Drop support for Ruby < 2.1

[johnnyshields]

Ruby 2.0 went EOL on 24 Feb 2016, over 5 years ago. See: https://endoflife.date/ruby

The Github Actions CI is no longer covering 2.0 and earlier. Using these EOL versions poses a significant security risk and is not advisable for RubySAML users. I have updated this in the README in PR #607

I would recommend to that Ruby SAML 1.13+ no longer support them; Ruby 2.0 and earlier users can stay on Ruby SAML 1.12.

[johnnyshields]

Fixed in #609

[pitbulk]

I agree 1.8.7 is kinda old, but I know there are people using it and using this library.

Those ppl that keep using 1.8.7 maybe rely on master branch or have an automatic system to update the gems, so we could break their system.

Based on your PR, you see there is no much difference if we keep supporting it, so I prefer to leave it as it is for now. Let's keep this PR open in case we need it later.

P.S CI does not support it but I'm still able to test it on machines before making an official release.

[johnnyshields]

Those ppl that keep using 1.8.7 maybe rely on master branch or have an automatic system to update the gems

The gemspec should include min_ruby_version which would prevent any automatic upgrades. Relying on master without a version lock is just bad practice, especially for a security-related gem like ruby-saml. No one should be doing this. At any rate their bundle will fail to install, and they will then fix it on their end.

There is no much difference if we keep supporting it

Once we upgrade there is actually more legacy syntax we can get rid of, i.e. using Rubocop. This will help prevent security issues as well. The PR I raised was just the bare minimum.

[johnnyshields]

@pitbulk lets go ahead and handle this. I actually think we should drop Ruby 2.5 and prior because they are deep EOL (min support should be 2.6.) It is a huge risk for users to be using SAML on older Ruby versions, it entirely defeats the purpose of security.

Should drop the versions then release gem as 2.x.x series. Can maintain a 1.x-stable branch for critical fixes affecting the old code.

[pitbulk]

Im ok releasing a future 2.X version with min 2.6 ruby.

[johnnyshields]

Can I raise the PR then?

[pitbulk]

Do you mean #609?

[johnnyshields]

Yeah, that PR makes min version to be Ruby 2.1 and can be merged as-is if you want, but we should actually make min to be Ruby 2.6, so I will update the PR.

[johnnyshields]

PR #609 updated to drop support for Ruby < 2.6 and JRuby < 9.3

[johnnyshields]

This is merged.