Bump doorkeeper from 5.9.6 to 5.9.7

[dependabot]

Bumps doorkeeper from 5.9.6 to 5.9.7.

Release notes

Sourced from doorkeeper's releases.

v5.9.7

• Refuse requests that transmit an access token by more than one method (RFC 6750 §2), instead of silently authorizing with the first configured access_token_methods entry that matched and discarding the other tokens. Such a request now fails closed as carrying no usable token (401 invalid_token); no calling contract changes. The form-encoded body (§2.2) and the URI query (§2.3) count as two methods even though Rails and Rack merge them into a single params hash. The same token repeated across two methods is refused too — §2 forbids the second method, not a disagreement between the two — and a custom callable extractor in access_token_methods keeps the historical first-wins behavior and is never invoked more than once. (The strict invalid_request (400) answer §3.1 prescribes ships with Doorkeeper 6.0.)
• #1925 Internal: pin the development dependency on json below 3.0. json 3 removed the positional options Hash from JSON.parse and the quirks_mode option from JSON.generate, both of which Active Support still uses, so the suite could not run on any supported Rails version.

Changelog

Sourced from doorkeeper's changelog.

5.9.7

• Refuse requests that transmit an access token by more than one method (RFC 6750 §2), instead of silently authorizing with the first configured access_token_methods entry that matched and discarding the other tokens. Such a request now fails closed as carrying no usable token (401 invalid_token); no calling contract changes. The form-encoded body (§2.2) and the URI query (§2.3) count as two methods even though Rails and Rack merge them into a single params hash. The same token repeated across two methods is refused too — §2 forbids the second method, not a disagreement between the two — and a custom callable extractor in access_token_methods keeps the historical first-wins behavior and is never invoked more than once. (The strict invalid_request (400) answer §3.1 prescribes ships with Doorkeeper 6.0.)
• #1925 Internal: pin the development dependency on json below 3.0. json 3 removed the positional options Hash from JSON.parse and the quirks_mode option from JSON.generate, both of which Active Support still uses, so the suite could not run on any supported Rails version.

Commits

• bc75190 Merge pull request #1929 from doorkeeper-gem/chore/bump-5.9.7
• 49dcb5b Release 5.9.7
• fcc425c Pin the development dependency on json below 3.0
• a6d4128 Merge commit from fork
• df59bd5 Refuse a request that transmits an access token by more than one method
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: b58eded4-be08-43bd-bb64-ee1ef4209dd1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}