Bump doorkeeper from 5.8.2 to 5.9.2

[dependabot]

Bumps doorkeeper from 5.8.2 to 5.9.2.

Release notes

Sourced from doorkeeper's releases.

v5.9.2

• #1822#1823#1825 Update Rubocop config, auto-corrections and codebase cleanup.
• #1830 Fix NameError: uninitialized constant ApplicationRecord on rails db:seed (and other non-eager-loading flows) caused by on_load(:active_record) firing re-entrantly during ApplicationRecord autoload. The orm hooks no longer depend on ActiveSupport.on_load(:active_record); model concerns (Ownership, PolymorphicResourceOwner::ForAccessGrant, PolymorphicResourceOwner::ForAccessToken) are now wired up from each Mixins::* included block, which fires at parent-class autoload time — after Doorkeeper.configure has applied user settings and without re-entering the AR load chain.
  • Upgrade note: fully custom model classes that don't include Doorkeeper::Orm::ActiveRecord::Mixins::{Application,AccessToken,AccessGrant} will no longer auto-receive Ownership / PolymorphicResourceOwner concerns (previously injected by run_orm_hooks via the configured class name). Either inherit from the Doorkeeper default model, include the corresponding Mixins::* module, or include the concerns directly.

v5.9.1

• #1781 Honor handle_auth_errors :raise in AuthorizationsController#authorize_response

• #1795 Fix: detailed error 'insufficient_scope' in protected resources 403s

• #1797 Fix doorkeeper:db:cleanup rake task failure on PostgreSQL

• #1800 Set @grant_type in ClientCredentialsRequest and RefreshTokenRequest constructors so request.grant_type returns the correct value in hooks like before_successful_strategy_response.

• #1802 Fix filter_parameters not applied when Doorkeeper.configure is called inside to_prepare.

• #1804 Use ActiveSupport.on_load(:active_record) in ORM hooks to prevent loading ActiveRecord models too early

• #1806 Fix token revocation bypass for public clients (RFC 7009)

• #1815 Expose current_resource_owner as a view helper in Doorkeeper::ApplicationController.

• #1818 Fix token introspection returning exp: 0 for non-expiring tokens.

• #1784 Remove hardcoded colons from view templates, move punctuation to i18n translation strings.

  [IMPORTANT]: if you have customized Doorkeeper views (authorizations/new, authorizations/show, applications/show) or overridden the default en.yml translations, you may need to update them. Colons are no longer hardcoded in the views — they are now part of the translation strings. Update the doorkeeper-i18n gem to get the updated translations for all locales.

• #1820 Remove dead wildcard presence check in Scopes#dynamic_scope_match? (internal cleanup, no behavior change).

• #1822 Update Rubocop config, auto-corrections.

• #1823 Update Rubocop config, part 2.

• #1825 Update Rubocop config, part 3.

• #1821 Fix noisy Could not find command "no_previous_refresh_token_column?" Thor output during the PreviousRefreshTokenGenerator spec by stubbing the underlying DB column check instead of the generator's private method (test-only change).

v.5.9.0

• #1791 Add support for Rails read replicas with automatic role switching via enable_multiple_database_roles configuration option
• #1792 Consider expires_in when clear expired tokens with StaleRecordsCleaner.
• #1790 Fix race condition in refresh token revocation check by moving InvalidGrantReuse check inside the lock block
• #1788 Fix regex for basic auth to be case-insensitive
• #1775 Fix Applications Secret Not Null Constraint generator
• #1779 Only lock previous access token model when creating a new token from its refresh token if revoke_previous_refresh_token_on_use is false
• #1778 Ensure that token revocation is idempotent by checking that that token has not already been revoked before revoking.

Changelog

Sourced from doorkeeper's changelog.

5.9.2

• #1822#1823#1825 Update Rubocop config, auto-corrections and codebase cleanup.
• #1830 Fix NameError: uninitialized constant ApplicationRecord on rails db:seed (and other non-eager-loading flows) caused by on_load(:active_record) firing re-entrantly during ApplicationRecord autoload. The orm hooks no longer depend on ActiveSupport.on_load(:active_record); model concerns (Ownership, PolymorphicResourceOwner::ForAccessGrant, PolymorphicResourceOwner::ForAccessToken) are now wired up from each Mixins::* included block, which fires at parent-class autoload time — after Doorkeeper.configure has applied user settings and without re-entering the AR load chain.
  • Upgrade note: fully custom model classes that don't include Doorkeeper::Orm::ActiveRecord::Mixins::{Application,AccessToken,AccessGrant} will no longer auto-receive Ownership / PolymorphicResourceOwner concerns (previously injected by run_orm_hooks via the configured class name). Either inherit from the Doorkeeper default model, include the corresponding Mixins::* module, or include the concerns directly.

5.9.1

• #1781 Honor handle_auth_errors :raise in AuthorizationsController#authorize_response

• #1795 Fix: detailed error 'insufficient_scope' in protected resources 403s

• #1797 Fix doorkeeper:db:cleanup rake task failure on PostgreSQL

• #1800 Set @grant_type in ClientCredentialsRequest and RefreshTokenRequest constructors so request.grant_type returns the correct value in hooks like before_successful_strategy_response.

• #1802 Fix filter_parameters not applied when Doorkeeper.configure is called inside to_prepare.

• #1804 Use ActiveSupport.on_load(:active_record) in ORM hooks to prevent loading ActiveRecord models too early

• #1806 Fix token revocation bypass for public clients (RFC 7009)

• #1815 Expose current_resource_owner as a view helper in Doorkeeper::ApplicationController.

• #1818 Fix token introspection returning exp: 0 for non-expiring tokens.

• #1784 Remove hardcoded colons from view templates, move punctuation to i18n translation strings.

  [IMPORTANT]: if you have customized Doorkeeper views (authorizations/new, authorizations/show, applications/show) or overridden the default en.yml translations, you may need to update them. Colons are no longer hardcoded in the views — they are now part of the translation strings. Update the doorkeeper-i18n gem to get the updated translations for all locales.

• #1820 Remove dead wildcard presence check in Scopes#dynamic_scope_match? (internal cleanup, no behavior change).

• #1822 Update Rubocop config, auto-corrections.

• #1823 Update Rubocop config, part 2.

• #1825 Update Rubocop config, part 3.

• #1821 Fix noisy Could not find command "no_previous_refresh_token_column?" Thor output during the PreviousRefreshTokenGenerator spec by stubbing the underlying DB column check instead of the generator's private method (test-only change).

5.9.0

• #1791 Add support for Rails read replicas with automatic role switching via enable_multiple_database_roles configuration option
• #1792 Consider expires_in when clear expired tokens with StaleRecordsCleaner.
• #1790 Fix race condition in refresh token revocation check by moving InvalidGrantReuse check inside the lock block
• #1788 Fix regex for basic auth to be case-insensitive
• #1775 Fix Applications Secret Not Null Constraint generator
• #1779 Only lock previous access token model when creating a new token from its refresh token if revoke_previous_refresh_token_on_use is false
• #1778 Ensure that token revocation is idempotent by checking that that token has not already been revoked before revoking.

Commits

• f278711 Release 5.9.2 🎉
• d83beb8 Merge pull request #1830 from 55728/refactor/1828-mixins-included-no-on-load
• ab58c37 Wire model concerns from Mixin included blocks, drop on_load(:active_record)
• 3666790 [ci skip] AGENTS.md update
• 7ae6104 [ci skip] AGENTS.md update
• c68d2a1 Merge pull request #1827 from doorkeeper-gem/dependabot/github_actions/action...
• 549e6f9 Merge pull request #1826 from doorkeeper-gem/dependabot/github_actions/dorny/...
• f4e5fd5 Bump actions/checkout from 4 to 6
• ec8873e Bump dorny/paths-filter from 3 to 4
• 3f5a58d Release 5.9.1 🎉
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)