oauth2 2.0.24 → 2.0.26

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6a0de4e6399834238562b52bb7e5c00550453118dfd111cb4bdc58de0e9e6657
-  data.tar.gz: d61082265dbbd08a4554d475fd7b9980f2beeae912e218191911db5dc12e55d5
+  metadata.gz: 362550ce65f2632c09c067acada7e36f37314e59a016257742019e7c4bd8adc2
+  data.tar.gz: e6f9cef5e5980840d428f0a577255555371ab151e66a78dceb1ea9b7a168fa9b
 SHA512:
-  metadata.gz: 9a8cfb81304f9337ea276cbda2741e9d808885b0b301e55dfb9f76fa0f835f636c97e9ab29a896cc4b17e3801c3b9eacca33b520f77d94fe1b67eb9f39c23751
-  data.tar.gz: 93a8e651d24279a9f13b7bc267a19210830d9ed5fb33c79dcb820d998de55b89c4b6a241667945466f7782a11fcf3b3bae00156a697f02505e5a7ac0f3ddeec4
+  metadata.gz: 309b6d12823319c793c211328e78b50da808807aecf7ee27049e2cdc36e252ec63267c8635d61be1015b58b95cea821680bcc65ee65e589a784e1a598561ee7e
+  data.tar.gz: 99d0e680e42243e6f35692826a27ce93f7fd3cc2372b65df4318d6bcef795ad7c9af707c04509fcede27317308d7c9f07272ebe61de1e7eedef44ba69b1d28a8

data/CHANGELOG.md

@@ -30,6 +30,146 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [2.0.26] - 2026-10-25
+
+- TAG: [v2.0.26][2.0.26t]
+- COVERAGE: 98.48% -- 647/657 lines in 16 files
+- BRANCH COVERAGE: 93.48% -- 215/230 branches in 16 files
+- 90.83% documented
+
+### Security
+
+- GHSA-cmh8-5q25-68v6 - OAUTH_DEBUG token-request secrets are redacted; see [gh!769][gh!769]. Reported by iamibi.
+
+- [gh!769][gh!769] - Redact secrets in structured token-request debug bodies, expand the default filtered credential keys, and require `auth-sanitizer` >= 0.2.5 by @makssein
+- [gh!775][gh!775] - Strip Authorization headers, request bodies, and query parameters from cross-origin redirects by @Huge
+- [gh!776][gh!776] - Redact configured sensitive response options from tokenless access-token initialization errors by @Huge
+- GHSA-cmh8-5q25-68v6 - OAUTH_DEBUG token-request secrets are redacted; see [gh!769][gh!769]. Reported by iamibi.
+
+[gh!769]: https://github.com/ruby-oauth/oauth2/pull/769
+[gh!770]: https://github.com/ruby-oauth/oauth2/pull/770
+[gh!775]: https://github.com/ruby-oauth/oauth2/pull/775
+[gh!776]: https://github.com/ruby-oauth/oauth2/pull/776
+
+### Deprecated
+
+- `allow_cross_origin_redirects: true` is deprecated. The default will change to `false` in the next minor release (2.1.0). Set it explicitly to retain the current behavior.
+
+### Added
+
+- kettle-jem-template-20260720-001 - READMEs can now display configured
+  corporate sponsor logos.
+- kettle-jem-template-20260720-005 - README Support & Community links now
+  include RubyForum.
+- kettle-jem-template-20260726-001 - Projects now include YARD lint
+  configuration and documentation dependencies so documentation issues fail
+  before generated docs are refreshed.
+- kettle-jem-template-20260727-001 - Spec harness documentation now lists the
+  RSpec helpers provided by `kettle-test`.
+- kettle-jem-template-20260913-001 - Templating now also surfaces a review
+  entry in `dependency_conflicts.resolve` when a direct development
+  dependency doesn't support one or more of this project's declared
+  `engines:` and has no template-managed modular home (e.g. `sqlite3` on
+  `jruby`). Review each entry and pick a resolution per the project's own
+  engine support needs.
+
+- kettle-jem-template-20260729-005 - Gemspec metadata now publishes this
+  project's RubyForum tag as `mailing_list_uri`, and support docs link to the
+  tagged RubyForum community alongside Discord.
+
+### Changed
+
+- [kc] kettle-jem/prepare: updated 25 project files:
+  - configuration (1)
+  - dependencies (24)
+
+- kettle-jem-template-20260716-002 - Gemspecs now ship fewer repository-only
+  files, reducing package noise for downstream packagers.
+- kettle-jem-template-20260720-002 - Development Gemfiles now use the released
+  `tree_sitter_language_pack` gem 1.13.3 or newer by default.
+- kettle-jem-template-20260725-002 - Version specs now use `anonymous_loader` to
+  cover `version.rb` without redefining constants, or are removed when version
+  specs are not managed for the project.
+- kettle-jem-template-20260728-001 - Generated Ruby workflows now use clearer
+  setup-ruby-flash planning and can prepare appraisal-only jobs without
+  installing the main Gemfile bundle.
+- kettle-jem-template-20260801-001 - Generated README gem dashboard links now
+  use ClickGems instead of BestGems.
+
+- [kc] kettle-jem/template: updated 84 project files:
+  - code and tests (7)
+  - configuration (1)
+  - dependencies (20)
+  - documentation (2)
+  - other (20)
+  - workflows (34)
+
+### Fixed
+
+- `OAuth2::AccessToken` no longer raises `NoMethodError` when `expires_latency` is set but the token has no known expiry (no `expires_in`/`expires_at`, or `expires_in: 0`), e.g. `client.get_token(params, expires_latency: 30)` against a provider that omits `expires_in` by @iamibi
+- [gh!770][gh!770] - Raise token response parse errors when using the deprecated `extract_access_token` option, rather than swallowing them by @dpep
+
+- kettle-jem-template-20260720-003 - StructuredMerge Git diff driver config now
+  uses the installed `smorg-rb` driver command.
+- kettle-jem-template-20260725-001 - Release pull request branches beginning
+  with `feature/release` now run JRuby and TruffleRuby workflows.
+- kettle-jem-template-20260726-002 - Generated version files now document their
+  version namespace and constants, reducing warning-only YARD lint output.
+- kettle-jem-template-20260726-003 - Coverage upload steps now treat Coveralls,
+  QLTY, and Codecov as optional, so provider outages do not fail CI when local
+  coverage thresholds still pass.
+- kettle-jem-template-20260728-002 - Generated RuboCop configs now ignore the
+  same `gemfiles/vendor/bundle` tree as `.gitignore`, so vendored dependency
+  installs are not reported as project lint debt.
+- kettle-jem-template-20260728-003 - Generated dep-heads workflows now run
+  TruffleRuby jobs with current RubyGems and Bundler, avoiding setup failures
+  before the test suite starts.
+- kettle-jem-template-20260728-004 - Generated dep-heads workflows now use the
+  setup-ruby Bundler install path for direct appraisal Gemfiles, avoiding rv
+  lockfile parser failures on Git and path dependencies.
+- kettle-jem-template-20260728-005 - VersionGem bootstrap now creates the
+  missing canonical version spec when a project only has shim namespace version
+  specs.
+- kettle-jem-template-20260729-001 - Generated JRuby 9.4 workflows now use the
+  legacy manual bundle install path, avoiding setup-time Bundler full-index
+  failures against `gem.coop`.
+- kettle-jem-template-20260730-001 - Gemspec package file enumeration now runs
+  relative to the gemspec directory, so release package contents stay correct
+  even when the gemspec is loaded from another working directory.
+- kettle-jem-template-20260801-002 - Generated RSpec helpers now normalize
+  managed configuration block bindings structurally, preventing mixed block
+  parameter names from producing invalid configuration after a merge.
+- kettle-jem-template-20260801-003 - Generated project metadata and
+  documentation now normalize configured underscore hostnames to valid
+  hyphenated hostnames.
+- kettle-jem-template-20260801-004 - Generated organization README logos now
+  use GitHub's stable organization avatar endpoint instead of assuming a
+  matching Galtzo-hosted asset exists.
+- kettle-jem-template-20260802-001 - Devcontainer JSON files now merge as JSONC,
+  preserving comments and trailing commas during template updates.
+
+## [2.0.25] - 2026-07-14
+
+- TAG: [v2.0.25][2.0.25t]
+- COVERAGE: 100.00% -- 558/558 lines in 15 files
+- BRANCH COVERAGE: 97.89% -- 186/190 branches in 15 files
+- 88.35% documented
+
+### Added
+
+- Added support for JRuby 10.1 and TruffleRuby 34.0.
+
+### Changed
+
+- Raised the `anonymous_loader` runtime dependency floor to `>= 0.1.3`.
+- Raised the `auth-sanitizer` runtime dependency floor to `>= 0.2.3`.
+- Retemplated generated project metadata, support documentation, CI workflows,
+  binstubs, and development dependency floors with `kettle-jem` v7.0.0.
+
+### Fixed
+
+- Package configured license files in gem release file lists.
+
 ## [2.0.24] - 2026-06-18
 
 - TAG: [v2.0.24][2.0.24t]
@@ -67,9 +207,9 @@ Please file a bug if you notice a violation of semantic versioning.
 - Addressed Reek code-quality checks with targeted cleanup and documented compatibility exclusions by @pboling
 - Fixed deprecation warning from MultiXML by @robzolkos
 
-[gh!733]: https://github.com/ruby-oauth/oauth2/pull/733
+- [gh!733][gh!733] - Fixed head appraisal dependency conflicts and Ruby 2.4 protocol-relative redirect handling by @pboling
 
-- Fixed head appraisal dependency conflicts and Ruby 2.4 protocol-relative redirect handling by @pboling
+[gh!733]: https://github.com/ruby-oauth/oauth2/pull/733
 
 ## [2.0.22] - 2026-06-07
 
@@ -908,7 +1048,11 @@ Please file a bug if you notice a violation of semantic versioning.
 
 [gemfiles/readme]: gemfiles/README.md
 
-[Unreleased]: https://github.com/ruby-oauth/oauth2/compare/v2.0.24...HEAD
+[Unreleased]: https://github.com/ruby-oauth/oauth2/compare/v2.0.26...HEAD
+[2.0.26]: https://github.com/ruby-oauth/oauth2/compare/v2.0.25...v2.0.26
+[2.0.26t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.26
+[2.0.25]: https://github.com/ruby-oauth/oauth2/compare/v2.0.24...v2.0.25
+[2.0.25t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.25
 [2.0.24]: https://github.com/ruby-oauth/oauth2/compare/v2.0.23...v2.0.24
 [2.0.24t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.24
 [2.0.23]: https://github.com/ruby-oauth/oauth2/compare/v2.0.22...v2.0.23