ruby.git/lib/rubygems/yaml_serializer.rb, branch master

[ruby/rubygems] Fix a bug that `Gem::YAMLSerializer.load` ignores quotation

2026-05-26T04:23:53+00:00

`"a: b"` must be processed as a string value (`a: b`) not a map
value (`{"a" => "b"}`).

https://github.com/ruby/rubygems/commit/3c3dfe3168

[ruby/rubygems] Refactor validate_tag! to enforce permitted_classes consistently with Psych

2026-03-17T00:21:54+00:00

Align YAMLSerializer's `permitted_classes` validation with Psych's whitelist
semantics: an empty `permitted_classes` list denies all tagged classes, matching
`Psych::ClassLoader::Restricted` behavior.

- Rename `@permitted_tags` to `@permitted_classes` and simplify initialization
- Extract `raise_disallowed_class!` from `validate_tag!` for clarity
- Move `check_anchor!` before `validate_tag!` in `build_mapping`
- Add test for `Gem::Version::Requirement` tag used by old gems like `escape`

https://github.com/ruby/rubygems/commit/3c5855e833

Co-Authored-By: Claude Opus 4.6

[ruby/rubygems] Fix Bundler crashing when installing very old gems:

2026-03-17T00:21:04+00:00

- ### Problem

  There is a regression where bundler can longer install gems that
  were packaged a long time ago, like the [memoize gem](https://rubygems.org/gems/memoize).

  Bundler will crash with such error:

  ```
  Installing memoize 1.3.1
  --- ERROR REPORT TEMPLATE -------------------------------------------------------

  NoMethodError: undefined method 'as_list' for nil
  /Users/edouard/src/opensource/rubygems/lib/rubygems/dependency.rb:146:in 'Gem::Dependency#requirements_list'
  ```

  ### Context

  These very old gems were packaged at the time were a
  `Gem::Dependency` had no ivars `requirement`.
  This is what the dumped gemspec looks like:

  ```
  dependencies:
  - !ruby/object:Gem::Dependency
  name: test-unit
  type: :development
  version_requirement:
  version_requirements: !ruby/object:Gem::Requirement
    requirements:
    - - ">="
      - !ruby/object:Gem::Version
        version: 2.0.2
    version:
  ```

  As opposed to a gem that was packaged more recently:

  ```
  - !ruby/object:Gem::Dependency
  name: minitest-global_expectations
  requirement: !ruby/object:Gem::Requirement
    requirements:
    - - ">="
      - !ruby/object:Gem::Version
        version: '0'
  type: :development
  prerelease: false
  version_requirements: !ruby/object:Gem::Requirement
    requirements:
    - - ">="
      - !ruby/object:Gem::Version
        version: '0'
  ```

  The change we made in https://github.com/ruby/rubygems/commit/cbe57bbbd71e8ac7fed686ae7d13a2fd1bd2e5b2#diff-5ccc8aa468df013cc970580e88642417da12284da6529a4885b9abf447ae95edL529
  broke old gem installation.

  ### Solution

  If `requirement` isn't set in the hash, look for
  `version_requirements` instead.

https://github.com/ruby/rubygems/commit/cfd8b20692

[ruby/rubygems] Support YAML 1.1 !binary tag in YAMLSerializer

2026-03-12T03:52:23+00:00

Decode base64-encoded values tagged with !binary in mapping keys,
mapping values (both inline and block scalar), and sequence items.
This fixes gem install failures for gems packaged with older RubyGems
that used !binary encoding in checksums.yaml.gz.

Fixes https://github.com/ruby/rubygems/issues/9387

https://github.com/ruby/rubygems/commit/cfc31601e9

Co-Authored-By: Claude Opus 4.6

[ruby/rubygems] bin/rubocop -A

2026-03-10T07:56:43+00:00

https://github.com/ruby/rubygems/commit/ba8e4ed9ed

[ruby/rubygems] Limit YAML nesting and alias resolutions

2026-03-10T07:56:43+00:00

https://github.com/ruby/rubygems/commit/d4c5fc58e7

[ruby/rubygems] Restrict platform ivars when deserializing YAML

2026-03-10T07:56:42+00:00

https://github.com/ruby/rubygems/commit/b8f77e3860

[ruby/rubygems] Handle malformed/unknown YAML Platform fields

2026-03-10T07:56:41+00:00

https://github.com/ruby/rubygems/commit/e5bcde365f

[ruby/rubygems] Stop normalizing requirements to Array

2026-03-10T07:56:40+00:00

https://github.com/ruby/rubygems/commit/6b0aa2a2d3

[ruby/rubygems] Treat rdoc_options as Hash instead of Array

2026-03-10T07:56:39+00:00

https://github.com/ruby/rubygems/commit/074e3f7f62