Martin Raifer [Thu, 4 Jun 2026 13:20:21 +0000 (15:20 +0200)]
fix detection of automatic hash changes for out-of-order events
see https://github.com/openstreetmap/iD/issues/10700#issuecomment-4615707609
Normally, the `onIframeHashChange` event is immediately followed by the respective `hashchange` event. But in some conditions (when the js main thread is busy with something else), it can happen that multiple `onIframeHashChange` events/messages are received right after each other, before the respective `hashchange` events are called.
The mechanism that detects wheter a hash change was "automatic" (set programmatically from inside the iframe by iD) relies on the order of events to function correctly.
This fixes the implementation by remembering which concrete hashchanges were triggered by the iframe message, avoiding duplicate/nop changes, and only updating the editor's map location if the hash change really did not come from the iD iframe itself.
Updates `bootsnap` from 1.24.5 to 1.24.6
- [Release notes](https://github.com/rails/bootsnap/releases)
- [Changelog](https://github.com/rails/bootsnap/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rails/bootsnap/compare/v1.24.5...v1.24.6)
Updates `doorkeeper-openid_connect` from 1.9.0 to 1.10.1
- [Release notes](https://github.com/doorkeeper-gem/doorkeeper-openid_connect/releases)
- [Changelog](https://github.com/doorkeeper-gem/doorkeeper-openid_connect/blob/master/CHANGELOG.md)
- [Commits](https://github.com/doorkeeper-gem/doorkeeper-openid_connect/compare/v1.9.0...v1.10.1)
Updates `aws-sdk-s3` from 1.224.0 to 1.225.0
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)
Updates `image_processing` from 2.0.1 to 2.0.2
- [Changelog](https://github.com/janko/image_processing/blob/master/CHANGELOG.md)
- [Commits](https://github.com/janko/image_processing/compare/v2.0.1...v2.0.2)
Updates `overcommit` from 0.69.0 to 0.70.0
- [Release notes](https://github.com/sds/overcommit/releases)
- [Changelog](https://github.com/sds/overcommit/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sds/overcommit/compare/v0.69.0...v0.70.0)
dependabot[bot] [Thu, 4 Jun 2026 03:32:07 +0000 (03:32 +0000)]
Bump the dependencies group with 2 updates
Bumps the dependencies group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [devcontainers/ci](https://github.com/devcontainers/ci).
Updates `actions/checkout` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10)
Updates `dalli` from 5.0.4 to 5.0.5
- [Changelog](https://github.com/petergoldstein/dalli/blob/main/CHANGELOG.md)
- [Commits](https://github.com/petergoldstein/dalli/compare/v5.0.4...v5.0.5)
Updates `opentelemetry-instrumentation-all` from 0.93.0 to 0.94.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-ruby-contrib/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-ruby-contrib/compare/opentelemetry-instrumentation-all/v0.93.0...opentelemetry-instrumentation-all/v0.94.0)
Updates `aws-sdk-s3` from 1.223.0 to 1.224.0
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)
Updates `image_processing` from 2.0.0 to 2.0.1
- [Changelog](https://github.com/janko/image_processing/blob/master/CHANGELOG.md)
- [Commits](https://github.com/janko/image_processing/compare/v2.0.0...v2.0.1)
Updates `jwt` from 2.10.2 to 2.10.3
- [Release notes](https://github.com/jwt/ruby-jwt/releases)
- [Changelog](https://github.com/jwt/ruby-jwt/blob/main/CHANGELOG.md)
- [Commits](https://github.com/jwt/ruby-jwt/compare/v2.10.2...v2.10.3)
Updates `puma` from 8.0.1 to 8.0.2
- [Release notes](https://github.com/puma/puma/releases)
- [Changelog](https://github.com/puma/puma/blob/main/History.md)
- [Commits](https://github.com/puma/puma/compare/v8.0.1...v8.0.2)
Updates `database_consistency` from 3.0.4 to 3.0.5
- [Changelog](https://github.com/djezzzl/database_consistency/blob/master/CHANGELOG.md)
- [Commits](https://github.com/djezzzl/database_consistency/compare/v3.0.4...v3.0.5)
Updates `jbuilder` from 2.14.1 to 2.15.0
- [Release notes](https://github.com/rails/jbuilder/releases)
- [Commits](https://github.com/rails/jbuilder/compare/v2.14.1...v2.15.0)
Updates `strong_migrations` from 2.7.0 to 2.8.0
- [Changelog](https://github.com/ankane/strong_migrations/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ankane/strong_migrations/compare/v2.7.0...v2.8.0)
Updates `omniauth-microsoft_graph` from 2.1.0 to 2.2.0
- [Release notes](https://github.com/synth/omniauth-microsoft_graph/releases)
- [Changelog](https://github.com/synth/omniauth-microsoft_graph/blob/main/CHANGELOG.md)
- [Commits](https://github.com/synth/omniauth-microsoft_graph/compare/2.1.0...2.2.0)
Updates `doorkeeper` from 5.9.0 to 5.9.1
- [Release notes](https://github.com/doorkeeper-gem/doorkeeper/releases)
- [Changelog](https://github.com/doorkeeper-gem/doorkeeper/blob/main/CHANGELOG.md)
- [Commits](https://github.com/doorkeeper-gem/doorkeeper/compare/v.5.9.0...v5.9.1)
Updates `dalli` from 5.0.2 to 5.0.4
- [Changelog](https://github.com/petergoldstein/dalli/blob/main/CHANGELOG.md)
- [Commits](https://github.com/petergoldstein/dalli/compare/v5.0.2...v5.0.4)
Updates `marcel` from 1.1.0 to 1.2.1
- [Release notes](https://github.com/rails/marcel/releases)
- [Commits](https://github.com/rails/marcel/compare/v1.1.0...v1.2.1)
Updates `aws-sdk-s3` from 1.222.0 to 1.223.0
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)
Updates `image_processing` from 1.14.0 to 2.0.0
- [Changelog](https://github.com/janko/image_processing/blob/master/CHANGELOG.md)
- [Commits](https://github.com/janko/image_processing/compare/v1.14.0...v2.0.0)
dependabot[bot] [Sat, 16 May 2026 06:18:51 +0000 (06:18 +0000)]
Bump the rubocop group across 1 directory with 2 updates
Bumps the rubocop group with 2 updates in the / directory: [rubocop](https://github.com/rubocop/rubocop) and [rubocop-rails](https://github.com/rubocop/rubocop-rails).
Updates `rubocop` from 1.86.1 to 1.86.2
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop/compare/v1.86.1...v1.86.2)
Updates `rubocop-rails` from 2.34.3 to 2.35.0
- [Release notes](https://github.com/rubocop/rubocop-rails/releases)
- [Changelog](https://github.com/rubocop/rubocop-rails/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop-rails/compare/v2.34.3...v2.35.0)
Amanda McCann [Fri, 15 May 2026 08:51:47 +0000 (10:51 +0200)]
Add ::1 (IPv6 local) to allowed http redirect_uris for OAuth
Allows one to do local testing and to use IPv6. Previously only IPv4 was
supported (127.0.0.1), but not ::1.
Related discussions:
https://github.com/openstreetmap/openstreetmap-website/pull/4287
https://github.com/openstreetmap/openstreetmap-website/issues/3613
Andy Allan [Tue, 12 May 2026 14:16:40 +0000 (15:16 +0100)]
Avoid string interpolation into bash commands
Although the `clone_url` and `sha` are safe, other similar aspects of
the pull request head are not (e.g. `head.ref`, `pull_request.title` etc)
and these must not be interpolated.
So let's use the convention of putting such data into environment
variables, where the contents are not interpolated into the bash
commands and are instead passed directly to the called program.
Andy Allan [Thu, 7 May 2026 09:51:14 +0000 (10:51 +0100)]
Remove pessimistic version constraints
We were ignoring them in dependabot so they aren't really necessary.
We can add constraints when we run into specific problems, but otherwise
we should be optimistic that, for the vast majority of cases, the new version
of a gem will either work fine as-is or will be flagged up by CI.
Andy Allan [Thu, 7 May 2026 09:42:13 +0000 (10:42 +0100)]
Remove explicit mini_racer dependency
This was originally added to constrain the transitive dependency (via rtlcss)
but the associated bug is now fixed and the version constraint was automatically
changed by dependabot anyway.
Andy Allan [Thu, 7 May 2026 08:48:37 +0000 (09:48 +0100)]
Remove minimum version constraints from Gemfile
It's very unlikely that a `bundle update` will:
* lead a version downgrade
* ... and that version falls below the nominal minimum version
* ... and that version causes a breakage
* ... and that breakage is not picked up by CI
It's therefore better for legibility and clarity of other constraints
if we remove the ones that aren't necessary.
dependabot[bot] [Wed, 6 May 2026 23:13:34 +0000 (23:13 +0000)]
Bump the dependencies group with 2 updates
Bumps the dependencies group with 2 updates: [leaflet.locatecontrol](https://github.com/domoritz/leaflet-locatecontrol) and [tag2link](https://github.com/JOSM/tag2link).
Updates `leaflet.locatecontrol` from 0.89.1 to 0.90.0
- [Changelog](https://github.com/domoritz/leaflet-locatecontrol/blob/gh-pages/CHANGELOG.md)
- [Commits](https://github.com/domoritz/leaflet-locatecontrol/compare/v0.89.1...v0.90.0)
Updates `tag2link` from 2026.3.21 to 2026.5.6
- [Release notes](https://github.com/JOSM/tag2link/releases)
- [Commits](https://github.com/JOSM/tag2link/compare/2026.3.21...2026.5.6)
dependabot[bot] [Wed, 6 May 2026 17:22:29 +0000 (17:22 +0000)]
Bump the dependencies group with 3 updates
Bumps the dependencies group with 3 updates: [bootsnap](https://github.com/rails/bootsnap), [bootstrap_form](https://github.com/bootstrap-ruby/bootstrap_form) and [minitest](https://github.com/minitest/minitest).
Updates `bootsnap` from 1.24.1 to 1.24.3
- [Release notes](https://github.com/rails/bootsnap/releases)
- [Changelog](https://github.com/rails/bootsnap/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rails/bootsnap/compare/v1.24.1...v1.24.3)
Updates `bootstrap_form` from 5.6.0 to 5.6.1
- [Release notes](https://github.com/bootstrap-ruby/bootstrap_form/releases)
- [Changelog](https://github.com/bootstrap-ruby/bootstrap_form/blob/main/CHANGELOG.md)
- [Commits](https://github.com/bootstrap-ruby/bootstrap_form/compare/v5.6.0...v5.6.1)
Updates `minitest` from 6.0.5 to 6.0.6
- [Changelog](https://github.com/minitest/minitest/blob/master/History.rdoc)
- [Commits](https://github.com/minitest/minitest/compare/v6.0.5...v6.0.6)
dependabot[bot] [Wed, 6 May 2026 17:20:02 +0000 (17:20 +0000)]
Bump the dependencies group with 3 updates
Bumps the dependencies group with 3 updates: [leaflet.locatecontrol](https://github.com/domoritz/leaflet-locatecontrol), [eslint](https://github.com/eslint/eslint) and [globals](https://github.com/sindresorhus/globals).
Updates `leaflet.locatecontrol` from 0.89.0 to 0.89.1
- [Changelog](https://github.com/domoritz/leaflet-locatecontrol/blob/gh-pages/CHANGELOG.md)
- [Commits](https://github.com/domoritz/leaflet-locatecontrol/compare/v0.89.0...v0.89.1)
Updates `eslint` from 10.2.1 to 10.3.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v10.2.1...v10.3.0)
Updates `globals` from 17.5.0 to 17.6.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](https://github.com/sindresorhus/globals/compare/v17.5.0...v17.6.0)
projects / rails.git / log