Skip to content

Update excon and require Ruby 3.1 - #469

Open
danarnold wants to merge 1 commit into
mailchimp:mainfrom
danarnold:update-excon-version
Open

Update excon and require Ruby 3.1#469
danarnold wants to merge 1 commit into
mailchimp:mainfrom
danarnold:update-excon-version

Conversation

@danarnold

Copy link
Copy Markdown
  • Upgrade the generated excon dependency to >=1.5.0, <2
  • Update Ruby CI and release workflows from 2.7 to 3.1
  • Set generated Marketing and Transactional gems to require Ruby 3.1 or greater

The current <1 excon version constraint prevents upgrading excon, which is important since versions older than 1.5 are vulnerable to CVE-2026-54171. This PR changes it to require at least 1.5.0, which is the oldest version with the CVE fix. It also updates the upper bound to <2 to ensure we don't unnecessarily loosen the version constraint.

This PR affects both the MailchimpMarketing and MailchimpTransactional clients.

It also updates the minimum Ruby version in the generator configurations to require at least Ruby 3.1, because the fixed version of excon requires at least Ruby 3.1. The CI Ruby versions are also updated to check against Ruby 3.1. People requiring an older Ruby version can still use an earlier version of the gem. I don't think it's an issue to change the minimum Ruby version here, since Ruby 2.7 has been EOL since 2023-03-31 and even Ruby 3.1 has been EOL since 2025-03-26 (source).

Locally, I tested that the both Ruby clients successfully generate and contain the intended Ruby and excon version constraints.

Related: #411, #467
Both of the above appear to have been held up by CLA issues.

Note that there appear to be workflow failures for other languages when generating the release for MailchimpMarketing, so a maintainer may need to fix those so the updated Ruby gems can be released.

- Upgrade the generated excon dependency to >=1.5.0, <2
- Update Ruby CI and release workflows from 2.7 to 3.1
- Set generated Marketing and Transactional gems to require Ruby 3.1 or
  greater
@cla-bot

cla-bot Bot commented Jul 21, 2026

Copy link
Copy Markdown

Contributor License Agreement Instructions
Thanks for your pull request. Before we can review your work, you’ll need to sign a Contributor License Agreement (CLA).

Please download the appropriate CLA below. Once downloaded, please read, sign, and send back to us at developer-cla@mailchimp.com. Please note, this account is not monitored so please visit https://mailchimp.com/contact/ if you need support.

Individual CLA: Mailchimp Individual CLA
Corporate CLA: Mailchimp Corporate CLA

Once you’ve emailed us the signed CLA, please reply here (e.g. CLA signed and sent!) and we’ll verify it.

What to do if you already signed the CLA
Individual signers
• If you’ve previously sent us a signed CLA, please reply here letting us know and we’ll verify. If we are unable to verify, It’s possible we don’t have your GitHub username or you’re using a different email address on your Git commit. Check that the CLA you previously submitted was sent to us using the email address associated with your GitHub username and verify that your email is set on your Git commits.
Corporate signers
• Your company has a Point of Contact (POC) who decides which employees are authorized to participate. Ask your POC to be added to the group of authorized contributors. If you’ve previously sent us an updated CLA, please reply here letting us know and we’ll verify.
• The email used to register you as an authorized contributor must be the email used for the Git commit.
• The email used to register you as an authorized contributor must also be attached to your GitHub account.

@danarnold

Copy link
Copy Markdown
Author

CLA signed and sent.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant