Merge pull request #4767 from Growstuff/bump-oauth-1.1.6

Bump oauth to 1.1.6
Merge pull request #4766 from Growstuff/bump-oauth-1.1.5
2026-09-08 12:06:59 -04:00 · 2026-08-23 18:03:46 +09:30 · 2026-08-23 18:00:37 +09:30 · 2026-08-23 18:00:25 +09:30 · 2026-08-23 18:00:09 +09:30 · 2026-08-23 17:58:45 +09:30
27 changed files with 250 additions and 150 deletions
@@ -74,7 +74,7 @@ jobs:
          sudo apt-get -y install libpq-dev google-chrome-stable

      - name: Install NodeJS
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: '24'

@@ -74,7 +74,7 @@ jobs:
          sudo apt-get -y install libpq-dev google-chrome-stable

      - name: Install NodeJS
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: '24'

@@ -74,7 +74,7 @@ jobs:
          sudo apt-get -y install libpq-dev google-chrome-stable

      - name: Install NodeJS
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: '24'

@@ -74,7 +74,7 @@ jobs:
          sudo apt-get -y install libpq-dev google-chrome-stable

      - name: Install NodeJS
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: '24'

@@ -74,7 +74,7 @@ jobs:
          sudo apt-get -y install libpq-dev google-chrome-stable

      - name: Install NodeJS
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: '24'

@@ -74,7 +74,7 @@ jobs:
          sudo apt-get -y install libpq-dev google-chrome-stable

      - name: Install NodeJS
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: '24'

@@ -74,7 +74,7 @@ jobs:
          sudo apt-get -y install libpq-dev google-chrome-stable

      - name: Install NodeJS
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: '24'

@@ -74,7 +74,7 @@ jobs:
          sudo apt-get -y install libpq-dev google-chrome-stable

      - name: Install NodeJS
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: '24'

@@ -74,7 +74,7 @@ jobs:
          sudo apt-get -y install libpq-dev google-chrome-stable

      - name: Install NodeJS
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: '24'

@@ -74,7 +74,7 @@ jobs:
          sudo apt-get -y install libpq-dev google-chrome-stable

      - name: Install NodeJS
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: '24'

@@ -74,7 +74,7 @@ jobs:
          sudo apt-get -y install libpq-dev google-chrome-stable

      - name: Install NodeJS
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: '24'

@@ -74,7 +74,7 @@ jobs:
          sudo apt-get -y install libpq-dev google-chrome-stable

      - name: Install NodeJS
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: '24'

@@ -74,7 +74,7 @@ jobs:
          sudo apt-get -y install libpq-dev google-chrome-stable

      - name: Install NodeJS
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: '24'

@@ -74,7 +74,7 @@ jobs:
          sudo apt-get -y install libpq-dev google-chrome-stable

      - name: Install NodeJS
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: '24'

@@ -89,7 +89,7 @@ jobs:
          sudo apt-get -y install libpq-dev google-chrome-stable

      - name: Install NodeJS
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: '24'

@@ -20,7 +20,7 @@ jobs:
        uses: docker/setup-buildx-action@v4

      - name: Log in to the Container registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -1 +1 @@
-3.4.9
+3.4.10
@@ -1,4 +1,4 @@
-FROM ruby:3.4.9-trixie
+FROM ruby:3.4.10-trixie

 # Install system dependencies
 RUN apt-get update -qq && \
@@ -5,7 +5,9 @@ source 'https://rubygems.org'
 # Match ruby version in .ruby-version
 ruby File.read('.ruby-version')

-gem 'rails', '~> 8.0.0'
+gem 'rails', '~> 8.1.0'
+
+gem 'csv'

 # Keeping old sprockets
 # https://github.com/rails/sprockets-rails/issues/444#issuecomment-637817050
@@ -16,6 +18,7 @@ gem 'bundler', '>= 2.4.22'
 gem 'coffee-rails'
 gem 'haml'
 gem 'sassc-rails'
+gem 'oauth', '1.1.6' # Explicitly pinned, as the maintainer does huge (400 files, 45k lines) changes in point releases - required manual plus agentic security review.

 # API data
 gem 'jsonapi-resources'
@@ -33,29 +33,31 @@ GEM
 GEM
  remote: https://rubygems.org/
  specs:
-    actioncable (8.0.5)
-      actionpack (= 8.0.5)
-      activesupport (= 8.0.5)
+    action_text-trix (2.1.19)
+      railties
+    actioncable (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      nio4r (~> 2.0)
      websocket-driver (>= 0.6.1)
      zeitwerk (~> 2.6)
-    actionmailbox (8.0.5)
-      actionpack (= 8.0.5)
-      activejob (= 8.0.5)
-      activerecord (= 8.0.5)
-      activestorage (= 8.0.5)
-      activesupport (= 8.0.5)
+    actionmailbox (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      mail (>= 2.8.0)
-    actionmailer (8.0.5)
-      actionpack (= 8.0.5)
-      actionview (= 8.0.5)
-      activejob (= 8.0.5)
-      activesupport (= 8.0.5)
+    actionmailer (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      actionview (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      mail (>= 2.8.0)
      rails-dom-testing (~> 2.2)
-    actionpack (8.0.5)
-      actionview (= 8.0.5)
-      activesupport (= 8.0.5)
+    actionpack (8.1.3.1)
+      actionview (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      nokogiri (>= 1.8.5)
      rack (>= 2.2.4)
      rack-session (>= 1.0.1)
@@ -63,15 +65,16 @@ GEM
      rails-dom-testing (~> 2.2)
      rails-html-sanitizer (~> 1.6)
      useragent (~> 0.16)
-    actiontext (8.0.5)
-      actionpack (= 8.0.5)
-      activerecord (= 8.0.5)
-      activestorage (= 8.0.5)
-      activesupport (= 8.0.5)
+    actiontext (8.1.3.1)
+      action_text-trix (~> 2.1.15)
+      actionpack (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      globalid (>= 0.6.0)
      nokogiri (>= 1.8.5)
-    actionview (8.0.5)
-      activesupport (= 8.0.5)
+    actionview (8.1.3.1)
+      activesupport (= 8.1.3.1)
      builder (~> 3.1)
      erubi (~> 1.11)
      rails-dom-testing (~> 2.2)
@@ -86,29 +89,29 @@ GEM
    active_utils (3.6.0)
      activesupport (>= 4.2)
      i18n
-    activejob (8.0.5)
-      activesupport (= 8.0.5)
+    activejob (8.1.3.1)
+      activesupport (= 8.1.3.1)
      globalid (>= 0.3.6)
-    activemodel (8.0.5)
-      activesupport (= 8.0.5)
-    activerecord (8.0.5)
-      activemodel (= 8.0.5)
-      activesupport (= 8.0.5)
+    activemodel (8.1.3.1)
+      activesupport (= 8.1.3.1)
+    activerecord (8.1.3.1)
+      activemodel (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      timeout (>= 0.4.0)
-    activestorage (8.0.5)
-      actionpack (= 8.0.5)
-      activejob (= 8.0.5)
-      activerecord (= 8.0.5)
-      activesupport (= 8.0.5)
+    activestorage (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      marcel (~> 1.0)
-    activesupport (8.0.5)
+    activesupport (8.1.3.1)
      base64
-      benchmark (>= 0.3)
      bigdecimal
      concurrent-ruby (~> 1.0, >= 1.3.1)
      connection_pool (>= 2.2.5)
      drb
      i18n (>= 1.6, < 2)
+      json
      logger (>= 1.4.2)
      minitest (>= 5.1)
      securerandom (>= 0.3)
@@ -116,12 +119,16 @@ GEM
      uri (>= 0.13.1)
    addressable (2.9.0)
      public_suffix (>= 2.0.2, < 8.0)
+    anonymous_loader (0.1.3)
+      version_gem (~> 1.1, >= 1.1.14)
    ast (2.4.3)
+    auth-sanitizer (0.2.3)
+      version_gem (~> 1.1, >= 1.1.14)
    autoprefixer-rails (10.4.16.0)
      execjs (~> 2)
    aws-eventstream (1.4.0)
-    aws-partitions (1.1261.0)
-    aws-sdk-core (3.252.0)
+    aws-partitions (1.1279.0)
+    aws-sdk-core (3.254.1)
      aws-eventstream (~> 1, >= 1.3.0)
      aws-partitions (~> 1, >= 1.992.0)
      aws-sigv4 (~> 1.9)
@@ -129,24 +136,23 @@ GEM
      bigdecimal
      jmespath (~> 1, >= 1.6.1)
      logger
-    aws-sdk-kms (1.129.0)
-      aws-sdk-core (~> 3, >= 3.248.0)
+    aws-sdk-kms (1.130.0)
+      aws-sdk-core (~> 3, >= 3.254.0)
      aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.226.0)
-      aws-sdk-core (~> 3, >= 3.248.0)
+    aws-sdk-s3 (1.229.0)
+      aws-sdk-core (~> 3, >= 3.254.1)
      aws-sdk-kms (~> 1)
      aws-sigv4 (~> 1.5)
    aws-sigv4 (1.12.1)
      aws-eventstream (~> 1, >= 1.0.2)
-    axe-core-api (4.12.0)
+    axe-core-api (4.13.0)
      dumb_delegator
-    axe-core-capybara (4.12.0)
-      axe-core-api (= 4.12.0)
-    axe-core-rspec (4.12.0)
-      axe-core-api (= 4.12.0)
+    axe-core-capybara (4.13.0)
+      axe-core-api (= 4.13.0)
+    axe-core-rspec (4.13.0)
+      axe-core-api (= 4.13.0)
    base64 (0.3.0)
    bcrypt (3.1.22)
-    benchmark (0.5.0)
    better_errors (2.10.1)
      erubi (>= 1.0.0)
      rack (>= 0.9.0)
@@ -193,6 +199,7 @@ GEM
      image_processing (~> 1.1)
      marcel (~> 1.0.0)
      ssrf_filter (~> 1.0)
+    cgi (0.5.2)
    chartkick (5.2.1)
    childprocess (5.1.0)
      logger (~> 1.5)
@@ -206,9 +213,9 @@ GEM
    coffee-script-source (1.12.2)
    comfy_bootstrap_form (4.0.9)
      rails (>= 5.0.0)
-    concurrent-ruby (1.3.7)
+    concurrent-ruby (1.3.8)
    connection_pool (2.5.5)
-    crass (1.0.6)
+    crass (1.0.7)
    crowdin-api (1.12.0)
      open-uri (>= 0.1.0, < 0.2.0)
      rest-client (>= 2.0.0, < 2.2.0)
@@ -217,11 +224,11 @@ GEM
      gli (>= 2.7.0)
      i18n (>= 0.6.4)
      rubyzip (>= 1.0.0)
-    csv (3.3.5)
+    csv (3.3.6)
    csv_shaper (1.4.0)
      activesupport (>= 3.0.0)
      csv
-    dalli (5.0.5)
+    dalli (5.1.0)
      logger
    database_cleaner (2.1.0)
      database_cleaner-active_record (>= 2, < 3)
@@ -259,9 +266,9 @@ GEM
    elasticsearch-transport (7.0.0)
      faraday
      multi_json
-    erb (6.0.4)
+    erb (6.0.7)
    erubi (1.13.1)
-    execjs (2.10.0)
+    execjs (2.10.1)
    factory_bot (6.5.5)
      activesupport (>= 6.1.0)
    factory_bot_rails (6.5.1)
@@ -291,21 +298,22 @@ GEM
      multi_json (>= 1.9.0)
    gli (2.22.2)
      ostruct
-    globalid (1.3.0)
+    globalid (1.4.0)
      activesupport (>= 6.1)
    gravatar-ultimate (2.0.0)
      activesupport (>= 2.3.14)
      rack
-    haml (7.2.0)
+    haml (7.4.1)
+      prism (>= 1.1.0)
      temple (>= 0.8.2)
      thor
      tilt
-    haml-rails (3.0.0)
+    haml-rails (3.1.0)
      actionpack (>= 5.1)
      activesupport (>= 5.1)
      haml (>= 4.0.6)
      railties (>= 5.1)
-    haml_lint (0.75.0)
+    haml_lint (0.77.0)
      haml (>= 5.0)
      parallel (>= 1.10)
      rainbow
@@ -338,7 +346,7 @@ GEM
      terminal-table (>= 1.5.1)
    i18n_data (1.1.0)
      simple_po_parser (~> 1.1)
-    icalendar (2.12.3)
+    icalendar (2.12.4)
      base64
      ice_cube (~> 0.16)
      logger
@@ -347,7 +355,7 @@ GEM
    image_processing (1.14.0)
      mini_magick (>= 4.9.5, < 6)
      ruby-vips (>= 2.0.17, < 3)
-    io-console (0.8.2)
+    io-console (0.9.1)
    irb (1.18.0)
      pp (>= 0.6.0)
      prism (>= 1.3.0)
@@ -358,7 +366,7 @@ GEM
      rails-dom-testing (>= 1, < 3)
      railties (>= 4.2.0)
      thor (>= 0.14, < 2.0)
-    json (2.20.0)
+    json (2.21.2)
    json-schema (6.2.0)
      addressable (~> 2.8)
      bigdecimal (>= 3.1, < 5)
@@ -386,10 +394,10 @@ GEM
      rb-fsevent (~> 0.10, >= 0.10.3)
      rb-inotify (~> 0.9, >= 0.9.10)
    logger (1.7.0)
-    loofah (2.25.1)
+    loofah (2.25.2)
      crass (~> 1.0.2)
      nokogiri (>= 1.12.0)
-    mail (2.9.0)
+    mail (2.9.1)
      logger
      mini_mime (>= 0.1.1)
      net-imap
@@ -421,13 +429,13 @@ GEM
    minitest (6.0.6)
      drb (~> 2.0)
      prism (~> 1.5)
-    msgpack (1.8.3)
+    msgpack (1.8.4)
    multi_json (1.19.1)
    multi_xml (0.8.1)
      bigdecimal (>= 3.1, < 5)
    net-http (0.9.1)
      uri (>= 0.11.1)
-    net-imap (0.6.4.1)
+    net-imap (0.6.6)
      date
      net-protocol
    net-pop (0.1.2)
@@ -443,8 +451,18 @@ GEM
      racc (~> 1.4)
    nokogiri (1.19.4-x86_64-linux-gnu)
      racc (~> 1.4)
-    oauth (0.5.6)
-    oj (3.17.3)
+    oauth (1.1.6)
+      auth-sanitizer (~> 0.2, >= 0.2.1)
+      base64 (~> 0.1)
+      cgi
+      oauth-tty (~> 1.0, >= 1.0.8)
+      snaky_hash (~> 2.0, >= 2.0.5)
+      version_gem (~> 1.1, >= 1.1.11)
+    oauth-tty (1.0.13)
+      anonymous_loader (~> 0.1, >= 0.1.3)
+      auth-sanitizer (~> 0.2, >= 0.2.3)
+      version_gem (~> 1.1, >= 1.1.14)
+    oj (3.17.6)
      bigdecimal (>= 3.0)
      ostruct (>= 0.2)
    omniauth (1.9.2)
@@ -463,15 +481,15 @@ GEM
      activerecord (>= 7.1)
      request_store (~> 1.4)
    parallel (2.1.0)
-    parser (3.3.11.1)
+    parser (3.3.12.0)
      ast (~> 2.4.1)
      racc
-    percy-capybara (5.0.0)
+    percy-capybara (5.0.1)
      capybara (>= 3)
    pg (1.6.3)
    pg (1.6.3-x86_64-linux)
    popper_js (2.11.8)
-    pp (0.6.3)
+    pp (0.6.4)
      prettyprint
    prettyprint (0.2.0)
    prism (1.9.0)
@@ -479,15 +497,12 @@ GEM
      coderay (~> 1.1)
      method_source (~> 1.0)
      reline (>= 0.6.0)
-    psych (5.3.1)
-      date
-      stringio
    public_suffix (7.0.5)
    puma (8.0.2)
      nio4r (~> 2.0)
    query_diet (0.7.3)
    racc (1.8.1)
-    rack (2.2.23)
+    rack (2.2.24)
    rack-attack (6.8.0)
      rack (>= 1.0, < 4)
    rack-cors (2.0.2)
@@ -502,20 +517,20 @@ GEM
    rackup (1.0.1)
      rack (< 3)
      webrick
-    rails (8.0.5)
-      actioncable (= 8.0.5)
-      actionmailbox (= 8.0.5)
-      actionmailer (= 8.0.5)
-      actionpack (= 8.0.5)
-      actiontext (= 8.0.5)
-      actionview (= 8.0.5)
-      activejob (= 8.0.5)
-      activemodel (= 8.0.5)
-      activerecord (= 8.0.5)
-      activestorage (= 8.0.5)
-      activesupport (= 8.0.5)
+    rails (8.1.3.1)
+      actioncable (= 8.1.3.1)
+      actionmailbox (= 8.1.3.1)
+      actionmailer (= 8.1.3.1)
+      actionpack (= 8.1.3.1)
+      actiontext (= 8.1.3.1)
+      actionview (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activemodel (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      bundler (>= 1.15.0)
-      railties (= 8.0.5)
+      railties (= 8.1.3.1)
    rails-controller-testing (1.0.5)
      actionpack (>= 5.0.1.rc1)
      actionview (>= 5.0.1.rc1)
@@ -524,8 +539,8 @@ GEM
      activesupport (>= 5.0.0)
      minitest
      nokogiri (>= 1.6)
-    rails-html-sanitizer (1.7.0)
-      loofah (~> 2.25)
+    rails-html-sanitizer (1.7.1)
+      loofah (~> 2.25, >= 2.25.2)
      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
    rails-i18n (8.1.0)
      i18n (>= 0.7, < 2)
@@ -535,9 +550,9 @@ GEM
      rails_stdout_logging
    rails_serve_static_assets (0.0.5)
    rails_stdout_logging (0.0.5)
-    railties (8.0.5)
-      actionpack (= 8.0.5)
-      activesupport (= 8.0.5)
+    railties (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      irb (~> 1.13)
      rackup (>= 1.0.0)
      rake (>= 12.2)
@@ -550,15 +565,20 @@ GEM
    rb-fsevent (0.11.2)
    rb-inotify (0.11.1)
      ffi (~> 1.0)
-    rdoc (7.2.0)
+    rbs (4.1.2)
+      logger
+      prism (>= 1.6.0)
+      tsort
+    rdoc (8.0.0)
      erb
-      psych (>= 4.0.0)
+      prism (>= 1.6.0)
+      rbs (>= 4.0.0)
      tsort
    recaptcha (5.21.2)
    redis-client (0.26.2)
      connection_pool
    regexp_parser (2.12.0)
-    reline (0.6.3)
+    reline (0.7.0)
      io-console (~> 0.5)
    request_store (1.7.0)
      rack (>= 1.4)
@@ -614,7 +634,7 @@ GEM
    rswag-ui (2.17.0)
      actionpack (>= 5.2, < 8.2)
      railties (>= 5.2, < 8.2)
-    rubocop (1.88.2)
+    rubocop (1.89.0)
      json (~> 2.3)
      language_server-protocol (~> 3.17.0.2)
      lint_roller (~> 1.1.0)
@@ -634,11 +654,11 @@ GEM
    rubocop-factory_bot (2.28.0)
      lint_roller (~> 1.1)
      rubocop (~> 1.72, >= 1.72.1)
-    rubocop-rails (2.35.5)
+    rubocop-rails (2.37.0)
      activesupport (>= 4.2.0)
      lint_roller (~> 1.1)
      rack (>= 1.1)
-      rubocop (>= 1.75.0, < 2.0)
+      rubocop (>= 1.89.0, < 2.0)
      rubocop-ast (>= 1.44.0, < 2.0)
    rubocop-rake (0.7.1)
      lint_roller (~> 1.1)
@@ -656,7 +676,7 @@ GEM
    ruby-vips (2.3.0)
      ffi (~> 1.12)
      logger
-    rubyzip (3.4.0)
+    rubyzip (3.4.1)
    sass (3.7.4)
      sass-listen (~> 4.0.0)
    sass-listen (4.0.0)
@@ -670,13 +690,13 @@ GEM
      sprockets (> 3.0)
      sprockets-rails
      tilt
-    scout_apm (6.2.0)
+    scout_apm (6.2.1)
      parser
    searchkick (5.3.1)
      activemodel (>= 6.1)
      hashie
    securerandom (0.4.1)
-    selenium-webdriver (4.45.0)
+    selenium-webdriver (4.47.0)
      base64 (~> 0.2)
      logger (~> 1.4)
      rexml (~> 3.2, >= 3.2.5)
@@ -689,8 +709,11 @@ GEM
      rack (>= 2.2.4, < 3.3)
      redis-client (>= 0.23.0, < 1)
    simple_po_parser (1.1.6)
-    sitemap_generator (7.1.0)
+    sitemap_generator (7.1.1)
      builder (~> 3.0)
+    snaky_hash (2.0.7)
+      hashie (>= 0.1.0, < 6)
+      version_gem (~> 1.1, >= 1.1.14)
    sprockets (3.7.5)
      base64
      concurrent-ruby (~> 1.0)
@@ -700,15 +723,14 @@ GEM
      activesupport (>= 5.2)
      sprockets (>= 3.0.0)
    ssrf_filter (1.5.0)
-    stringio (3.2.0)
    sysexits (1.2.0)
-    temple (0.10.4)
+    temple (0.10.7)
    terminal-table (4.0.0)
      unicode-display_width (>= 1.1.1, < 4)
-    terser (1.2.7)
+    terser (1.2.8)
      execjs (>= 0.3.0, < 3)
    thor (1.5.0)
-    tilt (2.8.0)
+    tilt (2.9.0)
    timecop (0.9.11)
    timeout (0.6.1)
    tsort (0.2.0)
@@ -727,6 +749,7 @@ GEM
      activemodel (>= 3.0.0)
      public_suffix
    vcr (6.4.0)
+    version_gem (1.1.15)
    warden (1.2.9)
      rack (>= 2.0.9)
    webrat (0.7.3)
@@ -735,7 +758,7 @@ GEM
      rack-test (>= 0.5.3)
    webrick (1.9.2)
    websocket (1.2.11)
-    websocket-driver (0.8.0)
+    websocket-driver (0.8.2)
      base64
      websocket-extensions (>= 0.1.0)
    websocket-extensions (0.1.5)
@@ -747,7 +770,7 @@ GEM
      webrick
    xpath (3.2.0)
      nokogiri (~> 1.8)
-    zeitwerk (2.7.5)
+    zeitwerk (2.8.3)

 PLATFORMS
  ruby
@@ -778,6 +801,7 @@ DEPENDENCIES
  comfortable_mexican_sofa!
  connection_pool (< 3)
  crowdin-cli
+  csv
  csv_shaper
  dalli
  database_cleaner
@@ -815,6 +839,7 @@ DEPENDENCIES
  material_icons
  memcachier
  msgpack
+  oauth (= 1.1.6)
  oj
  omniauth (~> 1.3)
  omniauth-flickr (>= 0.0.15)
@@ -827,7 +852,7 @@ DEPENDENCIES
  rack-attack
  rack-cors
  rack-protection (>= 2.0.1)
-  rails (~> 8.0.0)
+  rails (~> 8.1.0)
  rails-assets-leaflet.markercluster!
  rails-controller-testing
  rails_12factor
@@ -867,7 +892,7 @@ DEPENDENCIES
  xmlrpc

 RUBY VERSION
-   ruby 3.4.9
+   ruby 3.4.10p104

 BUNDLED WITH
   2.4.22
@@ -18,9 +18,11 @@ module PhotoCapable
    def thumbnail_url
      df = default_photo

-      return unless df
-
-      df.source == 'flickr' ? df.fullsize_url : df.thumbnail_url
+      if df
+        df.source == 'flickr' ? df.fullsize_url : df.thumbnail_url
+      elsif respond_to?(:crop) && crop.present?
+        crop.thumbnail_url
+      end
    end

    def most_liked_photo
@@ -28,6 +28,7 @@ class PhotoAssociation < ApplicationRecord

  def photo_and_item_have_same_owner
    return if photographable_type == 'Crop'
+    return if photographable.blank?

    errors.add(:photo, :photo_owner_mismatch) unless photographable.owner_id == photo.owner_id
  end
@@ -14,7 +14,7 @@ Bundler.require(*Rails.groups)
 module Growstuff
  class Application < Rails::Application
    # Initialize configuration defaults for originally generated Rails version.
-    config.load_defaults 8.0
+    config.load_defaults 8.1

    # Rails 7.1+ requires a coder for `serialize`.
    # We set YAML as the default for compatibility with gems like Mexican Sofa.
@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+# JSONAPI::Resources (0.10.7) is currently incompatible with Rails 8.1
+# because ActionDispatch::Routing::Mapper::Resources::Resource.initialize now expects keyword arguments for only/except.
+# This patch ensures that it passes keyword arguments correctly.
+# Remove when https://github.com/JSONAPI-Resources/jsonapi-resources/issues/1488 is fixed
+
+if defined?(JSONAPI)
+  module ActionDispatch
+    module Routing
+      class Mapper
+        module Resources
+          class Resource
+            alias_method :original_initialize, :initialize
+
+            def initialize(entities, api_only, shallow, options = {})
+              # In Rails 8.1, initialize(entities, api_only, shallow, only: nil, except: nil, **options)
+              # and jsonapi-resources passes them in the options hash.
+              if options.is_a?(Hash)
+                only = options.delete(:only)
+                except = options.delete(:except)
+                original_initialize(entities, api_only, shallow, only: only, except: except, **options)
+              else
+                original_initialize(entities, api_only, shallow, options)
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+
+  module JSONAPI
+    module RoutingExt
+      module Mapper
+        def jsonapi_resource_scope(resource, resource_type)
+          # The original implementation uses Resource.new which we patched above.
+          # We need to make sure we don't break Rails 5/6/7/8 logic if it were to run there.
+          @scope = @scope.new(scope_level_resource: resource, jsonapi_resource: resource_type)
+
+          controller(resource.resource_scope) { yield }
+        ensure
+          @scope = @scope.parent
+        end
+      end
+    end
+  end
+end
@@ -421,6 +421,25 @@ describe Planting do
      planting.photos << @photo2
      expect(planting.default_photo).to eq @photo2
    end
+
+    describe '#thumbnail_url' do
+      let(:crop_photo) { create(:photo) }
+
+      it 'returns its own default photo if present' do
+        expect(planting.thumbnail_url).to eq photo.fullsize_url
+      end
+
+      it 'falls back to crop default photo if no planting photo is present' do
+        planting_without_photo = create(:planting, crop:)
+        PhotoAssociation.create!(photo: crop_photo, photographable: crop)
+        expect(planting_without_photo.thumbnail_url).to eq crop_photo.fullsize_url
+      end
+
+      it 'returns nil if neither planting nor crop has a photo' do
+        planting_without_photo = create(:planting, crop:)
+        expect(planting_without_photo.thumbnail_url).to be_nil
+      end
+    end
  end

  context 'interesting plantings' do
@@ -58,7 +58,9 @@ RSpec.configure do |config|
  config.around(:each, :search) do |example|
    Searchkick.callbacks(true) do
      index_everything
+
      example.run
+
      index_everything
    end
  end
@@ -735,9 +735,9 @@ fast-levenshtein@^2.0.6:
  integrity sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==

 fast-uri@^3.0.1:
-  version "3.1.2"
-  resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.2.tgz#8af3d4fc9d3e71b11572cc2673b514a7d1a8c8ec"
-  integrity sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==
+  version "3.1.5"
+  resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.5.tgz#610f37419a030270430cecd68d74e3d4d96725d0"
+  integrity sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==

 fastq@^1.6.0:
  version "1.20.1"
@@ -915,9 +915,9 @@ inherits@2, inherits@~2.0.3:
  integrity sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==

 ip-address@^10.0.1:
-  version "10.2.0"
-  resolved "https://registry.yarnpkg.com/ip-address/-/ip-address-10.2.0.tgz#805fc178b20c518bd4c8548b24fe30892d7f3206"
-  integrity sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==
+  version "10.4.0"
+  resolved "https://registry.yarnpkg.com/ip-address/-/ip-address-10.4.0.tgz#c5910bc541b6eae287765d1e4846be0308a05d93"
+  integrity sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==

 is-arrayish@^0.2.1:
  version "0.2.1"
@@ -964,9 +964,9 @@ js-tokens@^4.0.0:
  integrity sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==

 js-yaml@^4.1.0:
-  version "4.2.0"
-  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.2.0.tgz#2bd9e85682dd91bd469afb809d816043b3d49524"
-  integrity sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==
+  version "4.3.1"
+  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.3.1.tgz#01216c001d67f48e2cd560d708c7af21090a3848"
+  integrity sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==
  dependencies:
    argparse "^2.0.1"

@@ -1396,9 +1396,9 @@ supports-preserve-symlinks-flag@^1.0.0:
  integrity sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==

 systeminformation@^5.25.11:
-  version "5.31.6"
-  resolved "https://registry.yarnpkg.com/systeminformation/-/systeminformation-5.31.6.tgz#2da4979a7262974fd068a3a306ded30aed6127c0"
-  integrity sha512-Uv2b2uGGM6ns+26czgW2cYRabYdnswM0ddSOOlryHOaelzsmDSet1iM/NT7VOYxW8x/BW+HkY+b1Ve2pLTSGSA==
+  version "5.31.17"
+  resolved "https://registry.yarnpkg.com/systeminformation/-/systeminformation-5.31.17.tgz#60bd1cdaeb34212b5ad2410608ee47d41d2d8560"
+  integrity sha512-TvFA9iwDWlMjqZVlKIJ0Cy+Zgm9ttlMx0SMRwJDMNKyhlEKWBMb3+WRwDi/3dvHdWbexpos4Osp4U49p5WjB5g==

 to-regex-range@^5.0.1:
  version "5.0.1"
@@ -1463,9 +1463,9 @@ wrappy@1:
  integrity sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==

 ws@^8.17.1:
-  version "8.20.0"
-  resolved "https://registry.yarnpkg.com/ws/-/ws-8.20.0.tgz#4cd9532358eba60bc863aad1623dfb045a4d4af8"
-  integrity sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==
+  version "8.21.1"
+  resolved "https://registry.yarnpkg.com/ws/-/ws-8.21.1.tgz#045650cd4b1207809e7547146223c3814a9af586"
+  integrity sha512-+0NTnW77fFN/DjQi6k/Sq/Yvk4Sgajw7urW8V+asjXnRgDs9gyGkdb7EzgfhA4goXsRIZKE28fzIXBHEzhuiWw==

 y18n@^4.0.0:
  version "4.0.3"
@@ -1 +1 @@
 .4.9
 .4.10