PSA: Rubygem psych 4.0 is out and it's a breaking change


this is a warning if your plugin has an open ended dependency for psych, the YAML serializer. Version 4.0 was pushed out last week and it introduces a breaking change - YAML is by default loaded in safe mode, meaning that Ruby objects will not be deserialized.

This is why Katello CI is failing at the moment:

Psych::DisallowedClass: Tried to load unspecified class: Symbol
/usr/local/rvm/gems/ruby-2.5.1@test_develop_pr_katello-1/gems/psych-4.0.0/lib/psych/class_loader.rb:99:in `find'
/usr/local/rvm/gems/ruby-2.5.1@test_develop_pr_katello-1/gems/psych-4.0.0/lib/psych/class_loader.rb:28:in `load'
(eval):2:in `symbol'
/usr/local/rvm/gems/ruby-2.5.1@test_develop_pr_katello-1/gems/psych-4.0.0/lib/psych/class_loader.rb:32:in `symbolize'
/usr/local/rvm/gems/ruby-2.5.1@test_develop_pr_katello-1/gems/psych-4.0.0/lib/psych/class_loader.rb:84:in `symbolize'
/usr/local/rvm/gems/ruby-2.5.1@test_develop_pr_katello-1/gems/psych-4.0.0/lib/psych/scalar_scanner.rb:74:in `tokenize'
/usr/local/rvm/gems/ruby-2.5.1@test_develop_pr_katello-1/gems/psych-4.0.0/lib/psych/visitors/to_ruby.rb:65:in `deserialize'
/usr/local/rvm/gems/ruby-2.5.1@test_develop_pr_katello-1/gems/psych-4.0.0/lib/psych/visitors/to_ruby.rb:128:in `visit_Psych_Nodes_Scalar'
/usr/local/rvm/gems/ruby-2.5.1@test_develop_pr_katello-1/gems/psych-4.0.0/lib/psych/visitors/visitor.rb:30:in `visit'

I will push a fix shortly, unless someone else is faster. Take care!


Here is my patch:

Looks like I have to pin psych to 3.x version because vcr is actually also pinned. I wonder why it failed in the first place.

Sadly this seems to have broken our local devel environments for running
tests. It seems (at least when running 1 test), that the psych
installed from a gem was conflicting with the psych installed from
ruby. I went trying to hunt down why psych was even being installed as
a gem and discovered that it was being added to the bundler.d directory

Digging further, i found this pr:

Those responsible have been sacked!

So i’ve reverted the katello pr here:

And removed this gem addition here:

This was done ~4 years ago and whatever problem it was trying to address
is likely not even around anymore.


Damn, I had no popcorn in the house. Well, sorry about that.