REXML is no longer pure ruby

[cabo]

This is a deliberate duplicate of #131, which appears to be mired in some unrelated discussion.

We use REXML because it is pure ruby and thus can be installed in environments that are limited in their native compilation support.

By requiring strscan, REXML no longer is pure Ruby.

REXML now is no longer useful for these environments.

I have pinned to <=3.2.6, but of course I'd like to have security fixes going forward.

[kou]

strscan is a default gem. It means that all Rubies have strscan without installing strscan separately. strscan is implemented in C like other built-in feature such as Regexp but we don't need to install strscan separately like other built-in feature.

But some Rubies may have strscan < 3.0.9. It may require installing newer strscan.
We've removed the restriction in 3.2.9. (See also: #132)
So we can still use REXML like as a pure Ruby library.

[cabo]

This does solve the problem when using gem install.
When you use bundle, a bundle install still tries to install a non-default gem (with 3.3.3, it tries to install 3.1.0 when it should be using the included default 3.0.9).

[kou]

You can specify strscan version you want to use in your Gemfile: gem "strscan", "3.0.9"

[Bo98]

Do we need the add_runtime_dependency anymore if any strscan version now works? strscan should be guaranteed to be available already in Ruby >= 2.5.

You can specify strscan version you want to use in your Gemfile: gem "strscan", "3.0.9"

Note that Bundler seems to no longer support using default gems anymore in recent Bundler versions. A declared dependency will always be installed fresh from source. Ruby 3.3.5 released today with those Bundler changes which is why I'm noticing now.

[kou]

Do we need the add_runtime_dependency anymore if any strscan version now works? strscan should be guaranteed to be available already in Ruby >= 2.5.

Yes. For example, we may use stringio but it's not listed. Could you open a PR for this?

You can specify strscan version you want to use in your Gemfile: gem "strscan", "3.0.9"

Note that Bundler seems to no longer support using default gems anymore in recent Bundler versions. A declared dependency will always be installed fresh from source. Ruby 3.3.5 released today with those Bundler changes which is why I'm noticing now.

Oh... I didn't notice it.

[Bo98]

Could you open a PR for this?

Sure! Just wanted to check here first.

Opened #204.