oauth 1.1.9

v1.1.9

on Ruby Gems

1.1.9 - 2026-11-07

• TAG: v1.1.9
• COVERAGE: 88.05% -- 862/979 lines in 34 files
• BRANCH COVERAGE: 62.63% -- 176/281 branches in 34 files
• 41.57% documented

Added

• access_token_cross_origin_requests consumer option (default false): AccessToken#request now refuses an absolute service URI whose origin differs from the configured :site, raising OAuth::Error, so the signed OAuth Authorization header is not sent to a different host. Same-origin absolute URIs and relative paths are unaffected. Set the option to true to restore cross-origin service calls. [CWE-918]

• kettle-jem-template-20260720-001 - READMEs can now display configured
  corporate sponsor logos.

• Spec coverage for OAuth::Client::Helper, the query_string OAuth signing scheme in
  lib/oauth/client/net_http.rb, and the OAuth::Error/OAuth::Unauthorized/OAuth::Problem
  classes — none previously had a dedicated spec file.

• kettle-jem-template-20260720-005 - README Support & Community links now
  include RubyForum.

• kettle-jem-template-20260726-001 - Projects now include YARD lint
  configuration and documentation dependencies so documentation issues fail
  before generated docs are refreshed.

• kettle-jem-template-20260727-001 - Spec harness documentation now lists the
  RSpec helpers provided by kettle-test.

• kettle-jem-template-20260729-005 - Gemspec metadata now publishes this
  project's RubyForum tag as mailing_list_uri, and support docs link to the
  tagged RubyForum community alongside Discord.

• kettle-jem-template-20260913-001 - Templating now also surfaces a review
  entry in dependency_conflicts.resolve when a direct development
  dependency doesn't support one or more of this project's declared
  engines: and has no template-managed modular home (e.g. sqlite3 on
  jruby). Review each entry and pick a resolution per the project's own
  engine support needs.

Changed

• [kc] kettle-jem/prepare: updated 22 project files:

  • configuration (2)
  • dependencies (20)

• [kc] kettle-jem/template: updated 51 project files:

  • code and tests (3)
  • dependencies (7)
  • documentation (2)
  • other (4)
  • workflows (35)

• Dependency floors raised to the latest releases, including auth-sanitizer >= 0.2.4 (Hash#inspect redaction in debug logging, GHSA-cmh8-5q25-68v6).

• kettle-jem-template-20260716-002 - Generated gemspec manifests now ship fewer
  repository-only files by default to reduce downstream distro packaging churn.

• kettle-jem-template-20260720-002 - Development Gemfiles now use the released
  tree_sitter_language_pack gem 1.13.3 or newer by default.

• kettle-jem-template-20260725-002 - Version specs now use anonymous_loader to
  cover version.rb without redefining constants, or are removed when version
  specs are not managed for the project.

• kettle-jem-template-20260728-001 - Generated Ruby workflows now use clearer
  setup-ruby-flash planning and can prepare appraisal-only jobs without
  installing the main Gemfile bundle.

• kettle-jem-template-20260801-001 - Generated README gem dashboard links now
  use ClickGems instead of BestGems.

• [kc] kettle-jem/prepare: updated 15 project files:

  • configuration (1)
  • dependencies (14)

• [kc] kettle-jem/template: updated 50 project files:

  • code and tests (1)
  • configuration (1)
  • dependencies (12)
  • documentation (1)
  • other (3)
  • workflows (32)

Fixed

• Token inspection specs no longer treat hexadecimal object identifiers as leaked secrets.

• kettle-jem-template-20260720-003 - StructuredMerge Git diff driver config now
  uses the installed smorg-rb driver command.

• kettle-jem-template-20260725-001 - Release pull request branches beginning
  with feature/release now run JRuby and TruffleRuby workflows.

• kettle-jem-template-20260726-002 - Generated version files now document their
  version namespace and constants, reducing warning-only YARD lint output.

• kettle-jem-template-20260726-003 - Coverage upload steps now treat Coveralls,
  QLTY, and Codecov as optional, so provider outages do not fail CI when local
  coverage thresholds still pass.

• kettle-jem-template-20260728-002 - Generated RuboCop configs now ignore the
  same gemfiles/vendor/bundle tree as .gitignore, so vendored dependency
  installs are not reported as project lint debt.

• kettle-jem-template-20260728-003 - Generated dep-heads workflows now run
  TruffleRuby jobs with current RubyGems and Bundler, avoiding setup failures
  before the test suite starts.

• kettle-jem-template-20260728-004 - Generated dep-heads workflows now use the
  setup-ruby Bundler install path for direct appraisal Gemfiles, avoiding rv
  lockfile parser failures on Git and path dependencies.

• kettle-jem-template-20260728-005 - VersionGem bootstrap now creates the
  missing canonical version spec when a project only has shim namespace version
  specs.

• kettle-jem-template-20260729-001 - Generated JRuby 9.4 workflows now use the
  legacy manual bundle install path, avoiding setup-time Bundler full-index
  failures against gem.coop.

• kettle-jem-template-20260730-001 - Gemspec package file enumeration now runs
  relative to the gemspec directory, so release package contents stay correct
  even when the gemspec is loaded from another working directory.

• Remove duplicate loading of the version file from the public entrypoint.

• kettle-jem-template-20260801-002 - Generated RSpec helpers now normalize
  managed configuration block bindings structurally, preventing mixed block
  parameter names from producing invalid configuration after a merge.

• kettle-jem-template-20260801-003 - Generated project metadata and
  documentation now normalize configured underscore hostnames to valid
  hyphenated hostnames.

• kettle-jem-template-20260801-004 - Generated organization README logos now
  use GitHub's stable organization avatar endpoint instead of assuming a
  matching Galtzo-hosted asset exists.

• kettle-jem-template-20260802-001 - Devcontainer JSON files now merge as JSONC,
  preserving comments and trailing commas during template updates.

• Exclude optional OAuth adapters from the default coverage scope.

Community support 👉️

Many paths lead to being a sponsor or a backer of this project. Are you on such a path?