Skip to content

Bump for release of v1.3.2 - #113

Open
sbhuiyan-r7 wants to merge 1 commit into
masterfrom
snr-1383/bump-1.3.2
Open

sbhuiyan-r7 wants to merge 1 commit into
masterfrom
snr-1383/bump-1.3.2

Conversation

@sbhuiyan-r7

Copy link
Copy Markdown
Contributor

What this does

Bumps VERSION to 1.3.2 so the LDAP fix from #112 can be released.

Why it is needed

#112 (internal ref: SNR-1383) is merged to master but not published. Consumers install dap from Rubygems, so the fix does not reach them until a release exists — master currently reads 1.3.1, the latest tag is v1.3.1, and Rubygems' latest is 1.3.1.

The concrete impact: a Project Sonar tcp_ldap_636 study aborts its whole processing stage on a single referral-returning host out of 22,482, because an unserializable value escapes to Oj.dump(..., mode: :strict) outside the filter's rescue and terminates dap mid-stream. Two studies had to be recovered by hand-patching the gem inside running containers; those patches died with the containers, so the next scheduled runs will fail identically until a release lands.

The diff

Two lines:

  • lib/dap/version.rb1.3.11.3.2
  • Gemfile.lock — the PATH self-reference (dap (1.3.1)dap (1.3.2))

The lock is included because at the v1.3.1 release (78ce38a) Gemfile.lock already read 1.3.1, so version and lock have been in step; bumping only version.rb would leave the tree inconsistent. No dependency versions are touched.

Verification

Note for whoever runs rake release

bundle exec fails on Ruby 3.1 in this repo, so run the release on Ruby ≥ 3.2:

Could not find nokogiri-1.19.4 in locally installed gems (Bundler::GemNotFound)

Gemfile.lock pins nokogiri (1.19.4), which requires Ruby >= 3.2, while dap.gemspec declares required_ruby_version = '>= 3.1' and the Gemfile says ruby '>= 3.1'. So the committed lock is unsatisfiable on the minimum supported Ruby. That is pre-existing and deliberately not addressed here to keep this a clean release commit — but it is worth a follow-up, since it also means the two nokogiri CVEs from #111 are not actually fixed for anyone installing on 3.1.

🤖 Generated with Claude Code

Releases the LDAP result coercion fix from #112 (SNR-1383), which is on master
but not yet published. Consumers install dap from Rubygems, so the fix does not
reach them until a release exists: a Project Sonar tcp_ldap_636 study is still
aborting on a single referral-returning host out of 22,482.

Gemfile.lock's PATH self-reference is bumped alongside version.rb, matching the
state the tree was in at the v1.3.1 release.

Verified: gem builds as dap-1.3.2, full spec suite 130 examples / 0 failures.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@snyk-io

snyk-io Bot commented Sep 14, 2026

Copy link
Copy Markdown

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant