♻️ Load auth-sanitizer through anonymous_loader

Author: pboling

.rubocop_gradual.lock

@@ -0,0 +1,9 @@
+{
+  "spec/oauth2/auth_sanitizer_spec.rb:899913194": [
+    [19, 14, 2, "Lint/Syntax: unexpected token tLSHFT\n(Using Ruby 2.2 parser; configure using `TargetRubyVersion` parameter, under `AllCops`)", 5859461],
+    [54, 35, 2, "Lint/Syntax: unexpected token tLSHFT\n(Using Ruby 2.2 parser; configure using `TargetRubyVersion` parameter, under `AllCops`)", 5859461],
+    [55, 38, 2, "Lint/Syntax: unexpected token tIDENTIFIER\n(Using Ruby 2.2 parser; configure using `TargetRubyVersion` parameter, under `AllCops`)", 5861278],
+    [55, 66, 4, "Lint/Syntax: unexpected token tIDENTIFIER\n(Using Ruby 2.2 parser; configure using `TargetRubyVersion` parameter, under `AllCops`)", 2087898353],
+    [57, 13, 1, "Lint/Syntax: unexpected token tCOLON\n(Using Ruby 2.2 parser; configure using `TargetRubyVersion` parameter, under `AllCops`)", 177567]
+  ]
+}

CHANGELOG.md

@@ -22,6 +22,10 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Changed
 
+- Raised the `auth-sanitizer` runtime dependency floor to `>= 0.2.2` and
+  switched isolated sanitizer loading to the released `anonymous_loader` gem,
+  including local workspace wiring for the new runtime dependency.
+
 ### Deprecated
 
 ### Removed

Gemfile

@@ -32,7 +32,7 @@ unless %w[false 0 no off].include?(ENV.fetch("RUBY_OAUTH_DEV", "false").downcase
   end
 
   eval_nomono_gems(
-    gems: %w[auth-sanitizer],
+    gems: %w[anonymous_loader auth-sanitizer],
     prefix: "RUBY_OAUTH",
     path_env: "RUBY_OAUTH_DEV",
     root: %w[code src ruby-oauth],

Gemfile.lock

@@ -2,7 +2,8 @@ PATH
   remote: .
   specs:
     oauth2 (2.0.23)
-      auth-sanitizer (~> 0.2, >= 0.2.1)
+      anonymous_loader (~> 0.1, >= 0.1.0)
+      auth-sanitizer (~> 0.2, >= 0.2.2)
       faraday (>= 0.17.3, < 4.0)
       jwt (>= 1.0, < 4.0)
       logger (~> 1.2)
@@ -16,6 +17,8 @@ GEM
   specs:
     addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
+    anonymous_loader (0.1.0)
+      version_gem (~> 1.1, >= 1.1.12)
     ansi (1.6.0)
     appraisal2 (3.1.2)
       bundler (>= 1.17.3)
@@ -26,7 +29,7 @@ GEM
       rubocop (>= 1.0)
       version_gem (~> 1.1, >= 1.1.10)
     ast (2.4.3)
-    auth-sanitizer (0.2.1)
+    auth-sanitizer (0.2.2)
       version_gem (~> 1.1, >= 1.1.10)
     backports (3.25.3)
     base64 (0.3.0)
@@ -374,7 +377,7 @@ GEM
       unicode-emoji (~> 4.1)
     unicode-emoji (4.2.0)
     uri (1.1.1)
-    version_gem (1.1.11)
+    version_gem (1.1.12)
     webrick (1.9.2)
     yaml-converter (0.2.0)
       hexapdf (>= 1.8, < 2)
@@ -462,11 +465,12 @@ DEPENDENCIES
 
 CHECKSUMS
   addressable (2.9.0) sha256=7fdf6ac3660f7f4e867a0838be3f6cf722ace541dd97767fa42bc6cfa980c7af
+  anonymous_loader (0.1.0) sha256=bcef54b92ff9266736fdabc511958f97e98ac84519339cc3e30c6dd490851e4a
   ansi (1.6.0) sha256=ac9ea0c0ea8d32fb4e271348e609963ac78882f34b73836c2a02b3622e666658
   appraisal2 (3.1.2) sha256=33a1f8c1e2808aa33a24b4c73d1f20c9571b5a34541d66d04d5e744b5906437a
   appraisal2-rubocop (0.2.0) sha256=c3353136ad1e32e9084c6ede76997510b3b77cf7d2fe19ab4c54a3f5e16cb9c9
   ast (2.4.3) sha256=954615157c1d6a382bc27d690d973195e79db7f55e9765ac7c481c60bdb4d383
-  auth-sanitizer (0.2.1) sha256=917dcf01f7589b06c26726afe90568cf2fb29d37a1f94facfc664f11967cc577
+  auth-sanitizer (0.2.2) sha256=300112debb67fe5e7a4f67a697790cea09744970e816745afb1f4235d6f27bae
   backports (3.25.3) sha256=94298d32dc3c40ca15633b54e282780b49e2db0c045f602ea1907e4f63a17235
   base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
   benchmark (0.5.0) sha256=465df122341aedcb81a2a24b4d3bd19b6c67c1530713fd533f3ff034e419236c
@@ -600,7 +604,7 @@ CHECKSUMS
   unicode-display_width (3.2.0) sha256=0cdd96b5681a5949cdbc2c55e7b420facae74c4aaf9a9815eee1087cb1853c42
   unicode-emoji (4.2.0) sha256=519e69150f75652e40bf736106cfbc8f0f73aa3fb6a65afe62fefa7f80b0f80f
   uri (1.1.1) sha256=379fa58d27ffb1387eaada68c749d1426738bd0f654d812fcc07e7568f5c57c6
-  version_gem (1.1.11) sha256=695df6464862b3dc976b4f6e0e089062517c8137ecd31078d8c378347f959c97
+  version_gem (1.1.12) sha256=b78f691677807997e63901e8aba1b96d4ae172ce5570ad9ceb0208eb3a0edb3d
   webrick (1.9.2) sha256=beb4a15fc474defed24a3bda4ffd88a490d517c9e4e6118c3edce59e45864131
   yaml-converter (0.2.0) sha256=0602148de1664ab701c7938a036987576c55e87fb6d4b3cb0fff19c4f7a91386
   yard (0.9.44) sha256=eb087e9b631ccd887b049f303d489963945452d5e2a7eb49a5a74a7cf6887f28

docs/OAuth2.html

@@ -278,30 +278,12 @@ <h5 class="example_title"><div class='inline'><p>Customize filtered output marke
 
         </dt>
         <dd><pre class="code"><span class='kw'>begin</span>
-  <span class='id identifier rubyid_auth_sanitizer_requirement'>auth_sanitizer_requirement</span> <span class='op'>=</span> <span class='const'>Gem</span><span class='op'>::</span><span class='const'>Requirement</span><span class='period'>.</span><span class='id identifier rubyid_new'>new</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>~&gt; 0.2</span><span class='tstring_end'>&quot;</span></span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>&gt;= 0.2.1</span><span class='tstring_end'>&quot;</span></span><span class='rparen'>)</span>
-  <span class='id identifier rubyid_auth_sanitizer_spec'>auth_sanitizer_spec</span> <span class='op'>=</span> <span class='const'>Gem</span><span class='period'>.</span><span class='id identifier rubyid_loaded_specs'>loaded_specs</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>auth-sanitizer</span><span class='tstring_end'>&quot;</span></span><span class='rbracket'>]</span>
-  <span class='kw'>unless</span> <span class='id identifier rubyid_auth_sanitizer_spec'>auth_sanitizer_spec</span> <span class='op'>&amp;&amp;</span> <span class='id identifier rubyid_auth_sanitizer_requirement'>auth_sanitizer_requirement</span><span class='period'>.</span><span class='id identifier rubyid_satisfied_by?'>satisfied_by?</span><span class='lparen'>(</span><span class='id identifier rubyid_auth_sanitizer_spec'>auth_sanitizer_spec</span><span class='period'>.</span><span class='id identifier rubyid_version'>version</span><span class='rparen'>)</span>
-    <span class='comment'># :nocov:
-</span>    <span class='id identifier rubyid_auth_sanitizer_spec'>auth_sanitizer_spec</span> <span class='op'>=</span> <span class='const'>Gem</span><span class='op'>::</span><span class='const'>Specification</span><span class='period'>.</span><span class='id identifier rubyid_find_by_name'>find_by_name</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>auth-sanitizer</span><span class='tstring_end'>&quot;</span></span><span class='comma'>,</span> <span class='id identifier rubyid_auth_sanitizer_requirement'>auth_sanitizer_requirement</span><span class='rparen'>)</span>
-    <span class='comment'># :nocov:
-</span>  <span class='kw'>end</span>
-
-  <span class='id identifier rubyid_auth_sanitizer_loader_path'>auth_sanitizer_loader_path</span> <span class='op'>=</span> <span class='const'>File</span><span class='period'>.</span><span class='id identifier rubyid_join'>join</span><span class='lparen'>(</span>
-    <span class='id identifier rubyid_auth_sanitizer_spec'>auth_sanitizer_spec</span><span class='period'>.</span><span class='id identifier rubyid_full_gem_path'>full_gem_path</span><span class='comma'>,</span>
-    <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>lib/auth_sanitizer/loader.rb</span><span class='tstring_end'>&quot;</span></span>
-  <span class='rparen'>)</span>
-  <span class='kw'>unless</span> <span class='const'>File</span><span class='period'>.</span><span class='id identifier rubyid_file?'>file?</span><span class='lparen'>(</span><span class='id identifier rubyid_auth_sanitizer_loader_path'>auth_sanitizer_loader_path</span><span class='rparen'>)</span>
-    <span class='comment'># :nocov:
-</span>    <span class='id identifier rubyid_raise'>raise</span> <span class='const'>LoadError</span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>oauth2 requires auth-sanitizer </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_auth_sanitizer_requirement'>auth_sanitizer_requirement</span><span class='embexpr_end'>}</span><span class='tstring_content'>; </span><span class='tstring_end'>&quot;</span></span> \
-      <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>loader not found at </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_auth_sanitizer_loader_path'>auth_sanitizer_loader_path</span><span class='embexpr_end'>}</span><span class='tstring_end'>&quot;</span></span>
-    <span class='comment'># :nocov:
-</span>  <span class='kw'>end</span>
-
-  <span class='id identifier rubyid_auth_sanitizer_loader_namespace'>auth_sanitizer_loader_namespace</span> <span class='op'>=</span> <span class='const'>Module</span><span class='period'>.</span><span class='id identifier rubyid_new'>new</span>
-  <span class='id identifier rubyid_auth_sanitizer_loader_namespace'>auth_sanitizer_loader_namespace</span><span class='period'>.</span><span class='id identifier rubyid_module_eval'>module_eval</span><span class='lparen'>(</span>
-    <span class='const'>File</span><span class='period'>.</span><span class='id identifier rubyid_read'>read</span><span class='lparen'>(</span><span class='id identifier rubyid_auth_sanitizer_loader_path'>auth_sanitizer_loader_path</span><span class='rparen'>)</span><span class='comma'>,</span>
-    <span class='id identifier rubyid_auth_sanitizer_loader_path'>auth_sanitizer_loader_path</span><span class='comma'>,</span>
-    <span class='int'>1</span>
+  <span class='id identifier rubyid_auth_sanitizer_requirement'>auth_sanitizer_requirement</span> <span class='op'>=</span> <span class='const'>Gem</span><span class='op'>::</span><span class='const'>Requirement</span><span class='period'>.</span><span class='id identifier rubyid_new'>new</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>~&gt; 0.2</span><span class='tstring_end'>&quot;</span></span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>&gt;= 0.2.2</span><span class='tstring_end'>&quot;</span></span><span class='rparen'>)</span>
+  <span class='id identifier rubyid_auth_sanitizer_loader_namespace'>auth_sanitizer_loader_namespace</span> <span class='op'>=</span> <span class='const'>AnonymousLoader</span><span class='period'>.</span><span class='id identifier rubyid_load_path'>load_path</span><span class='lparen'>(</span>
+    <span class='label'>gem_name:</span> <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>auth-sanitizer</span><span class='tstring_end'>&quot;</span></span><span class='comma'>,</span>
+    <span class='label'>require_path:</span> <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>auth_sanitizer/loader.rb</span><span class='tstring_end'>&quot;</span></span><span class='comma'>,</span>
+    <span class='label'>version_requirement:</span> <span class='id identifier rubyid_auth_sanitizer_requirement'>auth_sanitizer_requirement</span><span class='comma'>,</span>
+    <span class='label'>version_file:</span> <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>auth/sanitizer/version.rb</span><span class='tstring_end'>&quot;</span></span>
   <span class='rparen'>)</span>
 
   <span class='id identifier rubyid_auth_sanitizer_loader_namespace'>auth_sanitizer_loader_namespace</span><span class='period'>.</span>
@@ -498,7 +480,7 @@ <h3 class="signature " id="configure-class_method">
 </div>
 
       <div id="footer">
-  Generated on Sat Jun  6 21:31:15 2026 by
+  Generated on Thu Jun 18 08:22:24 2026 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
   0.9.44 (ruby-4.0.5).
 </div>

docs/file.CHANGELOG.html

@@ -76,12 +76,24 @@ <h3 id="added">Added</h3>
 
 <h3 id="changed">Changed</h3>
 
+<ul>
+  <li>Raised the <code>auth-sanitizer</code> runtime dependency floor to <code>&gt;= 0.2.2</code> and<br>
+switched isolated sanitizer loading to the released <code>anonymous_loader</code> gem,<br>
+including local workspace wiring for the new runtime dependency.</li>
+</ul>
+
 <h3 id="deprecated">Deprecated</h3>
 
 <h3 id="removed">Removed</h3>
 
 <h3 id="fixed">Fixed</h3>
 
+<ul>
+  <li>Fixed isolated <code>auth-sanitizer</code> loading when Bundler standalone setup makes<br>
+<code>auth_sanitizer/loader.rb</code> available on <code>$LOAD_PATH</code> without adding<br>
+<code>auth-sanitizer</code> to <code>Gem.loaded_specs</code> or <code>GEM_PATH</code>.</li>
+</ul>
+
 <h3 id="security">Security</h3>
 
 <h2 id="2023---2026-06-13">
@@ -167,7 +179,9 @@ <h3 id="changed-3">Changed</h3>
 
 <ul>
   <li>Raised generated <code>version_gem</code> dependency floor to <code>version_gem</code> &gt;= 1.1.10 - by @pboling</li>
-  <li>Raised the runtime dependency floor for <code>auth-sanitizer</code> to <code>&gt;= 0.2.1</code> - by @pboling</li>
+  <li>Raised the runtime dependency floor for <code>auth-sanitizer</code> to <code>&gt;= 0.2.1</code> so<br>
+OAuth2 consumers get hash and nested-attribute inspect redaction fixes plus<br>
+downstream RBS duplicate-declaration fixes - by @pboling</li>
   <li>Refreshed generated package metadata, support documentation, CI workflows,<br>
 and development dependency floors from the current kettle-jem template - by @pboling</li>
   <li>Documented the current per-version Ruby, JRuby, and TruffleRuby CI matrix in<br>
@@ -1526,7 +1540,7 @@ <h2 id="001---2010-04-22">
 </div></div>
 
       <div id="footer">
-  Generated on Sat Jun 13 04:37:02 2026 by
+  Generated on Thu Jun 18 08:22:24 2026 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
   0.9.44 (ruby-4.0.5).
 </div>

lib/oauth2/auth_sanitizer.rb

@@ -1,48 +1,15 @@
 # frozen_string_literal: true
 
+require "anonymous_loader"
+
 module OAuth2
   AUTH_SANITIZER = begin
-    auth_sanitizer_requirement = Gem::Requirement.new("~> 0.2", ">= 0.2.1")
-    auth_sanitizer_spec = Gem.loaded_specs["auth-sanitizer"]
-    unless auth_sanitizer_spec && auth_sanitizer_requirement.satisfied_by?(auth_sanitizer_spec.version)
-      # :nocov:
-      begin
-        auth_sanitizer_spec = Gem::Specification.find_by_name("auth-sanitizer", auth_sanitizer_requirement)
-      rescue Gem::MissingSpecError
-        auth_sanitizer_spec = nil
-      end
-      # :nocov:
-    end
-
-    auth_sanitizer_loader_path = if auth_sanitizer_spec
-      File.join(auth_sanitizer_spec.full_gem_path, "lib/auth_sanitizer/loader.rb")
-    end
-    unless auth_sanitizer_loader_path && File.file?(auth_sanitizer_loader_path)
-      auth_sanitizer_loader_path = Gem.find_files("auth_sanitizer/loader.rb").find do |path|
-        version_path = File.expand_path("../auth/sanitizer/version.rb", File.dirname(path))
-        next false unless File.file?(version_path)
-
-        version_source = File.read(version_path)
-        # Gem.find_files resolves loaders from $LOAD_PATH without exposing gemspec
-        # metadata, so validate the adjacent version file before evaluating the
-        # loader. This is intentionally limited to auth-sanitizer's VERSION file.
-        version_match = version_source.match(/VERSION\s*=\s*(["'])([^"']+)\1/)
-        version_match && auth_sanitizer_requirement.satisfied_by?(Gem::Version.new(version_match[2]))
-      end
-    end
-
-    unless auth_sanitizer_loader_path && File.file?(auth_sanitizer_loader_path)
-      # :nocov:
-      raise LoadError, "oauth2 requires auth-sanitizer #{auth_sanitizer_requirement}; " \
-        "loader not found in installed gems or on $LOAD_PATH"
-      # :nocov:
-    end
-
-    auth_sanitizer_loader_namespace = Module.new
-    auth_sanitizer_loader_namespace.module_eval(
-      File.read(auth_sanitizer_loader_path),
-      auth_sanitizer_loader_path,
-      1
+    auth_sanitizer_requirement = Gem::Requirement.new("~> 0.2", ">= 0.2.2")
+    auth_sanitizer_loader_namespace = AnonymousLoader.load_path(
+      gem_name: "auth-sanitizer",
+      require_path: "auth_sanitizer/loader.rb",
+      version_requirement: auth_sanitizer_requirement,
+      version_file: "auth/sanitizer/version.rb"
     )
 
     auth_sanitizer_loader_namespace.

oauth2.gemspec

@@ -106,7 +106,8 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
 
   # Utilities
-  spec.add_dependency("auth-sanitizer", "~> 0.2", ">= 0.2.1") # ruby >= 2.2.0
+  spec.add_dependency("anonymous_loader", "~> 0.1", ">= 0.1.0") # ruby >= 2.2.0
+  spec.add_dependency("auth-sanitizer", "~> 0.2", ">= 0.2.2") # ruby >= 2.2.0
   spec.add_dependency("faraday", [">= 0.17.3", "< 4.0"])      # ruby >= 1.9
   spec.add_dependency("jwt", [">= 1.0", "< 4.0"])             # ruby >= 0
   spec.add_dependency("logger", "~> 1.2")                     # ruby >= 0