workos 10.2.0 → 10.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 63f6d02af5ecf1ab9f62af255a77ef281f8763b3e6c56feeb6ee87da3817c29d
-  data.tar.gz: 1691eb9636159a73295a6baabf6b63103bfc868f4f7660e49ae12644d7f27efa
+  metadata.gz: b7aff393f8f0d21fe3ff062ac8a0f835ad3d2f43bcfc300d55ec9f5a19688774
+  data.tar.gz: b94cd0e24ce40d7e61bc0c9d3578f14b1c627a4ebf935fdbad7d295584c75dec
 SHA512:
-  metadata.gz: 7b421f5433d3001c3dcb8de0aeddf93805bcbddd73c1a9c475b65f6c66b4e1a442d2a6eca5c37444f9dc97481abf5c7f05799bd914431de5411f368566e85a99
-  data.tar.gz: c6376c12ff9efe67ac13aaf63e63a3c5ddcad6926272b0cc1c36cde0ac4ed858c10157b3ee064143152a73c28674d848ecd81f200a2f64b1e7ae2a23def4c44a
+  metadata.gz: 235bb3273c2b574dad6cd967b69d5b832cc0bbfbcb7f8389e0eb53e909f915a6698047f68abf7e6826196e7e62a94a43c73686207236439a44c608198be374eb
+  data.tar.gz: bdb237a96780cac60c5bbe0ab7f0bc41bea1d31f38928111ef7a470f3d0e21d7b15e35b6190b7f0588f63dd707d442846293630260c3cd29b8ccf2d9dee7dac6

data/.github/workflows/block-generated-edits.yml

@@ -8,6 +8,6 @@ on:
 
 jobs:
   block-generated-edits:
-    uses: workos/actions/.github/workflows/block-generated-edits.yml@main
+    uses: workos/actions/.github/workflows/block-generated-edits.yml@5c7450a04f5a182b346eae2d833b869e337b12bb # main
     secrets:
       SDK_BOT_PRIVATE_KEY: ${{ secrets.SDK_BOT_PRIVATE_KEY }}

data/.github/workflows/ci.yml

@@ -21,8 +21,8 @@ jobs:
           - '3.4'
           - '4.0'
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
-      - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # 1.316.0
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # 6.1.0
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # 1.321.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true

data/.github/workflows/docs.yml

@@ -14,8 +14,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
-      - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # 1.316.0
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # 6.1.0
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # 1.321.0
         with:
           bundler-cache: true
       - run: ./script/docs

data/.github/workflows/lint.yml

@@ -15,8 +15,8 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
-      - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # 1.316.0
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # 6.1.0
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # 1.321.0
         with:
           bundler-cache: true
 

data/.github/workflows/release-please.yml

@@ -61,7 +61,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Checkout release PR branch
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # 6.1.0
         with:
           ref: ${{ fromJSON(needs.release-please.outputs.pr).headBranchName }}
           token: ${{ steps.generate-token.outputs.token }}
@@ -155,7 +155,7 @@ jobs:
           git push
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # 1.316.0
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # 1.321.0
         with:
           ruby-version: ruby
 
@@ -190,7 +190,7 @@ jobs:
           permission-contents: write
           permission-pull-requests: write
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # 6.1.0
         with:
           token: ${{ steps.generate-token.outputs.token }}
 

data/.github/workflows/release.yml

@@ -22,10 +22,10 @@ jobs:
           role-to-assume: rg_oidc_akr_fn8dx45asckvmsnd2kka
 
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # 6.1.0
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # 1.316.0
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # 1.321.0
         with:
           bundler-cache: true
 

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "10.2.0"
+  ".": "10.2.1"
 }

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [10.2.1](https://github.com/workos/workos-ruby/compare/v10.2.0...v10.2.1) (2026-08-20)
+
+
+### Bug Fixes
+
+* explicitly evict connections if request does not complete as success ([e792414](https://github.com/workos/workos-ruby/commit/e79241473e9cb0e8898632723200a7e23682ff24))
+
 ## [10.2.0](https://github.com/workos/workos-ruby/compare/v10.1.0...v10.2.0) (2026-08-11)
 
 * [#533](https://github.com/workos/workos-ruby/pull/533) feat(generated)!: regenerate from spec (2 changes)

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    workos (10.2.0)
+    workos (10.2.1)
       jwt (~> 3.1)
       logger (~> 1.7)
       zeitwerk (~> 2.6)
@@ -153,7 +153,7 @@ CHECKSUMS
   unicode-emoji (4.2.0) sha256=519e69150f75652e40bf736106cfbc8f0f73aa3fb6a65afe62fefa7f80b0f80f
   webmock (3.26.2) sha256=774556f2ea6371846cca68c01769b2eac0d134492d21f6d0ab5dd643965a4c90
   webrick (1.9.2) sha256=beb4a15fc474defed24a3bda4ffd88a490d517c9e4e6118c3edce59e45864131
-  workos (10.2.0)
+  workos (10.2.1)
   yard (0.9.44) sha256=eb087e9b631ccd887b049f303d489963945452d5e2a7eb49a5a74a7cf6887f28
   yard-markdown (0.7.1) sha256=06c378632dfe7ba053be9ba469eb4701aa0470e36bcf7e5546f353eb90c1bfd1
   zeitwerk (2.7.5) sha256=d8da92128c09ea6ec62c949011b00ed4a20242b255293dd66bf41545398f73dd

data/lib/workos/base_client.rb

@@ -137,7 +137,20 @@ module WorkOS
         loggable_path = redact_path(request.path)
         log(:debug, "request start", method: request.method, path: loggable_path, attempt: attempt + 1)
         http = connection_for(base, timeout)
-        response = http.request(request)
+        request_completed = false
+        begin
+          response = http.request(request)
+          request_completed = true
+        ensure
+          # Any exit from #request other than a returned response can leave
+          # the socket mid-stream: a connection error the rescue below knows
+          # about, one it doesn't (OpenSSL::SSL::SSLError,
+          # Net::HTTPBadResponse), or a non-local exit such as an
+          # application-level Timeout.timeout or Thread#kill. A half-read
+          # socket handed back to the pool desyncs the *next* request on this
+          # thread, so drop it here rather than in the rescue.
+          evict_connection(base) unless request_completed
+        end
         return response if response.is_a?(Net::HTTPSuccess)
 
         if attempt < retries && retryable?(response)

data/lib/workos/version.rb

@@ -2,5 +2,5 @@
 
 # @oagen-ignore-file
 module WorkOS
-  VERSION = "10.2.0"
+  VERSION = "10.2.1"
 end

data/test/workos/test_base_client.rb

@@ -82,6 +82,24 @@ class BaseClientTest < Minitest::Test
     end
   end
 
+  # A pooled connection that either returns a canned response or raises when
+  # driven, so execute_request can be exercised without real TCP+TLS.
+  class StubConnection < FakeConnection
+    attr_accessor :read_timeout, :open_timeout
+
+    def initialize(response: nil, error: nil, **kwargs)
+      super(**kwargs)
+      @response = response
+      @error = error
+    end
+
+    def request(_request)
+      raise @error if @error
+
+      @response
+    end
+  end
+
   def setup
     @client = WorkOS::BaseClient.new(api_key: "sk_test_123", max_retries: 1)
   end
@@ -206,6 +224,143 @@ class BaseClientTest < Minitest::Test
     refute keep.finished
   end
 
+  # An exception execute_request's rescue clause doesn't list still leaves the
+  # socket mid-stream, so the connection must not survive in the pool for the
+  # next request on this thread to pick up.
+  def test_unlisted_request_error_evicts_the_pooled_connection
+    conn = StubConnection.new(error: Net::HTTPBadResponse.new("wrong version"))
+    cache = @client.send(:thread_connections)
+    cache["https:api.workos.com:443:30"] = conn
+
+    assert_raises(Net::HTTPBadResponse) do
+      @client.execute_request(request: Net::HTTP::Get.new("/things"))
+    end
+
+    refute cache.key?("https:api.workos.com:443:30"),
+      "a connection whose request did not complete must not stay pooled"
+    assert conn.finished
+  end
+
+  def test_completed_request_keeps_the_connection_pooled
+    conn = StubConnection.new(response: Net::HTTPOK.new("1.1", "200", "OK"))
+    cache = @client.send(:thread_connections)
+    cache["https:api.workos.com:443:30"] = conn
+
+    @client.execute_request(request: Net::HTTP::Get.new("/things"))
+
+    assert cache.key?("https:api.workos.com:443:30")
+    refute conn.finished
+  end
+
+  # Raised asynchronously into the worker thread to stand in for a caller-side
+  # abort: Timeout.timeout, Thread#kill, a signal handler unwinding the stack.
+  # It descends from Exception rather than StandardError so that nothing in
+  # execute_request can catch it — the `ensure` is the only cleanup that runs.
+  class AbortSignal < Exception; end # standard:disable Lint/InheritException
+
+  # End-to-end regression test over a real keep-alive socket, for the failure
+  # the eviction actually prevents: request one is abandoned mid-flight, the
+  # server then writes response one onto that socket, and request two on the
+  # same thread reads those stale bytes as if they were its own response.
+  #
+  # Before the fix, request two sees marker "one" (or a mangled response) off
+  # the pooled socket. After it, the abandoned socket is closed and the server
+  # accepts a fresh connection for request two.
+  def test_aborted_request_does_not_leak_its_response_to_the_next_request
+    WebMock.disable!
+    server = TCPServer.new("127.0.0.1", 0)
+    port = server.addr[1]
+    client = WorkOS::BaseClient.new(
+      api_key: "sk_test_123",
+      base_url: "http://127.0.0.1:#{port}",
+      timeout: 5,
+      max_retries: 0
+    )
+
+    request_one_read = Queue.new
+    release_response_one = Queue.new
+    response_one_written = Queue.new
+    aborted = Queue.new
+    connections = Queue.new
+
+    server_thread = Thread.new do
+      # Connection one: read the request, then hold the response back until
+      # the client has been aborted and has unwound.
+      first = server.accept
+      connections << first
+      read_http_request(first)
+      request_one_read << true
+      release_response_one.pop
+      begin
+        write_http_response(first, {marker: "one"})
+      rescue Errno::EPIPE, Errno::ECONNRESET, IOError
+        # Expected once the fix closes the abandoned socket.
+      end
+      response_one_written << true
+
+      # Connection two: a fresh accept, which only completes because the
+      # client did not reuse the socket above.
+      second = server.accept
+      connections << second
+      read_http_request(second)
+      write_http_response(second, {marker: "two"})
+    end
+
+    worker = Thread.new do
+      begin
+        client.execute_request(request: Net::HTTP::Get.new("/one"))
+      rescue AbortSignal
+        # The caller unwinds but the thread survives and goes on to serve more
+        # work, the way a Puma or Solid Queue worker does. execute_request's
+        # `ensure` has already run by the time this body executes.
+        aborted << true
+        response_one_written.pop
+      end
+      response = client.execute_request(request: Net::HTTP::Get.new("/two"))
+      JSON.parse(response.body)["marker"]
+    end
+
+    marker = Timeout.timeout(15) do
+      request_one_read.pop
+      worker.raise(AbortSignal)
+      aborted.pop
+      release_response_one << true
+      worker.value
+    end
+
+    assert_equal "two", marker,
+      "request two read the abandoned socket's response instead of its own"
+  ensure
+    server_thread&.kill
+    worker&.kill
+    until connections.nil? || connections.empty?
+      socket = connections.pop
+      socket.close unless socket.closed?
+    end
+    server&.close
+    WebMock.enable!
+  end
+
+  def read_http_request(socket)
+    socket.gets # request line
+    loop do
+      line = socket.gets
+      break if line.nil? || line == "\r\n"
+    end
+  end
+
+  def write_http_response(socket, body)
+    payload = JSON.generate(body)
+    socket.write(
+      "HTTP/1.1 200 OK\r\n" \
+      "Content-Type: application/json\r\n" \
+      "Content-Length: #{payload.bytesize}\r\n" \
+      "Connection: keep-alive\r\n" \
+      "\r\n#{payload}"
+    )
+    socket.flush
+  end
+
   # Regression test for https://github.com/workos/workos-ruby/issues/496
   #
   # The connection cache must be isolated per thread. A previous version

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: workos
 version: !ruby/object:Gem::Version
-  version: 10.2.0
+  version: 10.2.1
 platform: ruby
 authors:
 - WorkOS