rb_snowflake_client 1.6.0 → 1.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8d4e6f5f28c211ce79c5c049125008efdbddca46ecb670f7bc724a10c11eb5ef
-  data.tar.gz: 42378b7321d2ce549b347b5f882d85af33f393a4a34e3032fa22e5bbbaa264e7
+  metadata.gz: 57d979564fce1cdc8fb8b92043e89b631f4f1ca35db2cc2d4601a1739506e89a
+  data.tar.gz: ecfd25eb94ae8e5767e49c7b3b5dd33f02905e09c839ba0bd59be81f629f1390
 SHA512:
-  metadata.gz: 33be4299bb251eb3be2ddef2301ab6e471c1a312d3a35dab3a2067d757125eec473aecf230bd84544992714e4dc7ab23b4a2129c8a460c5654eadb68de5f0109
-  data.tar.gz: 71ed8816683f48ed434fdb44515a3e92d0121d8935cc1e89c41a4accef4431ef5448c2feed0355df66cc04d17a1e88afcc7732a5a56af915d85e8345b84bd49a
+  metadata.gz: 906470b3b67d6a102bbe25bc02e42c2178a4a9fc7a1eb6785398a1bfc45d6e47e9b5dc392aebc4dc35dbd0c6a2263c30c39c3ce522396a6584629f8d8e7ad43e
+  data.tar.gz: d767e9956def03c80dd8eb66d24649c54c987f37dc07870a319a55ac9455821b330e4d5a59e89246282899f40d76222c6a07b90dc6882a5e89ba3c410a6c1f95

data/CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+## [1.6.1] - 2026-08-18
+### Security
+- Bumped `json` to patch a format-string injection CVE (#169)
+- Bumped `concurrent-ruby` and `jwt` to patch CVEs (#182)
+### Changed
+- `Gemfile.lock` is no longer shipped inside the published gem. It has no function in a
+  consumer's dependency resolution, but image scanners read it as a manifest and reported our
+  development pins as CRITICAL findings against every consumer (#186)
+
 ## [1.6.0] - 2026-04-13
 ### Added
 - Support for passing a passphrase when using an encrypted private key for JWT authentication (#166)

data/lib/ruby_snowflake/version.rb

@@ -1,3 +1,3 @@
 module RubySnowflake
-  VERSION = "1.6.0"
+  VERSION = "1.6.1"
 end

data/rb_snowflake_client.gemspec

@@ -14,8 +14,23 @@ Gem::Specification.new do |s|
   s.homepage = "https://github.com/rinsed-org/rb-snowflake-client"
   s.license = "MIT"
 
+  # Gemfile.lock is excluded deliberately, and it is a security fix rather than tidiness.
+  #
+  # A lockfile has no function inside a published gem -- Bundler resolves a consumer's tree from the
+  # dependency constraints below, never from a lockfile shipped in a dependency -- but container image
+  # scanners read any Gemfile.lock they find on disk as a manifest of what is installed. So our
+  # DEVELOPMENT lock became a vulnerability report against every consumer: an image that installs this
+  # gem gets .../gems/rb_snowflake_client-1.6.0/Gemfile.lock scanned, and the pinned
+  # concurrent-ruby 1.3.6, jwt 3.1.2 and json 2.15.1 are reported as CRITICAL findings on the consumer.
+  #
+  # That is all three CRITICAL findings on the DataExtract Lambda image, and they are unfixable there:
+  # the versions are ours, in our published artifact, and no bump on the consumer's side can move them.
+  # The runtime constraints (concurrent-ruby >= 1.2, json >= 2.1.0, jwt >= 2.7) are open-ended, so
+  # consumers already resolve their own versions and lose nothing by not receiving this file.
   s.files = Dir.chdir(File.expand_path(__dir__)) do
-    `git ls-files -z`.split("\x0").reject { |f| f.match(%r{\A(?:test|spec|features|vendor)/}) }
+    `git ls-files -z`.split("\x0").reject do |f|
+      f.match(%r{\A(?:test|spec|features|vendor)/}) || f == "Gemfile.lock"
+    end
   end
 
   s.require_paths = ["lib"]

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rb_snowflake_client
 version: !ruby/object:Gem::Version
-  version: 1.6.0
+  version: 1.6.1
 platform: ruby
 authors:
 - Rinsed
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-04-13 00:00:00.000000000 Z
+date: 2026-08-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bigdecimal
@@ -127,7 +127,6 @@ files:
 - CHANGELOG.md
 - CODE_OF_CONDUCT.md
 - Gemfile
-- Gemfile.lock
 - LICENSE.txt
 - README.md
 - Rakefile

data/Gemfile.lock

@@ -1,87 +0,0 @@
-PATH
-  remote: .
-  specs:
-    rb_snowflake_client (1.6.0)
-      bigdecimal (>= 3.0)
-      concurrent-ruby (>= 1.2)
-      connection_pool (>= 2.4)
-      dotenv (>= 2.8)
-      json (>= 2.1.0)
-      jwt (>= 2.7)
-      retryable (>= 3.0)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    activesupport (8.0.5)
-      base64
-      benchmark (>= 0.3)
-      bigdecimal
-      concurrent-ruby (~> 1.0, >= 1.3.1)
-      connection_pool (>= 2.2.5)
-      drb
-      i18n (>= 1.6, < 2)
-      logger (>= 1.4.2)
-      minitest (>= 5.1)
-      securerandom (>= 0.3)
-      tzinfo (~> 2.0, >= 2.0.5)
-      uri (>= 0.13.1)
-    base64 (0.3.0)
-    benchmark (0.5.0)
-    bigdecimal (4.1.1)
-    coderay (1.1.3)
-    concurrent-ruby (1.3.6)
-    connection_pool (3.0.2)
-    diff-lcs (1.6.2)
-    dotenv (3.1.8)
-    drb (2.2.3)
-    i18n (1.14.8)
-      concurrent-ruby (~> 1.0)
-    json (2.15.1)
-    jwt (3.1.2)
-      base64
-    logger (1.7.0)
-    method_source (1.1.0)
-    minitest (6.0.3)
-      drb (~> 2.0)
-      prism (~> 1.5)
-    parallel (1.27.0)
-    prism (1.9.0)
-    pry (0.15.2)
-      coderay (~> 1.1)
-      method_source (~> 1.0)
-    rake (13.3.0)
-    retryable (3.0.5)
-    rspec (3.13.1)
-      rspec-core (~> 3.13.0)
-      rspec-expectations (~> 3.13.0)
-      rspec-mocks (~> 3.13.0)
-    rspec-core (3.13.5)
-      rspec-support (~> 3.13.0)
-    rspec-expectations (3.13.5)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.13.0)
-    rspec-mocks (3.13.5)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.13.0)
-    rspec-support (3.13.6)
-    securerandom (0.4.1)
-    tzinfo (2.0.6)
-      concurrent-ruby (~> 1.0)
-    uri (1.1.1)
-
-PLATFORMS
-  arm64-darwin-22
-  ruby
-
-DEPENDENCIES
-  activesupport (~> 8.0.4, >= 8.0.4.1)
-  bundler
-  parallel
-  pry
-  rake
-  rb_snowflake_client!
-  rspec
-
-BUNDLED WITH
-  4.0.3