Bump oauth2 from 2.0.18 to 2.0.22 (#2214)

Bumps [oauth2](https://github.com/ruby-oauth/oauth2) from 2.0.18 to
2.0.22.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ruby-oauth/oauth2/releases">oauth2's
releases</a>.</em></p>
<blockquote>
<h2>v2.0.22</h2>
<h2><a
href="https://github.com/ruby-oauth/oauth2/compare/v2.0.21...v2.0.22">2.0.22</a>
- 2026-06-07</h2>
<ul>
<li>TAG: <a
href="https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.22">v2.0.22</a></li>
<li>COVERAGE: 100.00% -- 542/542 lines in 15 files</li>
<li>BRANCH COVERAGE: 100.00% -- 180/180 branches in 15 files</li>
<li>88.35% documented</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Raised generated development tooling floors to
<code>kettle-dev</code> &gt;= 2.1.1 and
<code>version_gem</code> &gt;= 1.1.11.</li>
<li>Raised the runtime dependency floor for <code>snaky_hash</code> to
<code>&gt;= 2.0.5</code>.</li>
</ul>
<h3>Security</h3>
<ul>
<li>[GHSA-pp92-crg2-gfv9] Prevent protocol-relative redirect
<code>Location</code> values from changing request authority, and strip
<code>Authorization</code> headers from cross-origin redirects.</li>
</ul>
<p>Official Discord 👉️ <a href="https://discord.gg/3qme4XHNKN"><img
src="https://img.shields.io/discord/1373797679469170758?style=flat"
alt="Live Chat on Discord" /></a></p>
<p>Many paths lead to being a sponsor or a backer of this project. Are
you on such a path?</p>
<p><a href="https://opencollective.com/ruby-oauth#backer"><img
src="https://opencollective.com/ruby-oauth/backers/badge.svg?style=flat"
alt="OpenCollective Backers" /></a> <a
href="https://opencollective.com/ruby-oauth#sponsor"><img
src="https://opencollective.com/ruby-oauth/sponsors/badge.svg?style=flat"
alt="OpenCollective Sponsors" /></a> <a
href="https://github.com/sponsors/pboling"><img
src="https://img.shields.io/badge/Sponsor_Me!-pboling.svg?style=social&amp;logo=github"
alt="Sponsor Me on Github" /></a> <a
href="https://liberapay.com/pboling/donate"><img
src="https://img.shields.io/liberapay/goal/pboling.svg?logo=liberapay&amp;color=a51611&amp;style=flat"
alt="Liberapay Goal Progress" /></a> <a
href="https://www.paypal.com/paypalme/peterboling"><img
src="https://img.shields.io/badge/donate-paypal-a51611.svg?style=flat&amp;logo=paypal"
alt="Donate on PayPal" /></a></p>
<p><a href="https://www.buymeacoffee.com/pboling"><img
src="https://img.shields.io/badge/buy_me_a_coffee-%E2%9C%93-a51611.svg?style=flat"
alt="Buy me a coffee" /></a> <a href="https://polar.sh/pboling"><img
src="https://img.shields.io/badge/polar-donate-a51611.svg?style=flat"
alt="Donate on Polar" /></a> <a href="https://ko-fi.com/pboling"><img
src="https://img.shields.io/badge/ko--fi-%E2%9C%93-a51611.svg?style=flat"
alt="Donate to my FLOSS efforts at ko-fi.com" /></a> <a
href="https://patreon.com/galtzo"><img
src="https://img.shields.io/badge/patreon-donate-a51611.svg?style=flat"
alt="Donate to my FLOSS efforts using Patreon" /></a></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ruby-oauth/oauth2/blob/main/CHANGELOG.md">oauth2's
changelog</a>.</em></p>
<blockquote>
<h2>[2.0.22] - 2026-06-07</h2>
<ul>
<li>TAG: [v2.0.22][2.0.22t]</li>
<li>COVERAGE: 100.00% -- 542/542 lines in 15 files</li>
<li>BRANCH COVERAGE: 100.00% -- 180/180 branches in 15 files</li>
<li>88.35% documented</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Raised generated development tooling floors to
<code>kettle-dev</code> &gt;= 2.1.1 and
<code>version_gem</code> &gt;= 1.1.11.</li>
<li>Raised the runtime dependency floor for <code>snaky_hash</code> to
<code>&gt;= 2.0.5</code>.</li>
</ul>
<h3>Security</h3>
<ul>
<li><a
href="https://github.com/ruby-oauth/oauth2/security/advisories/GHSA-pp92-crg2-gfv9">GHSA-pp92-crg2-gfv9</a>
Prevent protocol-relative redirect <code>Location</code> values from
changing request authority, and strip <code>Authorization</code> headers
from cross-origin redirects by <a
href="https://github.com/tonghuaroot"><code>@​tonghuaroot</code></a> and
<a href="https://github.com/pboling"><code>@​pboling</code></a></li>
</ul>
<h2>[2.0.21] - 2026-06-06</h2>
<ul>
<li>TAG: [v2.0.21][2.0.21t]</li>
<li>COVERAGE: 100.00% -- 525/525 lines in 15 files</li>
<li>BRANCH COVERAGE: 100.00% -- 174/174 branches in 15 files</li>
<li>88.35% documented</li>
</ul>
<h3>Added</h3>
<ul>
<li><a
href="https://redirect.github.com/ruby-oauth/oauth2/pull/730">gh!730</a>
- Alternatives section to README by <a
href="https://github.com/jonathangrinstead"><code>@​jonathangrinstead</code></a></li>
<li>Updates to alternatives section - by <a
href="https://github.com/pboling"><code>@​pboling</code></a></li>
</ul>
<ul>
<li>Added conditional <code>appraisal2-rubocop</code> Appraisal root
loading on modern Ruby
so generated Appraisal gemfiles are normalized during generation - by <a
href="https://github.com/pboling"><code>@​pboling</code></a></li>
</ul>
<h3>Changed</h3>
<ul>
<li>Raised generated <code>version_gem</code> dependency floor to
<code>version_gem</code> &gt;= 1.1.10 - by <a
href="https://github.com/pboling"><code>@​pboling</code></a></li>
<li>Raised the runtime dependency floor for <code>auth-sanitizer</code>
to <code>&gt;= 0.2.1</code> so
OAuth2 consumers get hash and nested-attribute inspect redaction fixes
plus
downstream RBS duplicate-declaration fixes - by <a
href="https://github.com/pboling"><code>@​pboling</code></a></li>
<li>Refreshed generated package metadata, support documentation, CI
workflows,
and development dependency floors from the current kettle-jem template -
by <a href="https://github.com/pboling"><code>@​pboling</code></a></li>
<li>Documented the current per-version Ruby, JRuby, and TruffleRuby CI
matrix in
generated README badges and compatibility tables - by <a
href="https://github.com/pboling"><code>@​pboling</code></a></li>
<li>Removed the post-install message from the gemspec to keep installs
quieter - by <a
href="https://github.com/pboling"><code>@​pboling</code></a></li>
<li>Refreshed generated README support badges so Ruby 2.3 is listed as
supported but untested - by <a
href="https://github.com/pboling"><code>@​pboling</code></a></li>
<li>Refreshed generated project metadata from the current kettle-jem
template - by <a
href="https://github.com/pboling"><code>@​pboling</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ruby-oauth/oauth2/commit/551f434a81912763fb5a8e240cd00a6532e26970"><code>551f434</code></a>
🔖 Prepare release v2.0.22</li>
<li><a
href="https://github.com/ruby-oauth/oauth2/commit/849e7e5e1f867c2d05c05428922aed12bc6439cb"><code>849e7e5</code></a>
🧪 Strengthen redirect security specs</li>
<li><a
href="https://github.com/ruby-oauth/oauth2/commit/442c1609858ebaecbac5eab77f4511bc81ed7383"><code>442c160</code></a>
📝 Reference GHSA in security changelog</li>
<li><a
href="https://github.com/ruby-oauth/oauth2/commit/f6fed86ddf4295c47f38df61ee37066b62a13ef2"><code>f6fed86</code></a>
⬆️ Raise snaky_hash floor</li>
<li><a
href="https://github.com/ruby-oauth/oauth2/commit/26bfeda3d8c0b34d6a51bfa30b7a8bf1b5f3b0f6"><code>26bfeda</code></a>
🔧 Refresh kettle-jem templates</li>
<li><a
href="https://github.com/ruby-oauth/oauth2/commit/0f0a474f1b38453e119e660c2daca742d4378ce9"><code>0f0a474</code></a>
Fix credential leakage on redirects</li>
<li><a
href="https://github.com/ruby-oauth/oauth2/commit/1118527f311a23d06feede403b88b8f6bd2a4eed"><code>1118527</code></a>
🔒️ Checksums for v2.0.21</li>
<li><a
href="https://github.com/ruby-oauth/oauth2/commit/3f4154985fc0ab9b2b3fd0b085fa132fdc8bd8b4"><code>3f41549</code></a>
🔖 Prepare release v2.0.21</li>
<li><a
href="https://github.com/ruby-oauth/oauth2/commit/3311b5b6b39c57c062a071356a55bcb826207e54"><code>3311b5b</code></a>
Raise auth-sanitizer floor to 0.2.1</li>
<li><a
href="https://github.com/ruby-oauth/oauth2/commit/5659d892c3dcb4266c682f1565d0266d0b321503"><code>5659d89</code></a>
🔖 Prepare release v2.0.21</li>
<li>Additional commits viewable in <a
href="https://github.com/ruby-oauth/oauth2/compare/v2.0.18...v2.0.22">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=oauth2&package-manager=bundler&previous-version=2.0.18&new-version=2.0.22)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/chicago-tool-library/circulate/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: dependabot[bot]

Gemfile.lock

@@ -112,6 +112,8 @@ GEM
     audited (5.8.0)
       activerecord (>= 5.2, < 8.2)
       activesupport (>= 5.2, < 8.2)
+    auth-sanitizer (0.2.3)
+      version_gem (~> 1.1, >= 1.1.14)
     aws-eventstream (1.4.0)
     aws-partitions (1.1229.0)
     aws-sdk-core (3.244.0)
@@ -292,7 +294,7 @@ GEM
     jmespath (1.6.2)
     jsbundling-rails (1.3.1)
       railties (>= 6.0.0)
-    json (2.20.0)
+    json (2.21.1)
     jwt (3.2.0)
       base64
     language_server-protocol (3.17.0.5)
@@ -347,7 +349,7 @@ GEM
       railties (>= 7.0)
     msgpack (1.8.2)
     multi_json (1.19.1)
-    multi_xml (0.8.1)
+    multi_xml (0.9.1)
       bigdecimal (>= 3.1, < 5)
     multipart-post (2.4.1)
     net-http (0.9.1)
@@ -372,14 +374,15 @@ GEM
       racc (~> 1.4)
     nokogiri (1.19.4-x86_64-linux-gnu)
       racc (~> 1.4)
-    oauth2 (2.0.18)
+    oauth2 (2.0.22)
+      auth-sanitizer (~> 0.2, >= 0.2.1)
       faraday (>= 0.17.3, < 4.0)
       jwt (>= 1.0, < 4.0)
       logger (~> 1.2)
       multi_xml (~> 0.5)
       rack (>= 1.2, < 4)
-      snaky_hash (~> 2.0, >= 2.0.3)
-      version_gem (~> 1.1, >= 1.1.9)
+      snaky_hash (~> 2.0, >= 2.0.5)
+      version_gem (~> 1.1, >= 1.1.11)
     omniauth (2.1.4)
       hashie (>= 3.4.6)
       logger
@@ -541,9 +544,9 @@ GEM
       multi_json (~> 1.10)
     singleton (0.2.0)
     smart_properties (1.17.0)
-    snaky_hash (2.0.3)
+    snaky_hash (2.0.7)
       hashie (>= 0.1.0, < 6)
-      version_gem (>= 1.1.8, < 3)
+      version_gem (~> 1.1, >= 1.1.14)
     sprockets (4.2.1)
       concurrent-ruby (~> 1.0)
       rack (>= 2.2.4, < 4)
@@ -601,7 +604,7 @@ GEM
     uri (1.1.1)
     useragent (0.16.11)
     vcr (6.4.0)
-    version_gem (1.1.9)
+    version_gem (1.1.14)
     warden (1.2.9)
       rack (>= 2.0.9)
     web-console (4.3.0)