Merge pull request #722 from spinel-coop/version-0.6.0

Version 0.6.0

Author: indirect

CHANGELOG.md

@@ -1,5 +1,83 @@
 # `rv` changelog
 
+## rv 0.6.0 (15 June, 2026)
+
+The significant changes in 0.6.0 include:
+  - run `rv ruby install dev` to install Ruby compiled daily from git
+  - use `rvx @name/gem` to run gems from `gem.coop` namespaces
+  - use `rv self update` to update rv itself
+  - gem servers that require authentication are now supported (e.g. sidekiq pro)
+
+Thank you to new contributors @parkr, @alepore, @solojavier, @kbruccoleri, and @simi!
+
+### Added
+
+ - Support for private gems with `username:password` credentials (#694, @alepore)
+ - `rvx` namespace syntax (#692, @indirect)
+ - `rv self update` integrates with Homebrew installs (#667, @a-chacon)
+ - `rv tool install` supports namespaced gem sources (#658, @deivid-rodriguez)
+ - `rv tool install` validates package checksums against the gem API (#640, @deivid-rodriguez)
+ - `rv tool dir` shows the tools directory path (#621, @savechina)
+ - `bin/install` accepts additional parameters (#610, @a-chacon)
+ - Settings can be configured via a config file (#590, #642, #633, @a-chacon)
+ - `rv` can now update itself with `rv self update` (#562, #620, @a-chacon, @savechina)
+
+### Fixed
+
+- Path traversal vulnerabilities in zip and tar extraction (#702, @deivid-rodriguez)
+ - Don't confuse `XDG_DATA_HOME` with `XDG_STATE_HOME` (#676, @deivid-rodriguez)
+ - User and gemspec inputs are now properly escaped (#670, @indirect)
+ - Several bugs compiling native extensions (#666, @deivid-rodriguez)
+ - Don't run `make` when there is no Makefile (#662, @deivid-rodriguez)
+ - `rv tool install` now tolerates additional metadata fields in compact index info files (#661, #718, @deivid-rodriguez, @parkr)
+ - `rv tool install` prints better errors when the target gem does not exist (#660, @deivid-rodriguez)
+ - `rv tool install foo` now fails clearly if no executable named `foo` is provided (#659, @deivid-rodriguez)
+ - `rv tool install archive-tar-minitar` failing due to compact index parsing bug (#629, @deivid-rodriguez)
+ - `.0.0.pre` incorrectly being treated as a valid version (#628, @deivid-rodriguez)
+ - `rv tool install` failing on truncated `data.tar.gz` archives (#625, @deivid-rodriguez)
+ - `rv tool install` panic when checksum validation failed (#624, @deivid-rodriguez)
+ - Only `rv clean-install` and `rv run` read Bundler settings (#617, @deivid-rodriguez)
+ - Activating `ruby-dev` versions (#616, @deivid-rodriguez)
+ - Handle empty Bundler config gracefully (#614, @deivid-rodriguez)
+ - Don't download anything if the lockfile does not specify a remote source (#609, @deivid-rodriguez)
+ - `rv shell init` falls back to the highest installed ruby if the pinned ruby is missing (#600, @deivid-rodriguez)
+ - Multiple lockfile parsing fixes (#597, #613, #619, #636, @deivid-rodriguez)
+ - Lockfile parse errors no longer break ruby version discovery (#596, @deivid-rodriguez)
+ - More Windows fixes (#587, @case)
+ - `ruby-dev` reinstalls now work correctly (#584, @deivid-rodriguez)
+
+### Improved
+
+ - More performant bash shell integration (#647, @deivid-rodriguez)
+ - Configuration is now resolved just once per invocation (#646, @deivid-rodriguez)
+ - Avoid shelling out to Ruby to discover extensions scope (#639, @deivid-rodriguez)
+ - Refactored `rv ruby list` and ruby version matching (#637, @deivid-rodriguez)
+ - `rv tool install` caching (#626, @deivid-rodriguez)
+ - `rv ruby list` output is now slimmer (#615, @deivid-rodriguez)
+ - `rv` now knows how to write `Gemfile.lock` files (#612, @deivid-rodriguez)
+ - Examples added to `rv ruby install --help` (#583, @deivid-rodriguez)
+
+### Internal
+
+ - Build linux-gnu releases on ubuntu-22.04 for glibc 2.35 compatibility (#699, @kbruccoleri)
+ - Added `SECURITY.md` (#657, @indirect)
+ - Removed unused dependencies (#634, @deivid-rodriguez)
+ - Unified duplicated types (#627, @deivid-rodriguez)
+ - Removed serde derive macros from lockfile types (#618, @deivid-rodriguez)
+ - Fixed intermittent integration test failures (#608, @deivid-rodriguez)
+ - Dependabot cooldown for rust-toolchain updates (#599, @shaanmajid)
+ - Replaced `dtolnay/rust-toolchain` action with `rustup show` (#598, @shaanmajid)
+ - GitHub Actions are pinned to commit SHAs (#593, @shaanmajid)
+ - Added zizmor for GitHub Actions security scanning (#578, @shaanmajid)
+ - Many dependency bumps across cargo, GitHub Actions, and the Rust toolchain (@dependabot)
+
+### Documentation
+
+ - Added link to Ruby Users Forum in the README (#691, @solojavier)
+ - Updated README Slack link (#688, @simi)
+ - Added rv settings configuration to the README (#644, @a-chacon)
+
+
 ## rv 0.5.3 (6 March, 2026)
 
 ### Added
@@ -44,6 +122,7 @@
 
  - Windows and standalone installer instructions now live right in our README (#526, @a-chacon)
 
+
 ## rv 0.5.2 (18 February, 2026)
 
 ### Added
@@ -55,6 +134,7 @@
  - rv ci: Gems weren't being compiled if extension deps already installed (#522, @deivid-rodriguez)
  - Tests fail faster when the required shell isn't installed (#521, @a-chacon)
 
+
 ## rv 0.5.1 (18 February, 2026)
 
 ### Added
@@ -72,6 +152,7 @@
  - Test improvements (#511, #510, @deivid-rodriguez)
  - rv ruby list sort order fixed (#513, @deivid-rodriguez)
 
+
 ## rv 0.5.0 (12 February, 2026)
 
 Thank you to new contributors @a-chacon and @phromo!
@@ -88,13 +169,11 @@ Thank you to new contributors @a-chacon and @phromo!
  - New rv ruby list flag to show all available versions #462 @a-chacon
  - New --force flag for reinstalling gems in rv clean-install #475 @a-chacon
 
-
 ### Changed
 
  - Better quickstart/readme #445 @indirect
  - rv clean-install shows how many native extension compilations were cached #473 @adamchalmers
 
-
 ### Fixed
 
  - Better error messages when gemspecs fail parsing #432 #435 @deivid-rodriguez
@@ -110,19 +189,20 @@ Thank you to new contributors @a-chacon and @phromo!
  - rv ruby pin `<version>` now properly pins version in project directory, even if there's a globally pinned version in user's home #476 @deivid-rodriguez
  - rv now properly activates ruby version configured in ~/.ruby-version , even if run outside of user's home folder #476 @deivid-rodriguez
 
-
 ### Internal
 
  - Big improvements to smoke test suite for most of rv’s surface area #440 #453 @case
  - Centralized, cohesive platform handling via rv_platform #472 @case
  - Integration tests for Rake extensions #481 @case
 
+
 ## rv 0.4.3 (22 January, 2026)
 
 - `rv ci` did not respect custom gem lib directories (#402, @deivid-rodriguez)
 - `rv ci` install path was wrong if BUNDLE_PATH was set (#403, @deivid-rodriguez)
 - better summary statistics for `rv ci` (#401, @deivid-rodriguez)
 
+
 ## rv 0.4.2 (22 January, 2026)
 
 ### Fixed
@@ -152,6 +232,7 @@ Thank you to new contributors @a-chacon and @phromo!
 - Nicer `rv ruby pin` output (#354, @kaspth)
 - Only find rubies that could match the desired version (#356, @deivid-rodriguez)
 
+
 ## rv 0.4.1 (9 January, 2026)
 
 This is a small release to fix a few bugs in the 0.4.0 release.
@@ -162,6 +243,7 @@ This is a small release to fix a few bugs in the 0.4.0 release.
 - Clearer descriptions for `rv ruby` subcommands (#338, @sstephenson)
 - Tests: Add smoke tests for `rv ci` with popular projects (#331, @case)
 
+
 ## rv 0.4.0 (6 January, 2026)
 
 Major new command: `rv clean-install`. Similar to `bundle install --frozen`, you can use `rv ci` to install gems that have already been resolved and recorded in your `Gemfile.lock`. If you notice anything wrong when installing your gems, please [let us know](https://github.com/spinel-coop/rv/issues/new)!
@@ -180,6 +262,7 @@ Improves listing Ruby versions, hiding (uninstalled) pre-releases once a final i
 - Add `Version::from(segments)` (<https://github.com/spinel-coop/rv/pull/320>, @kaspth)
 - Separate `RubyVersion` from `RubyRequest` (<https://github.com/spinel-coop/rv/pull/322>, @adamchalmers)
 
+
 ## rv 0.3.1 (30 December, 2025)
 
 Ruby 4.0.0 is now available! (and has been since Christmas Day). This release is mainly a fix to make sure that previews are considered "before" final releases, so we will stop showing 4.0.0-preview3 as if you might want to install it after 4.0.0.
@@ -195,6 +278,7 @@ Ruby 4.0.0 is now available! (and has been since Christmas Day). This release is
 - Set GEM_HOME to `~/.local/share/rv/gems` if `~/.gems` doesn't exist (<https://github.com/spinel-coop/rv/pull/231>, @lgarron)
 - Ensure `rv ruby pin` prints versions consistently (<https://github.com/spinel-coop/rv/pull/229>, @deivid-rodriguez)
 
+
 ## rv 0.3.0 (8 December, 2025)
 
 Highlights include support for Ruby versions 3.2.x, 3.5.0-preview1, 4.0.0-preview2, automatic Ruby installation during the `rv ruby run` command, and support for `.tool-versions` files, which are also used by the [asdf](https://asdf-vm.com) and [mise](https://mise.jdx.dev) tools.
@@ -217,6 +301,7 @@ Special thanks to our new contributors @savechina, @Mado13, @case, and @deivid-r
 - Add `rv ruby uninstall` (<https://github.com/spinel-coop/rv/pull/153>, @savechina)
 - Add `rv ruby dir` (<https://github.com/spinel-coop/rv/pull/150>, @savechina)
 
+
 ## rv 0.2.0 (8 October, 2025)
 
 Adds x86 macOS as a supported platform, Ruby 3.3, and YJIT for all Rubies. Adds shells bash, fish, and nushell.
@@ -236,6 +321,7 @@ Adds x86 macOS as a supported platform, Ruby 3.3, and YJIT for all Rubies. Adds
 - Support fish shell (<https://github.com/spinel-coop/rv/pull/67>, @renatolond)
 - Compact top-level help, even on `--help` (<https://github.com/spinel-coop/rv/pull/70>, @coezbek)
 
+
 ## rv 0.1.1 (28 August, 2025)
 
 - Dual license MIT / Apache-2
@@ -245,6 +331,7 @@ Adds x86 macOS as a supported platform, Ruby 3.3, and YJIT for all Rubies. Adds
 - replace openssl with rustls
 - Added bash to supported shells
 
+
 ## rv 0.1.0 (25 August, 2025)
 
 First release. Supports macOS 14+, Ubuntu 24.04+, Ruby 3.4.1+, and zsh.

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "rv"
-version = "0.5.3"
+version = "0.6.0"
 rust-version = "1.90.0"
 edition = "2024"
 repository = "https://github.com/spinel-coop/rv"