Update excon and require Ruby 3.1 - #469
Conversation
- Upgrade the generated excon dependency to >=1.5.0, <2 - Update Ruby CI and release workflows from 2.7 to 3.1 - Set generated Marketing and Transactional gems to require Ruby 3.1 or greater
|
Contributor License Agreement Instructions Please download the appropriate CLA below. Once downloaded, please read, sign, and send back to us at developer-cla@mailchimp.com. Please note, this account is not monitored so please visit https://mailchimp.com/contact/ if you need support. Individual CLA: Mailchimp Individual CLA Once you’ve emailed us the signed CLA, please reply here (e.g. CLA signed and sent!) and we’ll verify it. What to do if you already signed the CLA |
|
CLA signed and sent. |
The current <1 excon version constraint prevents upgrading excon, which is important since versions older than 1.5 are vulnerable to CVE-2026-54171. This PR changes it to require at least 1.5.0, which is the oldest version with the CVE fix. It also updates the upper bound to <2 to ensure we don't unnecessarily loosen the version constraint.
This PR affects both the MailchimpMarketing and MailchimpTransactional clients.
It also updates the minimum Ruby version in the generator configurations to require at least Ruby 3.1, because the fixed version of excon requires at least Ruby 3.1. The CI Ruby versions are also updated to check against Ruby 3.1. People requiring an older Ruby version can still use an earlier version of the gem. I don't think it's an issue to change the minimum Ruby version here, since Ruby 2.7 has been EOL since 2023-03-31 and even Ruby 3.1 has been EOL since 2025-03-26 (source).
Locally, I tested that the both Ruby clients successfully generate and contain the intended Ruby and excon version constraints.
Related: #411, #467
Both of the above appear to have been held up by CLA issues.
Note that there appear to be workflow failures for other languages when generating the release for MailchimpMarketing, so a maintainer may need to fix those so the updated Ruby gems can be released.