What happened to v1.2.8?

[dombarnes]

This was a dependency in my project last week, and now its gone from the public rubygems database, breaking clean installs.

[nahi]

@hsbt ?

[AlanFoster]

Just bumped into this with our CI builds now all failing:

Your bundle is locked to logger (1.2.8), but that version could not be found in
any of the sources listed in your Gemfile. If you haven't changed sources, that
means the author of logger (1.2.8) has removed it. You'll need to update your
bundle to a different version of logger (1.2.8) that hasn't been removed in
order to install.

I can't immediately see why it would have been yanked, but the Gem version history is a bit weird:

[seanhussey]

I put together some info on the issue here: https://stackoverflow.com/questions/53625347/what-happened-to-version-1-2-8-of-the-logger-gem

The newly published 1.2.7 has changes that are not present in this repo. When 1.2.7 was published in this repo (2008), it had not yet been gemified (that happened in 2011 for version 1.2.8). None of the forks on GitHub contain this new code.

So I'm curious as to where this new code is coming from. Is there a new official repo? Why drop down the version number? Why was 1.2.8 yanked?

[hsbt]

I yanked v1.2.8 because the current version of logger on the ruby standard library is 1.2.7.

[hsbt]

This is the new canonical repository https://github.com/ruby/logger

[hsbt]

I released v1.3.0 that is the same code of v1.2.7. Please use it instead of v1.2.8.

[sent-hil]

Same issue as @AlanFoster. Unfortunate a published version was yanked after 7 years.

[jrochkind]

I yanked v1.2.8 because the current version of logger on the ruby standard library is 1.2.7.

I don't understand why this was a reason to yank 1.2.8? Lots of projects were using it. There is no problem with a version existing on rubygems that is beyond what is in the ruby standard lib. Just like the 1.3.0 you went on to release.

I'm guessing you decided it was a mistake that you released 1.2.8 at all, but only realized that after 7 years? It was very disruptive to yank it at this point. Working apps now have to be changed just in order to keep working exactly how they were before, which always involves some risk and developer attention.

It also seemed so odd that it made me suspect some kind of malicious activity, since there have been recent npm (not ruby) malicious attacks that involved yanking and releasing in odd patterns.

I think this was a mistake to yank a gem people had been using for 7 years, with the reason that it had never been included in stdlib -- this does not seem like a reason to inconvenience people by yanking.

[Xylakant]

The 1.3.0 and 1.2.7 are not the same code as the yanked 1.2.8. Most notably, they are both not compatible with ruby 1.8.x which is still the default install on RHEL 6.x systems.

I'm absolutely in favour of not supporting 1.8.x in newer versions of libraries, but yanking a perfectly working version and breaking existing and deployed code is not a great move.

[chechsp]

1.2.7 is not the same as 1.2.8 (this is obvious), and it does not work where 1.2.8 worked. I just created a blank project based on other working projects with a gem that has a dependency on logger, and it doesn't even start. Errors are:

SyntaxError: /usr/local/rvm/gems/ruby-2.2.0@my-gemset/gems/logger-1.2.7/lib/logger.rb:482: syntax error, unexpected '.'
    @logdev&.write(msg)
             ^
/usr/local/rvm/gems/ruby-2.2.0@my-gemset/gems/logger-1.2.7/lib/logger.rb:569: syntax error, unexpected '.'
    @logdev&.close

Looks by comparing code side by side that 1.2.8 had no ampersands and an if @logdev after the close call.

EDIT: 1.3.0 doesn't work either.