[dependabot]

Bumps omniauth from 2.1.4 to 2.2.0.

Changelog

Sourced from omniauth's changelog.

[2.2.0] - 2026-10-22

Added

• Add a full_host option for each strategy, as a string or a proc that takes the Rack env. It takes precedence over OmniAuth.config.full_host. (#835)
• Ship RBS type signatures for OmniAuth in sig/.
• Document the Rack env keys OmniAuth sets, CSRF protection, sending origin as a form field, and how SameSite session cookies affect the callback in the README. (#909, #1075, #1048, #1149)
• Add this changelog.

Changed

• omniauth.params now includes params posted to the request phase's form, not just its query string, so they survive the POST-only request phase introduced in 2.0. The authenticity_token param is never included (see CVE-2017-18076 under 1.3.2). If your request form posts other fields, they now appear in omniauth.params and are stored in the session until the callback. (#975)
• OmniAuth::Builder builds its middleware stack on the first request and reuses it, instead of rebuilding every strategy on every request. Providers added after the first request are ignored. (#1083, #970)
• Strategy#call sends a request that isn't on the strategy's request or callback path straight to the app, instead of duplicating the strategy for it. It still duplicates it in test mode, with an other_phase, with path lambdas, or when the strategy overrides how #call! dispatches. Methods patched directly onto OmniAuth::Strategy, rather than overridden in a subclass, aren't detected, so a patched #call! no longer runs for requests outside the strategy's paths. (#1172)
• Require Ruby 2.5 or later (was 2.2). (#1167)
• Require Rack 2.2.8 or later (was 2.2.3), rack-protection 2.2.0 or later, and hashie 3.5.2 or later (was 3.4.6).
• The gem now contains only lib, sig, the license, the README, the changelog, and the security policy.

Fixed

• Run the before_callback_phase hook for mocked failures in test mode, as for real callbacks. (#1043, #1171)
• Recognize callback paths with a format suffix, such as /auth/:provider/callback.json. (#618, #1170)
• Don't fail callbacks when the app defines a method named uid, info, credentials, or extra on Object. (#898, #1169)
• Don't add a calculated name to the info hash subsets returned by slice, except, select, and reject. (#892, #1168)
• Collapse repeated slashes in the request path, as Rails routing does, so //auth/:provider from a misconfigured proxy reaches the strategy. (#1079)
• Avoid "instance variable not initialized" warnings on Ruby before 3.0.

Security

• Guard against forged hosts in callback URLs. Unless a full_host is set, OmniAuth builds the callback URL it sends to the provider from the request's Host, X-Forwarded-Host, or Forwarded header, which a client can forge. The new OmniAuth.config.allowed_hosts, a list of strings and regexps, makes the request and callback phases fail with invalid_host unless the request's host matches one of them. Until full_host or allowed_hosts is set, the request phase logs a warning. The README's full_host example, which copied the Host header, is fixed. (GHSA-m27g-v28p-f9fx, CVE-2026-63183)
• Run request_validation_phase before writing omniauth.params to the session, so a cross-site POST rejected by the authenticity check can no longer store attacker-controlled params. (#1162)

Commits

• 0d38078 Release 2.2.0
• 943b44f Add allowed_hosts to guard against forged hosts
• a241c94 Make the shipped signatures loadable from other gems
• 01142e0 Remove Tidelift from the README, funding, and security policy
• 6a77c9b Use the mutant 0.17.1 release
• 3420866 Mark the dispatch check private and note patched methods
• 1ee5e75 Skip duplicating the strategy for requests that aren't its own
• 84a4774 Update the copyright year and list every gem owner as an author
• b74232c Don't depend on the OS's wording of ECONNREFUSED in a spec
• 8b4e509 Test on Windows and let unreleased Rubies fail
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Test coverage

94.18% line coverage reported by SimpleCov.
Run: https://github.com/RaspberryPiFoundation/editor-api/actions/runs/42807567463

[macroscopeapp]

Approvability

Verdict: Would Approve

Macroscope's review found this PR approvable — OmniAuth now uses the configured application origin for callback URLs, reducing reliance on client-controlled host headers. Production already requires that configuration, and the test job now supplies it; the existing correctness finding remains subject to the separate blocking gate.

Needs human approval because:

• approvability is in preview mode for this repository — Macroscope would have approved this PR outside preview mode

Notes:

• This comment was updated automatically after the outstanding correctness findings were resolved. Macroscope did not re-review the code.

^{You can add or adjust custom eligibility rules. Learn more.}