[dependabot]

Bumps omniauth-oauth2 from 1.9.0 to 1.10.0.

Changelog

Sourced from omniauth-oauth2's changelog.

[1.10.0] - 2026-10-22

Added

• RBS type signatures for the strategy, in sig/, checked with Steep.
• Support up to 5 sign-ins in progress at once, for example in several tabs, instead of failing all but the latest with csrf_detected. Each one's redirect URI and PKCE verifier are stored by state in session["omniauth.oauth2"]. The omniauth.state, omniauth.redirect_uri, and omniauth.pkce.verifier keys still hold the latest sign-in, and the callback falls back to them, so provider gems and tests that set them keep working. The strategy also passes the state to OmniAuth's remember_sign_in, so each callback gets its own sign-in's omniauth.origin and omniauth.params. (#195)

Changed

• Require Ruby 2.5 or later.
• Require omniauth 2.3.1 or later, so apps can set OmniAuth.config.allowed_hosts to reject forged hosts in callback URLs (see GHSA-m27g-v28p-f9fx), and so each sign-in gets its own omniauth.origin and omniauth.params.
• Include the refresh token in the credentials whenever the provider returns one, not only when the access token expires. Some providers, like Twitch, issue expiring tokens without saying when they expire. (#122)
• Fail the request phase with missing_client_id when no client ID is configured, instead of redirecting to the provider with an authorize request it can only reject. (#65)
• The gem includes only lib, sig, the license, the README, and the security policy, not the specs, changelog, CI workflows, or tool configs. (#179)

Removed

• The pkce_verifier option. Setting it never had any effect, since the strategy overwrote it with a fresh verifier on every request, and the verifier is no longer kept in options at all. (#184)

Fixed

• Send the token request the same redirect_uri as the authorize request, instead of the callback URL with code and state appended, as RFC 6749 requires. (#93, #142)
• Send the token request a redirect_uri set in client_options, which oauth2 already sends in the authorize request. (#161)
• Fail with invalid_credentials instead of raising NoMethodError when oauth2's raise_errors is off and the token response has no token. (#138)
• Fail with csrf_detected instead of raising NoMethodError when the

... (truncated)

Commits

• 21eac69 Release 1.10.0
• c39f6b4 Give each sign-in its own origin and params
• 48ed1d5 Support several sign-ins in progress at once
• 825ebd5 Require omniauth 2.2
• 45a0cee Test on Ruby 2.5, 2.6, and 2.7
• 0e171e0 Require Ruby 2.5 or later in the gemspec
• e7f9163 Ship only lib, sig, the license, the README, and SECURITY.md
• 6470009 Push the gem from GitHub Actions with trusted publishing
• 6fff736 Fail the request phase when there's no client ID
• 75ccebf Include the refresh token even when the token doesn't expire
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	omniauth@​2.1.4 ⏵ 2.3.1	+1
	omniauth-oauth2@​1.9.0 ⏵ 1.10.0	+2

View full report

[dependabot]

Looks like omniauth-oauth2 is up-to-date now, so this is no longer needed.