Sourced from acme-client's changelog.

2.0.35

• Expose the RFC 8555 order error field on Resources::Order#error and add Order#typed_error

2.0.34

• Add badAttestationStatement error

2.0.33

• Add Acme::Client::Problem for structured RFC 7807 / RFC 8555 ACME problem documents
• Expose Acme::Client::Error#problem and problem field accessors while keeping #acme_error_body behavior
• Add typed error mappings for all currently registered IANA ACME error types and verify them against IANA's CSV registry

• a4328f1 bump to 2.0.35
• 63a0445 Expose the order error field and add Order#typed_error (#276)
• 710ba17 Bump actions/github-script from 7 to 9 (#275)
• cbadbf5 Split IANA ACME error registry check into its own weekly job (#274)
• 44aed48 Bump to 2.0.35
• abb3fba Add support for badAttestationStatement error
• d78e230 bump to 33
• 7e7b572 Add structured ACME problem documents (#273)
• bdd991e Restore TruffleRuby on CI (#272)
• 38427fc Bump actions/checkout from 6 to 7 (#271)
• See full diff in compare view

Sourced from excon's changelog.

1.7.2 2026-09-28

• updated bundled certs

1.7.1 2026-08-28

• updated bundled certs

• 920d5e8 v1.7.2
• ee10e36 update bundled certs
• b6ca287 v1.7.1
• 18ec428 update bundled certs
• See full diff in compare view

Sourced from jwt's changelog.

v3.3.0 (2026-09-11)

Full Changelog

Features:

• Allow a leeway to be given for the iat claim verification #747 - (@​denis1011101)
• Revamp the error hierarchy under a new JWT::Error base class; signing failures now consistently raise JWT::EncodeError, see https://github.com/jwt/ruby-jwt/blob/main/UPGRADING.md #722 (@​anakinj)

Fixes and enhancements:

• Refactor JWT::JWK::Set#initialize so each construction path is a named method #758 (@​anakinj)
• Fix rejection of unknown algorithms from JWKs for RFC compliance and pquip #728
• Fix the Style/DirectiveScope RuboCop offense failing the build #752
• Fix JWT::JWK::Set sharing its key collection with the set it was copied from #751
• Reset the decoded payload and verification state in JWT::EncodedToken#encoded_payload= #749
• Fix JWT::Token#detach_payload! not invalidating an already rendered token #748

• ccf2489 Prepare the v3.3.0 release (#762)
• 6cdacc3 Enforce parentheses on method calls with arguments (#761)
• 4a576f8 Declutter jwt_spec.rb (#760)
• 7ddcb0a Fix the RSA-PSS guard skipping the whole jwt_spec file (#759)
• 7cede0c Refactor JWT::JWK::Set#initialize (#758)
• 6ab1be7 Revamp error hierarchy (#722)
• 41fbf31 Invalidate the rendered token when detaching the payload (#757)
• d8e231d Reset verification state when replacing the encoded payload (#756)
• c25fb5e Fix JWT::JWK::Set sharing its key collection when copied (#751)
• bec0ffd Isolate gem builds from release credentials (#755)
• Additional commits viewable in compare view

Sourced from omniauth-google-oauth2's releases.

v1.2.3

Security

• Verify caller-supplied ID tokens against Google's published signing keys before trusting them. An ID token sent alongside a direct access_token callback was previously decoded without checking its signature, so extra.id_info and extra.id_token could be populated from a forged token. uid and info were never affected, as they come from the userinfo endpoint. A caller-supplied ID token genuinely issued by Google for the same user and a trusted client continues to be accepted after verification.
• Require a caller-supplied ID token to describe the same user as the access token it was sent with, by comparing the token's sub against the userinfo subject. A verified signature only proves Google issued the token, not that it belongs to the person the access token identifies, so without this a genuine ID token for one user could be paired with an access token for another and leave uid and extra.id_info describing different people. The at_hash claim is checked first as a fast path, and this subject check settles the cases at_hash cannot: tokens that omit the claim, and tokens whose at_hash is stale because the client refreshed its access token after sign-in. This check runs even when skip_info is set, as that option trims the auth hash rather than waiving verification.
• The bundled example app no longer disables TLS certificate verification. Anyone who copied that line into an application should remove it: it turns off certificate checking for every Faraday-based request in the process, not just the ones this gem makes.

Added

• reset_jwks_cache! for clearing the cached Google signing keys between tests.
• cached_jwks, the class-level fetch-and-cache primitive behind it, which takes the fetch itself as a block.
• JWKS_URL, JWKS_CACHE_TTL, and JWKS_RETRY_INTERVAL constants, and a JwksUnavailable error.
• An upper bound of < 4 on the jwt dependency. This is precautionary rather than a response to a released version: it keeps a future major release from being picked up before it has been verified against this strategy.

Deprecated

• Nothing.

Removed

• The fallback that placed the opaque access token in extra.id_token when no ID token was present. extra.id_token is now absent in that case rather than holding a value that was never an ID token. This was only reachable with skip_jwt set; without it the fallback raised instead.

Fixed

• Ignore every credential field a caller supplies in a direct access-token callback apart from the access token itself and a verified ID token. refresh_token and token expiry in particular cannot be verified, so they are no longer carried through.
• Avoid decoding opaque access tokens as JWTs when no ID token is available.
• Fail with a normal authentication failure when a callback carries no usable credential, such as an ID token with no access token, a JSON body that is not an object, or an unparseable body. Previously these raised a NoMethodError or TypeError that OmniAuth turned into a failure whose message was the raw Ruby error, so applications received an unstable message parameter such as undefined method 'expired?' instead of invalid_credentials.
• Serve the cached signing keys when Google's key endpoint is briefly unreachable, and back off before refetching, rather than retrying on every request, including when nothing is cached yet.
• Reject a signing key response that is not an object with a keys array, rather than passing it on to be interpreted as some other kind of key.
• Cap how often an ID token naming an unrecognised key can force a key refresh, so it cannot be used to drive unbounded outbound requests while holding the shared cache lock. Key rotation still resolves within JWKS_RETRY_INTERVAL.
• jwt_leeway now also applies when verifying caller-supplied ID tokens, matching how it already behaved for the extra block.
• Support non-rewindable JSON request bodies under Rack 3.
• Accept ID tokens issued to any configured authorized_client_ids, matching the audiences already accepted for access tokens.
• Reuse successfully verified ID token claims when building extra, so each ID token is decoded and validated only once per request.

Sourced from omniauth-google-oauth2's changelog.

1.2.3 - 2026-08-31

Security

• Verify caller-supplied ID tokens against Google's published signing keys before trusting them. An ID token sent alongside a direct access_token callback was previously decoded without checking its signature, so extra.id_info and extra.id_token could be populated from a forged token. uid and info were never affected, as they come from the userinfo endpoint. A caller-supplied ID token genuinely issued by Google for the same user and a trusted client continues to be accepted after verification.
• Require a caller-supplied ID token to describe the same user as the access token it was sent with, by comparing the token's sub against the userinfo subject. A verified signature only proves Google issued the token, not that it belongs to the person the access token identifies, so without this a genuine ID token for one user could be paired with an access token for another and leave uid and extra.id_info describing different people. The at_hash claim is checked first as a fast path, and this subject check settles the cases at_hash cannot: tokens that omit the claim, and tokens whose at_hash is stale because the client refreshed its access token after sign-in. This check runs even when skip_info is set, as that option trims the auth hash rather than waiving verification.
• The bundled example app no longer disables TLS certificate verification. Anyone who copied that line into an application should remove it: it turns off certificate checking for every Faraday-based request in the process, not just the ones this gem makes.

Added

• reset_jwks_cache! for clearing the cached Google signing keys between tests.
• cached_jwks, the class-level fetch-and-cache primitive behind it, which takes the fetch itself as a block.
• JWKS_URL, JWKS_CACHE_TTL, and JWKS_RETRY_INTERVAL constants, and a JwksUnavailable error.
• An upper bound of < 4 on the jwt dependency. This is precautionary rather than a response to a released version: it keeps a future major release from being picked up before it has been verified against this strategy.

Deprecated

• Nothing.

Removed

• The fallback that placed the opaque access token in extra.id_token when no ID token was present. extra.id_token is now absent in that case rather than holding a value that was never an ID token. This was only reachable with skip_jwt set; without it the fallback raised instead.

Fixed

• Ignore every credential field a caller supplies in a direct access-token callback apart from the access token itself and a verified ID token. refresh_token and token expiry in particular cannot be verified, so they are no longer carried through.
• Avoid decoding opaque access tokens as JWTs when no ID token is available.
• Fail with a normal authentication failure when a callback carries no usable credential, such as an ID token with no access token, a JSON body that is not an object, or an unparseable body. Previously these raised a NoMethodError or TypeError that OmniAuth turned into a failure whose message was the raw Ruby error, so applications received an unstable message parameter such as undefined method 'expired?' instead of invalid_credentials.
• Serve the cached signing keys when Google's key endpoint is briefly unreachable, and back off before refetching, rather than retrying on every request, including when nothing is cached yet.
• Reject a signing key response that is not an object with a keys array, rather than passing it on to be interpreted as some other kind of key.
• Cap how often an ID token naming an unrecognised key can force a key refresh, so it cannot be used to drive unbounded outbound requests while holding the shared cache lock. Key rotation still resolves within JWKS_RETRY_INTERVAL.
• jwt_leeway now also applies when verifying caller-supplied ID tokens, matching how it already behaved for the extra block.
• Support non-rewindable JSON request bodies under Rack 3.
• Accept ID tokens issued to any configured authorized_client_ids, matching the audiences already accepted for access tokens.
• Reuse successfully verified ID token claims when building extra, so each ID token is decoded and validated only once per request.

• c2fa91f Fix token info cache keying and log injection, and require core ID token claims
• c6af73e Reduce redundant JWKS cache timestamp calculations
• 778c990 Tiny README.md correction
• eae8feb Clarify CHANGELOG.md
• ef303e6 Accept ID tokens from authorized client IDs and fix Ruby 2.5 compatibility
• e5be50e Verify caller-supplied ID tokens against Google's signing keys and bind them ...
• 650aab9 Update example to show AJAX payloads
• 0b87f3f Fix ID token spoofing in direct access-token callbacks
• 41796b6 specify that jwt must be less than version 4 (#476)
• 5559071 Better CHANGELOG.md
• See full diff in compare view

Sourced from sequel_pg's changelog.

=== 1.20.0 (2026-09-06)

• Skip query canceling on Ruby < 2.4 (jeremyevans)

• Only allow parsing arrays of up to 6 dimensions (jeremyevans)

• Disable model optimization if the model_class.shape_friendly is true (jeremyevans)

• aa9bf60 Bump version to 1.20.0
• da7b244 Skip query canceling on Ruby < 2.4
• b7e9d2b Only allow parsing arrays of up to 6 dimensions
• edf688a Update coverage test code for simplecov 1.x
• 8318484 Disable model optimization if the model_class.shape_friendly is true
• fc40261 Bump copyright year
• d8def53 Update to actions/checkout@v6
• See full diff in compare view

Sourced from stripe's releases.

v19.6.2

• #1960 Validate that webhook secrets are non-empty
• #1962 Fix webhook tolerance reference
• #1959 Fix StripeContext hash key behavior
  • Fixes StripeContext value hashing so equivalent contexts work interchangeably as Hash and Set keys.

See the changelog for more details.

v19.6.1

• #1955 Forward request options when fetching V2 list pages
  • Fixes V2 fetch_next_page ignoring per-request API key and Stripe context overrides.
• #1956 Fix OAuth authorize response type defaulting
  • Fixes OAuthService#authorize_url to default response_type to code without overwriting an explicit value.
• #1950 Harden API requestor code against malicious URLs

See the changelog for more details.

v19.6.0

This release changes the pinned API version to 2026-08-26.dahlia.

• #1923 Support discriminated unions in the V2 runtime

  • Adds support for discriminated union (polymorphic) parameters and response fields in the V2 runtime.
  • Serializing a discriminated union parameter whose discriminator is missing, or not a String or Symbol, raises ArgumentError rather than sending the value uncoerced. Callers building a union parameter as a plain Hash must include the discriminator.
  • Adds nullable field encoding support, so int64_string and decimal_string fields wrapped in a nullable coerce correctly.

• #1937 Add new EventNotificationHandler class for better thin event management

  • We've been putting a lot of time into rethinking the event handling experience in the SDKs. This new class is the culmination of that effort.
  • They're designed for a tight coupling with both StripeClient and the fully-typed nature of thin events. This delivers painless event destination upgrades, in-editor checks for common mistakes, and better code modularity.
  • Now that we've released thin event notifications for v1 objects, these new handlers are our recommended path for all integrations using thin event notifications.
  • See more detailed docs here: https://docs.stripe.com/webhooks/event-notification-handlers

• #1926 Extract V2TypeCoercion module for bidirectional field encoding

  • Fixes V2 int64_string response fields so they return Integer (to match the field's Sorbet type) instead of String

• #1934 Update generated code

  • Add support for new resource Billing::FeedbackOption
  • Add support for create, deactivate, list, retrieve, and update methods on resource Billing::FeedbackOption
  • Add support for payment_method_settings on AccountSession::Component and AccountSessionCreateParams::Component
  • Add support for feedback_options on BillingPortal::Configuration::Feature::SubscriptionCancel::CancellationReason, BillingPortal::ConfigurationCreateParams::Feature::SubscriptionCancel::CancellationReason, and BillingPortal::ConfigurationUpdateParams::Feature::SubscriptionCancel::CancellationReason
  • Add support for customer_update on BillingPortal::Session::Flow
  • Add support for funding_source_group on Charge::PaymentMethodDetail::Card::Wallet::Link and Charge::PaymentMethodDetail::Link
  • Add support for funding_types_blocked on Checkout::Session::PaymentMethodOption::Card::Restriction and Checkout::SessionCreateParams::PaymentMethodOption::Card::Restriction
  • Add support for metadata on ConfirmationToken
  • Add support for active_entitlements and customer_portal on CustomerSession::Component and CustomerSessionCreateParams::Component
  • Add support for country on FinancialConnections::Session::Filter
  • Add support for frozen_fields on InvoiceItem
  • Add support for billie on Invoice::PaymentSetting::PaymentMethodOption, InvoiceCreateParams::PaymentSetting::PaymentMethodOption, InvoiceUpdateParams::PaymentSetting::PaymentMethodOption, Subscription::PaymentSetting::PaymentMethodOption, SubscriptionCreateParams::PaymentSetting::PaymentMethodOption, and SubscriptionUpdateParams::PaymentSetting::PaymentMethodOption
  • ⚠️ Remove support for cryptogram on PaymentAttemptRecord::PaymentMethodDetail::Card::ThreeDSecure and PaymentRecord::PaymentMethodDetail::Card::ThreeDSecure
  • Change PaymentIntent.allowed_payment_method_types and SetupIntent.allowed_payment_method_types to be required
  • Add support for application_fee_amount, application_fee_percent, on_behalf_of, and transfer_data on PaymentLinkUpdateParams

... (truncated)

Sourced from stripe's changelog.

19.6.2 - 2026-09-09

• #1959 Fix StripeContext hash key behavior
  • Fixes StripeContext value hashing so equivalent contexts work interchangeably as Hash and Set keys.
• #1962 Fix webhook tolerance reference
• #1960 Validate that webhook secrets are non-empty

19.6.1 - 2026-09-01

• #1950 Harden API requestor code against malicious URLs
• #1956 Fix OAuth authorize response type defaulting
  • Fixes OAuthService#authorize_url to default response_type to code without overwriting an explicit value.
• #1955 Forward request options when fetching V2 list pages
  • Fixes V2 fetch_next_page ignoring per-request API key and Stripe context overrides.

19.6.0 - 2026-08-26

This release changes the pinned API version to 2026-08-26.dahlia.

• #1926 Extract V2TypeCoercion module for bidirectional field encoding
  • Fixes V2 int64_string response fields so they return Integer (to match the field's Sorbet type) instead of String
• #1937 Add new EventNotificationHandler class for better thin event management
  • We've been putting a lot of time into rethinking the event handling experience in the SDKs. This new class is the culmination of that effort.
  • They're designed for a tight coupling with both StripeClient and the fully-typed nature of thin events. This delivers painless event destination upgrades, in-editor checks for common mistakes, and better code modularity.
  • Now that we've released thin event notifications for v1 objects, these new handlers are our recommended path for all integrations using thin event notifications.
  • See more detailed docs here: https://docs.stripe.com/webhooks/event-notification-handlers
• #1923 Support discriminated unions in the V2 runtime
  • Adds support for discriminated union (polymorphic) parameters and response fields in the V2 runtime.
  • Serializing a discriminated union parameter whose discriminator is missing, or not a String or Symbol, raises ArgumentError rather than sending the value uncoerced. Callers building a union parameter as a plain Hash must include the discriminator.
  • Adds nullable field encoding support, so int64_string and decimal_string fields wrapped in a nullable coerce correctly.
• ⚠️ #1934 Update generated code
  • Add support for new resource Billing::FeedbackOption
  • Add support for create, deactivate, list, retrieve, and update methods on resource Billing::FeedbackOption
  • Add support for payment_method_settings on AccountSession::Component and AccountSessionCreateParams::Component
  • Add support for feedback_options on BillingPortal::Configuration::Feature::SubscriptionCancel::CancellationReason, BillingPortal::ConfigurationCreateParams::Feature::SubscriptionCancel::CancellationReason, and BillingPortal::ConfigurationUpdateParams::Feature::SubscriptionCancel::CancellationReason
  • Add support for customer_update on BillingPortal::Session::Flow
  • Add support for funding_source_group on Charge::PaymentMethodDetail::Card::Wallet::Link and Charge::PaymentMethodDetail::Link
  • Add support for funding_types_blocked on Checkout::Session::PaymentMethodOption::Card::Restriction and Checkout::SessionCreateParams::PaymentMethodOption::Card::Restriction
  • Add support for metadata on ConfirmationToken
  • Add support for active_entitlements and customer_portal on CustomerSession::Component and CustomerSessionCreateParams::Component
  • Add support for country on FinancialConnections::Session::Filter
  • Add support for frozen_fields on InvoiceItem
  • Add support for billie on Invoice::PaymentSetting::PaymentMethodOption, InvoiceCreateParams::PaymentSetting::PaymentMethodOption, InvoiceUpdateParams::PaymentSetting::PaymentMethodOption, Subscription::PaymentSetting::PaymentMethodOption, SubscriptionCreateParams::PaymentSetting::PaymentMethodOption, and SubscriptionUpdateParams::PaymentSetting::PaymentMethodOption
  • ⚠️ Remove support for cryptogram on PaymentAttemptRecord::PaymentMethodDetail::Card::ThreeDSecure and PaymentRecord::PaymentMethodDetail::Card::ThreeDSecure
  • Change PaymentIntent.allowed_payment_method_types and SetupIntent.allowed_payment_method_types to be required
  • Add support for application_fee_amount, application_fee_percent, on_behalf_of, and transfer_data on PaymentLinkUpdateParams
  • Add support for feedback_option on Subscription::CancellationDetail, SubscriptionCancelParams::CancellationDetail, and SubscriptionUpdateParams::CancellationDetail
  • Add support for igic on Tax::Registration::CountryOption::At, Tax::Registration::CountryOption::Be, Tax::Registration::CountryOption::Bg, Tax::Registration::CountryOption::Cy, Tax::Registration::CountryOption::Cz, Tax::Registration::CountryOption::De, Tax::Registration::CountryOption::Dk, Tax::Registration::CountryOption::E, Tax::Registration::CountryOption::Ee, Tax::Registration::CountryOption::Fi, Tax::Registration::CountryOption::Fr, Tax::Registration::CountryOption::Gr, Tax::Registration::CountryOption::Hr, Tax::Registration::CountryOption::Hu, Tax::Registration::CountryOption::Ie, Tax::Registration::CountryOption::It, Tax::Registration::CountryOption::Lt, Tax::Registration::CountryOption::Lu, Tax::Registration::CountryOption::Lv, Tax::Registration::CountryOption::Mt, Tax::Registration::CountryOption::Nl, Tax::Registration::CountryOption::Pl, Tax::Registration::CountryOption::Pt, Tax::Registration::CountryOption::Ro, Tax::Registration::CountryOption::Se, Tax::Registration::CountryOption::Si, Tax::Registration::CountryOption::Sk, Tax::RegistrationCreateParams::CountryOption::At, Tax::RegistrationCreateParams::CountryOption::Be, Tax::RegistrationCreateParams::CountryOption::Bg, Tax::RegistrationCreateParams::CountryOption::Cy, Tax::RegistrationCreateParams::CountryOption::Cz, Tax::RegistrationCreateParams::CountryOption::De, Tax::RegistrationCreateParams::CountryOption::Dk, Tax::RegistrationCreateParams::CountryOption::E, Tax::RegistrationCreateParams::CountryOption::Ee, Tax::RegistrationCreateParams::CountryOption::Fi, Tax::RegistrationCreateParams::CountryOption::Fr, Tax::RegistrationCreateParams::CountryOption::Gr, Tax::RegistrationCreateParams::CountryOption::Hr, Tax::RegistrationCreateParams::CountryOption::Hu, Tax::RegistrationCreateParams::CountryOption::Ie, Tax::RegistrationCreateParams::CountryOption::It, Tax::RegistrationCreateParams::CountryOption::Lt, Tax::RegistrationCreateParams::CountryOption::Lu, Tax::RegistrationCreateParams::CountryOption::Lv, Tax::RegistrationCreateParams::CountryOption::Mt, Tax::RegistrationCreateParams::CountryOption::Nl, Tax::RegistrationCreateParams::CountryOption::Pl, Tax::RegistrationCreateParams::CountryOption::Pt, Tax::RegistrationCreateParams::CountryOption::Ro, Tax::RegistrationCreateParams::CountryOption::Se, Tax::RegistrationCreateParams::CountryOption::Si, and Tax::RegistrationCreateParams::CountryOption::Sk

19.5.0 - 2026-08-10

• #1924 Discard the connection when a request is interrupted
  • Fix connection reuse after a request is interrupted by a non-StandardError exception (e.g. from rack-timeout), which could cause subsequent requests to receive a previous request's response
• #1918 add/adjust event parsing helpers

... (truncated)

• 8e349e2 Bump version to 19.6.2
• 8c1ee32 validate that webhook secrets are non-empty (#1960)
• 8a59961 Fix webhook tolerance reference (#1962)
• 6318b32 Fix StripeContext hash key behavior (#1959)
• f98f67c Bump version to 19.6.1
• 37f3710 Forward options when fetching V2 list pages (#1955)
• 339e28b Fix OAuth authorize response type default (#1956)
• 18ecc12 Harden API requestor code against malicious URLs (#1950)
• f73e74e Carry private-preview's CI workflow branch list on master (#1951)
• 90349e5 Pin and modernize GitHub Actions references (#1943)
• Additional commits viewable in compare view

Sourced from tilt's changelog.

2.9.0 (2026-08-17)

• Add Herb template, registered for .herb and .html.erb (marcoroth) (#30)

• f0d75c6 Bump version to 2.9.0
• c6f5711 Register ERB/Erubi for .html.erb
• b5371b6 Update commonmarker tests for changes in recent versions of commonmarker
• 610b5e3 Add Herb Template Engine
• See full diff in compare view

Sourced from faraday's releases.

v2.14.4

What's Changed

• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in lostisland/faraday#1678
• Update copyright year to 2026 by @​iMacTia with @​Copilot in lostisland/faraday#1683
• Support JSON 3 by @​byroot in lostisland/faraday#1687
• Preserve caller-owned JSON parser options by @​OskarEichler in lostisland/faraday#1689
• Define HTTP verb methods on Faraday so tools can see them by @​mokevnin in lostisland/faraday#1708
• Document Options struct attributes for YARD (Fixes #1490) by @​tachyurgy in lostisland/faraday#1709
• chore: Configure SimpleCov for 1.0, too by @​olleolleolle in lostisland/faraday#1715

New Contributors

• @​byroot made their first contribution in lostisland/faraday#1687
• @​OskarEichler made their first contribution in lostisland/faraday#1689
• @​mokevnin made their first contribution in lostisland/faraday#1708
• @​tachyurgy made their first contribution in lostisland/faraday#1709

Full Changelog: lostisland/faraday@v2.14.3...v2.14.4

• 3ece9bd v2.14.4
• 6aa82a5 Configure SimpleCov for 1.0, too
• 20d93f8 Document Options struct attributes for YARD
• e7e23ae Define HTTP verb methods on Faraday so tools can see them
• 9458f04 Preserve caller-owned JSON parser options
• b25b1b2 Support JSON 3 (#1687)
• 3725183 Update copyright year to 2026 (#1683)
• 06bc5ad Bump actions/checkout from 6 to 7 (#1678)
• See full diff in compare view

Sourced from gapic-common's releases.

gapic-common: v1.5.1

1.5.1 (2026-09-30)

Bug Fixes

• tighten path template matching in the REST transcoder (#83)

gapic-common: v1.5.0

1.5.0 (2026-09-29)

Features

• Resumable Media Upload functionality implementation (#72)

Documentation

• remove stale preview notice and disclaimer from READMEs (#77)

gapic-common: v1.4.1

1.4.1 (2026-09-28)

Bug Fixes

• validate path parameters and prevent traversal/injection in REST transcoder (#67)

gapic-common: v1.4.0

1.4.0 (2026-09-23)

Features

• add custom predicate matching to RetryPolicy (#59)

Bug Fixes

• require grpc >= 1.83 for post-quantum key exchange (#73)
• only use emit_default for proto messages (#75)

• f239dde chore(main): release gapic-common 1.5.1 (#84)
• 22e26ee fix(rest): tighten path template matching in the REST transcoder (#83)
• 106bc8a chore(main): release gapic-common 1.5.0 (#81)
• afabc76 feat: Resumable Media Upload functionality implementation (#72)
• affdfee docs: remove stale preview notice and disclaimer from READMEs (#77)
• bdf4825 chore(main): release gapic-common 1.4.1 (#79)
• 2b064fc fix: validate path parameters and prevent traversal/injection in REST transco...
• b1af551 chore(main): release gapic-common 1.4.0 (#61)
• c80dbce fix: only use emit_default for proto messages (#75)
• fec610b fix(gapic-common): require grpc >= 1.83 for post-quantum key exchange (#73)
• Additional commits viewable in compare view

Sourced from grpc's releases.

Release v1.84.0

This is release 1.84.0 (gimbal) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

• [promise_based_filter] enable v2_non_owning_waker_implementation experiment. (#43253)
• [xDS] allow server listener address to match wildcard port. (#43247)
• [WRR] remove env var guard for custom backend metrics. (#43198)
• [subchannel] enable connection scaling service config fields. (#43116)
• [subchannel] add metrics as per A94. (#43140)
• Fix incorrect hostname suffix matching in no_proxy handling (prevents proxy bypass). (#41915)

C#

• [C# Grpc.Tools] Add native macOS ARM64 support via universal binaries. (#41222)

Python

• [Python] Fix -Werror=unused-result error triggered by Cythonized code. (#43313)
• [Python] Release Python 3.15 wheels publicly. (#43259)
• [Python][AsyncIO] Fixed reference cycles. (#43121)
• [Python] fix: remove ghost key in grpc.aio.Metadata.delitem when last value is deleted. (#42974)
• [Python] Fix the StatusCode Enums to be int. (#43167)
• [Python] Fixed the parenthesis placement. (#43111)
• [Python] Removed UsageError exception from registered method. (#43086)
• [Python] Added registered methods support in AsyncIO stack . (#41796)
• [Python] AIO Part 4 - Typehints fixes and add Pyright for aio/_channel.py. (#42736)
• [Python] grpc-status: Relax protobuf dependency lower bound to allow 6.x. (#43000)
• [Python] Observability plugin fixes. (#42785)

Ruby

• [Ruby] Fix: Addressed Array of strings passed as metadata. (#42827)

Release v1.84.0-pre2

This is a prerelease of gRPC Core 1.84.0 (gimbal).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This is a Python-only pre-release that introduces pre-built wheels for Python 3.15.

... (truncated)

• 3252a89 Bump release version to 1.84.0 on v1.84.x branch (#43405)
• c633e39 [Release] Bump version to 1.84.0-pre2 (on v1.84.x branch) (#43401)
• 12cafee [Backport][v1.84.x] Revert "[Python] Revert Python 3.15 changes due to sanity...
• 56e86cb Bump release version to 1.84.0-pre1 on v1.84.x branch (#43327)
• 7ef6a9e [build] Source reflection and channelz v1 schemas from BCR (@​grpc_proto) (#43...
• c337c3e [core][filters] Unit test framework for v3 filter (#42969)
• ce22bb4 [PH2][CHTTP2] Retire stream flow control delta early to avoid data race
• a7fabec [Python] Fix -Werror=unused-result error triggered by Cythonized code (#43313)
• d92ee43 [util] remove LoadFile() option to append null byte (#41478)
• 7e68550 [Core] Fix filter ordering semantics for v3 stack on server side (#43005)
• Additional commits viewable in compare view

Sourced from io-console's releases.

v0.9.4

What's Changed

• Conditionally require 'io/wait' for Ruby versions < 3.2 by @​headius in ruby/io-console#172
• Detect the old style ttyname_r return type by @​nobu in ruby/io-console#174

Full Changelog: ruby/io-console@v0.9.3...v0.9.4

v0.9.3

What's Changed

• Avoid timing race in noecho test by @​nobu in ruby/io-console#150
• Move the rules for win32_vk and add generated dependency rules by @​nobu in ruby/io-console#161
• Use ttyname_r return codes for errors by @​OskarEichler in ruby/io-console#153
• Correct ttyname documentation by @​OskarEichler in ruby/io-console#154
• Preserve nil from JRuby getpass at EOF by @​OskarEichler in ruby/io-console#156
• Honor JRuby raw mode options by @​OskarEichler in ruby/io-console#155
• Return nil when JRuby has no console device by @​OskarEichler in ruby/io-console#157
• Reject incomplete JRuby cursor responses by @​OskarEichler in ruby/io-console#158
• Ignore nonpositive console size overrides by @​OskarEichler in ruby/io-console#159
• Generate the version file before Java builds by @​OskarEichler in