The Ruby gem applies urlencoding to the hyphen ('-') character when making requests.
At some point between vault server 1.15 and 1.20.3 the handling of urlencoded paths has changed and a urldecode process no longer gets applied before checking permissions.
So when making the following requests against an up to date server
logical.read("/auth/token/lookup-self")
produces a 403 - permission denied error from the Vault server.
It looks like PR #343 fixes this issue