build(deps): Bump oauth from 0.5.14 to 1.1.6

[dependabot]

Bumps oauth from 0.5.14 to 1.1.6.

Release notes

Sourced from oauth's releases.

v1.1.6

1.1.6 - 2026-06-07

• TAG: v1.1.6
• COVERAGE: 89.05% -- 838/941 lines in 33 files
• BRANCH COVERAGE: 60.46% -- 159/263 branches in 33 files
• 40.38% documented

Changed

• Retemplated project workflows, appraisals, and development tooling with the current kettle-jem template.
• Documented current OAuth::Consumer configuration options, including token request redirect safety settings, and corrected the OAuth 1.0a usage example.
• Raised the runtime dependency floor for auth-sanitizer to >= 0.2.1.
• Raised the runtime dependency floor for snaky_hash to >= 2.0.5.

Security

• Hardened OAuth token endpoint redirect handling after the GHSA-pp92-crg2-gfv9 review: token redirects are now bounded, resolved explicitly, and rejected when they cross origins unless explicitly enabled.

Official Discord 👉️ [![Live Chat on Discord][✉️discord-invite-img]][✉️discord-invite]

Many paths lead to being a sponsor or a backer of this project. Are you on such a path?

[![Donate on PayPal][🖇paypal-img]][🖇paypal]

... (truncated)

Changelog

Sourced from oauth's changelog.

[1.1.6] - 2026-06-07

• TAG: [v1.1.6][1.1.6t]
• COVERAGE: 89.05% -- 838/941 lines in 33 files
• BRANCH COVERAGE: 60.46% -- 159/263 branches in 33 files
• 40.38% documented

Changed

• Retemplated project workflows, appraisals, and development tooling with the current kettle-jem template.
• Documented current OAuth::Consumer configuration options, including token request redirect safety settings, and corrected the OAuth 1.0a usage example.
• Raised the runtime dependency floor for auth-sanitizer to >= 0.2.1.
• Raised the runtime dependency floor for snaky_hash to >= 2.0.5.

Security

• Hardened OAuth token endpoint redirect handling after the GHSA-pp92-crg2-gfv9 review: token redirects are now bounded, resolved explicitly, and rejected when they cross origins unless explicitly enabled.

[1.1.5] - 2026-05-20

• TAG: [v1.1.5][1.1.5t]
• COVERAGE: 84.79% -- 864/1019 lines in 37 files
• BRANCH COVERAGE: 54.91% -- 151/275 branches in 37 files
• 40.86% documented

Changed

• auth-sanitizer v0.1.3

Fixed

• Load auth-sanitizer through an internal isolated loader so requiring oauth does not add top-level Auth or AuthSanitizer constants that may collide with downstream applications.

[1.1.4] - 2026-05-16

• TAG: [v1.1.4][1.1.4t]
• COVERAGE: 84.64% -- 854/1009 lines in 36 files
• BRANCH COVERAGE: 54.91% -- 151/275 branches in 36 files
• 40.78% documented

Added

• Add auth-sanitizer integration for inspect-time secret redaction in core OAuth objects.
• Traditional OAuth::VERSION constant

Changed

... (truncated)

Commits

• c4e50cb 🔖 Prepare release v1.1.6
• ad009cc 🔗 Restore OAuth Google Group README link
• 20bd991 📝 Correct OAuth README usage guidance
• da97783 🔧 Disable local ruby-oauth deps by default
• d70d175 🧰 Retemplate oauth with kettle-jem
• af32336 🧪 Strengthen OAuth redirect security specs
• d069dc8 🔒 Harden OAuth token redirects
• d898ad3 ⬆️ Raise snaky_hash floor
• f8afba7 Merge pull request #363 from ruby-oauth/fix/gem_version_load
• 5aff2e7 🎨 Better gem_version loading
• Additional commits viewable in compare view