Cannot update omniauth-saml due to dependency conflict with omniauth-rails_csrf_protection

[john-fitzpatrick-elocal]

A security vulnerability in omniauth-saml is documented here:

https://github.com/advisories/GHSA-cvp8-5r8g-fhvq

Fixing that requires omniauth 2.1, but your gem, which I also have installed, requires 2.0. Can you release a new version with an updated dependency?

[sikachu]

I checked and we're ~> 2.0, which means >= 2.0 but < 3.0.

https://github.com/cookpad/omniauth-rails_csrf_protection/blob/f0f5f84dae091fa3f4410840b331e771b3e0f28b/omniauth-rails_csrf_protection.gemspec#L31

Are you sure that it's this gem that blocking your upgrade?

[john-fitzpatrick-elocal]

I checked and we're ~> 2.0, which means >= 2.0 but < 3.0.

https://github.com/cookpad/omniauth-rails_csrf_protection/blob/f0f5f84dae091fa3f4410840b331e771b3e0f28b/omniauth-rails_csrf_protection.gemspec#L31

Are you sure that it's this gem that blocking your upgrade?

I just checked, and I had 1.0.0 installed, upgrading to 1.0.2 clears the issue. Sorry.

[sikachu]

No worries! Glad that we're already supporting it.

I'm going to close this issue.