-
Notifications
You must be signed in to change notification settings - Fork 72
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add 2.5 as minimum required ruby version for gem #70
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This PR makes explicit requirements that were implicit in the code: we need 2.3+.
Now, I am curious about which changes introduced the incompatibility. @ivoanjo Do you have any log output of failed tests, or the like, I can't see them from where I sit. I read the latest 10 changes at the end of the 3.2.5 release, and they seemed not to include "very new things". Update: d97b318 introduces refinements. |
The incompatibility with 2.0 is the addition in 9b311e5 (and possibly others) of required named arguments. Doing
|
The incompatibility with 2.2 and 2.1 is using
|
@ivoanjo Thanks for the backtraces! That makes it clear, to me, that a Ruby version specifier is useful. |
We don't want to care about EOL-ed Rubies...: #38 If you want to support EOL-ed Rubies, do it with your own risk.
We don't want to do it for EOL-ed Rubies. 3.2.5 includes a security fix: https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/ The announce mentions "3.2.5 or later". If we yank 3.2.5 for EOL-ed Rubies, it confuses users of not EOL-ed Rubies. REXML in Ruby 2.0 still has the security problem. So we don't recommend using REXML in Ruby 2.0. |
@kou I understand your point. I guess given the current constraints of not yanking 3.2.5, there's no good option for those older Rubies (< 2.3) -- they'll always get a broken But perhaps we could set things up to avoid this issue in the future. Because Ruby 2.5 is EOL as well now, would you consider adding That way hopefully this issue will not happen again once I'm open to updating this PR with that. Would that be an acceptable compromise? |
We don't want to maintain |
@kou, that's quite unfortunate, as it complicates a lot the life of people on older Rubies. Would you be open to help maintaining this gem, or even maintaining just that part? I'm definitely up for it, and I believe I could probably convince my employer @DataDog to let me carve out a bit of regular time for this if needed. I quite understand not supporting older rubies via code, but just not doing something really easy to make them not break I believe is missing an opportunity to help out a user which may be quite new to the ecosystem or that just inherited some legacy application and is trying to upgrade it to be able to move to a newer Ruby version. I'd call that a tiny bit of programmer happiness :) Furthermore, the latest @jruby release is 9.2.17.0, which still only supports Ruby 2.5.7. Since you mentioned that rexml 3.2.5 is the last version that would support Ruby 2.5, this means that any new version may break JRuby 9.2, and those users have no alternative yet, because that's the latest stable version. And even if JRuby 9.3 comes out really soon, is it that unreasonable to expect that users would have a time window of a few months before JRuby 9.2 becoming unsupported? I too advocate for using up-to-date Rubies, and supporting the old ones on behalf of my employer is a big resource sink, but our own stats at @DataDog look a lot like those in this Jetbrains study: https://www.jetbrains.com/lp/devecosystem-2020/ruby/ -- quite a lot of people are still on 2.5 and below. If I cannot convince you to reconsider this stance, I have a final proposal: Would you accept a PR that documents this stance in the README, so that there's a clear note for users that they must not expect a given version of rexml to work with a Ruby version that was considered EOL at the time it was released? That way at least we avoid this issue being opened from time to time (like I did with #69 that ends up being a dupe of #38), and hopefully will free you from being forced to revisit the issue from time to time. |
OK. Could you remove Could you also open a pull request to mention our stance in FYI: Ruby < 3 users can use bundled REXML. They don't need to use REXML gem. |
430b7ef
to
a6e339d
Compare
a6e339d
to
e3b1096
Compare
This gem is no longer tested with Rubies older than 2.5, and it's actually broken on at least <= 2.2. By setting the minimum version in the `gemspec`, we ensure that older Ruby versions don't try to use an incompatible `rexml` version. Issue ruby#69
a284a7a
to
3fb8b41
Compare
Thanks! I was going for minimum 2.6, but I realized that broke CI mainly due to JRuby so I just put 2.5 as the minimum, as that seems reasonable as well. I'll open up a separate PR to update the README, as discussed. |
As discussed in ruby#70 .
Thanks. |
Thanks for the help :) |
This gem is no longer tested with Rubies older than 2.5, and it's actually broken on at least <= 2.2.
By setting the minimum version in the
gemspec
, we ensure that older Ruby versions don't try to use an incompatiblerexml
version.Outdated original description: