Prepare 2.3.0 and fix release QA findings

[cardmagic]

Prepare 2.3.0 for website discovery, normalized entries, JSON Feed parsing, and the parser fixes merged in #62–#67. The release QA pass found five additional bug families; this PR fixes them and adds permanent regressions.

Both version declarations now report 2.3.0. The README includes release highlights, the package description reflects current capabilities, and the stale hardcoded gem date is removed. Existing release notes and the new fixes are grouped under Unreleased → 2.3.0.

QA findings fixed

Trigger	Previous behavior	Corrected behavior
Bodyless HTTP 204	Runtime exceptions in fetch/discover	Normal feed/discovery parsing behavior
Non-string discovery input	NoMethodError during HTTPS normalization	PolicyError before HTTP
Out-of-range JSON timestamp hours/offsets	Silent date shifts or invalid offsets interpreted as UTC	nil date and invalid_date issue, retaining the original value
Invalid UTF-8 in JSON	Invalid strings accepted and exposed	SimpleRSSError before exposing data
Overflowing JSON numbers	Distinct numeric IDs collapse to Infinity; extension serialization can fail	Clear range error; large integer IDs retain full precision

Timestamp validation also uses the Gregorian calendar consistently, accepting historical dates skipped by Ruby's default calendar cutover and rejecting Julian-only leap dates. Clock/offset ranges follow RFC 3339.

For example, malformed dates remain inspectable without becoming misleading timestamps:

require "simple-rss"

feed = SimpleRSS.parse({
  version: "https://jsonfeed.org/version/1.1",
  title: "Example",
  items: [{ id: "post-1", content_text: "Post", date_published: "2026-09-01T00:00:00+25:00" }]
}.to_json)

entry = feed.normalized_entries.first
entry.published_at       # => nil
entry.issues.first[:code] # => :invalid_date
SimpleRSS::VERSION       # => "2.3.0"

Validation

• 39 exploratory scenarios passed against the extracted 2.3.0 gem, using fresh valid/invalid fixtures and live requests.
• RSS/Atom checks cover date fallback, stable ties, pre-1970 ordering, merge/deduplication, relation aliases, categories, namespaces, CDATA, and nested metadata isolation.
• Normalization checks cover URL bases, content, authors, attachment associations, invalid metadata, per-call mappings, and immutable snapshots.
• JSON checks cover both versions, empty feeds, BOM/IO, extensions, field types, dates, numeric bounds, depth, malformed encoding, and serialization.
• Discovery/HTTP checks cover advertised and direct feeds, HTML syntax and charset decoding, redirects, credentials, conditional 304, bodyless 204, compressed-byte boundaries, truncation, partial responses, timeouts, and destination policies.
• Live RSS, GitHub Atom, and JSON Feed parsing passed. Self-signed and wrong-host TLS certificates were rejected.
• 233 tests / 1,114 assertions pass, with three existing external-network omissions. RuboCop, generated RBS validation, and Steep pass.
• Built and verified the gem, including all library files, examples, and release documentation, with zero mandatory runtime gem dependencies.

The five bug families were reproduced before their fixes. Raw RSS/Atom entity preservation was compared with 2.2.0 and confirmed as existing behavior; normalized fields decode those entities correctly. No further failures remained in the scenarios exercised.

Publication

When publishing, promote the staged notes to ## 2.3.0 - YYYY-MM-DD using the actual publication date, leave an empty ## Unreleased section, and tag v2.3.0 on the release commit. The existing tag workflow runs CI, publishes the gem, and creates the GitHub Release. The changelog remains undated here because repository instructions reserve release dates for publication.

[greptile-apps]

Greptile Summary

Prepares the 2.3.0 release and addresses the five release-QA failure families.

• Synchronizes gem version metadata and updates release documentation.
• Handles bodyless successful HTTP responses and rejects invalid discovery input before network access.
• Tightens RFC 3339 and Gregorian-calendar timestamp normalization.
• Rejects malformed UTF-8 and non-finite JSON numbers while preserving large integer precision.
• Adds regression coverage for the corrected transport, encoding, numeric, and timestamp behavior.

Confidence Score: 5/5

The current revision appears safe to merge, with the release-QA fixes preserving established error contracts and adding focused regression coverage.

No actionable new defect or repository-rule violation remains; bodyless responses are normalized consistently, invalid discovery inputs are rejected before HTTP access, malformed dates remain inspectable as normalization issues, and invalid JSON encoding or non-finite numbers are rejected before data exposure.

Important Files Changed

Filename	Overview
lib/simple-rss.rb	Updates the library version and safely normalizes absent HTTP response bodies before parsing.
lib/simple-rss/discovery.rb	Rejects non-string discovery inputs early and safely handles bodyless successful responses.
lib/simple-rss/json_entry_normalizer.rb	Enforces RFC 3339 clock and offset ranges while consistently applying the Gregorian calendar.
lib/simple-rss/json_feed.rb	Rejects invalid UTF-8 and recursively prevents non-finite JSON numbers from entering feed data.
test/base/discovery_transport_test.rb	Adds transport regressions for non-string URLs and bodyless successful responses.
test/base/json_feed_test.rb	Adds regressions for timestamp ranges, Gregorian dates, malformed encoding, numeric overflow, and large integer precision.
simple-rss.gemspec	Updates release metadata to version 2.3.0 and describes the expanded parser capabilities.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Feed input] --> B{Input type}
  B -->|Website URL| C[Discovery and HTTP policy checks]
  C --> D[Normalize absent response body]
  D --> E[Feed or HTML detection]
  B -->|JSON Feed| F[Validate UTF-8]
  F --> G[Parse JSON]
  G --> H[Reject non-finite numbers]
  H --> I[Validate feed structure]
  I --> J[Normalize entries]
  J --> K[Validate RFC 3339 and Gregorian dates]
  K --> L[Expose normalized feed]

Loading

_{Reviews (2): Last reviewed commit: "fix: address release QA failures" | Re-trigger Greptile}

[cardmagic]

@greptileai Please review current head 2c57fdb77adb80e142c78199ec93129d895069fc, including the five QA fixes added after the initial metadata review. We reproduced bodyless-response crashes, non-string discovery crashes, invalid JSON UTF-8, floating-point overflow causing ID collisions/serialization failures, and incorrect JSON timestamp/calendar handling. Permanent regressions and changelog notes are included. All 39 exploratory scenarios and 233 tests / 1,114 assertions pass, along with lint/types. Please provide a fresh confidence score for this SHA.

[cardmagic]

Hound is applying defaults that conflict with .rubocop.yml: this repository requires double quotes and allows 160-character source lines; tests are excluded from line-length, ABC-size, and method-length limits. All 17 open Hound comments concern those configuration differences. The configured RuboCop check passes locally and in CI on 2c57fdb; resolving the mismatched comments.