Bump omniauth and omniauth-github #25

dependabot · 2021-06-06T03:55:18Z

Bumps omniauth and omniauth-github. These dependencies needed to be updated together.
Updates omniauth from 1.9.1 to 2.0.4

Release notes

Sourced from omniauth's releases.

v2.0.4

This release removes unnecessary warning logging when accessing GET routes that are not related to the OmniAuth request path.

Thanks to @charlie-wasp and @sponomarev at Evil Martians for the bug find and subsequent PR.

Fix rescuing of application errors when call_app! is used.

As a consequence of the changes that were merged in #689, errors thrown by strategies that utilize other_phase (or more specifically call_app!), would be caught by omniauth, causing headaches for folks looking to have those errors handled by their application. This should allow for errors that come from the app to pass through, while passing errors that come from the authentication phases to the fail! handler.

Resolves #1030

Fix for incorrect order of request_validation_phase in test_mode.

@jsdalton gave an awesome report of the issue present in test_mode in #1033

The current implementation of mock_call was verifying the token for all requests, regardless of whether the current path is on the omniauth request path. The change was introduced recently in 1b784ff. See #1032 for details.

This creates two problems:

When test mode is on, the authenticity verification logic is run inappropriately against requests where this may not even be wanted.

The behavior varies from actual production behavior, potentially allowing bugs to be introduced by unwary developers.

Note that this bug was only present when OmniAuth was configured for test_mode and using the mock_call phases.

Allow passing rack-protection configuration to default request_validation_phase

This release now properly allows an instance of OmniAuth::AuthenticityTokenProtection (with passed in rack-protection configuration) to be used as the request_validation_phase.

Thanks @jkowens #1027

If you haven't already read the release notes for v2.0.0, you should do so.

v2.0.0

Version 2.0 of OmniAuth includes some changes that may be breaking depending on how you use OmniAuth in your app.

Many thanks to the folks who contributed in code and discussion for these changes.

OmniAuth now defaults to only POST as the allowed request_phase method.

Hopefully, you were already doing this as a result of the warnings due to CVE-2015-9284.
For detailed context, see:
#960
#809
Resolving CVE-2015-9284

This change also includes an additional configurable phase: request_validation_phase.

Rack/Sinatra

By default, this uses rack-protection's AuthenticityToken class to validate authenticity tokens. If you are using a rack based framework like sinatra, you can find an example of how to add authenticity tokens to your view here.

... (truncated)

Commits

e7b8811 Release v2.0.4
119a54d Remove jruby-head for now
f0e5d42 Merge pull request #1041 from charlie-wasp/fix/get-request-warning
b72a8db Warn only on GET requests for login path
481e307 Prepare for next development iteration
f9dddef v2.0.3 release
7e1b49f Merge pull request #1035 from omniauth/1030-standard-error-handling
6f4cdb0 Better handle errors that come from the actual app.
0d533c3 Update README for next dev cycle.
ba115e1 Prepare for 2.0.2 release
Additional commits viewable in compare view

Updates omniauth-github from 1.4.0 to 2.0.0

Release notes

Sourced from omniauth-github's releases.

Require OmniAuth 2.0.0

As of v2.0.0 of this gem, it will require OmniAuth 2.0.0. This is due to changes that came with OmniAuth that required a breaking change in this gem. Because we changed the strategy's code, you should not need to change any omniauth-github specific code.

You should refer to OmniAuth's v2.0.0 release and/or the v2.0 upgrade guide when upgrading OmniAuth to v2.0.

Commits

1f77226 Merge pull request #95 from BobbyMcWho/chores-2020-01-12
7e5bcd8 Release 2.0.0
f12d90f Allow for omniauth 2.0 series
5afe8ae Merge pull request #92 from Anthonyntilelli/patch-1
4547b90 Merge pull request #93 from mikong/docs/github-docs-readme
24480cd Update link to GitHub Docs in README
267f54b udate readme for rails usage
d001ed2 Add semver notice.
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

codecov-commenter · 2021-07-12T18:14:39Z

Codecov Report

Merging #25 (46d3643) into main (6e0d55f) will increase coverage by 55.07%.
The diff coverage is 86.03%.

@@             Coverage Diff             @@
##             main      #25       +/-   ##
===========================================
+ Coverage   27.19%   82.26%   +55.07%     
===========================================
  Files         100       98        -2     
  Lines        7586     5960     -1626     
===========================================
+ Hits         2063     4903     +2840     
+ Misses       5523     1057     -4466

Impacted Files	Coverage Δ
app/channels/room_channel.rb	`71.42% <0.00%> (+71.42%)`	⬆️
app/controllers/application_controller.rb	`90.42% <ø> (+67.14%)`	⬆️
app/controllers/map_controller.rb	`50.00% <ø> (+50.00%)`	⬆️
app/controllers/questions_controller.rb	`89.18% <0.00%> (+89.18%)`	⬆️
app/controllers/users_controller.rb	`80.51% <66.66%> (+80.51%)`	⬆️
app/controllers/tag_controller.rb	`80.42% <69.23%> (+80.42%)`	⬆️
app/controllers/comment_controller.rb	`82.53% <71.42%> (+82.53%)`	⬆️
app/models/user.rb	`86.12% <73.33%> (+7.44%)`	⬆️
app/models/comment.rb	`77.63% <82.35%> (+14.96%)`	⬆️
app/models/node.rb	`91.04% <84.21%> (+12.18%)`	⬆️
... and 80 more

Bumps [omniauth](https://github.com/omniauth/omniauth) and [omniauth-github](https://github.com/intridea/omniauth-github). These dependencies needed to be updated together. Updates `omniauth` from 1.9.1 to 2.0.4 - [Release notes](https://github.com/omniauth/omniauth/releases) - [Commits](omniauth/omniauth@v1.9.1...v2.0.4) Updates `omniauth-github` from 1.4.0 to 2.0.0 - [Release notes](https://github.com/intridea/omniauth-github/releases) - [Commits](omniauth/omniauth-github@v1.4.0...v2.0.0) --- updated-dependencies: - dependency-name: omniauth dependency-type: direct:production update-type: version-update:semver-major - dependency-name: omniauth-github dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>

github-actions · 2022-02-04T22:11:07Z

This pull request generated screenshots of many common pages in the running app. You should be able to download and view them here:
https://github.com/noi5e/plots2/suites/5185426658/artifacts/157688010

dependabot bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Jun 6, 2021

dependabot bot mentioned this pull request Jun 6, 2021

Bump omniauth from 1.9.0 to 1.9.1 #21

Closed

dependabot bot force-pushed the dependabot/bundler/omniauth-and-omniauth-github-2.0.4 branch from 3d2dcff to ad7e7d4 Compare July 12, 2021 18:08

dependabot bot force-pushed the dependabot/bundler/omniauth-and-omniauth-github-2.0.4 branch from ad7e7d4 to 46d3643 Compare July 19, 2021 02:23

dependabot bot force-pushed the dependabot/bundler/omniauth-and-omniauth-github-2.0.4 branch from 46d3643 to 108f1e6 Compare February 4, 2022 21:40

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump omniauth and omniauth-github #25

Bump omniauth and omniauth-github #25

dependabot bot commented on behalf of github Jun 6, 2021 •

edited

Loading

codecov-commenter commented Jul 12, 2021 •

edited

Loading

github-actions bot commented Feb 4, 2022

Bump omniauth and omniauth-github #25

Are you sure you want to change the base?

Bump omniauth and omniauth-github #25

Conversation

dependabot bot commented on behalf of github Jun 6, 2021 • edited Loading

v2.0.4

Fix rescuing of application errors when call_app! is used.

Fix for incorrect order of request_validation_phase in test_mode.

Allow passing rack-protection configuration to default request_validation_phase

v2.0.0

OmniAuth now defaults to only POST as the allowed request_phase method.

Rack/Sinatra

Require OmniAuth 2.0.0

codecov-commenter commented Jul 12, 2021 • edited Loading

Codecov Report

github-actions bot commented Feb 4, 2022

dependabot bot commented on behalf of github Jun 6, 2021 •

edited

Loading

codecov-commenter commented Jul 12, 2021 •

edited

Loading