Marcel 2.0.0

[jeremy]

Version bump plus regenerated lockfile pins (CI runs frozen). The release notes below are the draft GitHub Release body — the gem's changelog_uri points at Releases, so this is the changelog. Review it here in context.

---

Marcel 2.0.0 modernizes the toolchain, hardens the release pipeline, and teaches the content sniffer several new families of formats. It is a major release because it drops old Rubies and changes the canonical type returned for some inputs — details below so you can scan for the ones that affect you.

Breaking changes

• Ruby 3.3 or newer is required (was 2.3). (Require Ruby 3.3, the oldest non-EOL Ruby #170)
• Canonical type changes — the same bytes or filename may now return a different (more standard) type:
  • Aliased types now resolve to their canonical form on output (Respect MIME type aliases #171): audio/x-aac → audio/aac, audio/x-flac → audio/flac, audio/vnd.wave → audio/x-wav, text/x-yaml → application/yaml, application/x-debian-package → application/vnd.debian.binary-package, application/x-xliff+xml → application/xliff+xml. Lookups by any alias still work.
  • image/bmp;format=compressed is now plain image/bmp (Rename image/bmp;format=compressed into just image/bmp #148).
  • .cr2 files are image/x-canon-cr2 instead of image/x-raw-canon (Probe common magic types within their priority band #172).
  • OpenXPS (.oxps) is split from XPS (Respect MIME type aliases #171).
  • The XML/HTML detection work below can relabel documents that previously fell back to application/xml, text/html, or application/octet-stream.

Security & hardening

A review of the detection pipeline landed as a series of PRs (#157–#164):

• MIME data is validated before table generation, and the generated tables are checked in CI (Validate MIME data before generating tables #157, rake tables:check).
• HTML and XHTML magic matches only bounded opening-tag patterns instead of unanchored scans (Match HTML and XHTML from opening tags #158).
• IO edge cases — partial reads, unseekable and unrewindable IOs, non-string input — are handled explicitly while sniffing (Handle IO edge cases while sniffing #159).
• Declared MIME types are validated rather than trusted (Validate declared MIME types #160).
• Marcel's detection boundary — what sniffing does and does not promise — is documented in the README (Document Marcel's detection boundary #161).
• CI runs with locked dependencies (Run CI with locked dependencies #163), and the release workflow builds and publishes the same verified gem artifact with sha256 recorded and sigstore attestation (Build and publish the same gem artifact #164), with the gem's contents verified by script (Require Ruby 2.7 and verify gem contents #162, Identify XML vocabularies by their root element #173).

New detection

• OOXML documents (.docx/.xlsx/.pptx and their macro-enabled variants) are identified from the ZIP central directory, regardless of which application produced them (Sniff ZIP central directories to identify OOXML documents #169).
• XML vocabularies are identified by their root element, the way Apache Tika does: RSS, Atom, KML, Apple property lists, XSLT, ONIX, iWork flat XML, Office 2003 XML, and friends (Identify XML vocabularies by their root element #173 and Accept valid XML documents the token scan wrongly rejected #175, fixing Summary of a number of differences in mime type reporting before and after Tika #48).
• Canon CR2 raw images (Probe common magic types within their priority band #172).
• RAR archives (add rar fixture #155, @tristan-f-r) and Google Sheets shortcuts (Add Google Sheets to definitions #156, @tristan-f-r).
• AVIF image sequences (avis brand) (Add AVIS magic to definitons #151, @mm12) and audio-only .m4a files (Add fixture for audio only .m4a file #147).
• HTML detection also checks the end of the document for closing tags (Improve HTML detection by also checking the end of the document #146).

Performance

• The common-type fast path is restored with subtype-aware ordering, so common formats like JPEG are identified in ~25 IO reads instead of hundreds, without preempting subtype matchers (Probe common magic types within their priority band #172, Restore the common-type magic fast path without preempting subtype matchers #174).
• Sniffing uses IO#seek where possible instead of reading and discarding, including for regexp magic (Use IO#seek when possible #144, Improve magic_match_io to also use seek for regexp #145).

Upgrading

Most applications need no changes beyond Ruby ≥ 3.3. If you compare Marcel's output against stored MIME types, re-check the canonical type changes above — lookups by the old aliases still resolve, but Marcel now returns the canonical name.