[openstreetmap/openstreetmap-website] Bump the dependencies group with 2 updates (PR #7181)

Wed Jun 24 23:16:28 UTC 2026

Bumps the dependencies group with 2 updates: [doorkeeper-openid_connect](https://github.com/doorkeeper-gem/doorkeeper-openid_connect) and [cgi](https://github.com/ruby/cgi).

Updates `doorkeeper-openid_connect` from 1.10.1 to 1.10.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/doorkeeper-gem/doorkeeper-openid_connect/releases">doorkeeper-openid_connect's releases</a>.</em></p>
<blockquote>
<h2>v1.10.3</h2>
<ul>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/308">#308</a> Fix <code>NameError: uninitialized constant Auth::ApplicationRecord</code> on boot when using a namespaced custom access grant model (e.g. <code>Auth::OAuthAccessGrant < ApplicationRecord</code>). Since v1.10.0 (<a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/241">#241</a>) the <code>openid_request</code> association was wired inside an <code>ActiveSupport.on_load(:active_record)</code> block, which fires while <code>ActiveRecord::Base</code> is first loaded and constantizes the grant model too early. The association is now added from Doorkeeper's <code>AccessGrant</code> mixin <code>included</code> callback — at the model's own load time, without constantizing — mirroring the fix doorkeeper made in <a href="https://redirect.github.com/doorkeeper-gem/doorkeeper/pull/1830">#1830</a> (<a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/306">#306</a>)</li>
</ul>
<h2>v1.10.2</h2>
<ul>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/315">#315</a> Drop support for EOL Ruby 3.1 (EOL 2025-03-25) and require Ruby <code>>= 3.2</code>. <code>i18n 1.15.0</code> uses the <code>Fiber[]</code> storage API which only exists on Ruby 3.2+, so the Ruby 3.1 CI row no longer loads; the matrix now tests Ruby 3.2 as the minimum</li>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/316">#316</a> Set <code>fail-fast: false</code> in CI matrix so a single failing job no longer cancels the rest</li>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/303">#303</a> execute account selection even without owner, and <code>select_account_for_resource_owner</code> can now receive <code>nil</code> as the first argument.</li>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/304">#304</a> allow handle auth_time per grant</li>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/305">#305</a> Document the <code>auth_time_from_access_token</code> config option in the README (per-grant <code>auth_time</code>), clarifying that it only affects the ID Token <code>auth_time</code> claim and not <code>max_age</code> enforcement</li>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/307">#307</a> Fix <code>bundle exec rake server</code> for the test application</li>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/313">#313</a> Move Configuration documentation from README to Wiki</li>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/312">#312</a> Raise <code>Errors::MissingRequiredClaim</code> instead of silently dropping a blank REQUIRED ID Token claim (<code>iss</code>/<code>sub</code>/<code>aud</code>/<code>exp</code>/<code>iat</code>) in <code>IdToken#as_json</code>, which previously could emit a non-conformant ID Token (OIDC Core 1.0 §2). OPTIONAL claims such as <code>nonce</code>/<code>auth_time</code> are still omitted when blank</li>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/311">#311</a> Include the REQUIRED <code>client_secret_expires_at</code> member (value <code>0</code>, never expires) in the Dynamic Client Registration response whenever a <code>client_secret</code> is issued (RFC 7591 §3.2.1 / OpenID Connect Dynamic Client Registration 1.0 §3.2)</li>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/309">#309</a> Add a browser dashboard to the test application (<code>spec/dummy</code>) for exercising the OpenID Connect endpoints by hand — replacing the rails console + curl workflow with forms for Setup, Discovery, Authorization (code / implicit / PKCE / nonce / prompt / <code>max_age</code>), token exchange, UserInfo, introspection and revocation</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/doorkeeper-gem/doorkeeper-openid_connect/blob/master/CHANGELOG.md">doorkeeper-openid_connect's changelog</a>.</em></p>
<blockquote>
<h2>v1.10.3 (2026-06-23)</h2>
<ul>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/308">#308</a> Fix <code>NameError: uninitialized constant Auth::ApplicationRecord</code> on boot when using a namespaced custom access grant model (e.g. <code>Auth::OAuthAccessGrant < ApplicationRecord</code>). Since v1.10.0 (<a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/241">#241</a>) the <code>openid_request</code> association was wired inside an <code>ActiveSupport.on_load(:active_record)</code> block, which fires while <code>ActiveRecord::Base</code> is first loaded and constantizes the grant model too early. The association is now added from Doorkeeper's <code>AccessGrant</code> mixin <code>included</code> callback — at the model's own load time, without constantizing — mirroring the fix doorkeeper made in <a href="https://redirect.github.com/doorkeeper-gem/doorkeeper/pull/1830">#1830</a> (<a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/306">#306</a>)</li>
</ul>
<h2>v1.10.2 (2026-06-22)</h2>
<ul>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/315">#315</a> Drop support for EOL Ruby 3.1 (EOL 2025-03-25) and require Ruby <code>>= 3.2</code>. <code>i18n 1.15.0</code> uses the <code>Fiber[]</code> storage API which only exists on Ruby 3.2+, so the Ruby 3.1 CI row no longer loads; the matrix now tests Ruby 3.2 as the minimum</li>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/316">#316</a> Set <code>fail-fast: false</code> in CI matrix so a single failing job no longer cancels the rest</li>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/303">#303</a> execute account selection even without owner, and <code>select_account_for_resource_owner</code> can now receive <code>nil</code> as the first argument.</li>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/304">#304</a> allow handle auth_time per grant</li>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/305">#305</a> Document the <code>auth_time_from_access_token</code> config option in the README (per-grant <code>auth_time</code>), clarifying that it only affects the ID Token <code>auth_time</code> claim and not <code>max_age</code> enforcement</li>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/307">#307</a> Fix <code>bundle exec rake server</code> for the test application</li>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/313">#313</a> Move Configuration documentation from README to Wiki</li>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/312">#312</a> Raise <code>Errors::MissingRequiredClaim</code> instead of silently dropping a blank REQUIRED ID Token claim (<code>iss</code>/<code>sub</code>/<code>aud</code>/<code>exp</code>/<code>iat</code>) in <code>IdToken#as_json</code>, which previously could emit a non-conformant ID Token (OIDC Core 1.0 §2). OPTIONAL claims such as <code>nonce</code>/<code>auth_time</code> are still omitted when blank</li>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/311">#311</a> Include the REQUIRED <code>client_secret_expires_at</code> member (value <code>0</code>, never expires) in the Dynamic Client Registration response whenever a <code>client_secret</code> is issued (RFC 7591 §3.2.1 / OpenID Connect Dynamic Client Registration 1.0 §3.2)</li>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/309">#309</a> Add a browser dashboard to the test application (<code>spec/dummy</code>) for exercising the OpenID Connect endpoints by hand — replacing the rails console + curl workflow with forms for Setup, Discovery, Authorization (code / implicit / PKCE / nonce / prompt / <code>max_age</code>), token exchange, UserInfo, introspection and revocation</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/doorkeeper-gem/doorkeeper-openid_connect/commit/0de04e0ea6db49fa17d211535090a5d71c268da2"><code>0de04e0</code></a> Merge pull request <a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/319">#319</a> from 55728/release/v1.10.3</li>
<li><a href="https://github.com/doorkeeper-gem/doorkeeper-openid_connect/commit/83c16825fca334264b8722c2e0f4316c5bf15660"><code>83c1682</code></a> Release 1.10.3 🎉</li>
<li><a href="https://github.com/doorkeeper-gem/doorkeeper-openid_connect/commit/e4eaff659926819e375cf5adbd792b10b8861d96"><code>e4eaff6</code></a> Merge pull request <a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/308">#308</a> from 55728/fix/306-remove-on-load-active-record</li>
<li><a href="https://github.com/doorkeeper-gem/doorkeeper-openid_connect/commit/dba2c846dc032eba85593180094b5219699bd88f"><code>dba2c84</code></a> Merge pull request <a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/318">#318</a> from 55728/release/v1.10.2</li>
<li><a href="https://github.com/doorkeeper-gem/doorkeeper-openid_connect/commit/58eede21ccc337364391ca0bfd80fb6db16714e3"><code>58eede2</code></a> Merge pull request <a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/309">#309</a> from 55728/feature/dummy-oidc-dashboard</li>
<li><a href="https://github.com/doorkeeper-gem/doorkeeper-openid_connect/commit/967648d4d8c2d2cfec81f5a1850fb5f7e21ff303"><code>967648d</code></a> Release 1.10.2 🎉</li>
<li><a href="https://github.com/doorkeeper-gem/doorkeeper-openid_connect/commit/25ab03892be8be65fa85b1adaba7cd853cabe748"><code>25ab038</code></a> Merge pull request <a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/316">#316</a> from 55728/ci/fail-fast-false</li>
<li><a href="https://github.com/doorkeeper-gem/doorkeeper-openid_connect/commit/149c3638e711e1efdf48423054bde8fa48391e02"><code>149c363</code></a> Merge pull request <a href="https://redirect.github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/315">#315</a> from 55728/fix/314-drop-ruby-3.1</li>
<li><a href="https://github.com/doorkeeper-gem/doorkeeper-openid_connect/commit/f4e9caa2e4466b84214121cf152c15b2fe475464"><code>f4e9caa</code></a> Set fail-fast: false in CI matrix</li>
<li><a href="https://github.com/doorkeeper-gem/doorkeeper-openid_connect/commit/808c76c9d788fc4c706d090c89fd868a0bb21490"><code>808c76c</code></a> Drop EOL Ruby 3.1, require Ruby >= 3.2</li>
<li>Additional commits viewable in <a href="https://github.com/doorkeeper-gem/doorkeeper-openid_connect/compare/v1.10.1...v1.10.3">compare view</a></li>
</ul>
</details>
<br />

Updates `cgi` from 0.5.1 to 0.5.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/ruby/cgi/releases">cgi's releases</a>.</em></p>
<blockquote>
<h2>v0.5.2</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>Improve readme copy/paste + update URLs to HTTPS by <a href="https://github.com/tas50"><code>@tas50</code></a> in <a href="https://redirect.github.com/ruby/cgi/pull/101">ruby/cgi#101</a></li>
<li>Add changelog URI to cgi.gemspec metadata by <a href="https://github.com/phallstrom"><code>@phallstrom</code></a> in <a href="https://redirect.github.com/ruby/cgi/pull/105">ruby/cgi#105</a></li>
<li>Fix escape_html/h aliases to use C extension instead of pure Ruby fallback by <a href="https://github.com/ianks"><code>@ianks</code></a> in <a href="https://redirect.github.com/ruby/cgi/pull/110">ruby/cgi#110</a></li>
<li>[DOC] More on CGI.new by <a href="https://github.com/BurdetteLamar"><code>@BurdetteLamar</code></a> in <a href="https://redirect.github.com/ruby/cgi/pull/95">ruby/cgi#95</a></li>
<li>[DOC] Doc for CGI#http_header by <a href="https://github.com/BurdetteLamar"><code>@BurdetteLamar</code></a> in <a href="https://redirect.github.com/ruby/cgi/pull/98">ruby/cgi#98</a></li>
<li>[DOC] Doc for accept_charset and accept_charset= by <a href="https://github.com/BurdetteLamar"><code>@BurdetteLamar</code></a> in <a href="https://redirect.github.com/ruby/cgi/pull/97">ruby/cgi#97</a></li>
<li>[DOC] Fix examples in accept_charset and http_header docs by <a href="https://github.com/hsbt"><code>@hsbt</code></a> in <a href="https://redirect.github.com/ruby/cgi/pull/125">ruby/cgi#125</a></li>
<li>Add 'digest' option by <a href="https://github.com/nobu"><code>@nobu</code></a> in <a href="https://redirect.github.com/ruby/cgi/pull/62">ruby/cgi#62</a></li>
<li>Handle POST without Content-Length by <a href="https://github.com/hsbt"><code>@hsbt</code></a> in <a href="https://redirect.github.com/ruby/cgi/pull/126">ruby/cgi#126</a></li>
<li>Fix CGI.unescapeHTML CompatibilityError in the pure-Ruby fallback by <a href="https://github.com/hsbt"><code>@hsbt</code></a> in <a href="https://redirect.github.com/ruby/cgi/pull/127">ruby/cgi#127</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/tas50"><code>@tas50</code></a> made their first contribution in <a href="https://redirect.github.com/ruby/cgi/pull/101">ruby/cgi#101</a></li>
<li><a href="https://github.com/phallstrom"><code>@phallstrom</code></a> made their first contribution in <a href="https://redirect.github.com/ruby/cgi/pull/105">ruby/cgi#105</a></li>
<li><a href="https://github.com/ianks"><code>@ianks</code></a> made their first contribution in <a href="https://redirect.github.com/ruby/cgi/pull/110">ruby/cgi#110</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/ruby/cgi/compare/v0.5.1...v0.5.2">https://github.com/ruby/cgi/compare/v0.5.1...v0.5.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/ruby/cgi/commit/bbfac8902e82e5419a7bdb62512aa68bfafa7979"><code>bbfac89</code></a> v0.5.2</li>
<li><a href="https://github.com/ruby/cgi/commit/09970b06d3286108a885a459c5fe078565b960fb"><code>09970b0</code></a> Fix unescapeHTML CompatibilityError in pure-Ruby fallback</li>
<li><a href="https://github.com/ruby/cgi/commit/23f26a07db459197a4b7d2212f3c53f17e246e22"><code>23f26a0</code></a> Handle POST without Content-Length</li>
<li><a href="https://github.com/ruby/cgi/commit/2af5afaaf1de421659db4d9b107dc47fd461d6aa"><code>2af5afa</code></a> Add <code>length</code> option</li>
<li><a href="https://github.com/ruby/cgi/commit/128feb5fb6eed9ae490123897f7661518199a301"><code>128feb5</code></a> Improve tests</li>
<li><a href="https://github.com/ruby/cgi/commit/bff5bbb109f0f5de5aa70bf6681de693ed96f7fe"><code>bff5bbb</code></a> Allow digest classes as the digest for store path</li>
<li><a href="https://github.com/ruby/cgi/commit/5e979c426dce2b71b310d520198b502ee4162012"><code>5e979c4</code></a> Add 'digest' option</li>
<li><a href="https://github.com/ruby/cgi/commit/240684037a340f92f404ed7f020243e1562a098b"><code>2406840</code></a> Separate each test methods</li>
<li><a href="https://github.com/ruby/cgi/commit/3ef24099e573a22d104bff4ad9ff4fa2126ee769"><code>3ef2409</code></a> [DOC] Fix wording in CGI#http_header</li>
<li><a href="https://github.com/ruby/cgi/commit/3ca9d12c818f86e342e78c14387bc1e76fa24c69"><code>3ca9d12</code></a> [DOC] Fix accept_charset default value in examples</li>
<li>Additional commits viewable in <a href="https://github.com/ruby/cgi/compare/v0.5.1...v0.5.2">compare view</a></li>
</ul>
</details>
<br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions

</details>
You can view, comment on, or merge this pull request online at:

  https://github.com/openstreetmap/openstreetmap-website/pull/7181

-- Commit Summary --

  * Bump the dependencies group with 2 updates

-- File Changes --

    M Gemfile.lock (10)

-- Patch Links --

https://github.com/openstreetmap/openstreetmap-website/pull/7181.patch
https://github.com/openstreetmap/openstreetmap-website/pull/7181.diff

-- 
Reply to this email directly or view it on GitHub:
https://github.com/openstreetmap/openstreetmap-website/pull/7181
You are receiving this because you are subscribed to this thread.

Message ID: <openstreetmap/openstreetmap-website/pull/7181 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstreetmap.org/pipermail/rails-dev/attachments/20260624/4277eac5/attachment-0001.htm>