Bump oauth2 from 2.0.19 to 2.0.22

[dependabot]

Bumps oauth2 from 2.0.19 to 2.0.22.

Release notes

Sourced from oauth2's releases.

v2.0.22

2.0.22 - 2026-06-07

• TAG: v2.0.22
• COVERAGE: 100.00% -- 542/542 lines in 15 files
• BRANCH COVERAGE: 100.00% -- 180/180 branches in 15 files
• 88.35% documented

Changed

• Raised generated development tooling floors to kettle-dev >= 2.1.1 and version_gem >= 1.1.11.
• Raised the runtime dependency floor for snaky_hash to >= 2.0.5.

Security

• [GHSA-pp92-crg2-gfv9] Prevent protocol-relative redirect Location values from changing request authority, and strip Authorization headers from cross-origin redirects.

Official Discord 👉️

Many paths lead to being a sponsor or a backer of this project. Are you on such a path?

... (truncated)

Changelog

Sourced from oauth2's changelog.

[2.0.22] - 2026-06-07

• TAG: [v2.0.22][2.0.22t]
• COVERAGE: 100.00% -- 542/542 lines in 15 files
• BRANCH COVERAGE: 100.00% -- 180/180 branches in 15 files
• 88.35% documented

Changed

• Raised generated development tooling floors to kettle-dev >= 2.1.1 and version_gem >= 1.1.11.
• Raised the runtime dependency floor for snaky_hash to >= 2.0.5.

Security

• GHSA-pp92-crg2-gfv9 Prevent protocol-relative redirect Location values from changing request authority, and strip Authorization headers from cross-origin redirects by @​tonghuaroot and @​pboling

[2.0.21] - 2026-06-06

• TAG: [v2.0.21][2.0.21t]
• COVERAGE: 100.00% -- 525/525 lines in 15 files
• BRANCH COVERAGE: 100.00% -- 174/174 branches in 15 files
• 88.35% documented

Added

• gh!730 - Alternatives section to README by @​jonathangrinstead
• Updates to alternatives section - by @​pboling

• Added conditional appraisal2-rubocop Appraisal root loading on modern Ruby so generated Appraisal gemfiles are normalized during generation - by @​pboling

Changed

• Raised generated version_gem dependency floor to version_gem >= 1.1.10 - by @​pboling
• Raised the runtime dependency floor for auth-sanitizer to >= 0.2.1 so OAuth2 consumers get hash and nested-attribute inspect redaction fixes plus downstream RBS duplicate-declaration fixes - by @​pboling
• Refreshed generated package metadata, support documentation, CI workflows, and development dependency floors from the current kettle-jem template - by @​pboling
• Documented the current per-version Ruby, JRuby, and TruffleRuby CI matrix in generated README badges and compatibility tables - by @​pboling
• Removed the post-install message from the gemspec to keep installs quieter - by @​pboling
• Refreshed generated README support badges so Ruby 2.3 is listed as supported but untested - by @​pboling
• Refreshed generated project metadata from the current kettle-jem template - by @​pboling

... (truncated)

Commits

• 551f434 🔖 Prepare release v2.0.22
• 849e7e5 🧪 Strengthen redirect security specs
• 442c160 📝 Reference GHSA in security changelog
• f6fed86 ⬆️ Raise snaky_hash floor
• 26bfeda 🔧 Refresh kettle-jem templates
• 0f0a474 Fix credential leakage on redirects
• 1118527 🔒️ Checksums for v2.0.21
• 3f41549 🔖 Prepare release v2.0.21
• 3311b5b Raise auth-sanitizer floor to 0.2.1
• 5659d89 🔖 Prepare release v2.0.21
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.