Replace rest-client with Faraday, require Ruby 3.3, fix spec mismatches

.github/workflows/release.yaml

@@ -27,7 +27,7 @@ jobs:
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:
-          ruby-version: 3.2
+          ruby-version: 3.3
           bundler-cache: true
       - name: Installing dependencies
         run: bundle install

.github/workflows/test.yaml

@@ -11,7 +11,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest]
-        ruby: ['3.0', '3.1', '3.2', '3.3']
+        ruby: ['3.3', '3.4', '4.0']
     runs-on: ${{ matrix.os }}
     services:
       redis:

.gitignore

@@ -10,3 +10,5 @@
 /spec/reports/
 /tmp/
 /dump.rdb
+/vendor/bundle/
+

.pre-commit-config.yaml

@@ -0,0 +1,20 @@
+# Hooks run by prek (https://github.com/j178/prek), or pre-commit. Install them
+# with `prek install --hook-type pre-commit`.
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.1
+    hooks:
+      - id: gitleaks
+        stages: [pre-commit]
+
+  - repo: local
+    hooks:
+      # Runs on every commit, not just Gemfile.lock changes, so new advisories
+      # against unchanged gems block the commit too.
+      - id: security-audit
+        name: Security Audit
+        entry: bundle exec rake security:audit
+        language: system
+        pass_filenames: false
+        always_run: true
+        stages: [pre-commit]

.rubocop.yml

@@ -1,9 +1,11 @@
-require: 
+plugins:
   - rubocop-rails
   - rubocop-performance
 
 AllCops:
-  TargetRubyVersion: 2.5
+  TargetRubyVersion: 3.3
+  NewCops: disable
+  SuggestExtensions: false
   Include:
     - '**/Rakefile'
     - '**/config.ru'
@@ -112,7 +114,7 @@ Metrics/BlockLength:
   Enabled: false
   CountComments: true  # count full line comments?
   Max: 25
-  ExcludedMethods: []
+  AllowedMethods: []
   Exclude:
     - "**/*.rake"
     - "spec/**/*"
@@ -172,7 +174,7 @@ Style/FrozenStringLiteralComment:
     to help transition from Ruby 2.3.0 to Ruby 3.0.
   Enabled: false
 
-Style/FlipFlop:
+Lint/FlipFlop:
   Description: 'Checks for flip flops'
   StyleGuide: 'https://github.com/bbatsov/ruby-style-guide#no-flip-flops'
   Enabled: false
@@ -225,7 +227,7 @@ Style/LineEndConcatenation:
                  line end.
   Enabled: false
 
-Metrics/LineLength:
+Layout/LineLength:
   Description: 'Limit lines to 80 characters.'
   StyleGuide: 'https://github.com/bbatsov/ruby-style-guide#80-character-limits'
   Max: 150
@@ -306,7 +308,7 @@ Style/PerlBackrefs:
   StyleGuide: 'https://github.com/bbatsov/ruby-style-guide#no-perl-regexp-last-matchers'
   Enabled: false
 
-Naming/PredicateName:
+Naming/PredicatePrefix:
   Description: 'Check the names of predicate methods.'
   StyleGuide: 'https://github.com/bbatsov/ruby-style-guide#bool-methods-qmark'
   ForbiddenPrefixes:
@@ -498,7 +500,7 @@ Lint/CircularArgumentReference:
   Description: "Don't refer to the keyword argument in the default value."
   Enabled: false
 
-Lint/ConditionPosition:
+Layout/ConditionPosition:
   Description: >-
                  Checks for condition placed in a confusing position relative to
                  the keyword.
@@ -606,7 +608,7 @@ Performance/ReverseEach:
   Reference: 'https://github.com/JuanitoFatas/fast-ruby#enumerablereverseeach-vs-enumerablereverse_each-code'
   Enabled: false
 
-Performance/Sample:
+Style/Sample:
   Description: >-
                   Use `sample` instead of `shuffle.first`,
                   `shuffle.last`, and `shuffle[Fixnum]`.
@@ -675,3 +677,7 @@ Rails/TimeZone:
 Rails/Validation:
   Description: 'Use validates :attribute, hash of validations.'
   Enabled: false
+
+# This is a gem, not a Rails app: there is no :environment task to depend on.
+Rails/RakeEnvironment:
+  Enabled: false

CHANGELOG.md

@@ -1,3 +1,34 @@
+## 2.0.0 (Oct 26, 2026)
+
+* **Breaking:** Require Ruby 3.3 or newer. Ruby 3.0, 3.1 and 3.2 are end-of-life.
+
+* **Breaking:** Replace rest-client with Faraday (see `docs/adr/0001-replace-rest-client-with-faraday.md` for the upgrade guide):
+  * `Response#request` is now a `Procore::Request` (`url`, `method`, `headers`, `payload`) instead of a `RestClient::Request`.
+  * TLS certificate errors, DNS failures and unreachable hosts now raise `Procore::APIConnectionError`.
+  * `APIConnectionError#cause` and `Requestable::HTTP_EXCEPTIONS` use Faraday exception classes.
+  * The gem no longer loads rest-client.
+
+* Fix token revoke failures raising `OAuth2::Error` instead of `Procore::OAuthError`.
+
+* Fix request logs never including the response's `X-Request-Id`.
+
+* Support Ruby 3.4 and 4.0:
+  * Replace `OpenStruct` (no longer bundled with Ruby 4.0) with `Struct` in `Procore::OAuthError`.
+  * Add `pstore` as a runtime dependency (no longer bundled with Ruby 4.0).
+  * Fix `Procore::Auth::Stores::File` failing to load saved tokens on Ruby 3.4+ (`Psych::DisallowedClass`).
+
+* Fix the gem failing outside Rails: the Session, Redis and Dalli stores, `sync` and `OAuthError` relied on ActiveSupport core extensions the gem never required. `Procore::Auth::Token` now defines `to_h` and `to_json`, and the gem requires `activesupport` 7.0 or newer.
+
+* **Breaking:** `Response#pagination` paths now include the API version (`"rest/v1.1/projects?page=2"`, `"vapid/projects?page=2"`) instead of stripping it, and `get`/`delete` accept such paths without adding `default_version`. Following a next link from a v1.1, v2.0 or vapid response previously requested the default version.
+
+* Fix the `Accept` header being sent as `Accepts`.
+
+* Fix empty response bodies (such as 204 No Content) parsing to the String `"{}"` instead of an empty Hash.
+
+* Fix `delete` ignoring `options:`, so `company_id` was never sent as the `Procore-Company-Id` header on DELETE requests.
+
+* **Security:** stop logging request headers on DELETE requests. The log line included the `Authorization` header, exposing the access token to anything with access to the logs. All log lines now also replace bearer tokens with `###`.
+
 ## 1.3.1 (Jan 9, 2024)
 
 * Fix a bug with the retry logic in `with_response_handling` resulting in performing one more retry than expected .

CONTRIBUTING.md

@@ -15,7 +15,8 @@ Once a GitHub issue is accepted and assigned to you, please follow general workf
 
 - `bundle install` to install the dependencies
 - Make sure tests pass locally
-  - You'll need to spin up a few containers (redis and memcached) to run the tests. You can do this by running `docker-compose up -d` in the root of the project.
+  - You'll need to spin up a few containers (redis and memcached) to run the tests. You can do this by running 
+    `docker compose up -d` in the root of the project.
   - Run tests with `COVERAGE=true bundle exec rake`
 
 3. Commit your changes in the branch you created in step 2. All commits need to be signed-off. Check the [legal](#legal) section bellow for more details.