oddb2xml 3.0.34 → 3.0.35

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aba1912f4878121d6d5aa1424b2c1f33f72b1eaceefd21d7b973753209b97c6e
-  data.tar.gz: 89ba2fffeefae9dffb569cb94be5308b67a7e847813e6de9771d5fee5a626996
+  metadata.gz: 99321f1703f8ab1645b7cdb4049433c355330f95db7e45d8510c31cd15cf5bc7
+  data.tar.gz: 1c5c50119b700ac8591dc087b452cdcf06be4a35382e1b5e2280a7913cd6f5d6
 SHA512:
-  metadata.gz: b9c54d7a0f8cf8189c5703e36aa309c40302b8880a65e552122dc8728d9827f7b15f1ae1c976abab6a342efb6547d31dc44e957ffb8b5b93ef2adb6be7cced99
-  data.tar.gz: d185bc2f3f9eadd52e618038fbae1b9050aa65ed4e36e0116cba42a68b9948d19a6794e300a131328c4db5a3075f1f1b250c7a43ef7a481129a4aaa3efd59fd4
+  metadata.gz: 98e7a7a8445bdad56f3d4d722c2243a068167d8242e874d37c4d0e4ad10c2ac14588a84c031e1c279948898602d416ba91be6e59c532e9637de80818a3bc4b06
+  data.tar.gz: 993e517ee499b12d448efb16a36f3dd72b4b1d758c7685a33b7cab6ae3b4f72bb0fd1f1ac9eb0aa2f58b7a3493432118e1221734a7b00b2976a3cc6be9ba2d1f

data/.github/workflows/ruby.yml

@@ -22,12 +22,12 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu]
-        ruby: ["3.0", "3.1", "3.2"]
+        ruby: ["3.2", "3.3"]
     env:
       BUNDLE_PATH: ".bundle/gems"
       BUNDLE_WITHOUT: "debugger"
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
     - uses: ruby/setup-ruby@v1
       with:
         ruby-version: ${{ matrix.ruby }}

data/CLAUDE.md

@@ -63,4 +63,6 @@ Only the scripts are git-tracked; the generated `index.html`/`logo.svg` and the
 - Framework: RSpec with flexmock (mocking), webmock + VCR (HTTP recording/playback)
 - Test fixtures: `spec/data/` (sample files), `spec/fixtures/vcr_cassettes/` (recorded HTTP responses)
 - `spec/spec_helper.rb` defines test constants (GTINs) and configures VCR to avoid real HTTP calls during tests
-- CI runs on Ruby 3.0, 3.1, 3.2
+- CI runs on Ruby 3.2 and 3.3 (`.github/workflows/ruby.yml`); 3.0/3.1 cannot resolve the lockfile since `public_suffix` 7 (Feb 2026) and are EOL
+- **Never call `Kernel#exit` inside `lib/`.** Until 02.09.2026 `Builder#prepare_substances` did (`exit 2` when an `-e`/`--artikelstamm` build had no substances). Under rspec that killed the *process* mid-run: the summary still printed, reading e.g. `1193 examples, 0 failures`, but the count was a random fraction of the ~1640 examples and the exit status was 2 — CI had been red on every run for over a year while local runs looked green to anyone reading the summary line instead of `$?`. The trigger was the June-2026 FHIR default: `-e` implies `--fhir`, `epl.bag.admin.ch` was never stubbed, `FhirExtractor added 0 items`, empty substances, exit. Builder now raises `Oddb2xml::NoSubstancesError` (`util.rb`) and only `bin/oddb2xml` turns that into exit status 2, so production keeps its contract and rspec sees an ordinary failure. `mock_downloads` stubs the three NDJSON URLs with `spec/data/fhir/cyramza.ndjson` (one bundle — enough to stay non-empty, not enough for price assertions), and the four CLI specs that assert on SL prices run with `--no-fhir` against the stubbed `Preparations.xml`, which is what they were written for. **When judging a run, read the exit status and the example count, not the failure count.**
+- **Dependabot security jobs (fixed 02.09.2026, `b9e1f09`):** the "bundler in /. for savon/json" runs had failed for months. Two lessons. (a) Dependabot resolves the lockfile against the **lowest** Ruby the gemspec allows — with `required_ruby_version >= 2.5.0` it could not pick json ≥ 2.8 (needs 2.7), so a stale floor silently blocks every security update; the floor is `>= 3.2.0` now. (b) A gem that is only `require`d but never called still carries its advisories: `savon` (two HIGH, GHSA Savon::Model evaluates WSDL operation names) had been dead since the SwissReg migration `4c65a9c` (March 2026), pinned `~> 2.12.0` so the fix 2.17.2 was unreachable. Removing it also removed akami/gyoku/nori/wasabi/httpi/socksify — and exposed that `HTTPI.log = false` in `Downloader#initialize` was loaded only through savon (305 NameErrors), so that line and `httpi` went too. Before bumping a pinned gem, `grep -rn "Savon::"`-style for actual use first. **The published 3.0.34 gem still declares `savon` and `httpi`**, so every `gem install oddb2xml` — including the nightly's step 1 — pulls the vulnerable savon 2.12.1 until 3.0.35 is released. `rubyntlm`, `multi_json` and the two `net/ntlm` requires in `downloader.rb` are the same kind of SOAP-era leftover (zero references), not yet removed.

data/Gemfile.lock

@@ -1,10 +1,9 @@
 PATH
   remote: .
   specs:
-    oddb2xml (3.0.34)
+    oddb2xml (3.0.35)
       csv
       htmlentities
-      httpi
       mechanize (>= 2.8.5)
       minitar
       multi_json
@@ -17,7 +16,6 @@ PATH
       rubyXL (~> 3.4.0)
       rubyntlm (>= 0.6.3)
       rubyzip (~> 3.0.1)
-      savon (~> 2.12.0)
       sax-machine
       spreadsheet
       standardrb
@@ -29,14 +27,9 @@ GEM
   specs:
     addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
-    akami (1.3.3)
-      base64
-      gyoku (>= 0.4.0)
-      nokogiri
     ast (2.4.3)
     base64 (0.3.0)
     bigdecimal (4.0.1)
-    builder (3.3.0)
     byebug (13.0.0)
       reline (>= 0.6.0)
     coderay (1.1.3)
@@ -48,18 +41,12 @@ GEM
     diff-lcs (1.6.2)
     domain_name (0.6.20240107)
     flexmock (3.0.2)
-    gyoku (1.4.0)
-      builder (>= 2.1.2)
-      rexml (~> 3.0)
     hashdiff (1.2.1)
     htmlentities (4.4.2)
     http-cookie (1.1.0)
       domain_name (~> 0.5)
-    httpi (2.5.0)
-      rack
-      socksify
     io-console (0.8.2)
-    json (2.19.5)
+    json (2.21.2)
     language_server-protocol (3.17.0.5)
     lint_roller (1.1.0)
     logger (1.7.0)
@@ -94,8 +81,6 @@ GEM
       racc (~> 1.4)
     nokogiri (1.19.4-arm64-darwin)
       racc (~> 1.4)
-    nori (2.7.1)
-      bigdecimal
     optimist (3.2.1)
     ox (2.14.23)
       bigdecimal (>= 3.0)
@@ -165,16 +150,7 @@ GEM
     rubyntlm (0.6.5)
       base64
     rubyzip (3.0.2)
-    savon (2.12.1)
-      akami (~> 1.2)
-      builder (>= 2.1.2)
-      gyoku (~> 1.2)
-      httpi (~> 2.3)
-      nokogiri (>= 1.8.1)
-      nori (~> 2.4)
-      wasabi (~> 3.4)
     sax-machine (1.3.2)
-    socksify (1.8.1)
     spreadsheet (1.3.4)
       bigdecimal
       logger
@@ -198,10 +174,6 @@ GEM
       unicode-emoji (~> 4.1)
     unicode-emoji (4.2.0)
     vcr (6.4.0)
-    wasabi (3.7.0)
-      addressable
-      httpi (~> 2.0)
-      nokogiri (>= 1.4.2)
     webmock (3.26.1)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)

data/History.txt

@@ -1,6 +1,11 @@
+=== 3.0.35 / 02.09.2026
+* Security: drop the savon dependency (two HIGH advisories, GHSA "Savon::Model evaluates WSDL operation names as Ruby source"). It had not been used since the SwissReg migration in 3.0.19 (commit 4c65a9c, March 2026) -- only a require remained -- but the gemspec pin ~> 2.12.0 kept every installer on the vulnerable 2.12.1 and blocked Dependabot's fix to 2.17.2. Removing it also drops akami, gyoku, nori, wasabi, httpi and socksify from the dependency tree; the one leftover reference, HTTPI.log = false in Downloader#initialize, had only ever been loaded through savon and is gone too. json is raised to 2.21.2 (LOW advisory: generator heap buffer overflow when streaming to an IO). 3.0.34 and earlier still declare savon and httpi, so `gem install oddb2xml` on those versions pulls savon 2.12.1 -- upgrade.
+* required_ruby_version is now >= 3.2 (was >= 2.5.0). Ruby 3.0 and 3.1 are end-of-life and have not been able to resolve the lockfile since public_suffix 7 (February 2026); the stale floor also made Dependabot resolve against Ruby 2.5, which is why its json update could never succeed. CI runs on 3.2 and 3.3.
+* Builder no longer calls Kernel#exit when an -e/--extended or --artikelstamm build ends up with no substances; it raises Oddb2xml::NoSubstancesError and bin/oddb2xml turns that into exit status 2 with a message on stderr. The observable behaviour of the command line is unchanged. Inside the spec suite the exit used to kill the rspec process at a random point with a summary line reading "0 failures", which is why the 3.0.34 note claimed a green suite at 1193 examples: that run had been cut short. The suite now runs to completion -- 1639 examples, 0 failures, exit 0 -- on both CI Rubies. The FHIR NDJSON URLs are stubbed in the specs, the four CLI specs asserting on SL prices run with --no-fhir against the BAG Preparations.xml fixture, and the Weleda Kapitel-70 record in spec/data/transfer.dat carries a valid VAT code (2, not 4).
+
 === 3.0.34 / 02.09.2026
 * Bugfix (WeledaSL): pin the encoding of the three runtime CSVs so the Kapitel-70 SL recovery cannot disappear without a trace. WeledaSL.source passed the downloaded content on in whatever encoding the downloader produced; when that is ASCII-8BIT -- any response served without a charset -- the first comparison against a UTF-8 literal raises Encoding::CompatibilityError, and WeledaSL.load rescues every error into an empty Hash. The whole Weleda/WALA recovery (~835 SL products, issue #121) then vanished silently: no <SL_ENTRY>, no BAG group price, and a build that still reported success. All three lists carry non-ASCII (umlauts in the product names, the "-" in the group-price table), so the live path was one charset-less response away from this; it has not happened yet only because raw.githubusercontent.com serves UTF-8. The encoding is now forced in source, as RoggerNames#parse already did, and the bundled fallback is read with an explicit encoding.
-* This was also the last failing spec: artikelstamm_spec.rb:86, the issue #121 regression test, failed because @weleda_sl was empty under webmock and the item was emitted as PHARMATYPE="N" without SL_ENTRY/PPUB. `rspec` is green again -- 1193 examples, 0 failures, 16 pending. Closes GitHub issue #104.
+* This was also the last failing spec: artikelstamm_spec.rb:86, the issue #121 regression test, failed because @weleda_sl was empty under webmock and the item was emitted as PHARMATYPE="N" without SL_ENTRY/PPUB. That example passes now. (This entry originally claimed the whole suite was green at "1193 examples, 0 failures" -- it was not: the count was a truncated run, killed by a Kernel#exit in Builder with exit status 2, see 3.0.35. GitHub issue #104 was closed on that basis and corrected.)
 
 === 3.0.33 / 26.08.2026
 * Bugfix (Refdata): skip PHARMA articles that carry no barcode instead of losing every single one of them. Refdata started publishing a handful of PHARMA articles without a <DataCarrierIdentifier> in August 2026 -- the Swiss Red Cross blood products under the collective registration 99999 (Erythrozytenkonzentrat & co), which have no GTIN at all. RefdataExtractor#to_hash called .size on that nil, and Cli#download_as rescues the resulting NoMethodError into an Oddb2xml.log call that prints nothing unless --log is given, so all 16'093 Refdata PHARMA articles silently vanished from the feeds while the build still reported success. On mediupdatexml.oddb.org the <SMNO> count in oddb_article.xml fell from ~15'300 to exactly 10'210 and stayed frozen there for twelve days -- the remainder came from the BAG FHIR SL feed -- and then to 50 once the BAG url move (3.0.32) took the FHIR feed away too. Refdata NONPHARMA was never affected, because the product-type check runs before the barcode is read. See GitHub issue #122.

data/README.md

@@ -136,8 +136,9 @@ FR
 
 ## Supported ruby version
 
-You will need ruby >= 2.5 to work correctly. Current development happens on Ruby 3.3 (`.ruby-version`).
-CI runs on Ruby 3.0, 3.1 and 3.2 via GitHub Actions — see the badge above for the latest spec results.
+You will need Ruby >= 3.2. Current development happens on Ruby 3.3 (`.ruby-version`).
+CI runs on Ruby 3.2 and 3.3 via GitHub Actions — see the badge above for the latest spec results.
+Ruby 3.0 and 3.1 dropped out with the dependency update of February 2026 (`public_suffix` 7 needs 3.2), and both are end-of-life.
 
 
 ## XSD files

data/bin/oddb2xml

@@ -38,6 +38,9 @@ begin
   ui.run
 rescue Interrupt
   exit
+rescue Oddb2xml::NoSubstancesError => e
+  warn "oddb2xml: #{e.message}"
+  exit 2
 end
 diff = (Time.now - start_time).to_i
 puts "#{Time.now}: #{__LINE__} done. Took #{diff} seconds"

data/lib/oddb2xml/builder.rb

@@ -277,7 +277,10 @@ module Oddb2xml
         @substances.uniq!
         @substances.sort!
         Oddb2xml.log("prepare_substances done. Total #{@substances.size} from #{@items.size} items")
-        exit 2 if (@options[:extended] || @options[:artikelstamm]) && (@substances.size == 0)
+        if (@options[:extended] || @options[:artikelstamm]) && @substances.empty?
+          raise NoSubstancesError, "prepare_substances: no substances from #{@items.size} items -- " \
+            "the SL source (FHIR NDJSON or BAG Preparations.xml) yielded nothing, refusing to write an empty feed"
+        end
       end
     end
 
@@ -417,7 +420,9 @@ module Oddb2xml
           XML_OPTIONS
         ) {
           Oddb2xml.log "build_substance #{@substances.size} substances"
-          exit 2 if (@options[:extended] || @options[:artikelstamm]) && (@substances.size == 0)
+            if (@options[:extended] || @options[:artikelstamm]) && @substances.empty?
+            raise NoSubstancesError, "build_substance: no substances to write"
+          end
           nbr_records = 0
           @substances.each_with_index do |sub_name, i|
             xml.SB("DT" => "") do

data/lib/oddb2xml/downloader.rb

@@ -2,7 +2,6 @@ require "net/ntlm/version" # needed to avoid error: uninitialized constant Net::
 require "rubyntlm"
 require "mechanize"
 require "zip"
-require "savon"
 require "open-uri"
 
 SKIP_MIGEL_DOWNLOADER = true # https://github.com/zdavatz/oddb2xml_files/raw/master/NON-Pharma.xls
@@ -49,7 +48,6 @@ module Oddb2xml
       @options = options
       @url = url
       @retry_times = 3
-      HTTPI.log = false # disable httpi warning
       Oddb2xml.log "Downloader from #{@url} for #{self.class}"
       init
     end

data/lib/oddb2xml/util.rb

@@ -7,6 +7,14 @@ module Oddb2xml
   # Raised when a downloaded archive (zip/xlsx) is empty or truncated, so the
   # caller can retry the download instead of crashing later in the parser.
   class IncompleteDownloadError < StandardError; end
+  # Raised by Builder when an -e/--extended or --artikelstamm build ends up with
+  # no substances at all: the SL source (FHIR NDJSON or BAG Preparations.xml)
+  # came back empty, so the feed would be useless. bin/oddb2xml turns it into
+  # exit status 2; under RSpec it is an ordinary exception. Builder used to call
+  # Kernel#exit here, which killed the host process -- inside rspec that ended
+  # the run after a random number of examples with a summary line reading
+  # "0 failures", so the suite looked green for months while exiting 2.
+  class NoSubstancesError < StandardError; end
 
   def self.gen_prodno(iksnr, seqnr)
     sprintf("%05d", iksnr) + sprintf("%02d", seqnr)

data/lib/oddb2xml/version.rb

@@ -1,3 +1,3 @@
 module Oddb2xml
-  VERSION = "3.0.34"
+  VERSION = "3.0.35"
 end

data/oddb2xml.gemspec

@@ -15,7 +15,7 @@ Gem::Specification.new do |spec|
   spec.executables = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
   spec.test_files = spec.files.grep(%r{^(test|spec|features)/})
   spec.require_paths = ["lib"]
-  spec.required_ruby_version = ">= 2.5.0"
+  spec.required_ruby_version = ">= 3.2.0"
 
   # We fix the version of the spec to newer versions only in the third position
   # hoping that these version fix only security/severe bugs
@@ -28,14 +28,12 @@ Gem::Specification.new do |spec|
   # while Ruby 3.1 (EOL but still in production) can install 1.18.10, the newest 3.1-compatible
   # release. oddb2xml uses no nokogiri 1.19-only API and no CSS/XSLT/C14N on untrusted input.
   spec.add_dependency "nokogiri", ">= 1.18.10"
-  spec.add_dependency "savon" , '~> 2.12.0'
   spec.add_dependency "spreadsheet" # , '~> 1.0.0'
   spec.add_dependency "rubyXL", "~> 3.4.0"
   spec.add_dependency "sax-machine" # ,  '~> 0.1.0'
   spec.add_dependency "parslet" # , '~> 1.7.0'
   spec.add_dependency "rubyntlm", ">= 0.6.3"
   spec.add_dependency "multi_json" # , '>= 0.3.2'
-  spec.add_dependency "httpi" # , '>= 2.4.1'
   spec.add_dependency "optimist"
   spec.add_dependency "xml-simple"
   spec.add_dependency "ox"

data/spec/builder_spec.rb

@@ -451,7 +451,9 @@ def checkProductXml(nbr_record = -1)
   expect(hirudoid.elements["ATC"].text).to eq("C05BA01") # modified by atc.csv!
 end
 
-NR_EXTENDED_ARTICLES = 80
+# 81 since 3.0.21: spec/data/transfer.dat gained the Weleda Kapitel-70 record
+# 7611916162404 (issue #121), which -e emits as a ZurRose-only article.
+NR_EXTENDED_ARTICLES = 81
 NR_SUBSTANCES = 28
 NR_LIMITATIONS = 15
 
@@ -685,7 +687,9 @@ describe Oddb2xml::Builder do
   context "when --append -I 80 -e is given" do
     before(:all) do
       common_run_init
-      options = Oddb2xml::Options.parse("--append -I 80 -e")
+      # --no-fhir: the assertions below come from the stubbed BAG Preparations.xml;
+      # the FHIR stub in mock_downloads is a single bundle (see spec_helper).
+      options = Oddb2xml::Options.parse("--append -I 80 -e --no-fhir")
       Oddb2xml::Cli.new(options).run
       # @res = buildr_capture(:stdout){ Oddb2xml::Cli.new(options).run }
     end
@@ -734,7 +738,9 @@ describe Oddb2xml::Builder do
   context "when option -e is given" do
     before(:all) do
       common_run_init
-      options = Oddb2xml::Options.parse("-e")
+      # --no-fhir: the assertions below come from the stubbed BAG Preparations.xml;
+      # the FHIR stub in mock_downloads is a single bundle (see spec_helper).
+      options = Oddb2xml::Options.parse("-e --no-fhir")
       puts options
       @cli = Oddb2xml::Cli.new(options)
       if RUN_ALL
@@ -853,7 +859,7 @@ describe Oddb2xml::Builder do
       dscrds = REXML::XPath.match(doc, "//ART")
       expect(dscrds.size).to eq(NR_EXTENDED_ARTICLES)
       expect(REXML::XPath.match(doc, "//PHAR").count { |x| x.text.match("0000000") }).to eq(0) # 0 is not a valid pharmacode
-      expect(REXML::XPath.match(doc, "//PHAR").count { |x| x.text.match(/\d+/) }).to eq 66
+      expect(REXML::XPath.match(doc, "//PHAR").count { |x| x.text.match(/\d+/) }).to eq 67 # 66 + the Weleda record
     end
 
     it "should have a correct NBR_RECORD in oddb_limitation.xml" do
@@ -912,7 +918,9 @@ describe Oddb2xml::Builder do
   context "testing -e -I 80 option" do
     before(:all) do
       common_run_init
-      options = Oddb2xml::Options.parse("-e -I 80 --log")
+      # --no-fhir: the assertions below come from the stubbed BAG Preparations.xml;
+      # the FHIR stub in mock_downloads is a single bundle (see spec_helper).
+      options = Oddb2xml::Options.parse("-e -I 80 --log --no-fhir")
       # @res = buildr_capture(:stdout){ Oddb2xml::Cli.new(options).run }
       @res = Oddb2xml::Cli.new(options).run
     end

data/spec/cli_spec.rb

@@ -184,7 +184,9 @@ describe Oddb2xml::Cli do
   context "when  -e and -f dat option is given" do
     before(:all) do
       cleanup_directories_before_run
-      options = Oddb2xml::Options.parse("-e -f dat")
+      # --no-fhir: the assertions below come from the stubbed BAG Preparations.xml;
+      # the FHIR stub in mock_downloads is a single bundle (see spec_helper).
+      options = Oddb2xml::Options.parse("-e -f dat --no-fhir")
       @cli = Oddb2xml::Cli.new(options)
       @cli_output = buildr_capture(:stdout) { @cli.run }
     end

data/spec/data/transfer.dat

@@ -72,4 +72,4 @@
 1130361821SEROCYTOL Kolon Supp 3 Stk                        002275003960401B080700076800027800132
 1131770177VARILRIX Trockensub c Solv (alt) Fertspr 0.5 ml   004768006650101B080800076800058500102
 1127766692VARILRIX Trockensub c Solv Fertspr 0.5 ml         004767006650101B080800076800058500342
-1111019849Absinthium ethanol Infusum D1 Tropfen 50 ml       002000000000300B080160076119161624044
+1111019849Absinthium ethanol Infusum D1 Tropfen 50 ml       002000000000300B080160076119161624042

data/spec/spec_helper.rb

@@ -260,6 +260,15 @@ def mock_downloads
    "https://raw.githubusercontent.com/zdavatz/oddb2xml_files/master/weleda_arzneimittel.csv" => "weleda_arzneimittel.csv",
    "https://raw.githubusercontent.com/zdavatz/oddb2xml_files/master/wala_arzneimittel.csv" => "wala_arzneimittel.csv",
    "https://raw.githubusercontent.com/zdavatz/oddb2xml_files/master/bag_sl_group_prices.csv" => "bag_sl_group_prices.csv",
+   # The FHIR NDJSON, default SL source for -e/-b since June 2026. It was never
+   # stubbed: webmock refused epl.bag.admin.ch, FhirExtractor added 0 items and
+   # Builder called Kernel#exit 2, which killed rspec mid-run with a summary
+   # line reading "0 failures". One real bundle keeps the extractor non-empty;
+   # specs asserting on SL prices/limitations pass --no-fhir and use
+   # Preparations.xml instead.
+   "https://epl.bag.admin.ch/static/sl/publication/fhir/foph-sl-publication-latest-de.ndjson" => "fhir/cyramza.ndjson",
+   "https://epl.bag.admin.ch/static/sl/publication/fhir/foph-sl-publication-latest-fr.ndjson" => "fhir/cyramza.ndjson",
+   "https://epl.bag.admin.ch/static/sl/publication/fhir/foph-sl-publication-latest-it.ndjson" => "fhir/cyramza.ndjson",
    "http://www.xn--spezialittenliste-yqb.ch/File.axd?file=XMLPublications.zip" => "XMLPublications.zip",
    "https://www.spezialitaetenliste.ch/File.axd?file=XMLPublications.zip" => "XMLPublications.zip",
    "https://files.refdata.ch/simis-public-prod/Articles/1.0/Refdata.Articles.zip" => "Refdata.Articles.zip",

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: oddb2xml
 version: !ruby/object:Gem::Version
-  version: 3.0.34
+  version: 3.0.35
 platform: ruby
 authors:
 - Yasuhiro Asaka, Zeno R.R. Davatz, Niklaus Giger
@@ -65,20 +65,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.18.10
-- !ruby/object:Gem::Dependency
-  name: savon
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 2.12.0
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 2.12.0
 - !ruby/object:Gem::Dependency
   name: spreadsheet
   requirement: !ruby/object:Gem::Requirement
@@ -163,20 +149,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: httpi
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: optimist
   requirement: !ruby/object:Gem::Requirement
@@ -604,7 +576,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.5.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="