Skip to content

Bump the bundler group across 1 directory with 2 updates - #930

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bundler/backend/bundler-c8326d14ac
Open

Bump the bundler group across 1 directory with 2 updates#930
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bundler/backend/bundler-c8326d14ac

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the bundler group with 2 updates in the /backend directory: omniauth and oauth2.

Updates omniauth from 1.8.1 to 2.2.0

Release notes

Sourced from omniauth's releases.

v2.1.4

What's Changed

Full Changelog: omniauth/omniauth@v2.1.3...v2.1.4

You may now configure an after_request_phase callback on your omniauth builder instance. This callback will be run after the request phase before returning the request result.

v2.1.3

What's Changed

New Contributors

Full Changelog: omniauth/omniauth@v2.1.2...v2.1.3

v2.1.2

What's Changed

New Contributors

Full Changelog: omniauth/omniauth@v2.1.1...v2.1.2

v2.1.1

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from omniauth's changelog.

[2.2.0] - 2026-10-22

Added

  • Add a full_host option for each strategy, as a string or a proc that takes the Rack env. It takes precedence over OmniAuth.config.full_host. (#835)
  • Ship RBS type signatures for OmniAuth in sig/.
  • Document the Rack env keys OmniAuth sets, CSRF protection, sending origin as a form field, and how SameSite session cookies affect the callback in the README. (#909, #1075, #1048, #1149)
  • Add this changelog.

Changed

  • omniauth.params now includes params posted to the request phase's form, not just its query string, so they survive the POST-only request phase introduced in 2.0. The authenticity_token param is never included (see CVE-2017-18076 under 1.3.2). If your request form posts other fields, they now appear in omniauth.params and are stored in the session until the callback. (#975)
  • OmniAuth::Builder builds its middleware stack on the first request and reuses it, instead of rebuilding every strategy on every request. Providers added after the first request are ignored. (#1083, #970)
  • Strategy#call sends a request that isn't on the strategy's request or callback path straight to the app, instead of duplicating the strategy for it. It still duplicates it in test mode, with an other_phase, with path lambdas, or when the strategy overrides how #call! dispatches. Methods patched directly onto OmniAuth::Strategy, rather than overridden in a subclass, aren't detected, so a patched #call! no longer runs for requests outside the strategy's paths. (#1172)
  • Require Ruby 2.5 or later (was 2.2). (#1167)
  • Require Rack 2.2.8 or later (was 2.2.3), rack-protection 2.2.0 or later, and hashie 3.5.2 or later (was 3.4.6).
  • The gem now contains only lib, sig, the license, the README, the changelog, and the security policy.

Fixed

  • Run the before_callback_phase hook for mocked failures in test mode, as for real callbacks. (#1043, #1171)
  • Recognize callback paths with a format suffix, such as /auth/:provider/callback.json. (#618, #1170)
  • Don't fail callbacks when the app defines a method named uid, info, credentials, or extra on Object. (#898, #1169)
  • Don't add a calculated name to the info hash subsets returned by slice, except, select, and reject. (#892, #1168)
  • Collapse repeated slashes in the request path, as Rails routing does, so //auth/:provider from a misconfigured proxy reaches the strategy. (#1079)
  • Avoid "instance variable not initialized" warnings on Ruby before 3.0.

Security

  • Guard against forged hosts in callback URLs. Unless a full_host is set, OmniAuth builds the callback URL it sends to the provider from the request's Host, X-Forwarded-Host, or Forwarded header, which a client can forge. The new OmniAuth.config.allowed_hosts, a list of strings and regexps, makes the request and callback phases fail with invalid_host unless the request's host matches one of them. Until full_host or allowed_hosts is set, the request phase logs a warning. The README's full_host example, which copied the Host header, is fixed. (GHSA-m27g-v28p-f9fx, CVE-2026-63183)
  • Run request_validation_phase before writing omniauth.params to the session, so a cross-site POST rejected by the authenticity check can no longer store attacker-controlled params. (#1162)

[2.1.4] - 2025-10-01

Added

  • Add an after_request_phase hook, settable with OmniAuth.config.after_request_phase or in the builder block, that runs after the request phase (including in test mode). (#1147)

Changed

  • Add logger as a runtime dependency, because Ruby 3.5 no longer bundles it as a default gem. (#1142)

[2.1.3] - 2025-02-27

Fixed

  • Keep an omniauth.origin value already set in the Rack env in test mode instead of replacing it with the session value. The session's omniauth.origin is still cleared. (#1134)
  • Fix full_host with versions of the uri library that no longer define URI::ABS_URI. (#1136)

[2.1.2] - 2023-12-19

Added

  • Add a :method option to OmniAuth::Form. It defaults to 'post'. (#1106)

Changed

  • Make the developer strategy's form submit to its callback with GET, so it works with the setup described in the README. (#1106)

... (truncated)

Commits
  • 0d38078 Release 2.2.0
  • 943b44f Add allowed_hosts to guard against forged hosts
  • a241c94 Make the shipped signatures loadable from other gems
  • 01142e0 Remove Tidelift from the README, funding, and security policy
  • 6a77c9b Use the mutant 0.17.1 release
  • 3420866 Mark the dispatch check private and note patched methods
  • 1ee5e75 Skip duplicating the strategy for requests that aren't its own
  • 84a4774 Update the copyright year and list every gem owner as an author
  • b74232c Don't depend on the OS's wording of ECONNREFUSED in a spec
  • 8b4e509 Test on Windows and let unreleased Rubies fail
  • Additional commits viewable in compare view

Updates oauth2 from 1.4.7 to 2.1.0

Release notes

Sourced from oauth2's releases.

v2.1.0

2.1.0 - 2026-10-25

  • TAG: v2.1.0
  • COVERAGE: 98.48% -- 649/659 lines in 16 files
  • BRANCH COVERAGE: 93.53% -- 217/232 branches in 16 files
  • 90.83% documented

Changed

  • BREAKING: allow_cross_origin_redirects now defaults to false. Cross-origin redirects are blocked before credentials are replayed. Set allow_cross_origin_redirects: true explicitly to retain the previous behavior (deprecated).

Security

  • GHSA-cmh8-5q25-68v6 - OAUTH_DEBUG token-request secrets are redacted; see gh!769. Reported by iamibi.

  • gh!769 - Redact secrets in structured token-request debug bodies, expand the default filtered credential keys, and require auth-sanitizer >= 0.2.5 by @​makssein

  • gh!775 - Strip Authorization headers, request bodies, and query parameters from cross-origin redirects by @​Huge

  • gh!776 - Redact configured sensitive response options from tokenless access-token initialization errors by @​Huge

v2.0.26

[2.0.26] - 2026-10-25

  • TAG: [v2.0.26][2.0.26t]
  • COVERAGE: 98.48% -- 647/657 lines in 16 files
  • BRANCH COVERAGE: 93.48% -- 215/230 branches in 16 files
  • 90.83% documented

Security

  • GHSA-cmh8-5q25-68v6 - OAUTH_DEBUG token-request secrets are redacted; see gh!769. Reported by iamibi.

  • gh!769 - Redact secrets in structured token-request debug bodies, expand the default filtered credential keys, and require auth-sanitizer >= 0.2.5 by @​makssein

  • gh!775 - Strip Authorization headers, request bodies, and query parameters from cross-origin redirects by @​Huge

  • gh!776 - Redact configured sensitive response options from tokenless access-token initialization errors by @​Huge

  • GHSA-cmh8-5q25-68v6 - OAUTH_DEBUG token-request secrets are redacted; see gh!769. Reported by iamibi.

... (truncated)

Changelog

Sourced from oauth2's changelog.

[2.1.0] - 2026-10-25

  • TAG: [v2.1.0][2.1.0t]
  • COVERAGE: 98.48% -- 649/659 lines in 16 files
  • BRANCH COVERAGE: 93.53% -- 217/232 branches in 16 files
  • 90.83% documented

Changed

  • BREAKING: allow_cross_origin_redirects now defaults to false. Cross-origin redirects are blocked before credentials are replayed. Set allow_cross_origin_redirects: true explicitly to retain the previous behavior (deprecated).

Security

  • GHSA-cmh8-5q25-68v6 - OAUTH_DEBUG token-request secrets are redacted; see gh!769. Reported by iamibi.

  • gh!769 - Redact secrets in structured token-request debug bodies, expand the default filtered credential keys, and require auth-sanitizer >= 0.2.5 by @​makssein

  • gh!775 - Strip Authorization headers, request bodies, and query parameters from cross-origin redirects by @​Huge

  • gh!776 - Redact configured sensitive response options from tokenless access-token initialization errors by @​Huge

[2.0.26] - 2026-10-25

  • TAG: [v2.0.26][2.0.26t]
  • COVERAGE: 98.48% -- 647/657 lines in 16 files
  • BRANCH COVERAGE: 93.48% -- 215/230 branches in 16 files
  • 90.83% documented

Security

Deprecated

  • allow_cross_origin_redirects: true is deprecated. The default will change to false in the next minor release (2.1.0). Set it explicitly to retain the current behavior.

Added

  • kettle-jem-template-20260720-001 - READMEs can now display configured corporate sponsor logos.
  • kettle-jem-template-20260720-005 - README Support & Community links now include RubyForum.
  • kettle-jem-template-20260726-001 - Projects now include YARD lint configuration and documentation dependencies so documentation issues fail before generated docs are refreshed.
  • kettle-jem-template-20260727-001 - Spec harness documentation now lists the RSpec helpers provided by kettle-test.

... (truncated)

Commits
  • 33d0896 🔖 Prepare release v2.1.0
  • fbeacbc ⬆️ Reconcile family dependencies
  • 9a407cf Merge pull request #779 from ruby-oauth/room/fix-https-github-com-ruby-oauth-...
  • 1cd914b 🔧 Constrain URI for TruffleRuby 22.3
  • 7e8f82a 🔧 Update RuboCop Gradual lockfile after client_spec.rb changes
  • 868fb39 🔧 Fix Ruby 2.4 compatibility: use scheme/host instead of URI#origin
  • 8963899 🔖 Prepare release v2.1.0
  • d8c18b7 🔒️ Checksums for v2.0.26
  • b3e092d 🔖 Prepare release v2.0.26
  • a0ddf66 🔒 Load Faraday logging formatter explicitly
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the bundler group across 1 directory with 2 updates
d9c4e41 
Bumps the bundler group with 2 updates in the /backend directory: [omniauth](https://github.com/omniauth/omniauth) and [oauth2](https://github.com/ruby-oauth/oauth2).


Updates `omniauth` from 1.8.1 to 2.2.0
- [Release notes](https://github.com/omniauth/omniauth/releases)
- [Changelog](https://github.com/omniauth/omniauth/blob/master/CHANGELOG.md)
- [Commits](omniauth/omniauth@v1.8.1...v2.2.0)

Updates `oauth2` from 1.4.7 to 2.1.0
- [Release notes](https://github.com/ruby-oauth/oauth2/releases)
- [Changelog](https://github.com/ruby-oauth/oauth2/blob/main/CHANGELOG.md)
- [Commits](ruby-oauth/oauth2@v1.4.7...v2.1.0)

---
updated-dependencies:
- dependency-name: omniauth
  dependency-version: 2.2.0
  dependency-type: direct:production
  dependency-group: bundler
- dependency-name: oauth2
  dependency-version: 2.1.0
  dependency-type: indirect
  dependency-group: bundler
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Nov 9, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants