[andreibondarev]

Follow-ups to #72. Everything here goes into the unreleased 0.10.0.

CI and tooling

• ci.yml was triggered by pushes to a master branch, but the default branch is main, so pushes to main never ran CI.
• Test on Ruby 2.7, 3.0, 3.1, 3.2, 3.3, 3.4 and 4.0. Lint now runs in its own job on Ruby 3.4.
• Upgrade standard 1.25 → 1.57. The old rubocop couldn't parse Ruby 3.4+. Standard 1.38+ needs Ruby ≥ 3.0, so it moved to a lint Gemfile group that the test jobs skip with BUNDLE_WITHOUT=lint. .standard.yml targets Ruby 2.7.
• Pin actions/checkout@v5 instead of @master.
• Bump yard to 0.9.45. This fixes the 2 open Dependabot alerts, both path traversal in yard server, and replaces Bump yard from 0.9.37 to 0.9.42 in the bundler group across 1 directory #71.
• required_ruby_version is now >= 2.7, the oldest version CI tests.
• Gemspec metadata and README links now point at patterns-ai-core/weaviate-ruby. changelog_uri was also missing /blob/main/.
• RBS signatures for the public API, validated in CI.

Bug fixes

• live?/ready? return false on error responses (Weaviate returns 503 while starting up) and when it can't be reached, instead of raising.
• add_tenants sent JSON built by interpolating strings. It now sends an array and accepts { name:, activityStatus: } hashes.
• query.rb and collections.rb called to_json/JSON without requiring json. This only worked because of load order.
• Removed response.success? branches that can't run now that non-2xx responses raise.

Client options

• API key headers for every provider Weaviate 1.38 reads, taken from its source: anthropic, anyscale, contextualai, databricks, deepseek, digitalocean, friendliai, google, google_studio, google_vertex, jinaai, mistral, nvidia, twelvelabs, voyageai and xai. The existing ones are kept.
• headers: for extra headers, e.g. AWS access/secret keys or base URL overrides.
• open_timeout:, read_timeout: and write_timeout:.
• Token, secret and access-key headers are now filtered from the logs too, and requests send a weaviate-ruby/<version> User-Agent.

GraphQL arguments as Ruby hashes

where:, near_text:, sort: and the other query arguments can now be hashes or arrays. Strings are quoted and escaped, so values from user input can't break out of the query. Symbols, and string values under operator/order/fusionType, are sent as enums. Raw GraphQL strings still pass through unchanged.

New endpoints and options

• Objects: add_reference, replace_references, delete_reference, batch_create_references.
• Query: get(group_by:), aggs(limit:, with_hybrid:). explore is deprecated and warns once, because Weaviate disables it when more than one vectorizer module is loaded.
• Collections: update_tenants, get_tenant, tenant_exists?, shards(tenant:).
• Backups: list, cancel, cancel_restore, config: on create/restore, bucket:/path: on status reads.
• Nodes: client.nodes(output:, class_name:, shard_name:).
• New clients: client.aliases, client.users (database users and role assignment), client.roles (RBAC roles and permissions), client.groups (OIDC group roles).

Not included

gRPC. It would add the grpc gem, a large native dependency, which works against #56's goal of keeping dependencies minimal.

Testing

• 98 specs on Ruby 2.7 and 3.4. New endpoints are tested at the Net::HTTP level, checking method, path, query and body.
• The RBS signatures were type-checked at runtime against the whole suite with rbs/test/setup, with 0 type errors.
• Live run against Weaviate 1.38.22 with API-key auth, RBAC, DB users and the backup module enabled. All 41 new-feature checks pass, including:
  • a limited user can read but gets ForbiddenError on delete
  • a backup cancel ends in CANCELED
  • queries through an alias
  • a hostile valueText is escaped
• The regression suite still gives 63/67 on the authenticated server. The 4 remaining are the expected raises.
• langchainrb's Weaviate adapter call patterns all work on this branch. langchainrb pins weaviate-ruby ~> 0.9.2, so it will need a bump to use 0.10.0.