Bump omniauth, rack-cors, rack-attack, sidekiq, rails, activeadmin and omniauth-github

[dependabot]

Bumps omniauth, rack-cors, rack-attack, sidekiq, rails, activeadmin and omniauth-github. These dependencies needed to be updated together.
Updates omniauth from 1.9.2 to 2.1.1

Release notes

Sourced from omniauth's releases.

v2.1.0

This release adds Ruby 3.0+ support.

Due to kwarg changes in ruby 3, we have bumped the minimum required version of Rack to 2.2.3, which is where ruby3 support was added.

Releasing as a minor as dependency resolution should fail at install if an application is locked to a rack below new minimum.

Full Changelog: omniauth/omniauth@v2.0.4...v2.1.0

v2.0.4

This release removes unnecessary warning logging when accessing GET routes that are not related to the OmniAuth request path.

Thanks to @​charlie-wasp and @​sponomarev at Evil Martians for the bug find and subsequent PR.

Fix rescuing of application errors when call_app! is used.

As a consequence of the changes that were merged in #689, errors thrown by strategies that utilize other_phase (or more specifically call_app!), would be caught by omniauth, causing headaches for folks looking to have those errors handled by their application. This should allow for errors that come from the app to pass through, while passing errors that come from the authentication phases to the fail! handler.

Resolves #1030

Fix for incorrect order of request_validation_phase in test_mode.

@​jsdalton gave an awesome report of the issue present in test_mode in #1033

The current implementation of mock_call was verifying the token for all requests, regardless of whether the current path is on the omniauth request path. The change was introduced recently in 1b784ff. See #1032 for details.

This creates two problems:

1. When test mode is on, the authenticity verification logic is run inappropriately against requests where this may not even be wanted.
2. The behavior varies from actual production behavior, potentially allowing bugs to be introduced by unwary developers.

Note that this bug was only present when OmniAuth was configured for test_mode and using the mock_call phases.

Allow passing rack-protection configuration to default request_validation_phase

This release now properly allows an instance of OmniAuth::AuthenticityTokenProtection (with passed in rack-protection configuration) to be used as the request_validation_phase.

Thanks @​jkowens #1027

If you haven't already read the release notes for v2.0.0, you should do so.

v2.0.0

Version 2.0 of OmniAuth includes some changes that may be breaking depending on how you use OmniAuth in your app.

Many thanks to the folks who contributed in code and discussion for these changes.

OmniAuth now defaults to only POST as the allowed request_phase method.

Hopefully, you were already doing this as a result of the warnings due to CVE-2015-9284.

... (truncated)

Commits

• d2fd0fc v2.1.1 release
• f66dd2d Merge pull request #1092 from shreyakurian02/fix_nil_error_in_callback_path
• dece21b Fixed nil error in callback_path
• 7d90ba2 Update SECURITY.md
• 66110da Merge pull request #1070 from HoneyryderChuck/patch-1
• 7413f4f Added docs showing how to integrate omniauth with rack_csrf
• f35c0bb Fix badges
• 1df974b Merge pull request #1065 from omniauth/new-CI-workflows
• 56b369f Update badges
• dce31d7 Separate jruby and truffle ruby workflows
• Additional commits viewable in compare view

Updates rack-cors from 1.0.6 to 2.0.0

Changelog

Sourced from rack-cors's changelog.

2.0.0 - 2023-02-14

Changed

• Refactored codebase
• Support declaring custom protocols in origin
• Lowercased header names as defined by Rack spec
• Fix issue with duplicate headers because of header name case

1.1.1 - 2019-12-29

Changed

• Allow //* to match // and / paths

1.1.0 - 2019-11-19

Changed

• Use Rack::Utils.escape_path instead of Rack::Utils.escape
• Require Rack 2.0 for escape_path method
• Don't try to clean path if invalid.
• Return 400 (Bad Request) on preflights with invalid path

Commits

• 97882eb Support custom protocols as origins
• 70f9126 README: Exampe for start & end string anchors
• 908ea29 Remove incorrect wildcard usage from README
• b718a19 Update Rails6 example
• 3b6b5af Update rack example
• a37c33e Update Rails5 example
• d83baa7 Link to SO about testing CORS
• 47af8a8 Updates to note common issues.
• 43a1882 Update .travis.yml
• b528e2b Update README.md
• Additional commits viewable in compare view

Updates rack-attack from 6.0.0 to 6.6.1

Release notes

Sourced from rack-attack's releases.

v6.6.1

Details in CHANGELOG entry.

v6.6.0

Details in CHANGELOG entry.

v6.5.0

Details in CHANGELOG entry.

v6.4.0

Details in CHANGELOG entry.

v6.2.2

Fixed

• Fixed occasional Redis::FutureNotReady error (#445) (@​fatkodima)

v6.2.1

Fixed

• Remove unintended side-effects on Rails app initialization order. It was potentially affecting the order of config/initializers/* in respect to gems initializers (#457)

v6.2.0

Added

• Failsafe on Redis error replies in RedisCacheStoreProxy (#421) (@​cristiangreco)
• Rack::Attack middleware is now auto added for Rails 5.1+ apps to simplify gem setup (#431) (@​fatkodima)
• You can disable Rack::Attack with Rack::Attack.enabled = false (#431) (@​fatkodima)

v6.1.0

Added

• Provide throttle discriminator in the env throttle_data

Changelog

Sourced from rack-attack's changelog.

[6.6.1] - 2022-04-14

Fixed

• Fixes deprecation warning in redis 4.6+ ([@​ixti])

[6.6.0] - 2022-01-29

Added

• Ability to have access to the request object instead of only env (still can access env with request.env) when customizing throttle and blocklist responses with new methods Rack::Attack.blocklisted_responder= and Rack::Attack.throttled_responder= which yield the request to your lambda. ([@​NikolayRys])

Deprecated

• Rack::Attack.blocklisted_response=
• Rack::Attack.throttled_response=

[6.5.0] - 2021-02-07

Added

• Added ability to normalize throttle discriminator by setting Rack::Attack.throttle_discriminator_normalizer (@​fatkodima)

  Example:

  Rack::Attack.throttle_discriminator_normalizer = ->(discriminator) { ... }
  

  or disable default normalization with:

  Rack::Attack.throttle_discriminator_normalizer = nil
  

Removed

• Dropped support for ruby v2.4
• Dropped support for rails v5.1

[6.4.0] - 2021-01-23

Added

• Added support for ruby v3.0

Removed

• Dropped support for ruby v2.3

[6.3.1] - 2020-05-21

... (truncated)

Commits

• f5f92f4 Bump gem version to v6.6.1
• 07822ad ci: update rubies
• b0be383 Merge pull request #575 from sixpark/adriancb/update_readme
• 8313e38 fix(documentation): Updating README with non-deprecated configuration.
• 933c057 Lower case headers. (#573)
• d41abd7 Merge pull request #572 from ixti/ixti/fix-redis-4.6.0-warnings
• c01208a fix: Fix redis-rb 4.6.0 deprecation warnings
• 8218132 docs: update docs to point to main branch
• d0ec4de Bump gem version to v6.6.0
• 3eca60d Merge pull request #556 from zarqman/dalli3-and-rails7
• Additional commits viewable in compare view

Updates sidekiq from 6.2.1 to 7.0.6

Changelog

Sourced from sidekiq's changelog.

7.0.5,7.0.6

• More context for debugging json unsafe errors #5787

7.0.4

• Performance and memory optimizations [#5768, fatkodima]
• Add 1-8 hour period selector to Metrics pages #5694
• Fix process display with sidekiqmon #5733

7.0.3

• Don't warn about memory policy on Redis Enterprise #5712
• Don't allow Quiet/Stop on embedded Sidekiq instances #5716
• Fix size: X for configuring the default Redis pool size #5702
• Improve the display of queue weights on Busy page #5642
• Freeze CurrentAttributes on a job once initially set #5692

7.0.2

• Improve compatibility with custom loggers #5673
• Add queue weights on Busy page #5640
• Add BID link on job_info page if job is part of a Batch #5623
• Allow custom extensions to add rows/links within Job detail pages #5624

Sidekiq::Web.custom_job_info_rows << AddAccountLink.new
class AddAccountLink
include CGI::Util
def add_pair(job)
# yield a (name, value) pair
# You can include HTML tags and CSS, Sidekiq does not do any
# escaping so beware user data injection! Note how we use CGI's
# h escape helper.
aid = job["account_id"]
yield "Account", "<a href='/accounts/#{h aid}'>#{h aid}</a>" if aid
end
end

7.0.1

• Allow an embedding process to reuse its own heartbeat thread
• Update zh-cn localization

... (truncated)

Commits

• b292bc0 prep for release
• 1813cbd 5793
• 404827a Handle correctly subclasses when finding json unsafe item
• 0b753ff changes
• 0592931 changes
• cbfa0f6 Fix detecting json unsafe item within job arguments
• a552633 Improve error message when checking arguments for json safety
• 4c101d2 release
• a703890 move perf lower
• 6bd03aa Change all repo links from mperham/sidekiq to sidekiq/sidekiq
• Additional commits viewable in compare view

Updates rails from 5.2.6 to 5.2.8.1

Release notes

Sourced from rails's releases.

5.2.8.1

Active Support

• No changes.

Active Model

• No changes.

Active Record

• Change ActiveRecord::Coders::YAMLColumn default to safe_load

  This adds two new configuration options The configuration options are as follows:

  • config.active_storage.use_yaml_unsafe_load

  When set to true, this configuration option tells Rails to use the old "unsafe" YAML loading strategy, maintaining the existing behavior but leaving the possible escalation vulnerability in place. Setting this option to true is not recommended, but can aid in upgrading.

  • config.active_record.yaml_column_permitted_classes

  The "safe YAML" loading method does not allow all classes to be deserialized by default. This option allows you to specify classes deemed "safe" in your application. For example, if your application uses Symbol and Time in serialized data, you can add Symbol and Time to the allowed list as follows:

  config.active_record.yaml_column_permitted_classes = [Symbol, Date, Time]
  

  [CVE-2022-32224]

Action View

• No changes.

Action Pack

... (truncated)

Commits

• 8030cff Preparing for 5.2.8.1 release
• 85b72c3 Ruby 3.1 compatibility
• ec10235 updating version and changelog
• 6576aa7 Change ActiveRecord::Coders::YAMLColumn default to safe_load
• 2652133 Preparing for 5.2.8 release
• a1b8a9b Merge pull request #45027 from rails/fix-tag-helper-regression
• cfef5e9 Merge pull request #44966 from fallwith/patch-1
• cd9d9f0 retain Ruby 2.2 compatibility for Rails 5.2
• 9f3761a Merge branch '5-2-sec' into 5-2-stable
• b290430 Preparing for 5.2.7.1 release
• Additional commits viewable in compare view

Updates activeadmin from 1.4.3 to 2.9.0

Release notes

Sourced from activeadmin's releases.

2.9.0

Enhancements

• Support for Rails 6.1. #6548 by [@​deivid-rodriguez]
• Add ability to override "Remove" button text on has_many forms. #6523 by [@​littleforest]
• Drop git in gemspec. #6462 by [@​utkarsh2102]

Bug Fixes

• Pick up upstream fixes in devise templates. #6536 by [@​munen]

Documentation

• Fix has_many syntax in forms documentation. #6583 by [@​krzcho]
• Add example of using default_main_content in show pages. #6487 by [@​sjieg]

Dependency Changes

• Remove sassc and sprockets runtime dependencies. #6584 by [@​deivid-rodriguez]

#1926: activeadmin/activeadmin#1926 #1979: activeadmin/activeadmin#1979 #2001: activeadmin/activeadmin#2001 #2040: activeadmin/activeadmin#2040 #2326: activeadmin/activeadmin#2326 #2523: activeadmin/activeadmin#2523 #2532: activeadmin/activeadmin#2532 #2541: activeadmin/activeadmin#2541 #2544: activeadmin/activeadmin#2544 #2545: activeadmin/activeadmin#2545 #3038: activeadmin/activeadmin#3038 #3075: activeadmin/activeadmin#3075 #3463: activeadmin/activeadmin#3463 #3464: activeadmin/activeadmin#3464 #3486: activeadmin/activeadmin#3486 #3519: activeadmin/activeadmin#3519 #3535: activeadmin/activeadmin#3535 #3553: activeadmin/activeadmin#3553 #3606: activeadmin/activeadmin#3606 #3686: activeadmin/activeadmin#3686 #3695: activeadmin/activeadmin#3695 #3731: activeadmin/activeadmin#3731 #3783: activeadmin/activeadmin#3783 #3894: activeadmin/activeadmin#3894 #4118: activeadmin/activeadmin#4118 #4173: activeadmin/activeadmin#4173 #4187: activeadmin/activeadmin#4187

... (truncated)

Changelog

Sourced from activeadmin's changelog.

2.9.0 ☰

Enhancements

• Support for Rails 6.1. #6548 by [@​deivid-rodriguez]
• Add ability to override "Remove" button text on has_many forms. #6523 by [@​littleforest]
• Drop git in gemspec. #6462 by [@​utkarsh2102]

Bug Fixes

• Pick up upstream fixes in devise templates. #6536 by [@​munen]

Documentation

• Fix has_many syntax in forms documentation. #6583 by [@​krzcho]
• Add example of using default_main_content in show pages. #6487 by [@​sjieg]

Dependency Changes

• Remove sassc and sprockets runtime dependencies. #6584 by [@​deivid-rodriguez]

2.8.1 ☰

Bug Fixes

• Fix permitted_param generation for belongs_to when :param is used. #6460 by [@​deivid-rodriguez]
• Fix streaming CSV export. #6451 by [@​deivid-rodriguez]
• Fix input string filter no rendering dropdown input when its column name ends with a ransack predicate. #6422 by [@​Fivell]

2.8.0 ☰

Enhancements

• Allow using PORO decorators. #6249 by [@​brunvez]
• Make sure ActiveAdmin.routes provides routes in a consistent order. #6124 by [@​jiikko]
• Use proper closing tags for HTML in ModalDialog component. #6221 by [@​javierjulio]

Bug Fixes

• Fix comment layout so regardless of size, each is aligned and spaced evenly. #6393 by [@​Ivanov-Anton]

Translation Improvements

• Fix several Arabic translations. #6368 by [@​mshalaby]
• Add missing scope/all italian translation. #6341 by [@​fuzziness]
• Improve Japanese translation. #6315 by [@​rn0rno]
• Fix es and es-MX sign_in and sign_up translation. #6210 by [@​roramirez]

Documentation

... (truncated)

Commits

• ec5a516 Bump rollup from 2.34.2 to 2.35.0 (#6614)
• c761470 Get ready for 2.9.0 release (#6612)
• e055434 Bump cancancan from 3.1.0 to 3.2.0 (#6609)
• 2c83a39 Bump cancancan from 3.1.0 to 3.2.0 in /gemfiles/rails_60 (#6607)
• 4f755da Bump cancancan from 3.1.0 to 3.2.0 in /gemfiles/rails_52 (#6610)
• 515822e Bump cancancan from 3.1.0 to 3.2.0 in /gemfiles/rails_61_webpacker (#6611)
• 4cd47d1 Bump cancancan from 3.1.0 to 3.2.0 in /gemfiles/rails_61_turbolinks (#6608)
• 388f270 Merge pull request #6606 from activeadmin/bundler_2.2
• 88b5b9c Use latest rubygems
• 029b4c8 Use bundler 2.2.0
• Additional commits viewable in compare view

Updates omniauth-github from 1.4.0 to 2.0.1

Release notes

Sourced from omniauth-github's releases.

Require OmniAuth 2.0.0

As of v2.0.0 of this gem, it will require OmniAuth 2.0.0. This is due to changes that came with OmniAuth that required a breaking change in this gem. Because we changed the strategy's code, you should not need to change any omniauth-github specific code.

You should refer to OmniAuth's v2.0.0 release and/or the v2.0 upgrade guide when upgrading OmniAuth to v2.0.

Commits

• 0ac46b5 Release 2.0.1
• fa3e9cf Merge pull request #102 from jessieay/master
• 684a74a Upgrade omniauth-oauth2 dependency
• 1633cbb Merge pull request #100 from petergoldstein/feature/add_modern_rubies
• 23cfa75 Add Ruby 2.7, 3.0, and 3.1 to the CI matrix
• d2d9e01 Merge pull request #96 from gogainda/patch-1
• 4ac10c7 Update ruby.yml
• f4e28d9 Update ruby.yml
• 027b861 Update ruby.yml
• 1f77226 Merge pull request #95 from BobbyMcWho/chores-2020-01-12
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.