Skip to content

Bump oauth to 1.1.6 - #4767

Merged
CloCkWeRX merged 2 commits into
devfrom
bump-oauth-1.1.6
Aug 23, 2026
Merged

Bump oauth to 1.1.6#4767
CloCkWeRX merged 2 commits into
devfrom
bump-oauth-1.1.6

Conversation

@CloCkWeRX

@CloCkWeRX CloCkWeRX commented Aug 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

ruby-oauth/oauth@v1.1.5...v1.1.6

12 commits 226 files changed

facepalm

More ocean boiling:

Changelog claim Found in code? Assessment
Retemplate workflows/appraisals/development tooling Yes Accurate
Document OAuth::Consumer options Yes Accurate
Correct OAuth 1.0a example Yes Accurate
auth-sanitizer >= 0.2.1 Yes Accurate
snaky_hash >= 2.0.5 Yes Accurate
Bound token redirects Yes Accurate
Explicit redirect resolution Yes Accurate
Reject cross-origin redirects by default Yes Accurate
Require explicit opt-in for cross-origin redirects Yes Accurate

The changelog does not, however, convey the full security implications of the enormous development-environment change. In particular, it doesn't call out the new download-and-execute path for tsdl.
That omission is not necessarily malicious—the changelog describes the template migration at a high level—but from a supply-chain-review perspective it is material.

@CloCkWeRX CloCkWeRX changed the title Bump oauth 1.1.6 Bump oauth to 1.1.6 Aug 23, 2026
Base automatically changed from bump-oauth-1.1.5 to dev August 23, 2026 08:30
@CloCkWeRX
CloCkWeRX marked this pull request as ready for review August 23, 2026 08:33
@CloCkWeRX
CloCkWeRX merged commit 1ee993f into dev Aug 23, 2026
16 checks passed
@CloCkWeRX
CloCkWeRX deleted the bump-oauth-1.1.6 branch August 23, 2026 08:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@CloCkWeRX