Bump version and push to Rubygems

[gabceb]

Please 😔

[teeparham]

@mbleigh can I help triage issues / test to get a new release out? Releasing a new gem with the updated oauth2 dependency would be nice, at least.

[axilleas]

👍 I am trying to package the auth family gems for Fedora and this is somehow a stopper.

[BlakeLucchesi]

The easiest/recommended way to get around this is to specify a git or github location in your gemfile so that it pulls the latest code when bundling:

gem 'omniauth-oauth2', github: 'intridea/omniauth-oauth2'

if you want to use a specific version tag/branch -- notice: if you use v1.1.1 of omniauth-oauth2 it will only work with oauth2 "~> 0.8.0", so you'll probably want to use my example above.

gem 'omniauth-oauth2', :git => 'git://github.com/intridea/omniauth-oauth2.git', :tag: => 'v1.1.1'

[BlakeLucchesi]

alternatively, you may fork the code, mark a new tag and use your new tag if you really want to use the latest version of oauth2 but don't want to just automatically pull in any new commits to omniauth-oauth2 master next time you run bundle update without further vetting.

[tmilewski]

/cc @mbleigh @sferik (I don't retain the ability to release.)

[sferik]

@tmilewski I can give you gem push access to omniauth but @mbleigh is the only one with access this repo, so you’ll need to get that from him.

[tmilewski]

@sferik That'd be great, thanks!

[sferik]

💥 BOOM 💥

gem owner omniauth --add tmilewski@gmail.com
Pushing gem to https://rubygems.org...
Owner added successfully.
Pushing gem to https://rubygems.org...
Owners for gem: omniauth
- tmilewski@gmail.com
- mbleigh@mbleigh.com
- sferik@gmail.com

[gabceb]

SUCCESS! Thanks everybody!

[axilleas]

@gabceb is this really resolved? I don't see a bump in rubygems.org. Am I missing something?

[tmilewski]

@gabceb It's up to Michael at this point, he's the only one with the ability to do so.

[gabceb]

Ha. You are absolutely right @axilleas. I checked Rubygems yesterday and saw the image below and probably my brain was like "Yep, september sounds about right" but I didn't realize it was the wrong day/year. Reopening....

[warmwaffles]

@sferik @axilleas @tmilewski the newer version has still not been cut

EDIT: A release candidate could be cut and if any issues rise from it, then they can be addressed.

[sferik]

I can not release, nor can @axilleas or @tmilewski. The only person with gem push access is @mbleigh.

[tmilewski]

I was just going to type the same thing but @sferik beat me to it.

[joscarsson]

I would really like to see the bump in version for oauth2 form 0.8.0 to 0.9.x happen in rubygems as well (currently done on master but not even tagged on github yet), need the new functionality from oauth2 to get my identity provider working.

[anthonator]

👍

[bbatsov]

@mbleigh Maybe you should grant push access to @sferik, @axilleas or @tmilewski? Anyways, I hope someone would be able to release a new version soon.

[yorkxin]

Hi, could you release 1.1.2? I need a feature that is not available in 1.1.1 but available in master.

Specifically, it's #19, which makes it possible to set AccessToken mode when requesting for raw_info to the API server. The API I'm working with only support { :mode => :query, :param_name => 'access_token' }. With this feature I can set mode with option :auth_token_params.

[niels]

+1 👍

[thesp0nge]

Any news on bumping gem version? It fixes a critical security issue, it's important to release a 1.1.2 version

[tmilewski]

I'm working on gaining access to push to Rubygems. Sorry for the huge delays.

[thesp0nge]

In codesake-dawn, I'm releasing soon version 1.0.0, to match this vulnerability I recommend to tell Gemfile to grab the git source instead of the rubygem (thesp0nge/dawnscanner@fa45f6c).

Can you please update me when a version 1.1.2 will be out so to update mitigation message accordingly?

Thanks
Paolo

[sferik]

💥 https://twitter.com/mbleigh/status/423494998571499520

[bbatsov]

@sferik Finally!

[sferik]

Sorry for the wait, everybody. I’m just reviewing the changes since the last release and will push out a new version shortly.