Constrain omniauth version

[dudemanvox]

Relates to issue #395

• Omniauth v2 has been release recently and will be used per the gemspec. Doing this will cause an exception to raise in devise 4.7.3. The Omniauth version in the gemspec should be constrained so it does not install v2 until a new release of Devise comes out.

[atmos]

Couldn't you just pin your devise version in the Gemfile so people who aren't using devise get the latest version of omniauth?

[dudemanvox]

Couldn't you just pin your devise version in the Gemfile so people who aren't using devise get the latest version of omniauth?

Hey @atmos,

I guess I was looking at it as if this gem were intended for use with devise, but no, pinning the devise version wouldn't (currently) address the issue. The code below has been in there for 9 years, so not a recent thing by any stretch, and I'd think would remain until they implement omniauth v 2.

Was thinking that any fresh bundle with both gems could be an issue/headache for folks - the devise error is also a bit misleading now since it assumes any version not beginning with '1.' is an older version.

https://github.com/heartcombo/devise/blob/e0395367e4a06eaf5915c650f048249bcf0c9bda/lib/devise/omniauth.rb#L11

unless OmniAuth::VERSION =~ /^1\./
  raise "You are using an old OmniAuth version, please ensure you have 1.0.0.pr2 version or later installed."
end

That being said, explicitly including omniauth in a gemfile and constraining the version there in the same way gem 'omniauth', '~> 1.1' would take care of it and not impact folks not using devise.