vault 0.20.0 → 0.20.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c86a7bae231cd9c95b9e43bbb61640fe6fe29a30cace67d03d27ffc96de7e6c8
-  data.tar.gz: 3f4a0cd1294c8c6ac4f5224b4561b9db921d93ba2ea1084c4efcc070ea34f44e
+  metadata.gz: 46acf59f9b079b96d8af544537fc4657b02a04c0fdf9bd613cb46027435a6148
+  data.tar.gz: 828e7e36228d6900e8c1be9e7b9d319fb03fe2cb541eabca81a8a5323989a313
 SHA512:
-  metadata.gz: c288f3b0fa1f7ee0e9c7b8143bb2dfd168d8b55d39fe86846a157637fc0d2ddbeda2c0a21671fa9572bf7d61be9d29adef10c353eed62d97e706131f662f1819
-  data.tar.gz: 41fe6e37b5fc42b4d2aa3834a9ce985eab915cd0a92d6e6e0f4f7cf623d32e229dba51f37d5a5ff300625fcf5bc7ff6502b4e5cf682cafd6556a5b1f577649cd
+  metadata.gz: 0cc19d71f9f16123ab02539691a932098c39cea39362dc4c5b5e46f42390df23ae367b0ce26fb0a33940daf1af178884982076cd2d0dc92f310e326d4dfb8b8c
+  data.tar.gz: 1072fd9dfec4dfab692455b6b06833cb5ce9f9b3bacff3d36773b5491c326b1683ec9b7aa6c55926bf73f08c74a88fbfd71dcf4d778ce6ddf3b2669d04ad527d

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Vault Ruby Changelog
 
+## Unreleased
+
+## v0.20.1 (March 31, 2026)
+
+BUG FIXES
+
+- Removed explicit `connection_pool` runtime dependency to allow use of connection_pool 3.x for compatibility with sidekiq 8.1+. The gem is already managed as a transitive dependency by `net-http-persistent`, which supports connection_pool 2.2.4+ through 3.x. [GH-393]
+- Hardened STS endpoint parsing in AWS auth by replacing permissive matching with strict HTTPS URI and host validation, preserving supported global, regional, GovCloud, and China endpoints while rejecting malformed inputs. [GH-402]
+
 ## v0.20.0 (February 4, 2026)
 
 IMPROVEMENTS

data/lib/vault/api/auth.rb

@@ -2,6 +2,7 @@
 # SPDX-License-Identifier: MPL-2.0
 
 require "json"
+require "uri"
 
 require_relative "secret"
 require_relative "../client"
@@ -302,7 +303,7 @@ module Vault
     #   The path to the auth backend to use for the login procedure.
     #
     # @param [String] name optional
-    #   The named certificate role provided to the login request. 
+    #   The named certificate role provided to the login request.
     #
     # @return [Secret]
     def tls(pem = nil, path = 'cert', name: nil)
@@ -328,9 +329,23 @@ module Vault
     #
     # @return [String] aws region
     def region_from_sts_endpoint(sts_endpoint)
-      valid_sts_endpoint = %r{https:\/\/sts\.?(.*)\.amazonaws\.com}.match(sts_endpoint)
-      raise "Unable to parse STS endpoint #{sts_endpoint}" unless valid_sts_endpoint
-      valid_sts_endpoint[1].empty? ? 'us-east-1' : valid_sts_endpoint[1]
+      uri = URI.parse(sts_endpoint)
+
+      unless uri.is_a?(URI::HTTPS) && uri.userinfo.nil?
+        raise "Unable to parse STS endpoint #{sts_endpoint}"
+      end
+
+      case uri.host
+      when "sts.amazonaws.com"
+        "us-east-1"
+      when /\Asts\.([a-z0-9-]+)\.amazonaws\.com\z/,
+           /\Asts\.([a-z0-9-]+)\.amazonaws\.com\.cn\z/
+        Regexp.last_match(1)
+      else
+        raise "Unable to parse STS endpoint #{sts_endpoint}"
+      end
+    rescue URI::InvalidURIError
+      raise "Unable to parse STS endpoint #{sts_endpoint}"
     end
   end
 end

data/lib/vault/version.rb

@@ -2,5 +2,5 @@
 # SPDX-License-Identifier: MPL-2.0
 
 module Vault
-  VERSION = "0.20.0"
+  VERSION = "0.20.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: vault
 version: !ruby/object:Gem::Version
-  version: 0.20.0
+  version: 0.20.1
 platform: ruby
 authors:
 - Seth Vargo
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-02-04 00:00:00.000000000 Z
+date: 2026-03-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sigv4
@@ -38,20 +38,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: connection_pool
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.4'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.4'
 - !ruby/object:Gem::Dependency
   name: net-http-persistent
   requirement: !ruby/object:Gem::Requirement