Bump doorkeeper from 5.4.0 to 5.5.0

[dependabot]

Bumps doorkeeper from 5.4.0 to 5.5.0.

Release notes

Sourced from doorkeeper's releases.

v5.5.0

• #1482 Simplify TokenInfoController to be overridable (extract response rendering).
• #1478 Fix ownership association and Rake tasks when custom models configured.
• #1477 Respect ActiveRecord::Base.pluralize_table_names for Doorkeeper table names.

v5.5.0.rc2

• #1473 Enable Applications and AuthorizedApplications controllers in API mode.

  [IMPORTANT] you can still skip these controllers using skip_controllers in use_doorkeeper inside routes.rb. Please do it in case you don't need them.

• #1472 Fix establish_connection configuration for custom defined models.

• #1471 Add support for Ruby 3.0.

• #1469 Check if redirect_uri exists.

• #1465 Memoize nil doorkeeper_token.

• #1459 Use built-in Ruby option to remove padding in PKCE code challenge value.

• #1457 Make owner_id a bigint for newly-generated owner migrations

• #1452 Empty previous_refresh_token only if present.

• #1440 Validate empty host in redirect_uri.

• #1438 Add form post response mode.

• #1458 Make config.skip_client_authentication_for_password_grant a long term configuration option.

v5.5.0.rc1

• #1435 Make error response not redirectable when client is unauthorized

• #1426 Ensure ActiveRecord callbacks are executed on token revocation.

• #1407 Remove redundant and complex to support helpers froms tests (should_have_json, etc).

• #1416 Don't add introspection route if token introspection completely disabled.

• #1410 Properly memoize current_resource_owner value (consider nil and false values).

• #1415 Ignore PKCE params for non-PKCE grants.

• #1418 Add ability to register custom OAuth Grant Flows.

• #1420 Require client authentication for Resource Owner Password Grant as stated in OAuth RFC.

  [IMPORTANT] you need to create a new OAuth client (Doorkeeper::Application) if yoo didn't have it before and use client credentials in HTTP Basic auth if you previously used this grant flow without client authentication. For migration purposes you could enable skip_client_authentication_for_password_grant configuration option to true, but such behavior (as well as configuration option) would be completely removed in a future version of Doorkeeper. All the users of your provider application now need to include client credentials when they use this grant flow.

• #1421 Add Resource Owner instance to authorization hook context for custom_access_token_expires_in configuration option to allow resource owner based Access Tokens TTL.

Changelog

Sourced from doorkeeper's changelog.

5.5.0

• #1482 Simplify TokenInfoController to be overridable (extract response rendering).
• #1478 Fix ownership association and Rake tasks when custom models configured.
• #1477 Respect ActiveRecord::Base.pluralize_table_names for Doorkeeper table names.

5.5.0.rc2

• #1473 Enable Applications and AuthorizedApplications controllers in API mode.

  [IMPORTANT] you can still skip these controllers using skip_controllers in use_doorkeeper inside routes.rb. Please do it in case you don't need them.

• #1472 Fix establish_connection configuration for custom defined models.

• #1471 Add support for Ruby 3.0.

• #1469 Check if redirect_uri exists.

• #1465 Memoize nil doorkeeper_token.

• #1459 Use built-in Ruby option to remove padding in PKCE code challenge value.

• #1457 Make owner_id a bigint for newly-generated owner migrations

• #1452 Empty previous_refresh_token only if present.

• #1440 Validate empty host in redirect_uri.

• #1438 Add form post response mode.

• #1458 Make config.skip_client_authentication_for_password_grant a long term configuration option.

5.5.0.rc1

• #1435 Make error response not redirectable when client is unauthorized

• #1426 Ensure ActiveRecord callbacks are executed on token revocation.

• #1407 Remove redundant and complex to support helpers froms tests (should_have_json, etc).

• #1416 Don't add introspection route if token introspection completely disabled.

• #1410 Properly memoize current_resource_owner value (consider nil and false values).

• #1415 Ignore PKCE params for non-PKCE grants.

• #1418 Add ability to register custom OAuth Grant Flows.

• #1420 Require client authentication for Resource Owner Password Grant as stated in OAuth RFC.

  [IMPORTANT] you need to create a new OAuth client (Doorkeeper::Application) if you didn't have it before and use client credentials in HTTP Basic auth if you previously used this grant flow without client authentication. To opt out of this you could set the skip_client_authentication_for_password_grant configuration option to true, but note that this is in violation of the OAuth spec and represents a security risk. All the users of your provider application now need to include client credentials when they use this grant flow.

• #1421 Add Resource Owner instance to authorization hook context for custom_access_token_expires_in configuration option to allow resource owner based Access Tokens TTL.

Commits

• bb00082 Release 5.5.0 🎉
• c7c2c9c Use main instead of master
• ceeac7d Update Rubocop version in gemfiles
• eb6ed6e Merge pull request #1482 from doorkeeper-gem/simplify-token-info-customization
• da9e3c6 Simplify TokenInfoController to be overridable (extract response rendering)
• e7efd51 Merge pull request #1481 from doorkeeper-gem/update-travis-config
• 2c217ff Update Travis config to use Rails 6.1
• 55488cc Merge pull request #1478 from doorkeeper-gem/fix-ownership
• ac4cece Fix ownership association and Rake tasks
• d3dcfb6 Merge pull request #1477 from doorkeeper-gem/respect-table-name-pluralization
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #103.