Release 1.1.1 - Update dependencies

.agent/tdd-flow/skill.md

@@ -7,9 +7,9 @@ triggers:
 
 ## Workflow Steps
 1. **Red Phase:** Write ONE failing test. Explain the failure. **STOP.**
-- Requirement: All tests generated in this phase must adhere to the Test Expectations defined in the ai_instruction file (specifically: No mocking, real HTTP requests, and semantic validation).
+- Requirement: All tests generated in this phase must follow the test expectations in `AGENTS.md` (specifically: no mocked endpoint integration tests, real HTTP requests, and semantic validation).
 2. **Green Phase:** Write the simplest possible implementation to pass that specific test. **STOP.**
 3. **Refactor Phase:** Suggest improvements to the implementation. Do not change tests.
 
 ## Constraint
-- Do not jump to Step 2 until the user confirms Step 1 passes (or fails correctly).
+- Do not jump to Step 2 until the user confirms Step 1 passes (or fails correctly).

AGENTS.md

@@ -1,9 +1,17 @@
-All AI agents (Codex, Copilot, Antigravity) must adhere to the rules defined in .agent/rules/ and this file.
+All AI agents (Codex, Copilot, Antigravity) must follow this file and the rules in `.agent/rules/`.
 
-# Project Standards & Agent Behavior
+# Project Standards and Agent Behavior
 
-- **Primary Workflow:** We use the `tdd-flow` skill for all new feature development.
-- **Test Style:** Focus on behavior-driven assertions. No mocking.
-- **Anti-Pattern Guardrail:** Do not "hallucinate" implementation for skipped tests. If a test is ignored, the underlying code must remain untouched.
-- **Language/Framework:** Ruby with RSpec for testing.
-- **Spec-Strictness:** When generating tests for the SDK, only assert properties explicitly defined in the OpenAPI specification provided. Do not invent "common sense" validations that are not codified in the schema. Call out any ambiguities or gaps in the spec for human review instead of making assumptions.
+- **Language and tests:** This is a Ruby SDK tested with Minitest.
+- **Primary workflow:** Use the `.agent/tdd-flow` skill for feature implementation and bug fixes, subject to `.agent/rules/tdd.md`.
+- **Test style:** Write behavior-driven assertions. Endpoint integration tests must use real HTTP requests; do not mock them.
+- **Skipped tests:** Never infer or change implementation for a skipped test. Leave the underlying code untouched.
+- **OpenAPI source of truth:** Use the [Mailinator OpenAPI specification](https://raw.githubusercontent.com/manybrain/mailinatordocs/main/openapi/mailinator-api.yaml).
+- **Spec strictness:** Only assert behavior and properties explicitly defined by the OpenAPI specification. Do not invent validations. Flag ambiguities or gaps for human review.
+- **Request paths:** Resource wrappers use paths relative to `https://api.mailinator.com/api/v2`; do not include `/api/v2` or `/v2` in resource method paths.
+- **Gap-analysis changes:** Follow `docs/openapi-maintenance.md`. Present the implementation plan and wait for approval before changing SDK coverage.
+
+# Project References
+
+- `docs/openapi-maintenance.md` documents the SDK architecture, conventions, and OpenAPI gap-analysis workflow.
+- `ROADMAP.md` tracks known gaps and planned improvements.

CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project aims to follow [Semantic Versioning](https://semver.org/).
 
+## [1.1.1]
+
+### Security
+
+- Updated `httparty` to `>= 0.24, < 0.25` to address the SSRF and API-key leakage vulnerability in CVE-2025-68696.
+- Required `addressable >= 2.9, < 3.0` for development to address the URI-template ReDoS vulnerability in CVE-2026-35611.
+
+### Changed
+
+- Raised the minimum supported Ruby version from 2.1 to 2.7, matching the requirement of the fixed `httparty` release line.
+- Updated development dependency floors for `minitest`, `rake`, and `webmock`.
+
 ## [1.1.0]
 
 ### Changed

README.md

@@ -90,19 +90,19 @@ When the Mailinator API returns a unsuccessful response, an instance of Response
 
 ## Testing
 
-Run individual integration tests with real API Key.
+Run an individual integration test with a real API key:
 
 ```ruby
-ruby -I test test/mailinator_client_api_test.rb
+bundle exec ruby -Itest test/messages_api_test.rb
 ```
 
-OR run them all:
+Or run the full test suite:
 
 ```ruby
 bundle exec rake test
 ```
 
-Most of the tests require env variables with valid values. Visit tests source code and review `mailinator_client_api_test.rb` file. The more env variables you set, the more tests are run.
+Most integration tests require environment variables with valid values. Review the files under `test/` and `.env.example`; the tests whose required variables are unavailable will be skipped.
 
 * `MAILINATOR_TEST_API_TOKEN` - API tokens for authentication; basic requirement across many tests;see also https://manybrain.github.io/m8rdocs/#api-authentication
 * `MAILINATOR_TEST_INBOX` - some already existing inbox within the private domain

ROADMAP.md

@@ -30,7 +30,7 @@ Webhooks (`lib/mailinator_client/webhooks.rb`):
 
 ## Completed (Phase 1)
 
-- [x] Add structural docs (`ROADMAP.md`, `CHANGELOG.md`, `AI_INSTRUCTIONS.md`, `EXAMPLES.md`)
+- [x] Add structural docs (`ROADMAP.md`, `CHANGELOG.md`, `docs/openapi-maintenance.md`, `EXAMPLES.md`)
 - [x] Update outdated dependencies (`rake` and `webmock`; `httparty` pinned to latest Ruby 2.6-compatible range)
 - [x] Update version number (`1.0.7`)
 - [x] Publish those changes (minor release)
@@ -55,4 +55,4 @@ Messages (`lib/mailinator_client/messages.rb`):
 - [x] Add `stream_inbox_messages` for `GET /domains/{domain}/stream/{inbox}`
 - [x] Add `list_domain_messages` for `GET /domains/{domain}/inboxes` (covered by `messages.fetch_inbox` with `inbox: "*"`)
 
-Note: We are intentionally not adding a separate SDK method for `GET /domains/{domain}/inboxes`. The existing `messages.fetch_inbox` with `inbox: "*"` provides equivalent domain-wide listing. Future gap analyses should treat this as covered.
+Note: We are intentionally not adding a separate SDK method for `GET /domains/{domain}/inboxes`. The existing `messages.fetch_inbox` with `inbox: "*"` provides equivalent domain-wide listing. Future gap analyses should treat this as covered.