quonfig 1.5.0 → 1.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5be29a29cae00eb43e09f2aadef25191ec4dc9959ff0037cdfd7ba89dfbd5a10
-  data.tar.gz: b47703c3beb5a4f85f6b2237b3e4295e8e82055ab105168827e750dbd428d13e
+  metadata.gz: 96d17a74751571b9c6099b8239b2ccaafb25a5f7e55d006cecae5cb1f8651979
+  data.tar.gz: 6bbe54bd07a5fb1e20b987ef8a8aaef417533ca8ef26000873db8a671142d4bb
 SHA512:
-  metadata.gz: 7616048fcd0a2a0727ac79a0a801f35d71be44cd54667dc4aaa8aa86009033194f20abbfb69f0b959dc5ba90cdf3e29069db1384e8a432caafe34898f69e3165
-  data.tar.gz: 31d412725f88752b8cbde55daa05c99b926212c2951519a177c24dae72b19d665b3452f4f723e5b2b7e78258cdb37e064733e18249316f7b055846408d2eda92
+  metadata.gz: dcb86b3f98c5f986d61f0b0db084b992fe4c3bfefc86ef2f7d0f65487fa95dc6d66fdd4b5150dd2c0f8b6ddd819f6c0bc77980e4ae89d618d31daa3649bc48c6
+  data.tar.gz: 9faba58f93536256b216dd70dc95849adbb1c4e18b033feb9419d87d26dd8b04ec132738f4bfcbee3b0e7dca0b9051bad43971644b3312d0320ee496e8550efc

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 1.6.0 - 2026-09-28
+
+- **Change: a weighted rollout that hashes on a property missing from the context now hashes an empty value, so every such caller gets the same variant for that flag (qfg-9dxb.8).** Before, such evaluations got a random variant on every call. It is the same variant a context with the property set to `""` gets, and a variant with weight 0 is not served. The reason is still `SPLIT`. The `flag_metadata` of `get_*_details` results includes `'hashPropertyMissing' => true` when the property is missing, and the SDK logs one warning per flag. A weighted rollout with no hash property configured still picks a random variant on every evaluation, unchanged. Users whose context has the property keep the same variant as in 1.5.0.
+- **Change: once the client holds a numbered config generation, a payload with generation 0 is ignored and the client keeps its current config (qfg-9dxb.9).** Only a delivery server with a damaged git store sends one. In 1.5.0 such a payload installed and could move the client back to older config. `held_generation` never goes backward. A client that has never received a real generation (for example one talking to `qfg serve`) still installs every payload.
+- **Fix: a segment or `decryptWith` key that references itself (directly or through a chain) no longer crashes with `SystemStackError` (qfg-9dxb.7).** The looping segment reference evaluates as a missing segment. A `decryptWith` loop raises `DecryptionError`.
+- **Fix: an HTTP 200 or SSE event that is not a config payload (for example `{}` from a proxy) is ignored instead of deleting all configs (qfg-9dxb.3).** Over HTTP the SDK tries the next server.
+
 ## 1.5.0 - 2026-09-25
 
 - **Telemetry transport policy (qfg-y8je.8).** The telemetry POST had no timeout of its own (Faraday's defaults, 60s connect + 60s read); it now has a 15s overall deadline (`telemetry_timeout_ms`) and a 5s connect + TLS deadline (`telemetry_connect_timeout_ms`). A failed batch is kept byte-for-byte and resent (never merged with newer data, so the server dedups a resend of a batch that did land). Resends happen no sooner than 30s after a failure and honor `Retry-After` up to 10 min. The retained queue is capped at 5 batches / 2MB / 5 min (oldest dropped). At most one POST is in flight. 401/403/404 disable telemetry for the process with one ERROR; any other 4xx drops that batch with one ERROR. Before this, a failed batch was simply lost.

data/lib/quonfig/client.rb

@@ -1636,13 +1636,15 @@ module Quonfig
       end
 
       reason = result.of_reason
+      flag_metadata = build_flag_metadata(
+        config_id, config_type, result.rule_index, result.weighted_value_index, reason
+      )
+      flag_metadata['hashPropertyMissing'] = true if result.hash_property_missing
       Quonfig::EvaluationDetails.new(
         value: coerced,
         reason: reason,
         variant: build_variant(reason, result.rule_index, result.weighted_value_index),
-        flag_metadata: build_flag_metadata(
-          config_id, config_type, result.rule_index, result.weighted_value_index, reason
-        )
+        flag_metadata: flag_metadata
       )
     rescue StandardError => e
       Quonfig::EvaluationDetails.new(

data/lib/quonfig/config_envelope.rb

@@ -1,5 +1,20 @@
 # frozen_string_literal: true
 
 module Quonfig
-  ConfigEnvelope = Struct.new(:configs, :meta, keyword_init: true)
+  ConfigEnvelope = Struct.new(:configs, :meta, keyword_init: true) do
+    # qfg-9dxb.3: true when a decoded wire payload is a config envelope — a
+    # Hash carrying a +meta+ object with a non-empty +version+. api-delivery and
+    # `qfg serve` always send one; a `{}` or `{"error":"x"}` 200 from a
+    # misbehaving proxy/WAF does not, and must never be installed (it would
+    # read as "zero configs" and wipe every key on an established client).
+    def self.wire_envelope?(data)
+      return false unless data.is_a?(Hash)
+
+      meta = data['meta']
+      return false unless meta.is_a?(Hash)
+
+      version = meta['version']
+      !version.nil? && !version.to_s.empty?
+    end
+  end
 end

data/lib/quonfig/config_loader.rb

@@ -325,7 +325,11 @@ module Quonfig
         envelope = parse_envelope(response.body)
         result = install_envelope(envelope, source: source, source_index: index)
         # Write this leg's ETag back AFTER the response (per-leg, race-free).
-        set_etag_for(index, new_etag)
+        # Exception (qfg-9dxb.9): an ignored gen<=0 payload keeps the previous
+        # ETag. Its ETag is the git sha, and the server may later repair the
+        # generation for the SAME sha; remembering it would 304 that repair.
+        ignored_unversioned = result == :not_modified && extract_generation(envelope.meta || {}) <= 0
+        set_etag_for(index, new_etag) unless ignored_unversioned
         # install_envelope returns :not_modified when the reject-older guard drops
         # an equal/older payload — surface that so the caller doesn't double-count.
         result == :not_modified ? :not_modified : :updated
@@ -339,6 +343,12 @@ module Quonfig
         @logger.info "Config fetch failed: status #{response.status} from #{source}"
         :failed
       end
+    rescue NonEnvelopeError => e
+      # qfg-9dxb.3: a non-envelope 200 is a leg error, NOT an install — the
+      # hedge/failover proceeds and this leg's ETag is never stored (so a junk
+      # 200 cannot pin itself through later 304s).
+      @logger.warn "Config fetch from #{source} returned a non-envelope 200 (#{e.message}); treating as a failed leg"
+      :failed
     rescue Faraday::ConnectionFailed => e
       @logger.debug "Connection failure fetching configs from #{source}: #{e.message}"
       :failed
@@ -355,8 +365,14 @@ module Quonfig
       @etag_mutex.synchronize { @etags[index || 0] = value }
     end
 
+    # Raised by #parse_envelope for a 200 whose body is not a config envelope
+    # (qfg-9dxb.3). Caught in #fetch_from as a leg error.
+    class NonEnvelopeError < StandardError; end
+
     def parse_envelope(body)
       data = body.is_a?(String) ? JSON.parse(body) : body
+      raise NonEnvelopeError, 'missing meta.version' unless Quonfig::ConfigEnvelope.wire_envelope?(data)
+
       Quonfig::ConfigEnvelope.new(
         configs: data['configs'] || [],
         meta: data['meta'] || {}
@@ -375,23 +391,37 @@ module Quonfig
       incoming_gen = extract_generation(meta)
 
       @install_mutex.synchronize do
-        # Reject-older install guard (canonical ordering, §5f). A fresh client
-        # (no held generation) seeds off whatever arrives first — even an older
-        # or gen-0 snapshot. An established client installs ONLY when the incoming
-        # generation strictly advances the held one: a same-generation snapshot is
-        # a no-op (no store churn, no install-count bump, no resolved-from change)
-        # so a duplicate leg never flaps an established client, and an OLDER
-        # snapshot (a stale secondary reached on failover) is dropped so the client
-        # never regresses. Reject-older is the whole rule — no source ranking; a
-        # newer primary landing late heals forward automatically. Applies on every
-        # network install path (initial fetch, failover/poll fetch, SSE snapshot,
-        # SSE update, fallback poller); datadir install bypasses this (it is the
-        # local source of truth and goes through Client#apply_datadir_envelope).
-        # Carve-out: an UNVERSIONED snapshot (generation <= 0 — a server that
-        # predates the watermark, or one whose rev-count failed) carries no
-        # ordering info, so it is never rejected as "older"; freezing the client
-        # on stale config would be worse (mirrors sdk-node).
-        unless @held_generation.nil? || incoming_gen <= 0 || incoming_gen > @held_generation
+        # Reject-older install guard (canonical ordering, §5f; mirrors sdk-go
+        # shouldInstall). The rule:
+        #   - fresh client (nothing installed yet)  -> install, whatever arrives
+        #   - incoming generation <= 0 (unversioned) -> install ONLY if the held
+        #     generation is 0 (the client has never held a real generation)
+        #   - otherwise -> install iff incoming strictly exceeds held
+        # A same-generation snapshot is a no-op (no store churn, no install-count
+        # bump, no resolved-from change) so a duplicate leg never flaps an
+        # established client, and an OLDER snapshot (a stale secondary reached on
+        # failover) is dropped so the client never regresses. Reject-older is the
+        # whole rule — no source ranking; a newer primary landing late heals
+        # forward automatically. Applies on every network install path (initial
+        # fetch, failover/poll fetch, SSE snapshot, SSE update, fallback poller);
+        # datadir install bypasses this (it is the local source of truth and goes
+        # through Client#apply_datadir_envelope).
+        #
+        # Unversioned payloads (qfg-9dxb.9): the pre-watermark servers that sent
+        # gen 0 on every payload are long gone. Today gen 0 comes only from a
+        # server whose git store is damaged (rev-count failed) — the least
+        # trustworthy source — so it must not override a held real generation.
+        # A client that has only ever seen gen 0 (e.g. `qfg serve`) keeps
+        # installing each gen 0 payload.
+        unless should_install?(incoming_gen)
+          if incoming_gen <= 0
+            # Unversioned payload while a real generation is held: not provably
+            # older (it carries no ordering info), so a silent no-op — NOT
+            # counted as guardRejected.
+            @logger.debug "Unversioned payload ignored: held generation #{@held_generation} (source=#{source})"
+            return :not_modified
+          end
+
           if incoming_gen < @held_generation
             @logger.debug "Reject-older guard: dropping incoming generation #{incoming_gen} < held #{@held_generation} (source=#{source})"
             # Failover observability (qfg-41nh.18): count the guard rejection.
@@ -431,7 +461,11 @@ module Quonfig
         @version = meta['version'] || meta[:version] || @version
         @environment_id = meta['environment'] || meta[:environment] || @environment_id
 
-        @held_generation = incoming_gen
+        # qfg-9dxb.3 Fix A: an unversioned install (generation <= 0) carries no
+        # ordering info and must never LOWER a positive held generation. Under
+        # the qfg-9dxb.9 rule it only installs when held is nil/0 anyway, so
+        # this keeps held at 0 there; a fresh client seeds off it as usual.
+        @held_generation = incoming_gen if @held_generation.nil? || incoming_gen.positive?
         @install_count += 1
         @resolved_from_index = source_index unless source_index.nil?
         # Failover observability (qfg-41nh.18): record which leg served this
@@ -457,6 +491,14 @@ module Quonfig
       end
     end
 
+    # The install decision for a network payload (see #install_envelope).
+    def should_install?(incoming_gen)
+      return true if @held_generation.nil?
+      return @held_generation.zero? if incoming_gen <= 0
+
+      incoming_gen > @held_generation
+    end
+
     # Read Meta.generation (qfg-7h5d.1.1) — the monotonic per-branch commit
     # counter the backend stamps on every envelope. Absent/garbage → 0 (an old
     # backend that doesn't emit it, or fixture mode with no FIXTURE_GENERATION).

data/lib/quonfig/evaluator.rb

@@ -131,10 +131,15 @@ module Quonfig
 
     # --- Rule evaluation ------------------------------------------------
 
-    def evaluate_rules(rules, context, config)
+    # +seg_path+ holds the keys of the configs being evaluated above this one
+    # through IN_SEG / NOT_IN_SEG, so segment resolution can detect a
+    # reference cycle instead of recursing until SystemStackError
+    # (qfg-9dxb.7). It is a path, not a global visited set, so a diamond (two
+    # segments that both reference a third) still resolves.
+    def evaluate_rules(rules, context, config, seg_path = [])
       rules.each_with_index do |rule, index|
         criteria = Array(hget(rule, :criteria) || [])
-        next unless all_criteria_match?(criteria, context, config)
+        next unless all_criteria_match?(criteria, context, config, seg_path)
 
         value_hash = hget(rule, :value)
         return EvalResult.new(value: value_hash, rule_index: index, config: config)
@@ -142,8 +147,8 @@ module Quonfig
       nil
     end
 
-    def all_criteria_match?(criteria, context, config)
-      criteria.all? { |c| evaluate_criterion(c, context, config) }
+    def all_criteria_match?(criteria, context, config, seg_path)
+      criteria.all? { |c| evaluate_criterion(c, context, config, seg_path) }
     end
 
     # --- Per-operator evaluation ---------------------------------------
@@ -151,7 +156,7 @@ module Quonfig
     # Faithful port of sdk-node/src/operators.ts evaluateCriterion. Matches
     # context-exists / missing-context semantics (e.g. PROP_IS_NOT_ONE_OF is
     # true when context is missing).
-    def evaluate_criterion(criterion, context, _config)
+    def evaluate_criterion(criterion, context, config, seg_path)
       property_name = hget(criterion, :propertyName) || ''
       operator = hget(criterion, :operator)
       match_value = hget(criterion, :valueToMatch)
@@ -296,7 +301,7 @@ module Quonfig
       when OP_IN_SEG, OP_NOT_IN_SEG
         if match_value
           segment_key = to_s_nil(hget(match_value, :value))
-          found, result = resolve_segment(segment_key, context)
+          found, result = resolve_segment(segment_key, context, config, seg_path)
           return operator == OP_NOT_IN_SEG unless found
 
           return result == (operator == OP_IN_SEG)
@@ -319,16 +324,22 @@ module Quonfig
 
     # --- Segment resolution -------------------------------------------
 
-    def resolve_segment(segment_key, context)
+    def resolve_segment(segment_key, context, config, seg_path)
       return [false, false] if segment_key.nil? || segment_key.empty?
 
+      # A reference back onto the current evaluation path is a cycle. Treat
+      # it like a missing segment (IN_SEG false, NOT_IN_SEG true), matching
+      # sdk-go (qfg-9dxb.4).
+      current_key = hget(config, :key).to_s
+      return [false, false] if segment_key == current_key || seg_path.include?(segment_key)
+
       seg_config = @store.get(segment_key)
       return [false, false] if seg_config.nil?
 
       # Segments have no environment-specific rules in the JSON shape; we
       # evaluate against default rules only (mirrors sdk-node behaviour —
       # evaluate_config with env_id='' falls through to default).
-      match = evaluate_rules(default_rules_of(seg_config), context, seg_config)
+      match = evaluate_rules(default_rules_of(seg_config), context, seg_config, seg_path + [current_key])
       return [false, false] if match.nil?
 
       raw = match.raw_value
@@ -424,14 +435,18 @@ module Quonfig
     REASON_TARGETING_MATCH  = 2
     REASON_SPLIT            = 3
 
-    attr_reader :value, :rule_index, :config, :reportable_value
+    attr_reader :value, :rule_index, :config, :reportable_value, :hash_property_missing
     attr_accessor :weighted_value_index
 
-    def initialize(value:, rule_index:, config:, weighted_value_index: nil, reportable_value: nil)
+    def initialize(value:, rule_index:, config:, weighted_value_index: nil, reportable_value: nil,
+                   hash_property_missing: false)
       @value = value
       @rule_index = rule_index
       @config = config
       @weighted_value_index = weighted_value_index
+      # True when a weighted rollout's hash property was missing from the
+      # context and an empty value was hashed instead (qfg-9dxb.8).
+      @hash_property_missing = hash_property_missing
       # Telemetry-safe substitute for #unwrapped_value. Set by Resolver when
       # the underlying Value was confidential / decryptWith, so callers
       # (the eval-summary aggregator) never see the plaintext. Mirrors

data/lib/quonfig/resolver.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'digest'
+require 'set'
 
 module Quonfig
   # Public-API resolver: looks up a config by key in a ConfigStore and runs
@@ -16,6 +17,7 @@ module Quonfig
   # production read path (with config_loader, SSE updates, telemetry), see
   # Quonfig::ConfigResolver — the two coexist during the JSON migration.
   class Resolver
+    LOG = Quonfig::InternalLogger.new(self)
     TRUE_VALUES = %w[true 1 t yes].freeze
     # Prefix the eval-summary aggregator stamps onto redacted confidential
     # values before the 5-char MD5 hash. Matches CONFIDENTIAL_PREFIX in
@@ -29,6 +31,9 @@ module Quonfig
     def initialize(store, evaluator)
       @store = store
       @evaluator = evaluator
+      # Config keys already warned about a missing hash property (qfg-9dxb.8).
+      @hash_missing_warned = Set.new
+      @hash_missing_mutex = Mutex.new
     end
 
     def raw(key)
@@ -50,7 +55,8 @@ module Quonfig
       return nil if eval_result.nil?
 
       weighted_index = nil
-      resolved_value = resolve_value(eval_result.value, config, context) do |idx|
+      hash_missing = []
+      resolved_value = resolve_value_on_path(eval_result.value, config, context, [], hash_missing) do |idx|
         weighted_index = idx
       end
       EvalResult.new(
@@ -58,7 +64,8 @@ module Quonfig
         rule_index: eval_result.rule_index,
         config: config,
         weighted_value_index: weighted_index,
-        reportable_value: redacted_reportable_value(eval_result.value)
+        reportable_value: redacted_reportable_value(eval_result.value),
+        hash_property_missing: !hash_missing.empty?
       )
     end
 
@@ -68,32 +75,42 @@ module Quonfig
     # - confidential + decryptWith → look up the key config, decrypt
     # - everything else passes through unchanged
     def resolve_value(value, config, context = nil, &on_weighted_index)
+      resolve_value_on_path(value, config, context, [], &on_weighted_index)
+    end
+
+    # Integration shims for code that expects a ConfigResolver. Keep these
+    # narrow; the real ConfigResolver still owns the production hot path.
+    def symbolize_json_names?
+      false
+    end
+
+    private
+
+    # resolve_value plus +key_path+: the config keys already being resolved
+    # above this one through decryptWith, so a decryptWith cycle raises a
+    # DecryptionError instead of recursing until SystemStackError
+    # (qfg-9dxb.7, matching sdk-go qfg-9dxb.4). +hash_missing+, when given,
+    # gets an entry for each weighted rollout whose hash property was missing
+    # from the context (qfg-9dxb.8).
+    def resolve_value_on_path(value, config, context, key_path, hash_missing = nil, &on_weighted_index)
       return nil if value.nil?
 
       type = vget(value, :type, 'type')
 
       return resolve_provided(value, config) if type == 'provided'
 
-      return resolve_weighted(value, config, context, &on_weighted_index) if type == 'weighted_values'
+      return resolve_weighted(value, config, context, key_path, hash_missing, &on_weighted_index) if type == 'weighted_values'
 
       confidential = vget(value, :confidential, 'confidential')
       decrypt_with = vget(value, :decryptWith, 'decryptWith', :decrypt_with, 'decrypt_with')
       if confidential && decrypt_with && !decrypt_with.to_s.empty?
         return resolve_decryption(value, config, context,
-                                  decrypt_with)
+                                  decrypt_with, key_path)
       end
 
       value
     end
 
-    # Integration shims for code that expects a ConfigResolver. Keep these
-    # narrow; the real ConfigResolver still owns the production hot path.
-    def symbolize_json_names?
-      false
-    end
-
-    private
-
     # If +value+ is confidential or has a decryptWith key, return the
     # `*****<5-hex>` redacted string the eval-summary telemetry aggregator
     # should ship in place of the resolved plaintext. The hash is computed
@@ -162,7 +179,12 @@ module Quonfig
     # (or fall back to a per-call random) into [0,1), then walk the variant
     # weights until cumulative weight >= bucket. Recurses through
     # resolve_value so nested provided/encrypted variants work too.
-    def resolve_weighted(value, config, context, &on_weighted_index)
+    #
+    # A hash property that is configured but missing from the context (or
+    # nil) hashes an empty value, the same bucket as a present "", and warns
+    # once per config key (qfg-9dxb.8). With no hash property configured the
+    # pick stays random per call.
+    def resolve_weighted(value, config, context, key_path, hash_missing = nil, &on_weighted_index)
       payload = vget(value, :value, 'value') || {}
       weighted = vget(payload, :weightedValues, 'weightedValues', :weighted_values, 'weighted_values')
       return value unless weighted.is_a?(Array) && !weighted.empty?
@@ -182,23 +204,42 @@ module Quonfig
       end
 
       cfg_key = config_key(config)
+      if hash_value.nil? && !hash_property.to_s.empty?
+        hash_value = ''
+        hash_missing&.push(true)
+        warn_hash_property_missing(cfg_key, hash_property)
+      end
       picker = Quonfig::WeightedValueResolver.new(weighted, cfg_key, hash_value)
       variant, index = picker.resolve
       on_weighted_index&.call(index)
       variant_value = vget(variant, :value, 'value')
-      resolve_value(variant_value, config, context, &on_weighted_index)
+      resolve_value_on_path(variant_value, config, context, key_path, hash_missing, &on_weighted_index)
+    end
+
+    def warn_hash_property_missing(cfg_key, hash_property)
+      return unless @hash_missing_mutex.synchronize { @hash_missing_warned.add?(cfg_key) }
+
+      LOG.warn "quonfig: weighted rollout for \"#{cfg_key}\" hashes on \"#{hash_property}\" " \
+               'which is missing from context; hashing an empty value instead'
     end
 
     # Recursively resolve the decryption-key config (it may itself be a
     # provided ENV_VAR), then AES-GCM decrypt the value with that key.
-    def resolve_decryption(value, config, context, decrypt_with)
+    def resolve_decryption(value, config, context, decrypt_with, key_path)
+      key_path += [config_key(config).to_s]
+      if key_path.include?(decrypt_with.to_s)
+        raise Quonfig::Errors::DecryptionError.new(
+          config_key(config), %(decryption key config "#{decrypt_with}" is part of a decryptWith cycle)
+        )
+      end
+
       key_cfg = @store.get(decrypt_with)
       raise Quonfig::Error, %(Decryption key config "#{decrypt_with}" not found) if key_cfg.nil?
 
       key_match = @evaluator.evaluate_config(key_cfg, context, resolver: self)
       raise Quonfig::Error, %(Decryption key config "#{decrypt_with}" did not match) if key_match.nil?
 
-      resolved_key = resolve_value(key_match.value, key_cfg, context)
+      resolved_key = resolve_value_on_path(key_match.value, key_cfg, context, key_path)
       secret_key = vget(resolved_key, :value, 'value').to_s
       raise Quonfig::Error, %(Decryption key from "#{decrypt_with}" is empty) if secret_key.empty?
 

data/lib/quonfig/sse_config_client.rb

@@ -604,6 +604,14 @@ module Quonfig
           return nil
         end
 
+        # qfg-9dxb.3: drop a JSON event that is not a config envelope (no meta
+        # object with a non-empty version) exactly like malformed JSON — it must
+        # never reach install and wipe an established client's keys.
+        unless Quonfig::ConfigEnvelope.wire_envelope?(parsed)
+          (@logger || LOG).error 'SSE Streaming Error: non-envelope event (missing meta.version); dropped'
+          return nil
+        end
+
         envelope = Quonfig::ConfigEnvelope.new(
           configs: parsed['configs'] || [],
           meta: parsed['meta'] || {}

data/lib/quonfig/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Quonfig
-  VERSION = '1.5.0'
+  VERSION = '1.6.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: quonfig
 version: !ruby/object:Gem::Version
-  version: 1.5.0
+  version: 1.6.0
 platform: ruby
 authors:
 - Jeff Dwyer
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-25 00:00:00.000000000 Z
+date: 2026-09-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport