "
                      "Leptris::XML::NativeNode subclass");
     }
@@ -1378,7 +1399,7 @@ static VALUE nf_insert_binding_child(VALUE self, VALUE document,
     case 2:  st = f_insert_after(anchor, child);  break;
     case 3:  st = f_insert_before(anchor, child); break;
     default:
-        rb_raise(rb_eArgError, "invalid insert mode %d", m);
+        rb_raise(c_arg_error, "invalid insert mode %d", m);
         return Qnil;
     }
     check_status_c(st);
@@ -1393,7 +1414,7 @@ static VALUE nn_create_element(VALUE klass, VALUE document, VALUE name)
     (void)klass;
     ptr = f_elem_create(doc_ptr_of(document), StringValueCStr(name));
     if (!ptr)
-        rb_raise(rb_eRuntimeError, "leptris_element_create failed");
+        rb_raise(c_runtime_error, "leptris_element_create failed");
     return wrap_new(document, ptr);
 }
 
@@ -1403,7 +1424,7 @@ static VALUE nn_create_text(VALUE klass, VALUE document, VALUE content)
     (void)klass;
     ptr = f_text_create(doc_ptr_of(document), StringValueCStr(content));
     if (!ptr)
-        rb_raise(rb_eRuntimeError, "leptris_text_node_create failed");
+        rb_raise(c_runtime_error, "leptris_text_node_create failed");
     return wrap_new(document, ptr);
 }
 
@@ -1416,7 +1437,7 @@ static VALUE nn_create_child(VALUE self, VALUE name)
     document_advance_version(n->document);
     ptr = f_create_child(n->ptr, StringValueCStr(name));
     if (!ptr)
-        rb_raise(rb_eRuntimeError, "leptris_element_create_child failed");
+        rb_raise(c_runtime_error, "leptris_element_create_child failed");
     out = wrap_new(n->document, ptr);
     return out;
 }
@@ -1430,7 +1451,7 @@ static VALUE nn_append_child(VALUE self, VALUE child)
     document_advance_version(n->document);
     rc = f_append_child(n->ptr, c->ptr);
     if (rc != 0)
-        rb_raise(rb_eRuntimeError, "leptris_element_append_child failed (%d)", rc);
+        rb_raise(c_runtime_error, "leptris_element_append_child failed (%d)", rc);
     return child;
 }
 
@@ -1443,7 +1464,7 @@ static VALUE nn_set_root(VALUE klass, VALUE document, VALUE element)
     document_advance_version(document);
     rc = f_set_root(doc_ptr_of(document), n->ptr);
     if (rc != 0)
-        rb_raise(rb_eRuntimeError, "leptris_document_set_root failed (%d)", rc);
+        rb_raise(c_runtime_error, "leptris_document_set_root failed (%d)", rc);
     return element;
 }
 
@@ -2897,14 +2918,28 @@ static void check_status_c(int st)
 /* Document.parse default path in one dispatch (TODO.perf/35):
  * leptris_parse_string + wrapper + handle. Qnil = parse failure
  * (the caller raises with the same message shape). */
-static VALUE nf_parse_binding_document(VALUE self, VALUE xml)
+static VALUE nf_parse_binding_document(int argc, VALUE *argv, VALUE self)
 {
     void *doc;
+    VALUE xml, recover;
 
     (void)self;
+    rb_scan_args(argc, argv, "11", &xml, &recover);
     resolve_binding_classes();
-    doc = f_parse_str(RSTRING_PTR(StringValue(xml)),
-                      (size_t)RSTRING_LEN(StringValue(xml)), NULL);
+    xml = StringValue(xml);
+    if (RTEST(recover) && f_parse_str_ex) {
+        /* Recover lane (ruby#465): a best-effort tree plus the
+         * engine's parse diagnostics — never NULL for malformed
+         * input, so the caller answers a document, not a raise. */
+        struct leptris_parse_opts_mirror opts;
+        memset(&opts, 0, sizeof(opts));
+        opts.recover = 1;
+        doc = f_parse_str_ex(RSTRING_PTR(xml),
+                             (size_t)RSTRING_LEN(xml), &opts, NULL);
+    } else {
+        doc = f_parse_str(RSTRING_PTR(xml),
+                          (size_t)RSTRING_LEN(xml), NULL);
+    }
     return doc ? build_binding_document(doc) : Qnil;
 }
 
@@ -3401,9 +3436,16 @@ LEPTRIS_INIT_EXPORT void Init_native(void)
      * entry mutates only under the engine's document path. */
     rb_ext_ractor_safe(true);
 
+    /* BEFORE any class definition — NativeNode/DocHandle/SaxParser
+     * define against c_object. */
+    c_object = rb_path2class("Object");
+    c_arg_error = rb_path2class("ArgumentError");
+    c_type_error = rb_path2class("TypeError");
+    c_runtime_error = rb_path2class("RuntimeError");
+
     m_leptris = rb_define_module("Leptris");
     m_xml = rb_define_module_under(m_leptris, "XML");
-    c_native_node = rb_define_class_under(m_xml, "NativeNode", rb_cObject);
+    c_native_node = rb_define_class_under(m_xml, "NativeNode", c_object);
     rb_undef_alloc_func(c_native_node);
 
     id_iv_name = rb_intern("@name");
@@ -3485,7 +3527,7 @@ LEPTRIS_INIT_EXPORT void Init_native(void)
     id_sax_end_prefix = rb_intern("end_prefix_mapping");
     id_sax_error = rb_intern("error");
     c_sax_parser = rb_define_class_under(m_native, "SaxParser",
-                                         rb_cObject);
+                                         c_object);
     rb_define_module_function(m_native, "sax_parse", nf_sax_parse, 3);
     rb_define_module_function(m_native, "sax_parser_create",
                               nf_sax_parser_create, 2);
@@ -3545,7 +3587,7 @@ LEPTRIS_INIT_EXPORT void Init_native(void)
     rb_define_module_function(m_native, "set_binding_root",
                               nf_set_binding_root, 2);
     rb_define_module_function(m_native, "parse_binding_document",
-                              nf_parse_binding_document, 1);
+                              nf_parse_binding_document, -1);
     rb_define_module_function(m_native, "parse_fragment_addr",
                               nf_parse_fragment_addr, 2);
     rb_define_module_function(m_native, "append_markup",
@@ -3579,7 +3621,7 @@ LEPTRIS_INIT_EXPORT void Init_native(void)
                               nf_doc_handle_mark_absorbed, 1);
     rb_define_module_function(m_native, "create_binding_document",
                               nf_create_binding_document, 0);
-    c_doc_handle = rb_define_class_under(m_xml, "DocHandle", rb_cObject);
+    c_doc_handle = rb_define_class_under(m_xml, "DocHandle", c_object);
     rb_undef_alloc_func(c_doc_handle);
     rb_define_module_function(m_native, "bulk_attributes", nf_bulk_attributes, 1);
     rb_define_module_function(m_native, "bulk_attr_faces",
@@ -3598,14 +3640,16 @@ LEPTRIS_INIT_EXPORT void Init_native(void)
                               nf_fast_element_xml, 4);
 }
 
-#ifdef _WIN32
 /* MRI derives a C extension's init symbol from the require
- * feature's basename cut at the first dot. The Windows per-minor
- * DLLs are therefore named dot-free (native_3_3.so etc.), and
- * each needs its exact init name exported. All are defined here
- * unconditionally: a DLL only ever loads under the Ruby minor it
- * was built against (PE binds its build Ruby's runtime DLL). */
+ * feature's basename cut at the first dot. The per-minor artifacts
+ * are therefore named dot-free (native_3_3.so / native_3_1.bundle
+ * etc.), and each needs its exact init name exported. Defined
+ * unconditionally on every platform since ruby#476: the darwin/
+ * Linux per-minor bundles (native_<minor>) resolve these too —
+ * an artifact only ever loads under the Ruby minor it was built
+ * against. */
+LEPTRIS_INIT_EXPORT void Init_native_3_1(void) { Init_native(); }
+LEPTRIS_INIT_EXPORT void Init_native_3_2(void) { Init_native(); }
 LEPTRIS_INIT_EXPORT void Init_native_3_3(void) { Init_native(); }
 LEPTRIS_INIT_EXPORT void Init_native_3_4(void) { Init_native(); }
 LEPTRIS_INIT_EXPORT void Init_native_4_0(void) { Init_native(); }
-#endif

data/lib/leptris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Leptris
-  VERSION = "1.9.360.0"
+  VERSION = "1.9.361.1"
 end

data/lib/leptris/xml/builder.rb

@@ -123,7 +123,7 @@ class Leptris::XML::Builder
     return @sink if markup.empty?
     case @sink
     when Leptris::XML::Document
-      parsed = Leptris::XML::Document.parse(markup)
+      parsed = Leptris::XML::Document.parse(markup, strict: true)
       root = parsed.root
       if root.nil?
         raise Leptris::XML::Error,