Fix code review issues, CVE-2026-33210 pin, and Ruby 4.0 test suite

[cmwright33]

Summary

• Fixes a load-order bug that caused NoMethodError on Ruby 4.0 at require time
• Adds nil/empty api_key guard in send_batch to avoid sending broken Authorization: Bearer headers
• Brings flush! (at-exit path) in line with safe_flush: now calls on_flush_error and increments consecutive_failures on failure
• Closes HTTP connection leak in RegistryLoader.fetch_remote
• Raises json floor to >= 2.19.2 to exclude CVE-2026-33210 (CVSS 9.1)
• Deletes lib/apidepth/core.rb tombstone file
• Fixes test suite to pass on Ruby 4.0 (leaked doubles, be_in without ActiveSupport, SSL consistency error from started? stub, WebMock 0ms duration)

What changed and why

lib/apidepth/vendor_registry.rb

initialize_registry called replace(BUNDLED_BASELINE) at require time, which logs via Apidepth.logger. But logger is defined in apidepth.rb's class << self block, which hasn't been evaluated yet when vendor_registry.rb is first required. Fixed by inlining the state assignment in initialize_registry without the log call.

lib/apidepth/collector.rb

• send_batch: returns early when api_key is nil or empty — avoids a wasted round-trip that was guaranteed to 401 and burn a failure increment
• flush!: rescue block now calls on_flush_error and increments consecutive_failures, matching safe_flush behavior. The at-exit path is the one users are most likely to notice failures in
• Removed respond_to?(:name=) guards — Thread#name= has been available since Ruby 2.3; gem requires 2.7+
• Added comment documenting collector_url memoization intent

lib/apidepth/registry_loader.rb

fetch_remote creates a new Net::HTTP per call and was never calling finish. Added http&.finish rescue nil in the ensure block. Also removed dead respond_to?(:name=) guard.

apidepth.gemspec

• Raised json floor to >= 2.19.2 — CVE-2026-33210 (CVSS 9.1 Critical) affects json 2.14–2.15.2.0, 2.16–2.17.1.1, and 2.18–2.19.1. Patched in 2.19.2
• Removed fabricated CVE reference placeholder

spec/spec_helper.rb

Added a safety nil-out of @http on the singleton Collector instance before reset! runs in after(:each). Tests that set a mock Net::HTTP double on the singleton were leaving it alive past example teardown, causing "expired test double" failures in subsequent tests.

spec/sdk_spec.rb

• Added before { Apidepth.configuration.api_key = "sk_test" } to the Collector describe block — required now that send_batch skips when api_key is nil
• cold_start: false test: removed allow_any_instance_of stub. Net::HTTP.start establishes a real connection before yielding to our instrumented request, so started? is naturally true. The stub was unnecessary and caused a Ruby 4.0 SSL consistency IOError
• Changed be_positive → be >= 0 for duration_ms checks: WebMock returns with no delay; elapsed rounds to 0ms on fast hardware
• Replaced be_in([true, false]) with include matcher: be_in requires ActiveSupport which is not loaded in the test suite
• Updated SSRF flush! test: consecutive_failures should be 1 after a failed flush now that flush! tracks failures correctly
• Fixed event() helper to include outcome: :success (required field)
• Fixed env fallback test to expect "unknown" (Rails is not loaded in specs)
• Added tests for empty api_key guard and corrected env fallback

Test plan

• bundle exec rspec passes — 118 examples, 0 failures on Ruby 4.0.3
• No warnings about missing api_key at suite startup
• Security tests (SSRF, header injection, log injection) all pass

🤖 Generated with Claude Code