[lewkoowicz]

Why

This gem is one of housecall-web's lockfile constraints for faraday v2 upgrade. oauth2 1.4.11 already permits faraday >= 0.17.3, < 3.0, so this gem is the entire blocker and nothing else has to move.

Upstream's 2-stable solves it with faraday < 3.0 and oauth2 < 3.0. That second part is why this beats fork PR #14: < 3.0 keeps housecall-web's gem 'oauth2', '~> 1.4' satisfiable, whereas #14's oauth2 ~> 2.0 drags Google SSO and 8 unrelated call sites into a QBO ticket.

What

Rebased onto upstream 2-stable (67335f4, v2.0.7) with our fork deltas replayed on top. 27 of the 34 commits are upstream's own history. quickbooks-ruby.gemspec and lib/quickbooks-ruby.rb are byte-identical to 2-stable.

Review these 10 files - the rest is upstream:

file
lib/quickbooks/model/purchase.rb	payment_method_ref (ruckus#595)
lib/quickbooks/service/bill_payment.rb + spec + fixture	void action
lib/quickbooks/service/base_service.rb	pass remaining options to the query URL (ruckus#592); blank error element ↓
lib/quickbooks/service/change_service.rb	bug fix ↓
spec/lib/quickbooks/service/base_service_spec.rb + fixture	spec rewrite ↓, blank-element regression test
Gemfile, .github/workflows/ci.yml	CI matrix ↓

ChangeService#url_for_query arity. fetch_collection passes 4 args, the override took 3, so every ChangeService subclass raises ArgumentError (given 4, expected 0..3) on #query - 8 specs are red on master today. 2-stable already declares the wider signature but never passes the 4th arg, so upstream never trips this - our ruckus#592 cherry-pick is what made fetch_collection start passing it. CDC endpoints have no pagination, so the extra args are accepted and ignored.

Spec rewrite. Three request-hook tests asserted captured stdout and url_for_query asserted an escaped query string, both of which break on things unrelated to the behaviour under test: Ruby 3.4 changed Hash#inspect spacing, and oauth2 2.x sets Faraday::Utils.default_space_encoding = "%20" globally. Now asserts the RequestInfo and the decoded query.

CI. Was 9 rubies × 2 faraday on [push, pull_request] = 36 checks, 12 red. Now 4 rubies × faraday × oauth2 = 16 checks, all green. Dropped Ruby 2.6 / JRuby / -head, which cannot resolve (activesupport 6.1 needs a require "logger" that concurrent-ruby >= 1.3.5 no longer does, and faraday-gzip caps Ruby at < 4 on the faraday-1 axis). Added Ruby 3.3/3.4 and an oauth2 axis - the old matrix never covered faraday 2 + oauth2 1.4.x, which is exactly what housecall-web runs.

Behaviour changes worth knowing

• Error messages gain an element prefix when Intuit names a field: "Name: String length is either shorter or longer...". New IntuitRequestException#element accessor. ExceptionFactory and ExceptionHandleable match on substrings, so classification is unaffected, but Sentry grouping will shift.
• Blank elements are normalised to nil. Intuit sends element="" on code-6000 faults and "" is truthy in Ruby, so upstream Add element name to IntuitRequestException and message ruckus/quickbooks-ruby#609 prefixed those messages with a bare ": ". ReprocessSelfHealingErrors exact-matches exception_message IN (...) against 13 full Intuit strings, three of them code-6000 business validation messages, so that prefix would have silently stopped those auto-retries. Fixed here with a regression test. A populated element still prefixes, but none of the 13 are field-level validation errors.
• rebuild_connection! replaces oauth2's connection instead of rebuilding it, so site / connection_opts / ssl are no longer inherited. A no-op today (we pass none, and token_url is absolute) but a trap if anyone adds timeouts there later. Upstream code, left as-is.
• Removed: Upload#class_for_io, the vendored Gzip middleware (now the faraday-gzip gem), OAuth1 upload support; preferences section :vendor_and_purchase → :vendor_and_purchases. All verified unused in housecall-web.
• Version 1.0.21 → 2.0.7. housecall-web pins by git ref:, so there is no version constraint to update.