Merge pull request #4767 from Growstuff/bump-oauth-1.1.6

Bump oauth to 1.1.6
Merge pull request #4766 from Growstuff/bump-oauth-1.1.5
2026-09-09 12:39:16 -04:00 · 2026-08-23 18:03:46 +09:30 · 2026-08-23 18:00:37 +09:30 · 2026-08-23 18:00:25 +09:30 · 2026-08-23 18:00:09 +09:30 · 2026-08-23 17:58:45 +09:30
10 changed files with 190 additions and 91 deletions
@@ -1 +1 @@
-3.4.9
+3.4.10
@@ -1,4 +1,4 @@
-FROM ruby:3.4.9-trixie
+FROM ruby:3.4.10-trixie

 # Install system dependencies
 RUN apt-get update -qq && \
@@ -5,7 +5,9 @@ source 'https://rubygems.org'
 # Match ruby version in .ruby-version
 ruby File.read('.ruby-version')

-gem 'rails', '~> 8.0.0'
+gem 'rails', '~> 8.1.0'
+
+gem 'csv'

 # Keeping old sprockets
 # https://github.com/rails/sprockets-rails/issues/444#issuecomment-637817050
@@ -16,6 +18,7 @@ gem 'bundler', '>= 2.4.22'
 gem 'coffee-rails'
 gem 'haml'
 gem 'sassc-rails'
+gem 'oauth', '1.1.6' # Explicitly pinned, as the maintainer does huge (400 files, 45k lines) changes in point releases - required manual plus agentic security review.

 # API data
 gem 'jsonapi-resources'
@@ -33,29 +33,31 @@ GEM
 GEM
  remote: https://rubygems.org/
  specs:
-    actioncable (8.0.5.1)
-      actionpack (= 8.0.5.1)
-      activesupport (= 8.0.5.1)
+    action_text-trix (2.1.19)
+      railties
+    actioncable (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      nio4r (~> 2.0)
      websocket-driver (>= 0.6.1)
      zeitwerk (~> 2.6)
-    actionmailbox (8.0.5.1)
-      actionpack (= 8.0.5.1)
-      activejob (= 8.0.5.1)
-      activerecord (= 8.0.5.1)
-      activestorage (= 8.0.5.1)
-      activesupport (= 8.0.5.1)
+    actionmailbox (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      mail (>= 2.8.0)
-    actionmailer (8.0.5.1)
-      actionpack (= 8.0.5.1)
-      actionview (= 8.0.5.1)
-      activejob (= 8.0.5.1)
-      activesupport (= 8.0.5.1)
+    actionmailer (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      actionview (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      mail (>= 2.8.0)
      rails-dom-testing (~> 2.2)
-    actionpack (8.0.5.1)
-      actionview (= 8.0.5.1)
-      activesupport (= 8.0.5.1)
+    actionpack (8.1.3.1)
+      actionview (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      nokogiri (>= 1.8.5)
      rack (>= 2.2.4)
      rack-session (>= 1.0.1)
@@ -63,15 +65,16 @@ GEM
      rails-dom-testing (~> 2.2)
      rails-html-sanitizer (~> 1.6)
      useragent (~> 0.16)
-    actiontext (8.0.5.1)
-      actionpack (= 8.0.5.1)
-      activerecord (= 8.0.5.1)
-      activestorage (= 8.0.5.1)
-      activesupport (= 8.0.5.1)
+    actiontext (8.1.3.1)
+      action_text-trix (~> 2.1.15)
+      actionpack (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      globalid (>= 0.6.0)
      nokogiri (>= 1.8.5)
-    actionview (8.0.5.1)
-      activesupport (= 8.0.5.1)
+    actionview (8.1.3.1)
+      activesupport (= 8.1.3.1)
      builder (~> 3.1)
      erubi (~> 1.11)
      rails-dom-testing (~> 2.2)
@@ -86,29 +89,29 @@ GEM
    active_utils (3.6.0)
      activesupport (>= 4.2)
      i18n
-    activejob (8.0.5.1)
-      activesupport (= 8.0.5.1)
+    activejob (8.1.3.1)
+      activesupport (= 8.1.3.1)
      globalid (>= 0.3.6)
-    activemodel (8.0.5.1)
-      activesupport (= 8.0.5.1)
-    activerecord (8.0.5.1)
-      activemodel (= 8.0.5.1)
-      activesupport (= 8.0.5.1)
+    activemodel (8.1.3.1)
+      activesupport (= 8.1.3.1)
+    activerecord (8.1.3.1)
+      activemodel (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      timeout (>= 0.4.0)
-    activestorage (8.0.5.1)
-      actionpack (= 8.0.5.1)
-      activejob (= 8.0.5.1)
-      activerecord (= 8.0.5.1)
-      activesupport (= 8.0.5.1)
+    activestorage (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      marcel (~> 1.0)
-    activesupport (8.0.5.1)
+    activesupport (8.1.3.1)
      base64
-      benchmark (>= 0.3)
      bigdecimal
      concurrent-ruby (~> 1.0, >= 1.3.1)
      connection_pool (>= 2.2.5)
      drb
      i18n (>= 1.6, < 2)
+      json
      logger (>= 1.4.2)
      minitest (>= 5.1)
      securerandom (>= 0.3)
@@ -116,12 +119,16 @@ GEM
      uri (>= 0.13.1)
    addressable (2.9.0)
      public_suffix (>= 2.0.2, < 8.0)
+    anonymous_loader (0.1.3)
+      version_gem (~> 1.1, >= 1.1.14)
    ast (2.4.3)
+    auth-sanitizer (0.2.3)
+      version_gem (~> 1.1, >= 1.1.14)
    autoprefixer-rails (10.4.16.0)
      execjs (~> 2)
    aws-eventstream (1.4.0)
-    aws-partitions (1.1277.0)
-    aws-sdk-core (3.254.0)
+    aws-partitions (1.1279.0)
+    aws-sdk-core (3.254.1)
      aws-eventstream (~> 1, >= 1.3.0)
      aws-partitions (~> 1, >= 1.992.0)
      aws-sigv4 (~> 1.9)
@@ -132,21 +139,20 @@ GEM
    aws-sdk-kms (1.130.0)
      aws-sdk-core (~> 3, >= 3.254.0)
      aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.228.2)
-      aws-sdk-core (~> 3, >= 3.254.0)
+    aws-sdk-s3 (1.229.0)
+      aws-sdk-core (~> 3, >= 3.254.1)
      aws-sdk-kms (~> 1)
      aws-sigv4 (~> 1.5)
    aws-sigv4 (1.12.1)
      aws-eventstream (~> 1, >= 1.0.2)
-    axe-core-api (4.12.0)
+    axe-core-api (4.13.0)
      dumb_delegator
-    axe-core-capybara (4.12.0)
-      axe-core-api (= 4.12.0)
-    axe-core-rspec (4.12.0)
-      axe-core-api (= 4.12.0)
+    axe-core-capybara (4.13.0)
+      axe-core-api (= 4.13.0)
+    axe-core-rspec (4.13.0)
+      axe-core-api (= 4.13.0)
    base64 (0.3.0)
    bcrypt (3.1.22)
-    benchmark (0.5.0)
    better_errors (2.10.1)
      erubi (>= 1.0.0)
      rack (>= 0.9.0)
@@ -193,6 +199,7 @@ GEM
      image_processing (~> 1.1)
      marcel (~> 1.0.0)
      ssrf_filter (~> 1.0)
+    cgi (0.5.2)
    chartkick (5.2.1)
    childprocess (5.1.0)
      logger (~> 1.5)
@@ -217,11 +224,11 @@ GEM
      gli (>= 2.7.0)
      i18n (>= 0.6.4)
      rubyzip (>= 1.0.0)
-    csv (3.3.5)
+    csv (3.3.6)
    csv_shaper (1.4.0)
      activesupport (>= 3.0.0)
      csv
-    dalli (5.0.6)
+    dalli (5.1.0)
      logger
    database_cleaner (2.1.0)
      database_cleaner-active_record (>= 2, < 3)
@@ -259,7 +266,7 @@ GEM
    elasticsearch-transport (7.0.0)
      faraday
      multi_json
-    erb (6.0.6)
+    erb (6.0.7)
    erubi (1.13.1)
    execjs (2.10.1)
    factory_bot (6.5.5)
@@ -296,7 +303,8 @@ GEM
    gravatar-ultimate (2.0.0)
      activesupport (>= 2.3.14)
      rack
-    haml (7.2.2)
+    haml (7.4.1)
+      prism (>= 1.1.0)
      temple (>= 0.8.2)
      thor
      tilt
@@ -305,7 +313,7 @@ GEM
      activesupport (>= 5.1)
      haml (>= 4.0.6)
      railties (>= 5.1)
-    haml_lint (0.76.0)
+    haml_lint (0.77.0)
      haml (>= 5.0)
      parallel (>= 1.10)
      rainbow
@@ -347,7 +355,7 @@ GEM
    image_processing (1.14.0)
      mini_magick (>= 4.9.5, < 6)
      ruby-vips (>= 2.0.17, < 3)
-    io-console (0.8.2)
+    io-console (0.9.1)
    irb (1.18.0)
      pp (>= 0.6.0)
      prism (>= 1.3.0)
@@ -443,8 +451,18 @@ GEM
      racc (~> 1.4)
    nokogiri (1.19.4-x86_64-linux-gnu)
      racc (~> 1.4)
-    oauth (0.5.6)
-    oj (3.17.5)
+    oauth (1.1.6)
+      auth-sanitizer (~> 0.2, >= 0.2.1)
+      base64 (~> 0.1)
+      cgi
+      oauth-tty (~> 1.0, >= 1.0.8)
+      snaky_hash (~> 2.0, >= 2.0.5)
+      version_gem (~> 1.1, >= 1.1.11)
+    oauth-tty (1.0.13)
+      anonymous_loader (~> 0.1, >= 0.1.3)
+      auth-sanitizer (~> 0.2, >= 0.2.3)
+      version_gem (~> 1.1, >= 1.1.14)
+    oj (3.17.6)
      bigdecimal (>= 3.0)
      ostruct (>= 0.2)
    omniauth (1.9.2)
@@ -484,7 +502,7 @@ GEM
      nio4r (~> 2.0)
    query_diet (0.7.3)
    racc (1.8.1)
-    rack (2.2.23)
+    rack (2.2.24)
    rack-attack (6.8.0)
      rack (>= 1.0, < 4)
    rack-cors (2.0.2)
@@ -499,20 +517,20 @@ GEM
    rackup (1.0.1)
      rack (< 3)
      webrick
-    rails (8.0.5.1)
-      actioncable (= 8.0.5.1)
-      actionmailbox (= 8.0.5.1)
-      actionmailer (= 8.0.5.1)
-      actionpack (= 8.0.5.1)
-      actiontext (= 8.0.5.1)
-      actionview (= 8.0.5.1)
-      activejob (= 8.0.5.1)
-      activemodel (= 8.0.5.1)
-      activerecord (= 8.0.5.1)
-      activestorage (= 8.0.5.1)
-      activesupport (= 8.0.5.1)
+    rails (8.1.3.1)
+      actioncable (= 8.1.3.1)
+      actionmailbox (= 8.1.3.1)
+      actionmailer (= 8.1.3.1)
+      actionpack (= 8.1.3.1)
+      actiontext (= 8.1.3.1)
+      actionview (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activemodel (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      bundler (>= 1.15.0)
-      railties (= 8.0.5.1)
+      railties (= 8.1.3.1)
    rails-controller-testing (1.0.5)
      actionpack (>= 5.0.1.rc1)
      actionview (>= 5.0.1.rc1)
@@ -532,9 +550,9 @@ GEM
      rails_stdout_logging
    rails_serve_static_assets (0.0.5)
    rails_stdout_logging (0.0.5)
-    railties (8.0.5.1)
-      actionpack (= 8.0.5.1)
-      activesupport (= 8.0.5.1)
+    railties (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      irb (~> 1.13)
      rackup (>= 1.0.0)
      rake (>= 12.2)
@@ -547,7 +565,7 @@ GEM
    rb-fsevent (0.11.2)
    rb-inotify (0.11.1)
      ffi (~> 1.0)
-    rbs (4.1.0)
+    rbs (4.1.2)
      logger
      prism (>= 1.6.0)
      tsort
@@ -560,7 +578,7 @@ GEM
    redis-client (0.26.2)
      connection_pool
    regexp_parser (2.12.0)
-    reline (0.6.3)
+    reline (0.7.0)
      io-console (~> 0.5)
    request_store (1.7.0)
      rack (>= 1.4)
@@ -616,7 +634,7 @@ GEM
    rswag-ui (2.17.0)
      actionpack (>= 5.2, < 8.2)
      railties (>= 5.2, < 8.2)
-    rubocop (1.88.2)
+    rubocop (1.89.0)
      json (~> 2.3)
      language_server-protocol (~> 3.17.0.2)
      lint_roller (~> 1.1.0)
@@ -636,11 +654,11 @@ GEM
    rubocop-factory_bot (2.28.0)
      lint_roller (~> 1.1)
      rubocop (~> 1.72, >= 1.72.1)
-    rubocop-rails (2.36.0)
+    rubocop-rails (2.37.0)
      activesupport (>= 4.2.0)
      lint_roller (~> 1.1)
      rack (>= 1.1)
-      rubocop (>= 1.75.0, < 2.0)
+      rubocop (>= 1.89.0, < 2.0)
      rubocop-ast (>= 1.44.0, < 2.0)
    rubocop-rake (0.7.1)
      lint_roller (~> 1.1)
@@ -678,7 +696,7 @@ GEM
      activemodel (>= 6.1)
      hashie
    securerandom (0.4.1)
-    selenium-webdriver (4.46.0)
+    selenium-webdriver (4.47.0)
      base64 (~> 0.2)
      logger (~> 1.4)
      rexml (~> 3.2, >= 3.2.5)
@@ -693,6 +711,9 @@ GEM
    simple_po_parser (1.1.6)
    sitemap_generator (7.1.1)
      builder (~> 3.0)
+    snaky_hash (2.0.7)
+      hashie (>= 0.1.0, < 6)
+      version_gem (~> 1.1, >= 1.1.14)
    sprockets (3.7.5)
      base64
      concurrent-ruby (~> 1.0)
@@ -703,13 +724,13 @@ GEM
      sprockets (>= 3.0.0)
    ssrf_filter (1.5.0)
    sysexits (1.2.0)
-    temple (0.10.4)
+    temple (0.10.7)
    terminal-table (4.0.0)
      unicode-display_width (>= 1.1.1, < 4)
    terser (1.2.8)
      execjs (>= 0.3.0, < 3)
    thor (1.5.0)
-    tilt (2.8.0)
+    tilt (2.9.0)
    timecop (0.9.11)
    timeout (0.6.1)
    tsort (0.2.0)
@@ -728,6 +749,7 @@ GEM
      activemodel (>= 3.0.0)
      public_suffix
    vcr (6.4.0)
+    version_gem (1.1.15)
    warden (1.2.9)
      rack (>= 2.0.9)
    webrat (0.7.3)
@@ -748,7 +770,7 @@ GEM
      webrick
    xpath (3.2.0)
      nokogiri (~> 1.8)
-    zeitwerk (2.8.2)
+    zeitwerk (2.8.3)

 PLATFORMS
  ruby
@@ -779,6 +801,7 @@ DEPENDENCIES
  comfortable_mexican_sofa!
  connection_pool (< 3)
  crowdin-cli
+  csv
  csv_shaper
  dalli
  database_cleaner
@@ -816,6 +839,7 @@ DEPENDENCIES
  material_icons
  memcachier
  msgpack
+  oauth (= 1.1.6)
  oj
  omniauth (~> 1.3)
  omniauth-flickr (>= 0.0.15)
@@ -828,7 +852,7 @@ DEPENDENCIES
  rack-attack
  rack-cors
  rack-protection (>= 2.0.1)
-  rails (~> 8.0.0)
+  rails (~> 8.1.0)
  rails-assets-leaflet.markercluster!
  rails-controller-testing
  rails_12factor
@@ -868,7 +892,7 @@ DEPENDENCIES
  xmlrpc

 RUBY VERSION
-   ruby 3.4.9
+   ruby 3.4.10p104

 BUNDLED WITH
   2.4.22
@@ -18,9 +18,11 @@ module PhotoCapable
    def thumbnail_url
      df = default_photo

-      return unless df
-
-      df.source == 'flickr' ? df.fullsize_url : df.thumbnail_url
+      if df
+        df.source == 'flickr' ? df.fullsize_url : df.thumbnail_url
+      elsif respond_to?(:crop) && crop.present?
+        crop.thumbnail_url
+      end
    end

    def most_liked_photo
@@ -28,6 +28,7 @@ class PhotoAssociation < ApplicationRecord

  def photo_and_item_have_same_owner
    return if photographable_type == 'Crop'
+    return if photographable.blank?

    errors.add(:photo, :photo_owner_mismatch) unless photographable.owner_id == photo.owner_id
  end
@@ -14,7 +14,7 @@ Bundler.require(*Rails.groups)
 module Growstuff
  class Application < Rails::Application
    # Initialize configuration defaults for originally generated Rails version.
-    config.load_defaults 8.0
+    config.load_defaults 8.1

    # Rails 7.1+ requires a coder for `serialize`.
    # We set YAML as the default for compatibility with gems like Mexican Sofa.
@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+# JSONAPI::Resources (0.10.7) is currently incompatible with Rails 8.1
+# because ActionDispatch::Routing::Mapper::Resources::Resource.initialize now expects keyword arguments for only/except.
+# This patch ensures that it passes keyword arguments correctly.
+# Remove when https://github.com/JSONAPI-Resources/jsonapi-resources/issues/1488 is fixed
+
+if defined?(JSONAPI)
+  module ActionDispatch
+    module Routing
+      class Mapper
+        module Resources
+          class Resource
+            alias_method :original_initialize, :initialize
+
+            def initialize(entities, api_only, shallow, options = {})
+              # In Rails 8.1, initialize(entities, api_only, shallow, only: nil, except: nil, **options)
+              # and jsonapi-resources passes them in the options hash.
+              if options.is_a?(Hash)
+                only = options.delete(:only)
+                except = options.delete(:except)
+                original_initialize(entities, api_only, shallow, only: only, except: except, **options)
+              else
+                original_initialize(entities, api_only, shallow, options)
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+
+  module JSONAPI
+    module RoutingExt
+      module Mapper
+        def jsonapi_resource_scope(resource, resource_type)
+          # The original implementation uses Resource.new which we patched above.
+          # We need to make sure we don't break Rails 5/6/7/8 logic if it were to run there.
+          @scope = @scope.new(scope_level_resource: resource, jsonapi_resource: resource_type)
+
+          controller(resource.resource_scope) { yield }
+        ensure
+          @scope = @scope.parent
+        end
+      end
+    end
+  end
+end
@@ -421,6 +421,25 @@ describe Planting do
      planting.photos << @photo2
      expect(planting.default_photo).to eq @photo2
    end
+
+    describe '#thumbnail_url' do
+      let(:crop_photo) { create(:photo) }
+
+      it 'returns its own default photo if present' do
+        expect(planting.thumbnail_url).to eq photo.fullsize_url
+      end
+
+      it 'falls back to crop default photo if no planting photo is present' do
+        planting_without_photo = create(:planting, crop:)
+        PhotoAssociation.create!(photo: crop_photo, photographable: crop)
+        expect(planting_without_photo.thumbnail_url).to eq crop_photo.fullsize_url
+      end
+
+      it 'returns nil if neither planting nor crop has a photo' do
+        planting_without_photo = create(:planting, crop:)
+        expect(planting_without_photo.thumbnail_url).to be_nil
+      end
+    end
  end

  context 'interesting plantings' do
@@ -58,7 +58,9 @@ RSpec.configure do |config|
  config.around(:each, :search) do |example|
    Searchkick.callbacks(true) do
      index_everything
+
      example.run
+
      index_everything
    end
  end
@@ -1 +1 @@
 .4.9
 .4.10