pubnub 6.0.2 → 6.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: daa6325913f4e4fa3b9a42a89dcb268ec8b9174ca7c30d1b26e0b94bb4e8d3c3
-  data.tar.gz: e8cdc5e228388108d80cc51daa58e7a0a08d71aa69f51ae206fbcfe020aa7433
+  metadata.gz: 2f484475c6f9a486f2f4acb5c1882edb3a5647bd5c3fbfe2a16d521221568488
+  data.tar.gz: '09949bfd0ce89c476eb315783549e8fadde4681b3764311cf96576fb566bd79f'
 SHA512:
-  metadata.gz: 3a2c68e75729803cd99a560b82b4974929a8e10d8b8c2845c4146655055c9505ea606b58427eb631860fdded94a8df7b16f36b35617ac59e2c5dbb50ed8d46da
-  data.tar.gz: 8cb3e679e395a59214da0a21233ae080097a4600a6351644a59021e80dff85f9fb86e22a6b784d7c00092ed3944d80d7cbb89276842becc0df998a7e15d8bbf3
+  metadata.gz: 25cf31e4588c18a6458c9c2ddeb25862b02cd14339cd50ae59b3e9818adc756a05ba1bdfc9bdbaee5587469334b4633dddf9b5216552974d50d1ddebd116fcfa
+  data.tar.gz: f52d1c3fdc09ee349f25639d55844829261d514b4963e42f33b3a402cbc71f05381ea33b65216116ecc36fd6bed645827c3731b866a78c474ed7d9bb8230209f

data/.pubnub.yml

@@ -1,6 +1,28 @@
 ---
-version: "6.0.2"
+version: "6.1.1"
 changelog:
+  - date: 2026-07-21
+    version: v6.1.1
+    changes:
+      - type: bug
+        text: "`Pubnub::Cbor` now enforces a recursion-depth cap, a per-container length cap, and a total input size cap. Malformed or attacker-crafted tokens reaching `Pubnub::Client#parse_token` raise `Pubnub::Cbor::DecodeError` instead of hanging the caller or triggering `SystemStackError`."
+      - type: bug
+        text: "`Pubnub::Constants::DEFAULT_SSL` flipped from `false` to `true`. Integrators must now opt out explicitly to send traffic in cleartext."
+      - type: bug
+        text: "The Requested URI debug entry in `Pubnub::Event#uri` now masks the `signature` and `pnsig` query parameter values."
+  - date: 2026-06-15
+    version: v6.1.0
+    changes:
+      - type: feature
+        text: "Replace `httpclient` gem with `httpx`, enabling HTTP/2 support."
+      - type: feature
+        text: "Add `HttpDispatcher` and `HttpResponse` wrapper classes for a consistent internal API ."
+      - type: feature
+        text: "Update timeout, proxy, and keepalive configuration to use HTTPX equivalents."
+      - type: feature
+        text: "Update error handling to use `HTTPX::TimeoutError`."
+      - type: improvement
+        text: "Update specs and test dependencies accordingly."
   - date: 2026-03-03
     version: v6.0.2
     changes:
@@ -634,7 +656,7 @@ sdks:
                     - x86-64
           - distribution-type: package
             distribution-repository: RubyGems
-            package-name: pubnub-6.0.2.gem
+            package-name: pubnub-6.1.1.gem
             location: https://rubygems.org/gems/pubnub
             requires:
               - name: addressable
@@ -739,8 +761,8 @@ sdks:
                     - x86-64
           - distribution-type: library
             distribution-repository: GitHub release
-            package-name: pubnub-6.0.2.gem
-            location: https://github.com/pubnub/ruby/releases/download/v6.0.2/pubnub-6.0.2.gem
+            package-name: pubnub-6.1.1.gem
+            location: https://github.com/pubnub/ruby/releases/download/v6.1.1/pubnub-6.1.1.gem
             requires:
               - name: addressable
                 min-version: 2.0.0

data/CHANGELOG.md

@@ -1,3 +1,23 @@
+## v6.1.1
+July 21 2026
+
+#### Fixed
+- `Pubnub::Cbor` now enforces a recursion-depth cap, a per-container length cap, and a total input size cap. Malformed or attacker-crafted tokens reaching `Pubnub::Client#parse_token` raise `Pubnub::Cbor::DecodeError` instead of hanging the caller or triggering `SystemStackError`.
+- `Pubnub::Constants::DEFAULT_SSL` flipped from `false` to `true`. Integrators must now opt out explicitly to send traffic in cleartext.
+- The Requested URI debug entry in `Pubnub::Event#uri` now masks the `signature` and `pnsig` query parameter values, per the SDK log practices ADR. `auth` and `token` remain visible at DEBUG since they are permitted URL parameters.
+
+## v6.1.0
+June 15 2026
+
+#### Added
+- Replace `httpclient` gem with `httpx`, enabling HTTP/2 support.
+- Add `HttpDispatcher` and `HttpResponse` wrapper classes for a consistent internal API .
+- Update timeout, proxy, and keepalive configuration to use HTTPX equivalents.
+- Update error handling to use `HTTPX::TimeoutError`.
+
+#### Modified
+- Update specs and test dependencies accordingly.
+
 ## v6.0.2
 March 03 2026
 

data/Gemfile

@@ -11,8 +11,8 @@ group :test do
   gem 'rubocop'
   gem 'standard'
   gem 'simplecov', '>= 0.21.2', require: false
-  gem 'vcr'
-  gem 'webmock'
+  gem 'vcr', '>= 6.4'
+  gem 'webmock', '>= 3.14'
   gem 'cucumber'
 end
 

data/Gemfile.lock

@@ -1,13 +1,16 @@
 PATH
   remote: .
   specs:
-    pubnub (6.0.2)
+    pubnub (6.1.1)
       addressable (>= 2.0.0)
+      base64
       concurrent-ruby (~> 1.3.4)
       concurrent-ruby-edge (~> 0.7.1)
       dry-validation (~> 1.0)
-      httpclient (~> 2.8, >= 2.8.3)
+      httpx (>= 1.0)
       json (>= 2.2.0, < 3)
+      logger
+      ostruct
       timers (>= 4.3.0)
 
 GEM
@@ -17,7 +20,7 @@ GEM
       public_suffix (>= 2.0.2, < 7.0)
     ast (2.4.2)
     awesome_print (1.9.2)
-    base64 (0.2.0)
+    base64 (0.3.0)
     bigdecimal (3.1.8)
     binding_of_caller (1.0.1)
       debug_inspector (>= 1.2.0)
@@ -94,14 +97,18 @@ GEM
       zeitwerk (~> 2.6)
     ffi (1.17.0)
     hashdiff (1.1.1)
-    httpclient (2.8.3)
+    http-2 (1.1.3)
+    httpx (1.7.8)
+      http-2 (>= 1.1.3)
     interception (0.5)
     json (2.7.2)
     language_server-protocol (3.17.0.3)
     lint_roller (1.1.0)
+    logger (1.7.0)
     method_source (1.1.0)
     mini_mime (1.1.5)
     multi_test (1.1.0)
+    ostruct (0.6.3)
     parallel (1.26.3)
     parser (3.3.5.0)
       ast (~> 2.4.1)
@@ -174,8 +181,7 @@ GEM
       ffi (~> 1.1)
     timers (4.3.5)
     unicode-display_width (2.6.0)
-    vcr (6.3.1)
-      base64
+    vcr (6.4.0)
     webmock (3.24.0)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
@@ -200,8 +206,8 @@ DEPENDENCIES
   rubocop
   simplecov (>= 0.21.2)
   standard
-  vcr
-  webmock
+  vcr (>= 6.4)
+  webmock (>= 3.14)
 
 BUNDLED WITH
    2.4.20

data/VERSION

@@ -1 +1 @@
-6.0.2
+6.1.1

data/features/support/hooks.rb

@@ -12,7 +12,7 @@ Before do |scenario|
     expect(ENV['SERVER_PORT']).not_to be_nil
     @pn_configuration = {
       origin: ENV['SERVER_HOST'] + ":" + ENV['SERVER_PORT'],
-      isSecure: false,
+      ssl: false,
     }
   }
 

data/lib/pubnub/cbor.rb

@@ -1,5 +1,10 @@
 module Pubnub
   class Cbor
+    class DecodeError < StandardError; end
+
+    MAX_DEPTH = 32
+    MAX_CONTAINER_LENGTH = 65_536
+    MAX_INPUT_SIZE = 1_048_576
 
     private
 
@@ -43,9 +48,14 @@ module Pubnub
       end
     end
 
+    def take_bytes(data, count)
+      raise DecodeError, "Truncated CBOR input" if data.size < count
+      data.shift(count)
+    end
+
     def decode_integer(data, additional)
       if ADDITIONAL_LENGTH_BYTES.member?(additional)
-        bytearray_to_i(data.shift(ADDITIONAL_LENGTH_BYTES[additional]))
+        bytearray_to_i(take_bytes(data, ADDITIONAL_LENGTH_BYTES[additional]))
       else
         additional
       end
@@ -55,7 +65,10 @@ module Pubnub
       if additional <= 23
         additional
       else
-        bytes = bytearray_to_i(data.shift(ADDITIONAL_LENGTH_BYTES[additional]))
+        raise DecodeError, "Invalid float additional value" unless ADDITIONAL_LENGTH_BYTES.member?(additional)
+
+        bytes = bytearray_to_i(take_bytes(data, ADDITIONAL_LENGTH_BYTES[additional]))
+        
         case (additional)
         when ADDITIONAL_LENGTH_1B
           bytes
@@ -98,44 +111,57 @@ module Pubnub
       result = []
 
       loop do
+        raise DecodeError, "Truncated CBOR input" if data.empty?
         byte = data.shift
         break if byte == INDEFINITE_BREAK
         result.append(byte)
-        break if data.empty?
       end
       result
     end
 
-    def compute_length(data, additional)
-      if ADDITIONAL_LENGTH_BYTES.member?(additional)
-        bytearray_to_i(data.shift(ADDITIONAL_LENGTH_BYTES[additional]))
-      else
-        additional
+    def compute_container_length(data, additional, min_element_bytes)
+      length = if ADDITIONAL_LENGTH_BYTES.member?(additional)
+                 bytearray_to_i(take_bytes(data, ADDITIONAL_LENGTH_BYTES[additional]))
+               else
+                 additional
+               end
+
+      if length > MAX_CONTAINER_LENGTH
+        raise DecodeError, "CBOR container length #{length} exceeds maximum #{MAX_CONTAINER_LENGTH}"
+      end
+
+      if length * min_element_bytes > data.size
+        raise DecodeError, "CBOR container length #{length} exceeds remaining input"
       end
+
+      length
     end
 
     def decode_string(data, additional)
       if additional == ADDITIONAL_TYPE_INDEFINITE
         indefinite_data(data).pack('C*').force_encoding('UTF-8')
       else
-        length = compute_length(data, additional)
-        data.shift(length).pack('C*').force_encoding('UTF-8')
+        length = compute_container_length(data, additional, 1)
+        take_bytes(data, length).pack('C*').force_encoding('UTF-8')
       end
     end
 
-    def decode_map(data, additional)
-      length = compute_length(data, additional)
+    def decode_map(data, additional, depth)
+      length = compute_container_length(data, additional, 2)
       result = Hash.new
-      (1..length).each { result.store(parse_data(data), parse_data(data)) }
+      length.times { result.store(parse_data(data, depth), parse_data(data, depth)) }
       result
     end
 
-    def decode_array(data, additional)
-      length = compute_length(data, additional)
-      (1..length).map { parse_data(data) }
+    def decode_array(data, additional, depth)
+      length = compute_container_length(data, additional, 1)
+      Array.new(length) { parse_data(data, depth) }
     end
 
-    def parse_data(data)
+    def parse_data(data, depth = 0)
+      raise DecodeError, "CBOR nesting depth exceeds #{MAX_DEPTH}" if depth > MAX_DEPTH
+      raise DecodeError, "Truncated CBOR input" if data.empty?
+
       byte = data.shift
 
       case (byte)
@@ -163,9 +189,9 @@ module Pubnub
         when TYPE_TEXT_STRING
           decode_string(data, additional)
         when TYPE_ARRAY
-          decode_array(data, additional)
+          decode_array(data, additional, depth + 1)
         when TYPE_HASHMAP
-          decode_map(data, additional)
+          decode_map(data, additional, depth + 1)
         else
           nil
         end
@@ -175,7 +201,11 @@ module Pubnub
     public
 
     def decode(value)
-      parse_data(value)
+      if value.size > MAX_INPUT_SIZE
+        raise DecodeError, "CBOR input size #{value.size} exceeds maximum #{MAX_INPUT_SIZE}"
+      end
+
+      parse_data(value.dup)
     end
   end
 

data/lib/pubnub/client.rb

@@ -268,11 +268,11 @@ module Pubnub
       if sync
         @env[:req_dispatchers_pool][:sync][origin] ||= {}
         @env[:req_dispatchers_pool][:sync][origin][event_type] ||=
-          setup_httpclient(event_type)
+          setup_httpx_session(event_type)
       else
         @env[:req_dispatchers_pool][:async][origin] ||= {}
         @env[:req_dispatchers_pool][:async][origin][event_type] ||=
-          setup_httpclient(event_type)
+          setup_httpx_session(event_type)
       end
     end
 
@@ -359,33 +359,43 @@ module Pubnub
       @env[:state][event.origin] ||= {}
     end
 
-    def setup_httpclient(event_type)
-      hc = if ENV["HTTP_PROXY"]
-        HTTPClient.new(ENV["HTTP_PROXY"])
-      else
-        HTTPClient.new
-      end
-
-      case event_type
-      when :subscribe_event
-        hc.connect_timeout = @env[:s_open_timeout]
-        hc.send_timeout = @env[:s_send_timeout]
-        hc.receive_timeout = @env[:s_read_timeout]
-        unless @env[:disable_keepalive] || @env[:disable_subscribe_keepalive]
-          hc.keep_alive_timeout = @env[:idle_timeout]
-          hc.tcp_keepalive = true
+    def setup_httpx_session(event_type)
+      timeout_opts = case event_type
+        when :subscribe_event
+          {
+            connect_timeout: @env[:s_open_timeout],
+            write_timeout: @env[:s_send_timeout] || @env[:s_open_timeout],
+            read_timeout: @env[:s_read_timeout]
+          }
+        when :single_event
+          {
+            connect_timeout: @env[:open_timeout],
+            write_timeout: @env[:send_timeout] || @env[:open_timeout],
+            read_timeout: @env[:read_timeout]
+          }
         end
-      when :single_event
-        hc.connect_timeout = @env[:open_timeout]
-        hc.send_timeout = @env[:send_timeout]
-        hc.receive_timeout = @env[:read_timeout]
-        unless @env[:disable_keepalive] || @env[:disable_non_subscribe_keepalive]
-          hc.keep_alive_timeout = @env[:idle_timeout]
-          hc.tcp_keepalive = true
+
+      keepalive_enabled = case event_type
+        when :subscribe_event
+          !(@env[:disable_keepalive] || @env[:disable_subscribe_keepalive])
+        when :single_event
+          !(@env[:disable_keepalive] || @env[:disable_non_subscribe_keepalive])
         end
+
+      if keepalive_enabled
+        timeout_opts[:keep_alive_timeout] = @env[:idle_timeout]
+      end
+
+      options = { timeout: timeout_opts }
+      httpx = HTTPX.plugin(:persistent)
+
+      if ENV["HTTP_PROXY"]
+        options[:proxy] = { uri: ENV["HTTP_PROXY"] }
+        httpx = httpx.plugin(:proxy)
       end
 
-      hc
+      session = httpx.with(**options)
+      HttpDispatcher.new(session, keepalive_enabled: keepalive_enabled)
     end
 
     def validate!(env)

data/lib/pubnub/constants.rb

@@ -20,7 +20,7 @@ module Pubnub
     DEFAULT_TTL = 1440
     DEFAULT_REGION = '0'.freeze
     DEFAULT_USE_RANDOM_IV = true
-    DEFAULT_SSL = false
+    DEFAULT_SSL = true
     REQUEST_MESSAGE_COUNT_THRESHOLD = 0
     MAXIMUM_HERE_NOW_COUNT = 1000
 

data/lib/pubnub/event/formatter.rb

@@ -5,7 +5,7 @@ module Pubnub
     # Module that holds formatters for events
     module EFormatter
       def format_envelopes(response, request)
-        if response.is_a?(HTTPClient::TimeoutError) || response.is_a?(OpenSSL::SSL::SSLError)
+        if response.is_a?(HTTPX::TimeoutError) || response.is_a?(OpenSSL::SSL::SSLError)
           return error_envelope(nil,
                                 response,
                                 request: request,

data/lib/pubnub/event.rb

@@ -88,7 +88,7 @@ module Pubnub
       uri += path
       uri += '?' + Formatter.params_hash_to_url_params(parameters)
       uri += "&signature=#{sa_signature}" if sa_signature
-      Pubnub.logger.debug('Pubnub::Event') { "Requested URI: #{uri}" }
+      Pubnub.logger.debug('Pubnub::Event') { "Requested URI: #{uri.gsub(/([?&](?:signature|pnsig)=)[^&#]*/i, '\1***')}" }
       URI uri
     end
 
@@ -251,7 +251,7 @@ module Pubnub
       when JSON::ParserError
         error_category = Pubnub::Constants::STATUS_NON_JSON_RESPONSE
         code = req_res_objects[:response].code
-      when HTTPClient::TimeoutError
+      when HTTPX::TimeoutError
         error_category = Pubnub::Constants::STATUS_TIMEOUT
         code = 408
       when OpenSSL::SSL::SSLError

data/lib/pubnub/http_dispatcher.rb

@@ -0,0 +1,40 @@
+module Pubnub
+  class HttpDispatcher
+    attr_reader :tcp_keepalive
+
+    def initialize(httpx_session, keepalive_enabled: true)
+      @session = httpx_session
+      @tcp_keepalive = keepalive_enabled
+    end
+
+    def get(url, header: {})
+      execute { @session.get(url, headers: header) }
+    end
+
+    def post(url, body: '', header: {})
+      execute { @session.post(url, headers: header, body: body) }
+    end
+
+    def patch(url, body: '', header: {})
+      execute { @session.patch(url, headers: header, body: body) }
+    end
+
+    def delete(url, header: {})
+      execute { @session.delete(url, headers: header) }
+    end
+
+    def reset_all
+      @session.close
+    end
+
+    private
+
+    def execute
+      response = yield
+      if response.is_a?(HTTPX::ErrorResponse)
+        raise response.error
+      end
+      Pubnub::HttpResponse.new(response)
+    end
+  end
+end

data/lib/pubnub/http_response.rb

@@ -0,0 +1,12 @@
+module Pubnub
+  class HttpResponse
+    attr_reader :body, :code, :http_version
+    alias status_code code
+
+    def initialize(httpx_response)
+      @code = httpx_response.status
+      @body = httpx_response.body.to_s
+      @http_version = httpx_response.version
+    end
+  end
+end

data/lib/pubnub/pam.rb

@@ -77,7 +77,7 @@ module Pubnub
       when JSON::ParserError
         error_category = Pubnub::Constants::STATUS_NON_JSON_RESPONSE
         code = req_res_objects[:response].code
-      when HTTPClient::TimeoutError
+      when HTTPX::TimeoutError
         error_category = Pubnub::Constants::STATUS_TIMEOUT
         code = 408
       else

data/lib/pubnub/subscribe_event.rb

@@ -69,6 +69,7 @@ module Pubnub
 
       begin
         req = request_dispatcher.get(uri.to_s)
+
         if retries > 0
           @app.subscriber.announce_status(announcement_type: Pubnub::Constants::RECONNECTED_ANNOUNCEMENT,
                                           event: @event,

data/lib/pubnub/version.rb

@@ -1,4 +1,4 @@
 # Toplevel Pubnub module.
 module Pubnub
-  VERSION = '6.0.2'.freeze
+  VERSION = '6.1.1'.freeze
 end

data/lib/pubnub.rb

@@ -5,7 +5,9 @@ require 'open-uri'
 require 'openssl'
 
 require 'timers'
-require 'httpclient'
+require 'httpx'
+require 'pubnub/http_response'
+require 'pubnub/http_dispatcher'
 require 'logger'
 require 'dry-validation'
 require 'cgi'

data/pubnub.gemspec

@@ -19,10 +19,13 @@ Gem::Specification.new do |spec|
   spec.required_ruby_version = '>= 3.0.0'
 
   spec.add_dependency 'addressable', '>= 2.0.0'
+  spec.add_dependency 'base64'
+  spec.add_dependency 'logger'
+  spec.add_dependency 'ostruct'
   spec.add_dependency 'concurrent-ruby', '~> 1.3.4'
   spec.add_dependency 'concurrent-ruby-edge', '~> 0.7.1'
   spec.add_dependency 'dry-validation', '~> 1.0'
-  spec.add_dependency 'httpclient', '~> 2.8', '>= 2.8.3'
+  spec.add_dependency 'httpx', '>= 1.0'
   spec.add_dependency 'json', '>= 2.2.0', '< 3'
   spec.add_dependency 'timers', '>= 4.3.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pubnub
 version: !ruby/object:Gem::Version
-  version: 6.0.2
+  version: 6.1.1
 platform: ruby
 authors:
 - PubNub
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-03-03 00:00:00.000000000 Z
+date: 2026-07-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable
@@ -24,6 +24,48 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 2.0.0
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: logger
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: ostruct
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
   requirement: !ruby/object:Gem::Requirement
@@ -67,25 +109,19 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.0'
 - !ruby/object:Gem::Dependency
-  name: httpclient
+  name: httpx
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.8'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.8.3
+        version: '1.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.8'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.8.3
+        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: json
   requirement: !ruby/object:Gem::Requirement
@@ -224,6 +260,8 @@ files:
 - lib/pubnub/format.rb
 - lib/pubnub/formatter.rb
 - lib/pubnub/heart.rb
+- lib/pubnub/http_dispatcher.rb
+- lib/pubnub/http_response.rb
 - lib/pubnub/modules/crypto/crypto_module.rb
 - lib/pubnub/modules/crypto/crypto_provider.rb
 - lib/pubnub/modules/crypto/cryptor.rb