From a4902fbf95dd5bea510ca4b2e3123b4d566e862b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 9 Nov 2026 22:40:56 +0000
Subject: [PATCH 1/2] Bump omniauth from 2.1.4 to 2.2.0

Bumps [omniauth](https://github.com/omniauth/omniauth) from 2.1.4 to 2.2.0.
- [Release notes](https://github.com/omniauth/omniauth/releases)
- [Changelog](https://github.com/omniauth/omniauth/blob/master/CHANGELOG.md)
- [Commits](https://github.com/omniauth/omniauth/compare/v2.1.4...v2.2.0)

---
updated-dependencies:
- dependency-name: omniauth
  dependency-version: 2.2.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Gemfile.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 6fb77666b..e19552554 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -226,7 +226,7 @@ GEM
       activesupport (>= 3.0)
       graphql (>= 1.13.0)
     hashdiff (1.2.1)
-    hashie (5.1.0)
+    hashie (5.2.0)
       logger
     i18n (1.15.2)
       concurrent-ruby (~> 1.0)
@@ -310,11 +310,11 @@ GEM
       rack (>= 1.2, < 4)
       snaky_hash (~> 2.0, >= 2.0.5)
       version_gem (~> 1.1, >= 1.1.11)
-    omniauth (2.1.4)
-      hashie (>= 3.4.6)
+    omniauth (2.2.0)
+      hashie (>= 3.5.2)
       logger
-      rack (>= 2.2.3)
-      rack-protection
+      rack (>= 2.2.8)
+      rack-protection (>= 2.2.0)
     omniauth-oauth2 (1.9.0)
       oauth2 (>= 2.0.2, < 3)
       omniauth (~> 2.0)
@@ -363,7 +363,7 @@ GEM
       nio4r (~> 2.0)
     raabro (1.5.0)
     racc (1.8.1)
-    rack (3.2.7)
+    rack (3.2.8)
     rack-cors (3.0.0)
       logger
       rack (>= 3.0.14)

From 888045bfed6a71f0792cfbe36bac27e65dfeea34 Mon Sep 17 00:00:00 2001
From: Chris Zetter <253059100+zetter-rpf@users.noreply.github.com>
Date: Tue, 10 Nov 2026 11:26:43 +0000
Subject: [PATCH 2/2] Set the full host in OmniAuth

I think we're a lower risk because Rails authorizes hosts, but this is recommended by OmniAuth and we see a warning without it.
---
 .github/workflows/ci.yml        | 1 +
 config/initializers/omniauth.rb | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4e2a18dd9..ae2529d1c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -73,6 +73,7 @@ jobs:
       POSTGRES_PORT: '5432'
       REDIS_URL: redis://127.0.0.1:6379/1
       HOSTNAME: 127.0.0.1
+      HOST_URL: http://127.0.0.1:3000
       ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY: primary-key
       ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT: derivation-salt
       EDITOR_ENCRYPTION_KEY: a1b2c3d4e5f67890123456789abcdef0123456789abcdef0123456789abcdef0
diff --git a/config/initializers/omniauth.rb b/config/initializers/omniauth.rb
index 87d82bb2d..4e288fde1 100644
--- a/config/initializers/omniauth.rb
+++ b/config/initializers/omniauth.rb
@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 OmniAuth.config.logger = Rails.logger
+OmniAuth.config.full_host = ENV.fetch('HOST_URL')
 
 if ENV['BYPASS_OAUTH'].present?
   using RpiAuthBypass