rb_snowflake_client 1.6.0 → 1.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8d4e6f5f28c211ce79c5c049125008efdbddca46ecb670f7bc724a10c11eb5ef
-  data.tar.gz: 42378b7321d2ce549b347b5f882d85af33f393a4a34e3032fa22e5bbbaa264e7
+  metadata.gz: 14628efb496cd0a61e49675e329f38d075dd5bb201371df522b7a84e31a6beca
+  data.tar.gz: b8b3618986b2d8d5a24d660270ab8860ebb985718375183c8ab73af0a89cd124
 SHA512:
-  metadata.gz: 33be4299bb251eb3be2ddef2301ab6e471c1a312d3a35dab3a2067d757125eec473aecf230bd84544992714e4dc7ab23b4a2129c8a460c5654eadb68de5f0109
-  data.tar.gz: 71ed8816683f48ed434fdb44515a3e92d0121d8935cc1e89c41a4accef4431ef5448c2feed0355df66cc04d17a1e88afcc7732a5a56af915d85e8345b84bd49a
+  metadata.gz: '00485ce43306464ac2d541a1349879d0e0130c4ced1dba7c785a0c1cd78319954e3eea734c6f77e4448d825f3ed42538f6ea042b1224a01d4b644d587cfa805b'
+  data.tar.gz: 90a65fc0820e5783870540d335a1db672f1a01affb5160cf4d88ba5411217a4e45ad896a16b274061f1d892161863958ad2da1c6ae87a373506c7c59692426f4

data/.github/workflows/arby-review.yml

@@ -0,0 +1,96 @@
+# For a PUBLIC repo: copy this one file into its .github/workflows/ instead of review.yml,
+# review-manual-request.yml and review-dismiss-stale.yml. A public repo can't use actions or reusable
+# workflows from rinsed-org/review-bot-workflows (an internal repo), so it doesn't run Arby itself. It asks
+# rinsed-org/review-bot-public-runner (internal) to, by dispatching that repo's review workflow with nothing
+# but this repo's name and the PR number. The runner reads this repo's settings (limit-approval-to,
+# blocking-severities, ...) from its own config file and runs the reusable workflow in cross-repo mode, which
+# reviews this PR in public repo mode and posts the review here as Arby. Per-repo setup: add this repo to the
+# runner's config, then add this file. See the bot's README, "Public repositories".
+#
+# Nothing PR-controlled reaches the dispatch: only github.repository and the PR number, passed through env.
+# No checkout, no PR code. The token is minted from the Arby Dispatcher app (Actions: write, installed only on
+# the runner repo) and scoped to that one repo, so all it can do is start runs there. The run's own red/green
+# status shows in the runner repo; on this PR the result is Arby's review. Manual "re-request Arby" reviews
+# aren't supported here yet: push a commit to get a new review.
+name: Arby review (public repo)
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+# Nothing by default; each job asks for exactly what it needs.
+permissions: {}
+
+jobs:
+  dispatch:
+    name: Request Arby review
+    # Drafts skip, as in review.yml.
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    # Only the app token is used, so the job's own token needs nothing.
+    permissions: {}
+    steps:
+      - name: Mint a dispatch token
+        id: token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ secrets.ARBY_DISPATCH_CLIENT_ID }}
+          private-key: ${{ secrets.ARBY_DISPATCH_PRIVATE_KEY }}
+          owner: rinsed-org
+          repositories: review-bot-public-runner
+          permission-actions: write
+      - name: Dispatch the review
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+          REPO: ${{ github.repository }}
+          PR: ${{ github.event.pull_request.number }}
+        run: |
+          # The REST endpoint directly, with an explicit ref: `gh workflow run` would first look up the runner
+          # repo's default branch, which needs Contents read, and this token has only Actions: write.
+          gh api --method POST repos/rinsed-org/review-bot-public-runner/actions/workflows/review.yml/dispatches \
+            -f ref=master -f "inputs[repo]=$REPO" -f "inputs[pr]=$PR"
+
+  # A COPY of rinsed-org/review-bot-workflows' dismiss-stale/action.yml, inlined because a public repo can't
+  # use that internal action. The two must change together. Its own job, so it stays a cheap check with no
+  # dependency on Arby, the app or the runner repo: make THIS job ("Dismiss stale Arby approvals") the
+  # required status check, as in review-dismiss-stale.yml. It runs on the job's default token and consumes
+  # nothing PR-controlled beyond the PR number.
+  dismiss:
+    # The required check is keyed on this name; keep it exactly as is.
+    name: Dismiss stale Arby approvals
+    concurrency:
+      group: arby-dismiss-stale-${{ github.event.pull_request.number }}
+      cancel-in-progress: true
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Dismiss stale review-bot approvals
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR: ${{ github.event.pull_request.number }}
+          BOT_LOGIN: rinsed-review-bot
+        run: |
+          set -euo pipefail
+          if [ -z "$PR" ]; then
+            echo "::error::No pull request in the event payload — call this from a pull_request_target workflow."
+            exit 1
+          fi
+          # Skip approvals for the PR's current head: the review workflow runs on the same event with no
+          # ordering, so a delayed dismiss job must not kill an approval Arby already gave the new commits. The
+          # head is fetched at execution time (not from the event payload) so a run delayed past a newer push
+          # can't dismiss that newer push's approval either.
+          head_sha=$(gh api "repos/$REPO/pulls/$PR" --jq .head.sha)
+          gh api "repos/$REPO/pulls/$PR/reviews" --paginate \
+            --jq ".[] | select(.user.login == \"$BOT_LOGIN\" and .state == \"APPROVED\"
+                              and .commit_id != \"$head_sha\") | .id" |
+          while read -r review_id; do
+            echo "Dismissing stale approval (review $review_id)"
+            # The API rejects blank (or whitespace-only) messages, so this is as terse as GitHub allows.
+            gh api --method PUT "repos/$REPO/pulls/$PR/reviews/$review_id/dismissals" \
+              --field message="Dismissing stale review" --field event="DISMISS"
+          done

data/CHANGELOG.md

@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+## [1.6.2] - 2026-10-19
+### Fixed
+- Compatibility with `json` 3.0, where `JSON.parse` options are keyword-only: every query raised
+  `ArgumentError: wrong number of arguments (given 2, expected 1)` because the parse options were passed
+  as a positional Hash. They're now passed as keywords, which works on `json` 2.x and 3.x. (#191)
+
+## [1.6.1] - 2026-08-18
+### Security
+- Bumped `json` to patch a format-string injection CVE (#169)
+- Bumped `concurrent-ruby` and `jwt` to patch CVEs (#182)
+### Changed
+- `Gemfile.lock` is no longer shipped inside the published gem. It has no function in a
+  consumer's dependency resolution, but image scanners read it as a manifest and reported our
+  development pins as CRITICAL findings against every consumer (#186)
+
 ## [1.6.0] - 2026-04-13
 ### Added
 - Support for passing a passphrase when using an encrypted private key for JWT authentication (#166)

data/lib/ruby_snowflake/client.rb

@@ -300,12 +300,12 @@ module RubySnowflake
       end
 
       def retrieve_result_set(query_start_time, query, response, streaming, query_timeout)
-        json_body = JSON.parse(response.body, JSON_PARSE_OPTIONS)
+        json_body = JSON.parse(response.body, **JSON_PARSE_OPTIONS)
         statement_handle = json_body["statementHandle"]
 
         if response.code == POLLING_RESPONSE_CODE
           result_response = poll_for_completion_or_timeout(query_start_time, query, statement_handle, query_timeout)
-          json_body = JSON.parse(result_response.body, JSON_PARSE_OPTIONS)
+          json_body = JSON.parse(result_response.body, **JSON_PARSE_OPTIONS)
         end
 
         num_threads = number_of_threads_to_use(json_body["resultSetMetaData"]["partitionInfo"].size)
@@ -331,7 +331,7 @@ module RubySnowflake
         end
 
         partition_json = {}
-        bm = Benchmark.measure { partition_json = JSON.parse(partition_response.body, JSON_PARSE_OPTIONS) }
+        bm = Benchmark.measure { partition_json = JSON.parse(partition_response.body, **JSON_PARSE_OPTIONS) }
         logger.debug { "JSON parsing took: #{bm.real}" }
         partition_data = partition_json["data"]
 

data/lib/ruby_snowflake/version.rb

@@ -1,3 +1,3 @@
 module RubySnowflake
-  VERSION = "1.6.0"
+  VERSION = "1.6.2"
 end

data/rb_snowflake_client.gemspec

@@ -14,8 +14,23 @@ Gem::Specification.new do |s|
   s.homepage = "https://github.com/rinsed-org/rb-snowflake-client"
   s.license = "MIT"
 
+  # Gemfile.lock is excluded deliberately, and it is a security fix rather than tidiness.
+  #
+  # A lockfile has no function inside a published gem -- Bundler resolves a consumer's tree from the
+  # dependency constraints below, never from a lockfile shipped in a dependency -- but container image
+  # scanners read any Gemfile.lock they find on disk as a manifest of what is installed. So our
+  # DEVELOPMENT lock became a vulnerability report against every consumer: an image that installs this
+  # gem gets .../gems/rb_snowflake_client-1.6.0/Gemfile.lock scanned, and the pinned
+  # concurrent-ruby 1.3.6, jwt 3.1.2 and json 2.15.1 are reported as CRITICAL findings on the consumer.
+  #
+  # That is all three CRITICAL findings on the DataExtract Lambda image, and they are unfixable there:
+  # the versions are ours, in our published artifact, and no bump on the consumer's side can move them.
+  # The runtime constraints (concurrent-ruby >= 1.2, json >= 2.1.0, jwt >= 2.7) are open-ended, so
+  # consumers already resolve their own versions and lose nothing by not receiving this file.
   s.files = Dir.chdir(File.expand_path(__dir__)) do
-    `git ls-files -z`.split("\x0").reject { |f| f.match(%r{\A(?:test|spec|features|vendor)/}) }
+    `git ls-files -z`.split("\x0").reject do |f|
+      f.match(%r{\A(?:test|spec|features|vendor)/}) || f == "Gemfile.lock"
+    end
   end
 
   s.require_paths = ["lib"]

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rb_snowflake_client
 version: !ruby/object:Gem::Version
-  version: 1.6.0
+  version: 1.6.2
 platform: ruby
 authors:
 - Rinsed
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-04-13 00:00:00.000000000 Z
+date: 2026-10-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bigdecimal
@@ -120,6 +120,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".github/dependabot.yml"
+- ".github/workflows/arby-review.yml"
 - ".github/workflows/ci.yml"
 - ".github/workflows/release-gh-packages.yml"
 - ".github/workflows/release-rubygems.yml"
@@ -127,7 +128,6 @@ files:
 - CHANGELOG.md
 - CODE_OF_CONDUCT.md
 - Gemfile
-- Gemfile.lock
 - LICENSE.txt
 - README.md
 - Rakefile

data/Gemfile.lock

@@ -1,87 +0,0 @@
-PATH
-  remote: .
-  specs:
-    rb_snowflake_client (1.6.0)
-      bigdecimal (>= 3.0)
-      concurrent-ruby (>= 1.2)
-      connection_pool (>= 2.4)
-      dotenv (>= 2.8)
-      json (>= 2.1.0)
-      jwt (>= 2.7)
-      retryable (>= 3.0)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    activesupport (8.0.5)
-      base64
-      benchmark (>= 0.3)
-      bigdecimal
-      concurrent-ruby (~> 1.0, >= 1.3.1)
-      connection_pool (>= 2.2.5)
-      drb
-      i18n (>= 1.6, < 2)
-      logger (>= 1.4.2)
-      minitest (>= 5.1)
-      securerandom (>= 0.3)
-      tzinfo (~> 2.0, >= 2.0.5)
-      uri (>= 0.13.1)
-    base64 (0.3.0)
-    benchmark (0.5.0)
-    bigdecimal (4.1.1)
-    coderay (1.1.3)
-    concurrent-ruby (1.3.6)
-    connection_pool (3.0.2)
-    diff-lcs (1.6.2)
-    dotenv (3.1.8)
-    drb (2.2.3)
-    i18n (1.14.8)
-      concurrent-ruby (~> 1.0)
-    json (2.15.1)
-    jwt (3.1.2)
-      base64
-    logger (1.7.0)
-    method_source (1.1.0)
-    minitest (6.0.3)
-      drb (~> 2.0)
-      prism (~> 1.5)
-    parallel (1.27.0)
-    prism (1.9.0)
-    pry (0.15.2)
-      coderay (~> 1.1)
-      method_source (~> 1.0)
-    rake (13.3.0)
-    retryable (3.0.5)
-    rspec (3.13.1)
-      rspec-core (~> 3.13.0)
-      rspec-expectations (~> 3.13.0)
-      rspec-mocks (~> 3.13.0)
-    rspec-core (3.13.5)
-      rspec-support (~> 3.13.0)
-    rspec-expectations (3.13.5)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.13.0)
-    rspec-mocks (3.13.5)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.13.0)
-    rspec-support (3.13.6)
-    securerandom (0.4.1)
-    tzinfo (2.0.6)
-      concurrent-ruby (~> 1.0)
-    uri (1.1.1)
-
-PLATFORMS
-  arm64-darwin-22
-  ruby
-
-DEPENDENCIES
-  activesupport (~> 8.0.4, >= 8.0.4.1)
-  bundler
-  parallel
-  pry
-  rake
-  rb_snowflake_client!
-  rspec
-
-BUNDLED WITH
-  4.0.3