pubnub 6.1.0 → 6.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 71b414f7fd632778c8f35096a7dc3c8fd3c730b827ad2335df6067fd06fc24ac
-  data.tar.gz: 0d58ad506e63c4979b1c105a14062557ec5a84580ead37882896b6f8636a53e3
+  metadata.gz: 376093de161830660661ecd60b0eb9a7f38e06096efad64a5588d5b00aaaa554
+  data.tar.gz: 8409b67c533fc6d079d230eb0bea64eddbbdc40ddb48ff95bb48be116aa5be16
 SHA512:
-  metadata.gz: eb9cf2ed6c70458c3fc4d5e784273013f362b95d5328e8c98340df39dbb2290f11376e30bce891ef47d5de576a2b9307a3cfde0e76b8bf49558e742353363c83
-  data.tar.gz: 33dcaca1439a6729e76a41eb2fb12a7ac58dc8acabace463afd035b3112aa5b8766f5a0cdeb5a095ed5d80a46408de0c2d310955506fc5efed7eb7bd3b4609f3
+  metadata.gz: 6df8f51d9465cfdf3f9c4cc14ae0afb83e43cc4d83d20c78ae8e9fb7fb9eed99f83f9879e29a334dfbae52d8a39a084c8903b433c4248ae49d51f9cfe58fb766
+  data.tar.gz: e6e014c7736f84bcab8eab9b464f1622051372c99097750b5745942e0a153b84dd3fb4a9469516194238d84ae31d03444a9501fc45d2ab61d2573ff40a507377

data/.pubnub.yml

@@ -1,6 +1,20 @@
 ---
-version: "6.1.0"
+version: "6.2.0"
 changelog:
+  - date: 2026-10-21
+    version: v6.2.0
+    changes:
+      - type: feature
+        text: "Add `categories` support to `grant` and `grant_token` for granting enumeration (`get`) permission on all `channels` and `uuids` metadata."
+  - date: 2026-07-21
+    version: v6.1.1
+    changes:
+      - type: bug
+        text: "`Pubnub::Cbor` now enforces a recursion-depth cap, a per-container length cap, and a total input size cap. Malformed or attacker-crafted tokens reaching `Pubnub::Client#parse_token` raise `Pubnub::Cbor::DecodeError` instead of hanging the caller or triggering `SystemStackError`."
+      - type: bug
+        text: "`Pubnub::Constants::DEFAULT_SSL` flipped from `false` to `true`. Integrators must now opt out explicitly to send traffic in cleartext."
+      - type: bug
+        text: "The Requested URI debug entry in `Pubnub::Event#uri` now masks the `signature` and `pnsig` query parameter values."
   - date: 2026-06-15
     version: v6.1.0
     changes:
@@ -647,7 +661,7 @@ sdks:
                     - x86-64
           - distribution-type: package
             distribution-repository: RubyGems
-            package-name: pubnub-6.1.0.gem
+            package-name: pubnub-6.2.0.gem
             location: https://rubygems.org/gems/pubnub
             requires:
               - name: addressable
@@ -752,8 +766,8 @@ sdks:
                     - x86-64
           - distribution-type: library
             distribution-repository: GitHub release
-            package-name: pubnub-6.1.0.gem
-            location: https://github.com/pubnub/ruby/releases/download/v6.1.0/pubnub-6.1.0.gem
+            package-name: pubnub-6.2.0.gem
+            location: https://github.com/pubnub/ruby/releases/download/v6.2.0/pubnub-6.2.0.gem
             requires:
               - name: addressable
                 min-version: 2.0.0

data/CHANGELOG.md

@@ -1,3 +1,17 @@
+## v6.2.0
+October 21 2026
+
+#### Added
+- Add `categories` support to `grant` and `grant_token` for granting enumeration (`get`) permission on all `channels` and `uuids` metadata.
+
+## v6.1.1
+July 21 2026
+
+#### Fixed
+- `Pubnub::Cbor` now enforces a recursion-depth cap, a per-container length cap, and a total input size cap. Malformed or attacker-crafted tokens reaching `Pubnub::Client#parse_token` raise `Pubnub::Cbor::DecodeError` instead of hanging the caller or triggering `SystemStackError`.
+- `Pubnub::Constants::DEFAULT_SSL` flipped from `false` to `true`. Integrators must now opt out explicitly to send traffic in cleartext.
+- The Requested URI debug entry in `Pubnub::Event#uri` now masks the `signature` and `pnsig` query parameter values, per the SDK log practices ADR. `auth` and `token` remain visible at DEBUG since they are permitted URL parameters.
+
 ## v6.1.0
 June 15 2026
 

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    pubnub (6.1.0)
+    pubnub (6.2.0)
       addressable (>= 2.0.0)
       base64
       concurrent-ruby (~> 1.3.4)

data/README.md

@@ -1,3 +1,5 @@
+<img width="1920" height="600" alt="ruby-header" src="https://github.com/user-attachments/assets/ddf7134b-804c-48d6-aa74-cc67ee5aab94" />
+
 # PubNub Ruby SDK
 
 ![Tests Status](https://github.com/pubnub/ruby/actions/workflows/run-tests.yml/badge.svg)

data/VERSION

@@ -1 +1 @@
-6.1.0
+6.2.0

data/features/support/hooks.rb

@@ -12,7 +12,7 @@ Before do |scenario|
     expect(ENV['SERVER_PORT']).not_to be_nil
     @pn_configuration = {
       origin: ENV['SERVER_HOST'] + ":" + ENV['SERVER_PORT'],
-      isSecure: false,
+      ssl: false,
     }
   }
 

data/lib/pubnub/cbor.rb

@@ -1,5 +1,10 @@
 module Pubnub
   class Cbor
+    class DecodeError < StandardError; end
+
+    MAX_DEPTH = 32
+    MAX_CONTAINER_LENGTH = 65_536
+    MAX_INPUT_SIZE = 1_048_576
 
     private
 
@@ -43,9 +48,14 @@ module Pubnub
       end
     end
 
+    def take_bytes(data, count)
+      raise DecodeError, "Truncated CBOR input" if data.size < count
+      data.shift(count)
+    end
+
     def decode_integer(data, additional)
       if ADDITIONAL_LENGTH_BYTES.member?(additional)
-        bytearray_to_i(data.shift(ADDITIONAL_LENGTH_BYTES[additional]))
+        bytearray_to_i(take_bytes(data, ADDITIONAL_LENGTH_BYTES[additional]))
       else
         additional
       end
@@ -55,7 +65,10 @@ module Pubnub
       if additional <= 23
         additional
       else
-        bytes = bytearray_to_i(data.shift(ADDITIONAL_LENGTH_BYTES[additional]))
+        raise DecodeError, "Invalid float additional value" unless ADDITIONAL_LENGTH_BYTES.member?(additional)
+
+        bytes = bytearray_to_i(take_bytes(data, ADDITIONAL_LENGTH_BYTES[additional]))
+        
         case (additional)
         when ADDITIONAL_LENGTH_1B
           bytes
@@ -98,44 +111,57 @@ module Pubnub
       result = []
 
       loop do
+        raise DecodeError, "Truncated CBOR input" if data.empty?
         byte = data.shift
         break if byte == INDEFINITE_BREAK
         result.append(byte)
-        break if data.empty?
       end
       result
     end
 
-    def compute_length(data, additional)
-      if ADDITIONAL_LENGTH_BYTES.member?(additional)
-        bytearray_to_i(data.shift(ADDITIONAL_LENGTH_BYTES[additional]))
-      else
-        additional
+    def compute_container_length(data, additional, min_element_bytes)
+      length = if ADDITIONAL_LENGTH_BYTES.member?(additional)
+                 bytearray_to_i(take_bytes(data, ADDITIONAL_LENGTH_BYTES[additional]))
+               else
+                 additional
+               end
+
+      if length > MAX_CONTAINER_LENGTH
+        raise DecodeError, "CBOR container length #{length} exceeds maximum #{MAX_CONTAINER_LENGTH}"
+      end
+
+      if length * min_element_bytes > data.size
+        raise DecodeError, "CBOR container length #{length} exceeds remaining input"
       end
+
+      length
     end
 
     def decode_string(data, additional)
       if additional == ADDITIONAL_TYPE_INDEFINITE
         indefinite_data(data).pack('C*').force_encoding('UTF-8')
       else
-        length = compute_length(data, additional)
-        data.shift(length).pack('C*').force_encoding('UTF-8')
+        length = compute_container_length(data, additional, 1)
+        take_bytes(data, length).pack('C*').force_encoding('UTF-8')
       end
     end
 
-    def decode_map(data, additional)
-      length = compute_length(data, additional)
+    def decode_map(data, additional, depth)
+      length = compute_container_length(data, additional, 2)
       result = Hash.new
-      (1..length).each { result.store(parse_data(data), parse_data(data)) }
+      length.times { result.store(parse_data(data, depth), parse_data(data, depth)) }
       result
     end
 
-    def decode_array(data, additional)
-      length = compute_length(data, additional)
-      (1..length).map { parse_data(data) }
+    def decode_array(data, additional, depth)
+      length = compute_container_length(data, additional, 1)
+      Array.new(length) { parse_data(data, depth) }
     end
 
-    def parse_data(data)
+    def parse_data(data, depth = 0)
+      raise DecodeError, "CBOR nesting depth exceeds #{MAX_DEPTH}" if depth > MAX_DEPTH
+      raise DecodeError, "Truncated CBOR input" if data.empty?
+
       byte = data.shift
 
       case (byte)
@@ -163,9 +189,9 @@ module Pubnub
         when TYPE_TEXT_STRING
           decode_string(data, additional)
         when TYPE_ARRAY
-          decode_array(data, additional)
+          decode_array(data, additional, depth + 1)
         when TYPE_HASHMAP
-          decode_map(data, additional)
+          decode_map(data, additional, depth + 1)
         else
           nil
         end
@@ -175,7 +201,11 @@ module Pubnub
     public
 
     def decode(value)
-      parse_data(value)
+      if value.size > MAX_INPUT_SIZE
+        raise DecodeError, "CBOR input size #{value.size} exceeds maximum #{MAX_INPUT_SIZE}"
+      end
+
+      parse_data(value.dup)
     end
   end
 

data/lib/pubnub/constants.rb

@@ -20,7 +20,7 @@ module Pubnub
     DEFAULT_TTL = 1440
     DEFAULT_REGION = '0'.freeze
     DEFAULT_USE_RANDOM_IV = true
-    DEFAULT_SSL = false
+    DEFAULT_SSL = true
     REQUEST_MESSAGE_COUNT_THRESHOLD = 0
     MAXIMUM_HERE_NOW_COUNT = 1000
 

data/lib/pubnub/event.rb

@@ -88,7 +88,7 @@ module Pubnub
       uri += path
       uri += '?' + Formatter.params_hash_to_url_params(parameters)
       uri += "&signature=#{sa_signature}" if sa_signature
-      Pubnub.logger.debug('Pubnub::Event') { "Requested URI: #{uri}" }
+      Pubnub.logger.debug('Pubnub::Event') { "Requested URI: #{uri.gsub(/([?&](?:signature|pnsig)=)[^&#]*/i, '\1***')}" }
       URI uri
     end
 

data/lib/pubnub/events/grant.rb

@@ -7,6 +7,7 @@ module Pubnub
 
     def initialize(options, app)
       @event = current_operation
+      @categories = format_categories(options[:categories])
       super
       @uuids = Formatter::format_uuid(options[:uuids]) unless options[:uuids].nil?
       @ttl ||= Pubnub::Constants::DEFAULT_TTL
@@ -18,10 +19,22 @@ module Pubnub
       Pubnub::Constants::OPERATION_GRANT
     end
 
+    def format_categories(categories)
+      formatted = case categories
+                  when NilClass then return nil
+                  when Array then categories.map { |category| category.to_s.strip }
+                  when String, Symbol then categories.to_s.split(',').map(&:strip)
+                  else return categories
+                  end
+
+      formatted.empty? ? nil : formatted
+    end
+
     def parameters(signature = false)
-      write = [0, '0', false].include?(@write) ? 0 : 1
-      read = [0, '0', false].include?(@read) ? 0 : 1
-      manage = [0, '0', false].include?(@manage) ? 0 : 1 # unless @group.blank?
+      category_grant = !@categories.nil?
+      write = (category_grant && @write.nil?) || [0, '0', false].include?(@write) ? 0 : 1
+      read = (category_grant && @read.nil?) || [0, '0', false].include?(@read) ? 0 : 1
+      manage = (category_grant && @manage.nil?) || [0, '0', false].include?(@manage) ? 0 : 1 # unless @group.blank?
       delete = [0, '0', false].include?(@delete) ? 0 : 1 unless @delete.nil?
       get = [0, '0', false].include?(@get) ? 0 : 1 unless @get.nil?
       update = [0, '0', false].include?(@update) ? 0 : 1 unless @update.nil?
@@ -35,7 +48,8 @@ module Pubnub
         g: get,
         u: update,
         j: join,
-        ttl: @ttl }.delete_if { |_k, v| v.nil? }.merge(super(signature))
+        ttl: @ttl,
+        category: (@categories.join(',') unless @categories.nil?) }.delete_if { |_k, v| v.nil? }.merge(super(signature))
     end
 
     def path

data/lib/pubnub/events/grant_token.rb

@@ -12,6 +12,7 @@ module Pubnub
       options[:channel_groups] = options[:channel_groups] || {}
       @spaces_permissions = options[:spaces_permissions] || {}
       @users_permissions = options[:users_permissions] || {}
+      @categories = options[:categories] || {}
       super
     end
 
@@ -31,7 +32,8 @@ module Pubnub
           meta: @meta,
           uuid: uuid,
           resources: prepare_permissions(:resource, @channels, @channel_groups, @uuids, @spaces_permissions, @users_permissions),
-          patterns: prepare_permissions(:pattern, @channels, @channel_groups, @uuids, @spaces_permissions, @users_permissions)
+          patterns: prepare_permissions(:pattern, @channels, @channel_groups, @uuids, @spaces_permissions, @users_permissions),
+          categories: prepare_categories(@categories)
         }.select { |_, v| v }
       }
       body = Formatter.format_message(raw_body, nil, false)
@@ -70,6 +72,12 @@ module Pubnub
         .to_h { |k, v| [k, v.calculate_bitmask] }
     end
 
+    def prepare_categories(categories)
+      return nil if categories.empty?
+
+      categories.to_h { |k, v| [k.to_s, v.calculate_bitmask] }
+    end
+
     def valid_envelope(parsed_response, req_res_objects)
       Pubnub::Envelope.new(
         event: @event,
@@ -146,6 +154,13 @@ module Pubnub
           join: join
         )
       end
+
+      def cat(get: false)
+        Permissions.new(
+          type: :category,
+          get: get
+        )
+      end
     end
 
     def initialize(options)

data/lib/pubnub/validators/grant.rb

@@ -12,6 +12,7 @@ module Pubnub
         validate_keys!
         validate_ttl!
         validate_uuids!
+        validate_categories!
       end
 
       private
@@ -37,6 +38,27 @@ module Pubnub
         )
       end
 
+      def validate_categories!
+        return if @categories.nil?
+
+        raise(
+          ArgumentError.new(object: self, message: ':categories has to be kind of String, Symbol or Array for grant event.'),
+          ':categories has to be kind of String, Symbol or Array for grant event.'
+        ) unless @categories.is_a?(Array)
+
+        raise(
+          ArgumentError.new(object: self, message: ':categories supports only channels and uuids for grant event.'),
+          ':categories supports only channels and uuids for grant event.'
+        ) unless (@categories - %w[channels uuids]).empty?
+
+        # Use the per-call option: PAM#initialize resets @auth_key to options[:auth_key], so a client-level
+        # auth_key is never sent as the grant target `auth`.
+        raise(
+          ArgumentError.new(object: self, message: ':auth_key is required for grant event on categories.'),
+          ':auth_key is required for grant event on categories.'
+        ) if @given_options[:auth_key].nil? || @given_options[:auth_key].to_s.empty?
+      end
+
       def validate_uuids!
         return if @uuids.nil?
 

data/lib/pubnub/validators/grant_token.rb

@@ -12,6 +12,7 @@ module Pubnub
         validate_permissions!(@uuids, ":uuids")
         validate_permissions!(@channels, ":channels")
         validate_permissions!(@channel_groups, ":uuids")
+        validate_categories!
         validate_objects_entities_separation!
       end
 
@@ -47,6 +48,27 @@ module Pubnub
         ) unless arg.is_a?(Hash)
       end
 
+      def validate_categories!
+        return if @categories.nil?
+
+        raise(
+          ArgumentError.new(object: self, message: ':categories has to be kind of Hash for grant token event.'),
+          ':categories has to be kind of Hash for grant token event.'
+        ) unless @categories.is_a?(Hash)
+
+        @categories.each do |key, value|
+          raise(
+            ArgumentError.new(object: self, message: ':categories supports only :channels and :uuids keys for grant token event.'),
+            ':categories supports only :channels and :uuids keys for grant token event.'
+          ) unless %w[channels uuids].include?(key.to_s)
+
+          raise(
+            ArgumentError.new(object: self, message: ':categories values have to be created with Pubnub::Permissions.cat for grant token event.'),
+            ':categories values have to be created with Pubnub::Permissions.cat for grant token event.'
+          ) unless value.is_a?(Pubnub::Permissions) && value.type == :category
+        end
+      end
+
       def validate_objects_entities_separation!
         entities_set = !@spaces_permissions.empty? ||
           !@users_permissions.empty?

data/lib/pubnub/version.rb

@@ -1,4 +1,4 @@
 # Toplevel Pubnub module.
 module Pubnub
-  VERSION = '6.1.0'.freeze
+  VERSION = '6.2.0'.freeze
 end

data/pubnub.gemspec

@@ -11,6 +11,10 @@ Gem::Specification.new do |spec|
   spec.description = 'Ruby anywhere in the world in 250ms with PubNub!'
   spec.homepage = 'https://github.com/pubnub/ruby'
   spec.licenses = ['LicenseRef-LICENSE.txt']
+  spec.metadata = {
+    "changelog_uri" => "https://www.pubnub.com/docs/sdks/ruby/changelog",
+    "documentation_uri" => "https://www.pubnub.com/docs/sdks/ruby",
+  }
 
   spec.files = `git ls-files -z`.split("\x0").grep_v(/^(test|spec|fixtures)/)
   spec.executables = spec.files.grep(%r{^bin\/}) { |f| File.basename(f) }

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pubnub
 version: !ruby/object:Gem::Version
-  version: 6.1.0
+  version: 6.2.0
 platform: ruby
 authors:
 - PubNub
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-06-15 00:00:00.000000000 Z
+date: 2026-10-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable
@@ -332,7 +332,9 @@ files:
 homepage: https://github.com/pubnub/ruby
 licenses:
 - LicenseRef-LICENSE.txt
-metadata: {}
+metadata:
+  changelog_uri: https://www.pubnub.com/docs/sdks/ruby/changelog
+  documentation_uri: https://www.pubnub.com/docs/sdks/ruby
 post_install_message:
 rdoc_options: []
 require_paths: