v5.0.0

5.0.0 (2026-09-06)

What's Changed

• Require Ruby >= 3.3 and modernize toolchain (v5 baseline) by @SeanLF in #62
• Bump actions/checkout from 5 to 7 by @dependabot[bot] in #63
• Update simplecov requirement from ~> 0.22 to ~> 1.0 by @dependabot[bot] in #65
• RuboCop 1.88 cleanup + frozen string literals (v5) by @SeanLF in #64
• deps: remove the bigdecimal upper bound by @SeanLF in #67
• feat: expose base_score on CVSS 4.0 for NVD/GHSA comparison by @SeanLF in #69
• build: package only runtime files in the gem by @SeanLF in #70
• docs: cite the CVSS spec formula behind each scoring calculation by @SeanLF in #71
• Update simplecov requirement from ~> 0.22 to ~> 1.0 by @dependabot[bot] in #66
• feat: add CvssSuite.metrics for static metric introspection by @SeanLF in #68
• feat!: add CvssSuite.parse and make the parsing internals private by @SeanLF in #72
• docs: rewrite the README, and fix the scoring bug that writing it exposed by @SeanLF in #73
• ci: automate the changelog and release with release-please by @SeanLF in #75
• refactor: keep the metric lookup tables private by @SeanLF in #77
• refactor!: give every error one rescuable ancestor by @SeanLF in #78
• feat: name the rejected vector when one is not valid by @SeanLF in #79

New Contributors

• @SeanLF made their first contribution in #62
• @dependabot[bot] made their first contribution in #63

Full Changelog: v4.1.4...v5.0.0

Version 4.1.4

What's Changed

• Support BigDecimal 4.0 by @Bo98 in #60
• Add GitHub Action to publish gem to RubyGems on release by @0llirocks in #61

New Contributors

• @Bo98 made their first contribution in #60

Full Changelog: v4.1.3...v4.1.4

Version 4.1.3

What's Changed

• Fixes score discrepency due to temporal and environmental metric by @sachin-sandhu in #59

Full Changelog: v4.1.2...v4.1.3

Version 4.1.2

What's Changed

• Relaxes bigdecimal dependency to allow for greater versions by @sachin-sandhu in #57

New Contributors

• @sachin-sandhu made their first contribution in #57

Full Changelog: v4.1.1...v4.1.2

Version 4.1.1

What's Changed

• Fix #49 v2 impact calculation is wrong by @0llirocks in #52
• Bug: Impact calculation can be > 10 by @jgarber-cisco in #55
• Derive CVSS v2 severity from the base score. Fixes #50 by @jgarber-cisco in #53
• Don't round impact and exploitability subscores by @jgarber-cisco in #54

Full Changelog: v4.1.0...v4.1.1

Version 4.1.0

What's Changed

• Expose impact and exploitability sub-scores by @jgarber-cisco in #48

New Contributors

• @jgarber-cisco made their first contribution in #48

Full Changelog: v4.0.0...v4.1.0

Version 4.0.0

What's Changed

• Removed score method for all CVSS 4.0 metrics. Since CVSS 4.0 only has one score, it doesn't make sense for each metric to return a separate score. See #46 for more information.
• Changelog

Full Changelog: v3.3.0...v4.0.0

Version 3.3.0

What's Changed

• Update strings for frozen string compatibility by @HParker in #47
• Changelog

New Contributors

• @HParker made their first contribution in #47

Full Changelog: v3.2.2...v3.3.0

Version 3.2.2

What's Changed

• Add extra CVSS vector validations for 3.1 and lower by @kghandour in #42
• Add validation by @0llirocks in #43
• Changelog

New Contributors

• @kghandour made their first contribution in #42

Full Changelog: v3.2.1...v3.2.2

Version 3.2.1

What's Changed

• drop string extension to not pollute methods by @brphelps in #38
• Changelog

Full Changelog: v3.2.0...v3.2.1