yeptris 0.6.28.5 → 0.6.29.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c1da202c73aa559617b338f1f825583e9682860dda8cefb6733b833fd1780dfe
-  data.tar.gz: 90299ab625b032926427fc0b526f5a83a5f9b864a2183e8fef37e0c491ac6035
+  metadata.gz: 3f393e5d97dd930bd8dda0a92247a12e25684cbeb0b7c068ce9c58c5de1b6911
+  data.tar.gz: d373e283788cc0c02d40257fda655a66827f209f008e91ebcca8e4d74640ff69
 SHA512:
-  metadata.gz: 3081ff733d9335354f94aaf997919c4e6888c8ea03825899ef88b9716afd2ffc9b12b1221672b397cb66ac6c8a3c381524494446ef183539bbe9ff0bf1d9ea75
-  data.tar.gz: 3ccea6b6b21e3bd5680e5d351ec44c6d5db3c68e84bbe82180b7fa08dfcd4f811cc640b7721523314ea2f6c5220290e2d22ead009f0bb7ab0f4f2c31419a0ca9
+  metadata.gz: 441cf501ddba2e13a786162e0e3a67d909353f872d7dd24623e5a1d6a6a7f968719bdfbae61b21087dbca59776abd32a9e01c132f0b9534dc89397ab00dfd0c3
+  data.tar.gz: 383a856c2d6e4588eaffeb86dfdd6d731285060631c635ddb9cf04b9f7f4cf3da66906b58121fba513a4b17ac1870a7d88a4f0c8fca31cb664b5496a3d4b5028

data/ext/yeptris_native/cbor_ruby.c

@@ -183,7 +183,12 @@ VALUE yep_rb_cbor_load(const char* p, size_t len, int strict) {
     yep_cbor_sink sink = RV_SINK;
     sink.ctx = &ctx;
     st = yep_cbor_decode_gen((const unsigned char*)p, len, strict, NULL, &sink);
-    if (RTEST(gc_on)) {
+    /* rb_gc_disable returns Qfalse when GC was ON — enable exactly
+     * then (the old RTEST(gc_on) tested the inverted sense, so every
+     * CBOR load left GC permanently off; the Init self-check rides
+     * this path too, so one require disabled GC for the process —
+     * #259's linear RSS growth and never-running finalizers) */
+    if (gc_on == Qfalse) {
         rb_gc_enable();
     }
     if (st != YEPTRIS_OK) {

data/lib/yeptris/node.rb

@@ -394,6 +394,19 @@ class Yeptris::Node
   def scalar_to_ruby
     return symbolize if symbol? && tag_id == :str
 
+    # !ruby/symbol (#258): psych deserializes the scalar to a Symbol
+    # (both spellings; safety is walk_safe's permitted_classes gate)
+    if tag == "!ruby/symbol" || tag == "tag:ruby.yaml.org,2002:symbol"
+      return value.to_s.to_sym
+    end
+
+    # scanner-coercion primitives (psych's ClassLoader-free path)
+    case tag
+    when "!ruby/string", "tag:ruby.yaml.org,2002:string" then return value.to_s
+    when "!ruby/integer", "tag:ruby.yaml.org,2002:integer" then return value.to_i
+    when "!ruby/float", "tag:ruby.yaml.org,2002:float" then return value.to_f
+    end
+
     # stdlib deserialize's tagged-scalar arms: the class tag carries
     # DateTime (dumped tagged — a plain timestamp re-loads as Time)
     if tag == "!ruby/object:DateTime"

data/lib/yeptris/psych.rb

@@ -401,6 +401,42 @@ module Yeptris
       PERMITTED_BY_DEFAULT = [TrueClass, FalseClass, NilClass, Integer, Float,
                               String, Array, Hash].freeze
 
+      CORE_TAGS = %w[str int float bool null timestamp seq map merge value
+                     binary].freeze
+
+      # Both tag spellings to the "ruby/…" short form: the engine may
+      # hand either the "!ruby/symbol" shorthand or the
+      # "tag:ruby.yaml.org,2002:…" URI spelling.
+      def ruby_tag_short(tag)
+        t = tag.sub(/\A!/, "")
+        return t if t.start_with?("ruby/")
+        t.sub(/\Atag:ruby\.yaml\.org,2002:/, "ruby/")
+      end
+
+      # psych's scanner coercion path — always allowed, no class
+      # loader involved (verified against stdlib: !ruby/string with no
+      # permitted_classes loads fine)
+      RUBY_TAG_PRIMITIVES = %w[ruby/string ruby/integer ruby/float].freeze
+
+      # The class a !ruby/… tag names (psych's resolve_class face):
+      # "ruby/symbol" → Symbol; "ruby/object:Foo" and the collection
+      # forms "ruby/hash:Foo" name Foo. Nil = not a class-shaped ruby
+      # tag (or unresolvable) — the caller raises DisallowedClass.
+      RUBY_TAG_SINGLETONS = {
+        "ruby/symbol" => ::Symbol,
+      }.freeze
+
+      def ruby_tag_class(short)
+        return RUBY_TAG_SINGLETONS[short] if RUBY_TAG_SINGLETONS.key?(short)
+
+        rest = short[/\Aruby\/(?:object|hash|array|struct|exception)(?::(.*))?\z/, 1]
+        return nil if rest.nil? || rest.empty?
+        rest.split("::").inject(Object) do |mod, part|
+          return nil unless mod.const_defined?(part, false)
+          mod.const_get(part, false)
+        end
+      end
+
       def check(node, permitted, aliases_enabled)
         case node.kind
         when :alias
@@ -411,9 +447,19 @@ module Yeptris
             # both tag spellings pass: the URI form's last segment and
             # the short "!binary" shorthand (#168's cassettes carry it)
             name = tag.split(":").last.sub(/\A!/, "")
-            unless %w[str int float bool null timestamp seq map merge value
-                      binary].include?(name)
-              raise DisallowedClass, name
+            unless CORE_TAGS.include?(name)
+              # #258: !ruby/… tags follow psych's ClassLoader rules —
+              # the scalar primitives (string/integer/float) coerce
+              # through the scanner and are allowed as-is; !ruby/symbol
+              # passes exactly when Symbol is in permitted_classes;
+              # class-bearing forms (ruby/object:K, ruby/hash:K, …)
+              # pass when K is in permitted_classes
+              short = ruby_tag_short(tag)
+              unless RUBY_TAG_PRIMITIVES.include?(short)
+                klass = ruby_tag_class(short)
+                raise DisallowedClass, name if klass.nil?
+                raise DisallowedClass, name unless permitted.include?(klass)
+              end
             end
           end
           if node.kind == :scalar && node.tag_id == :timestamp &&

data/lib/yeptris.rb

@@ -3,7 +3,7 @@
 module Yeptris
   # The gem's version lives in the parent namespace's file — the last
   # internal require (yeptris/version) retired with it.
-  VERSION = "0.6.28.5".freeze
+  VERSION = "0.6.29.1".freeze
 
   # Informational notices are OPT-IN (yeptris-ruby#217): consumers
   # embed yeptris inside CLIs that assert clean stderr, and a

data/vendor/libyeptris/CMakeLists.txt

@@ -3,7 +3,7 @@
 cmake_minimum_required(VERSION 3.20)
 
 project(yeptris
-    VERSION 0.6.28
+    VERSION 0.6.29
     DESCRIPTION "Ultra-fast YAML 1.2 parser, emitter and streamer in C"
     LANGUAGES C CXX
 )

data/vendor/libyeptris/src/yeptris/parse/engine.c

@@ -3060,7 +3060,14 @@ static int e_parse_value(yep_engine* e, yep_ctx ctx, uint16_t floor_col) {
          * continue the value even at the parent column ("k:\n!!seq\n[a]"). */
         if (li.indent > floor_col || e->depth == 0 ||
             (ctx == YEP_CTX_AFTER_Q && li.indent == floor_col && li.first != ':') ||
-            ((li.first == '[' || li.first == '{') && li.indent == floor_col)) {
+            ((li.first == '[' || li.first == '{') && li.indent == floor_col) ||
+            /* libyaml never validates a block-scalar HEADER's column —
+             * only the content must out-indent the parent (e_block_scalar
+             * enforces that), so "|" / ">" at the key's own column is the
+             * pending value (yeptris-ruby#258: the metanorma collection
+             * fixture shape) */
+            (vctx == YEP_CTX_VALUE_LINE && (li.first == '|' || li.first == '>') &&
+             li.indent == floor_col)) {
             e->pos += li.indent;
             return e_node(e, vctx, floor_col);
         }

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: yeptris
 version: !ruby/object:Gem::Version
-  version: 0.6.28.5
+  version: 0.6.29.1
 platform: ruby
 authors:
 - Ribose Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-03 00:00:00.000000000 Z
+date: 2026-10-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi