[dependabot]

Bumps omniauth from 2.1.4 to 2.3.1.

Changelog

Sourced from omniauth's changelog.

[2.3.1] - 2026-10-22

Fixed

• remember_sign_in no longer raises KeyError when called outside the request phase, before omniauth.params is stored, as when a provider gem's specs call authorize_params directly.

[2.3.0] - 2026-10-22

Added

• Let strategies keep the origin and params of several sign-ins in progress at once, for example in several tabs, so each callback gets its own instead of the latest sign-in's. A strategy opts in by calling remember_sign_in in its request phase with a value the provider sends back, such as OAuth 2.0's state, and overriding callback_sign_in_key. The latest 5 are stored in session['omniauth.sign_ins'], and omniauth.origin and omniauth.params still hold the latest one. See the README. (omniauth-oauth2#195)

Changed

• The gem no longer includes CHANGELOG.md, which was about half its size. Its changelog_uri links to the changelog on GitHub.

[2.2.0] - 2026-10-22

Added

• Add a full_host option for each strategy, as a string or a proc that takes the Rack env. It takes precedence over OmniAuth.config.full_host. (#835)
• Ship RBS type signatures for OmniAuth in sig/.
• Document the Rack env keys OmniAuth sets, CSRF protection, sending origin as a form field, and how SameSite session cookies affect the callback in the README. (#909, #1075, #1048, #1149)
• Add this changelog.

Changed

• omniauth.params now includes params posted to the request phase's form, not just its query string, so they survive the POST-only request phase introduced in 2.0. The authenticity_token param is never included (see CVE-2017-18076 under 1.3.2). If your request form posts other fields, they now appear in omniauth.params and are stored in the session until the callback. (#975)
• OmniAuth::Builder builds its middleware stack on the first request and reuses it, instead of rebuilding every strategy on every request. Providers added after the first request are ignored. (#1083, #970)
• Strategy#call sends a request that isn't on the strategy's request or callback path straight to the app, instead of duplicating the strategy for it. It still duplicates it in test mode, with an other_phase, with path lambdas, or when the strategy overrides how #call! dispatches. Methods patched directly onto OmniAuth::Strategy, rather than overridden in a subclass, aren't detected, so a patched #call! no longer runs for requests outside the strategy's paths. (#1172)
• Require Ruby 2.5 or later (was 2.2). (#1167)
• Require Rack 2.2.8 or later (was 2.2.3), rack-protection 2.2.0 or later, and hashie 3.5.2 or later (was 3.4.6).
• The gem now contains only lib, sig, the license, the README, the changelog, and the security policy.

Fixed

• Run the before_callback_phase hook for mocked failures in test mode, as for real callbacks. (#1043, #1171)
• Recognize callback paths with a format suffix, such as /auth/:provider/callback.json. (#618, #1170)
• Don't fail callbacks when the app defines a method named uid, info, credentials, or extra on Object. (#898, #1169)
• Don't add a calculated name to the info hash subsets returned by slice, except, select, and reject. (#892, #1168)
• Collapse repeated slashes in the request path, as Rails routing does, so //auth/:provider from a misconfigured proxy reaches the strategy. (#1079)
• Avoid "instance variable not initialized" warnings on Ruby before 3.0.

Security

• Guard against forged hosts in callback URLs. Unless a full_host is set, OmniAuth builds the callback URL it sends to the provider from the request's Host, X-Forwarded-Host, or Forwarded header, which a client can forge. The new OmniAuth.config.allowed_hosts, a list of strings and regexps, makes the request and callback phases fail with invalid_host unless the request's host matches one of them. Until full_host or allowed_hosts is set, the request phase logs a warning. The README's full_host example, which copied the Host header, is fixed. (GHSA-m27g-v28p-f9fx, CVE-2026-63183)
• Run request_validation_phase before writing omniauth.params to the session, so a cross-site POST rejected by the authenticity check can no longer store attacker-controlled params. (#1162)

Commits

• 5813803 Release 2.3.1
• dde1f86 Let remember_sign_in run before omniauth.params is stored
• 9db25e1 Release 2.3.0
• d9f73a0 Require json in the sign-ins spec
• 4905b90 Let strategies keep several sign-ins' origins apart
• 8dc4b1e Stop shipping CHANGELOG.md in the gem
• 474bc91 Make rake release tag and push without pushing the gem
• 0d38078 Release 2.2.0
• 943b44f Add allowed_hosts to guard against forged hosts
• a241c94 Make the shipped signatures loadable from other gems
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Looks like omniauth is up-to-date now, so this is no longer needed.