Skip to content

chore(deps): bump oauth2 from 2.0.12 to 2.0.22 in the bundler-security-updates group across 1 directory - #95

Merged
mridang merged 1 commit into
mainfrom
dependabot/bundler/bundler-security-updates-9711cf3f38
Sep 11, 2026
Merged

chore(deps): bump oauth2 from 2.0.12 to 2.0.22 in the bundler-security-updates group across 1 directory#95
mridang merged 1 commit into
mainfrom
dependabot/bundler/bundler-security-updates-9711cf3f38

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the bundler-security-updates group with 1 update in the / directory: oauth2.

Updates oauth2 from 2.0.12 to 2.0.22

Release notes

Sourced from oauth2's releases.

v2.0.22

2.0.22 - 2026-06-07

  • TAG: v2.0.22
  • COVERAGE: 100.00% -- 542/542 lines in 15 files
  • BRANCH COVERAGE: 100.00% -- 180/180 branches in 15 files
  • 88.35% documented

Changed

  • Raised generated development tooling floors to kettle-dev >= 2.1.1 and version_gem >= 1.1.11.
  • Raised the runtime dependency floor for snaky_hash to >= 2.0.5.

Security

  • [GHSA-pp92-crg2-gfv9] Prevent protocol-relative redirect Location values from changing request authority, and strip Authorization headers from cross-origin redirects.

Official Discord 👉️ Live Chat on Discord

Many paths lead to being a sponsor or a backer of this project. Are you on such a path?

OpenCollective Backers OpenCollective Sponsors Sponsor Me on Github Liberapay Goal Progress Donate on PayPal

Buy me a coffee Donate on Polar Donate to my FLOSS efforts at ko-fi.com Donate to my FLOSS efforts using Patreon

... (truncated)

Changelog

Sourced from oauth2's changelog.

[2.0.22] - 2026-06-07

  • TAG: [v2.0.22][2.0.22t]
  • COVERAGE: 100.00% -- 542/542 lines in 15 files
  • BRANCH COVERAGE: 100.00% -- 180/180 branches in 15 files
  • 88.35% documented

Changed

  • Raised generated development tooling floors to kettle-dev >= 2.1.1 and version_gem >= 1.1.11.
  • Raised the runtime dependency floor for snaky_hash to >= 2.0.5.

Security

[2.0.21] - 2026-06-06

  • TAG: [v2.0.21][2.0.21t]
  • COVERAGE: 100.00% -- 525/525 lines in 15 files
  • BRANCH COVERAGE: 100.00% -- 174/174 branches in 15 files
  • 88.35% documented

Added

  • Added conditional appraisal2-rubocop Appraisal root loading on modern Ruby so generated Appraisal gemfiles are normalized during generation - by @​pboling

Changed

  • Raised generated version_gem dependency floor to version_gem >= 1.1.10 - by @​pboling
  • Raised the runtime dependency floor for auth-sanitizer to >= 0.2.1 so OAuth2 consumers get hash and nested-attribute inspect redaction fixes plus downstream RBS duplicate-declaration fixes - by @​pboling
  • Refreshed generated package metadata, support documentation, CI workflows, and development dependency floors from the current kettle-jem template - by @​pboling
  • Documented the current per-version Ruby, JRuby, and TruffleRuby CI matrix in generated README badges and compatibility tables - by @​pboling
  • Removed the post-install message from the gemspec to keep installs quieter - by @​pboling
  • Refreshed generated README support badges so Ruby 2.3 is listed as supported but untested - by @​pboling
  • Refreshed generated project metadata from the current kettle-jem template - by @​pboling

... (truncated)

Commits
  • 551f434 🔖 Prepare release v2.0.22
  • 849e7e5 🧪 Strengthen redirect security specs
  • 442c160 📝 Reference GHSA in security changelog
  • f6fed86 ⬆️ Raise snaky_hash floor
  • 26bfeda 🔧 Refresh kettle-jem templates
  • 0f0a474 Fix credential leakage on redirects
  • 1118527 🔒️ Checksums for v2.0.21
  • 3f41549 🔖 Prepare release v2.0.21
  • 3311b5b Raise auth-sanitizer floor to 0.2.1
  • 5659d89 🔖 Prepare release v2.0.21
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Jul 30, 2026
@github-actions

github-actions Bot commented Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Qodana for PHP

It seems all right 👌

No new problems were found according to the checks applied

💡 Qodana analysis was run in the pull request mode: only the changed files were checked
☁️ View the detailed Qodana report

Contact Qodana team

Contact us at qodana-support@jetbrains.com

@mridang

mridang commented Sep 11, 2026

Copy link
Copy Markdown
Collaborator

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Sep 11, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@mridang

mridang commented Sep 11, 2026

Copy link
Copy Markdown
Collaborator

@dependabot recreate

@dependabot
dependabot Bot force-pushed the dependabot/bundler/bundler-security-updates-9711cf3f38 branch from 544714d to 725a9d3 Compare September 11, 2026 01:04
@mridang

mridang commented Sep 11, 2026

Copy link
Copy Markdown
Collaborator

@dependabot rebase

@dependabot
chore(deps): bump oauth2
e6cb9ca 
Bumps the bundler-security-updates group with 1 update in the / directory: [oauth2](https://github.com/ruby-oauth/oauth2).


Updates `oauth2` from 2.0.12 to 2.0.22
- [Release notes](https://github.com/ruby-oauth/oauth2/releases)
- [Changelog](https://github.com/ruby-oauth/oauth2/blob/main/CHANGELOG.md)
- [Commits](ruby-oauth/oauth2@v2.0.12...v2.0.22)

---
updated-dependencies:
- dependency-name: oauth2
  dependency-version: 2.0.22
  dependency-type: direct:production
  dependency-group: bundler-security-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/bundler/bundler-security-updates-9711cf3f38 branch from 725a9d3 to e6cb9ca Compare September 11, 2026 01:50
@mridang
mridang merged commit 457988a into main Sep 11, 2026
15 checks passed
@dependabot
dependabot Bot deleted the dependabot/bundler/bundler-security-updates-9711cf3f38 branch September 11, 2026 01:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mridang mridang mridang approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mridang