Excon v0.111.0 has broken this gem

[bmhughes]

The VALID_REQUEST_KEYS constant is now frozen so a FrozenError is thrown when requireing this gem.

FrozenError: can't modify frozen Array: [:allow_unstubbed_requests, :body, :chunk_size, :debug_request, :debug_response, :dns_timeouts, :headers, :instrumentor, :logger, :method, :middlewares, :password, :path, :persistent, :pipeline, :query, :read_timeout, :request_block, :resolv_resolver, :response_block, :stubs, :timeout, :user, :versions, :write_timeout]

https://github.com/excon/excon/blame/master/lib/excon/constants.rb#L66

[AdilKh4n]

not nice to see this in our production env impacting 1000s of hosts today. How can we prevent this from happening in the future?

[bastelfreak]

Invest in a CI setup and don't pull random updates into production?

[feld]

Invest in a CI setup and don't pull random updates into production?

Chef automatically installs latest gem(s) that meet defined dependencies on each run. The only way to stop this would be to make sure it uses the Bundler flag --prefer-local so it uses the installed gems if they meet the requirements, but that feature didn't exist until December 2023 (Bundler 2.5) and Chef hasn't shipped a new version with that version of Bundler.

I suspect Puppet users are in the same situation.

The only other way this could have been avoided would be for docker-api to have more strictly pinned the version requirement of excon.

To work around it I had to modify the docker cookbook to pull the gem from my own rubygems server (geminabox) and build/upload a copy of "docker-api-2.2.1" from the fix-excon-frozenerror branch here.

Completely insane behavior all around, really.

[ls-todd-lunter]

Hi folks, released v2.3.0 which should fix this error.

[geemus]

Sorry to hear about this impact (I'm the author of excon). I hadn't seen any reason to believe this freeze would have this kind of impact since the excon test suite otherwise was not impacted by it. This may speak to the hijack middleware being somewhat unusual compared to other things and was doing something that was not expected. In any event, I'm glad you were able to find the fix quickly and feel free to reach out if you have issues or concerns in the future.

[ls-todd-lunter]

No worries @geemus, definitely our fault on this end for not updating to the proper interface.

[geemus]

Easy to overlook I'm sure, glad it was an easy fix.

[b-dean]

@ls-todd-lunter, do you mean to add a v2.3.0 tag? I was looking to see if the new version was out and saw no tag and didn't realize it was already on rubygems.org

[ls-todd-lunter]

@b-dean sorry, yes. Pushed the tag now.