Updates `jbuilder` from 2.14.1 to 2.15.0
- [Release notes](https://github.com/rails/jbuilder/releases)
- [Commits](https://github.com/rails/jbuilder/compare/v2.14.1...v2.15.0)
Updates `strong_migrations` from 2.7.0 to 2.8.0
- [Changelog](https://github.com/ankane/strong_migrations/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ankane/strong_migrations/compare/v2.7.0...v2.8.0)
Updates `omniauth-microsoft_graph` from 2.1.0 to 2.2.0
- [Release notes](https://github.com/synth/omniauth-microsoft_graph/releases)
- [Changelog](https://github.com/synth/omniauth-microsoft_graph/blob/main/CHANGELOG.md)
- [Commits](https://github.com/synth/omniauth-microsoft_graph/compare/2.1.0...2.2.0)
Updates `doorkeeper` from 5.9.0 to 5.9.1
- [Release notes](https://github.com/doorkeeper-gem/doorkeeper/releases)
- [Changelog](https://github.com/doorkeeper-gem/doorkeeper/blob/main/CHANGELOG.md)
- [Commits](https://github.com/doorkeeper-gem/doorkeeper/compare/v.5.9.0...v5.9.1)
Updates `dalli` from 5.0.2 to 5.0.4
- [Changelog](https://github.com/petergoldstein/dalli/blob/main/CHANGELOG.md)
- [Commits](https://github.com/petergoldstein/dalli/compare/v5.0.2...v5.0.4)
Updates `marcel` from 1.1.0 to 1.2.1
- [Release notes](https://github.com/rails/marcel/releases)
- [Commits](https://github.com/rails/marcel/compare/v1.1.0...v1.2.1)
Updates `aws-sdk-s3` from 1.222.0 to 1.223.0
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)
Updates `image_processing` from 1.14.0 to 2.0.0
- [Changelog](https://github.com/janko/image_processing/blob/master/CHANGELOG.md)
- [Commits](https://github.com/janko/image_processing/compare/v1.14.0...v2.0.0)
dependabot[bot] [Sat, 16 May 2026 06:18:51 +0000 (06:18 +0000)]
Bump the rubocop group across 1 directory with 2 updates
Bumps the rubocop group with 2 updates in the / directory: [rubocop](https://github.com/rubocop/rubocop) and [rubocop-rails](https://github.com/rubocop/rubocop-rails).
Updates `rubocop` from 1.86.1 to 1.86.2
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop/compare/v1.86.1...v1.86.2)
Updates `rubocop-rails` from 2.34.3 to 2.35.0
- [Release notes](https://github.com/rubocop/rubocop-rails/releases)
- [Changelog](https://github.com/rubocop/rubocop-rails/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop-rails/compare/v2.34.3...v2.35.0)
Amanda McCann [Fri, 15 May 2026 08:51:47 +0000 (10:51 +0200)]
Add ::1 (IPv6 local) to allowed http redirect_uris for OAuth
Allows one to do local testing and to use IPv6. Previously only IPv4 was
supported (127.0.0.1), but not ::1.
Related discussions:
https://github.com/openstreetmap/openstreetmap-website/pull/4287
https://github.com/openstreetmap/openstreetmap-website/issues/3613
Andy Allan [Tue, 12 May 2026 14:16:40 +0000 (15:16 +0100)]
Avoid string interpolation into bash commands
Although the `clone_url` and `sha` are safe, other similar aspects of
the pull request head are not (e.g. `head.ref`, `pull_request.title` etc)
and these must not be interpolated.
So let's use the convention of putting such data into environment
variables, where the contents are not interpolated into the bash
commands and are instead passed directly to the called program.
Andy Allan [Thu, 7 May 2026 09:51:14 +0000 (10:51 +0100)]
Remove pessimistic version constraints
We were ignoring them in dependabot so they aren't really necessary.
We can add constraints when we run into specific problems, but otherwise
we should be optimistic that, for the vast majority of cases, the new version
of a gem will either work fine as-is or will be flagged up by CI.
Andy Allan [Thu, 7 May 2026 09:42:13 +0000 (10:42 +0100)]
Remove explicit mini_racer dependency
This was originally added to constrain the transitive dependency (via rtlcss)
but the associated bug is now fixed and the version constraint was automatically
changed by dependabot anyway.
Andy Allan [Thu, 7 May 2026 08:48:37 +0000 (09:48 +0100)]
Remove minimum version constraints from Gemfile
It's very unlikely that a `bundle update` will:
* lead a version downgrade
* ... and that version falls below the nominal minimum version
* ... and that version causes a breakage
* ... and that breakage is not picked up by CI
It's therefore better for legibility and clarity of other constraints
if we remove the ones that aren't necessary.
dependabot[bot] [Wed, 6 May 2026 23:13:34 +0000 (23:13 +0000)]
Bump the dependencies group with 2 updates
Bumps the dependencies group with 2 updates: [leaflet.locatecontrol](https://github.com/domoritz/leaflet-locatecontrol) and [tag2link](https://github.com/JOSM/tag2link).
Updates `leaflet.locatecontrol` from 0.89.1 to 0.90.0
- [Changelog](https://github.com/domoritz/leaflet-locatecontrol/blob/gh-pages/CHANGELOG.md)
- [Commits](https://github.com/domoritz/leaflet-locatecontrol/compare/v0.89.1...v0.90.0)
Updates `tag2link` from 2026.3.21 to 2026.5.6
- [Release notes](https://github.com/JOSM/tag2link/releases)
- [Commits](https://github.com/JOSM/tag2link/compare/2026.3.21...2026.5.6)
dependabot[bot] [Wed, 6 May 2026 17:22:29 +0000 (17:22 +0000)]
Bump the dependencies group with 3 updates
Bumps the dependencies group with 3 updates: [bootsnap](https://github.com/rails/bootsnap), [bootstrap_form](https://github.com/bootstrap-ruby/bootstrap_form) and [minitest](https://github.com/minitest/minitest).
Updates `bootsnap` from 1.24.1 to 1.24.3
- [Release notes](https://github.com/rails/bootsnap/releases)
- [Changelog](https://github.com/rails/bootsnap/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rails/bootsnap/compare/v1.24.1...v1.24.3)
Updates `bootstrap_form` from 5.6.0 to 5.6.1
- [Release notes](https://github.com/bootstrap-ruby/bootstrap_form/releases)
- [Changelog](https://github.com/bootstrap-ruby/bootstrap_form/blob/main/CHANGELOG.md)
- [Commits](https://github.com/bootstrap-ruby/bootstrap_form/compare/v5.6.0...v5.6.1)
Updates `minitest` from 6.0.5 to 6.0.6
- [Changelog](https://github.com/minitest/minitest/blob/master/History.rdoc)
- [Commits](https://github.com/minitest/minitest/compare/v6.0.5...v6.0.6)
dependabot[bot] [Wed, 6 May 2026 17:20:02 +0000 (17:20 +0000)]
Bump the dependencies group with 3 updates
Bumps the dependencies group with 3 updates: [leaflet.locatecontrol](https://github.com/domoritz/leaflet-locatecontrol), [eslint](https://github.com/eslint/eslint) and [globals](https://github.com/sindresorhus/globals).
Updates `leaflet.locatecontrol` from 0.89.0 to 0.89.1
- [Changelog](https://github.com/domoritz/leaflet-locatecontrol/blob/gh-pages/CHANGELOG.md)
- [Commits](https://github.com/domoritz/leaflet-locatecontrol/compare/v0.89.0...v0.89.1)
Updates `eslint` from 10.2.1 to 10.3.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v10.2.1...v10.3.0)
Updates `globals` from 17.5.0 to 17.6.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](https://github.com/sindresorhus/globals/compare/v17.5.0...v17.6.0)
Matt Van Horn [Sat, 2 May 2026 07:01:30 +0000 (00:01 -0700)]
Cache social link platform and name at save time (#6950)
Cache rendered HTML fragment for social links using Rails.cache.fetch
instead of re-parsing URLs on every page load. This avoids repeated
regex matching and HTTP calls to resolve platform metadata.
Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
projects / rails.git / log