Support Ruby 4.0

[fbacall]

• Add 4.0 to GitHub Action tests.
• Bump rake version to ensure it includes ostruct.
• Removed rdoc (we use yard for docs).
• Fix some method signatures to match docs.
• Avoid use of Dir.chdir.

[Copilot]

Pull request overview

This PR updates the gem’s tooling and CI configuration to support Ruby 4.0, and aligns a couple of method signatures with their YARD documentation.

Changes:

• Add Ruby 4.0 to the GitHub Actions test matrix.
• Update development dependency on rake and remove RDoc tasks from the Rakefile (YARD is used for docs).
• Rename Reader unzip helper method parameters to match documented parameter names.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
ro_crate.gemspec	Bumps rake development dependency version.
Rakefile	Removes RDoc task wiring (keeps test + console tasks).
lib/ro_crate/reader.rb	Renames unzip helper method parameters; touches unzip logic area.
.github/workflows/tests.yml	Adds Ruby 4.0 to CI matrix.

Comments suppressed due to low confidence (2)

lib/ro_crate/reader.rb:52

• unzip_io_to writes each zip entry using entry.name directly after Dir.chdir(target). A crafted zip can use ../ or absolute paths to write outside target (Zip Slip). Sanitize/normalize entry paths and ensure the final destination stays within target before creating directories/writing, and skip or raise on unsafe names.

      Dir.chdir(target) do
        Zip::InputStream.open(source) do |input|
          while (entry = input.get_next_entry)
            unless ::File.exist?(entry.name) || entry.name_is_directory?
              FileUtils::mkdir_p(::File.dirname(entry.name))
              ::File.binwrite(entry.name, input.read)
            end

lib/ro_crate/reader.rb:70

• unzip_file_to extracts entries using entry.name relative to a Dir.chdir(target) directory. This is susceptible to Zip Slip path traversal (e.g., ../ / absolute paths) and can overwrite files outside target. Validate/normalize entry paths and ensure the resolved destination is within target before extracting.

    def self.unzip_file_to(source, target)
      Dir.chdir(target) do
        Zip::File.open(source) do |zipfile|
          zipfile.each do |entry|
            unless ::File.exist?(entry.name)
              FileUtils::mkdir_p(::File.dirname(entry.name))
              zipfile.extract(entry, entry.name)
            end

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 8 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 9 changed files in this pull request and generated 3 comments.