chore(deps): bump the ruby-dependencies group with 5 updates

[dependabot]

Bumps the ruby-dependencies group with 5 updates:

Package	From	To
omniauth-google-oauth2	1.2.2	1.2.3
mini_magick	5.3.3	5.4.0
graphql	2.6.9	2.6.10
bullet	8.1.3	8.2.0
webmock	3.26.3	3.26.4

Updates omniauth-google-oauth2 from 1.2.2 to 1.2.3

Release notes

Sourced from omniauth-google-oauth2's releases.

v1.2.3

Security

• Verify caller-supplied ID tokens against Google's published signing keys before trusting them. An ID token sent alongside a direct access_token callback was previously decoded without checking its signature, so extra.id_info and extra.id_token could be populated from a forged token. uid and info were never affected, as they come from the userinfo endpoint. A caller-supplied ID token genuinely issued by Google for the same user and a trusted client continues to be accepted after verification.
• Require a caller-supplied ID token to describe the same user as the access token it was sent with, by comparing the token's sub against the userinfo subject. A verified signature only proves Google issued the token, not that it belongs to the person the access token identifies, so without this a genuine ID token for one user could be paired with an access token for another and leave uid and extra.id_info describing different people. The at_hash claim is checked first as a fast path, and this subject check settles the cases at_hash cannot: tokens that omit the claim, and tokens whose at_hash is stale because the client refreshed its access token after sign-in. This check runs even when skip_info is set, as that option trims the auth hash rather than waiving verification.
• The bundled example app no longer disables TLS certificate verification. Anyone who copied that line into an application should remove it: it turns off certificate checking for every Faraday-based request in the process, not just the ones this gem makes.

Added

• reset_jwks_cache! for clearing the cached Google signing keys between tests.
• cached_jwks, the class-level fetch-and-cache primitive behind it, which takes the fetch itself as a block.
• JWKS_URL, JWKS_CACHE_TTL, and JWKS_RETRY_INTERVAL constants, and a JwksUnavailable error.
• An upper bound of < 4 on the jwt dependency. This is precautionary rather than a response to a released version: it keeps a future major release from being picked up before it has been verified against this strategy.

Deprecated

• Nothing.

Removed

• The fallback that placed the opaque access token in extra.id_token when no ID token was present. extra.id_token is now absent in that case rather than holding a value that was never an ID token. This was only reachable with skip_jwt set; without it the fallback raised instead.

Fixed

• Ignore every credential field a caller supplies in a direct access-token callback apart from the access token itself and a verified ID token. refresh_token and token expiry in particular cannot be verified, so they are no longer carried through.
• Avoid decoding opaque access tokens as JWTs when no ID token is available.
• Fail with a normal authentication failure when a callback carries no usable credential, such as an ID token with no access token, a JSON body that is not an object, or an unparseable body. Previously these raised a NoMethodError or TypeError that OmniAuth turned into a failure whose message was the raw Ruby error, so applications received an unstable message parameter such as undefined method 'expired?' instead of invalid_credentials.
• Serve the cached signing keys when Google's key endpoint is briefly unreachable, and back off before refetching, rather than retrying on every request, including when nothing is cached yet.
• Reject a signing key response that is not an object with a keys array, rather than passing it on to be interpreted as some other kind of key.
• Cap how often an ID token naming an unrecognised key can force a key refresh, so it cannot be used to drive unbounded outbound requests while holding the shared cache lock. Key rotation still resolves within JWKS_RETRY_INTERVAL.
• jwt_leeway now also applies when verifying caller-supplied ID tokens, matching how it already behaved for the extra block.
• Support non-rewindable JSON request bodies under Rack 3.
• Accept ID tokens issued to any configured authorized_client_ids, matching the audiences already accepted for access tokens.
• Reuse successfully verified ID token claims when building extra, so each ID token is decoded and validated only once per request.

Changelog

Sourced from omniauth-google-oauth2's changelog.

1.2.3 - 2026-08-31

Security

• Verify caller-supplied ID tokens against Google's published signing keys before trusting them. An ID token sent alongside a direct access_token callback was previously decoded without checking its signature, so extra.id_info and extra.id_token could be populated from a forged token. uid and info were never affected, as they come from the userinfo endpoint. A caller-supplied ID token genuinely issued by Google for the same user and a trusted client continues to be accepted after verification.
• Require a caller-supplied ID token to describe the same user as the access token it was sent with, by comparing the token's sub against the userinfo subject. A verified signature only proves Google issued the token, not that it belongs to the person the access token identifies, so without this a genuine ID token for one user could be paired with an access token for another and leave uid and extra.id_info describing different people. The at_hash claim is checked first as a fast path, and this subject check settles the cases at_hash cannot: tokens that omit the claim, and tokens whose at_hash is stale because the client refreshed its access token after sign-in. This check runs even when skip_info is set, as that option trims the auth hash rather than waiving verification.
• The bundled example app no longer disables TLS certificate verification. Anyone who copied that line into an application should remove it: it turns off certificate checking for every Faraday-based request in the process, not just the ones this gem makes.

Added

• reset_jwks_cache! for clearing the cached Google signing keys between tests.
• cached_jwks, the class-level fetch-and-cache primitive behind it, which takes the fetch itself as a block.
• JWKS_URL, JWKS_CACHE_TTL, and JWKS_RETRY_INTERVAL constants, and a JwksUnavailable error.
• An upper bound of < 4 on the jwt dependency. This is precautionary rather than a response to a released version: it keeps a future major release from being picked up before it has been verified against this strategy.

Deprecated

• Nothing.

Removed

• The fallback that placed the opaque access token in extra.id_token when no ID token was present. extra.id_token is now absent in that case rather than holding a value that was never an ID token. This was only reachable with skip_jwt set; without it the fallback raised instead.

Fixed

• Ignore every credential field a caller supplies in a direct access-token callback apart from the access token itself and a verified ID token. refresh_token and token expiry in particular cannot be verified, so they are no longer carried through.
• Avoid decoding opaque access tokens as JWTs when no ID token is available.
• Fail with a normal authentication failure when a callback carries no usable credential, such as an ID token with no access token, a JSON body that is not an object, or an unparseable body. Previously these raised a NoMethodError or TypeError that OmniAuth turned into a failure whose message was the raw Ruby error, so applications received an unstable message parameter such as undefined method 'expired?' instead of invalid_credentials.
• Serve the cached signing keys when Google's key endpoint is briefly unreachable, and back off before refetching, rather than retrying on every request, including when nothing is cached yet.
• Reject a signing key response that is not an object with a keys array, rather than passing it on to be interpreted as some other kind of key.
• Cap how often an ID token naming an unrecognised key can force a key refresh, so it cannot be used to drive unbounded outbound requests while holding the shared cache lock. Key rotation still resolves within JWKS_RETRY_INTERVAL.
• jwt_leeway now also applies when verifying caller-supplied ID tokens, matching how it already behaved for the extra block.
• Support non-rewindable JSON request bodies under Rack 3.
• Accept ID tokens issued to any configured authorized_client_ids, matching the audiences already accepted for access tokens.
• Reuse successfully verified ID token claims when building extra, so each ID token is decoded and validated only once per request.

Commits

• c2fa91f Fix token info cache keying and log injection, and require core ID token claims
• c6af73e Reduce redundant JWKS cache timestamp calculations
• 778c990 Tiny README.md correction
• eae8feb Clarify CHANGELOG.md
• ef303e6 Accept ID tokens from authorized client IDs and fix Ruby 2.5 compatibility
• e5be50e Verify caller-supplied ID tokens against Google's signing keys and bind them ...
• 650aab9 Update example to show AJAX payloads
• 0b87f3f Fix ID token spoofing in direct access-token callbacks
• 41796b6 specify that jwt must be less than version 4 (#476)
• 5559071 Better CHANGELOG.md
• See full diff in compare view

Updates mini_magick from 5.3.3 to 5.4.0

Release notes

Sourced from mini_magick's releases.

5.4.0

• Added :inherit_fds option for handing open file descriptors to the IM command, so an input that's already an open IO can be passed as /dev/fd/N instead of being written out to a file first:

  File.open("input.jpg", "rb") do |file|
    MiniMagick.identify(inherit_fds: [file]) do |identify|
      identify << "/dev/fd/#{file.fileno}"
    end
  end

  Thanks to @​flavorjones for the contribution!

Commits

• ca66da0 Bump to 5.4.0
• 6030c35 Add inherit_fds: to hand file descriptors to the tool (#605)
• See full diff in compare view

Updates graphql from 2.6.9 to 2.6.10

Changelog

Sourced from graphql's changelog.

2.6.10 (27 Aug 2026)

New features

• Execution::Next: Add dataload: { ..., method: } shorthand #5706

Bug fixes

• AsyncDataloader: Avoid ClosedError race in old fibers #5702
• AsyncDataloader: fix nested dataloader runs #5703
• Validation: speed up FieldsWillMerge #5704
• AsyncDataloader: Fix ActiveRecord relation loads in connections #5708
• Execution::Next: handle SystemStackErrors #5705
• Restore current multiplex after nested execution #5714
• Parser: handle out-of-range Unicode escapes as parse errors #5710
• Lexer: re-raise unexpected ArgumentErrors #5711
• Parser: support short braced unicode escapes #5712
• Float: reject non-finite values #5713

Commits

• cc4fe58 2.6.10
• 3d43cfd Merge pull request #5713 from ydah/reject-non-finite-float-values
• 10c6617 Merge pull request #5712 from ydah/support-short-braced-unicode-escapes
• 457c459 Merge pull request #5711 from ydah/reraise-unexpected-lexer-argument-errors
• 8a1a9e4 Merge pull request #5710 from ydah/reject-out-of-range-unicode-escapes
• a345858 Merge pull request #5714 from ydah/restore-current-multiplex-after-nested-exe...
• d4fefd8 Restore current multiplex after nested execution
• 93be7f6 Reject non-finite Float values
• 76d2448 Support short braced Unicode escapes
• 1dba7a8 Reraise unexpected lexer argument errors
• Additional commits viewable in compare view

Updates bullet from 8.1.3 to 8.2.0

Changelog

Sourced from bullet's changelog.

8.2.0 (08/29/2026)

• Add thread-safe Bullet.pause, Bullet.resume, Bullet.paused?, and Bullet.skip APIs
• Add configurable footer positioning
• Fix unused eager loading false positives when N+1 detection is disabled
• Fix unused eager loading false positives for conditional has_many :through associations
• Fix Ruby 4.0 compatibility issues
• Drop support for ActiveRecord versions older than 7 and Mongoid versions older than 8

Commits

• 805fc58 Bump version to 8.2.0
• fa67b54 Merge pull request #777 from deivid-rodriguez/deivid-rodriguez/fix-has-many-t...
• 5471086 Merge pull request #780 from deivid-rodriguez/deivid-rodriguez/mongoid-compat
• 0962b7b Make Gemfile.mongoid-8.0 installable
• 8ca4ff0 Drop no longer supported mongoid versions
• a48b03a rbx implementation is no longer maintained
• 1372b2b Fix has many through unused eager load false positives
• 09cd01d Merge pull request #779 from deivid-rodriguez/deivid-rodriguez/drop-very-old-...
• 770547f Drop support for ActiveRecord older than 7.x
• 3820804 Merge pull request #776 from deivid-rodriguez/deivid-rodriguez/fix-unused-eag...
• Additional commits viewable in compare view

Updates webmock from 3.26.3 to 3.26.4

Release notes

Sourced from webmock's releases.

3.26.4

• Fix race condition in HTTPClient adapter async requests by @​koic in #1131

Changelog

Sourced from webmock's changelog.

3.26.4

• Fix race condition in HTTPClient adapter async requests by @​koic in #1131

Commits

• 0fdbad0 Version 3.26.4
• b187df8 Merge pull request #1131 from koic/fix_race_condition_in_httpclient_adapter_a...
• f275724 Fix race condition in HTTPClient adapter async requests
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions