From be2e016e15e84b64f37e2d9902eb66b4bcacd9a7 Mon Sep 17 00:00:00 2001
From: Margarita Barvinok <brita@umich.edu>
Date: Tue, 27 Jan 2026 22:19:02 -0500
Subject: [PATCH 1/2] update ldap_lookup gem

---
 Gemfile                            |  2 +-
 Gemfile.lock                       |  4 ++--
 config/initializers/ldap_lookup.rb | 19 ++++++++++++++-----
 3 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/Gemfile b/Gemfile
index 08f8d152..fcf6f72c 100644
--- a/Gemfile
+++ b/Gemfile
@@ -53,7 +53,7 @@ gem "omniauth-saml", "~> 2.2"
 gem "omniauth-rails_csrf_protection", "~> 1.0"
 gem 'repost'
 
-gem "ldap_lookup" # will use for admin interface, add rovers
+gem "ldap_lookup", "2.0.1"
 gem "pundit"
 
 # Use Active Storage variants [https://guides.rubyonrails.org/active_storage_overview.html#transforming-images]
diff --git a/Gemfile.lock b/Gemfile.lock
index ca0b3250..4515a861 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -169,7 +169,7 @@ GEM
     launchy (3.0.1)
       addressable (~> 2.8)
       childprocess (~> 5.0)
-    ldap_lookup (0.1.8)
+    ldap_lookup (2.0.1)
       net-ldap (~> 0.18.0)
     letter_opener (1.10.0)
       launchy (>= 2.2, < 4)
@@ -394,7 +394,7 @@ DEPENDENCIES
   jbuilder
   jsbundling-rails
   kaminari
-  ldap_lookup
+  ldap_lookup (= 2.0.1)
   letter_opener_web
   omniauth-rails_csrf_protection (~> 1.0)
   omniauth-saml (~> 2.2)
diff --git a/config/initializers/ldap_lookup.rb b/config/initializers/ldap_lookup.rb
index f26d42e3..76cb35de 100644
--- a/config/initializers/ldap_lookup.rb
+++ b/config/initializers/ldap_lookup.rb
@@ -1,7 +1,16 @@
 LdapLookup.configuration do |config|
-  config.host = "ldap.umich.edu"
-  config.port =   "389" 
-  config.base =   "dc=umich,dc=edu"
-  config.dept_attribute =  "umichPostalAddressData"
-  config.group_attribute =   "umichGroupEmail"
+  config.host = ENV.fetch('LDAP_HOST', 'ldap.umich.edu')
+  config.port = ENV.fetch('LDAP_PORT', '389')
+  config.base = ENV.fetch('LDAP_BASE', 'dc=umich,dc=edu')
+
+  # Optional: set for authenticated binds
+  config.username = ENV['LDAP_USERNAME']
+  config.password = ENV['LDAP_PASSWORD']
+
+  # Encryption - REQUIRED
+  config.encryption = ENV.fetch('LDAP_ENCRYPTION', 'start_tls').to_sym
+
+  # Optional: attribute overrides
+  config.dept_attribute = ENV.fetch('LDAP_DEPT_ATTRIBUTE', 'umichPostalAddressData')
+  config.group_attribute = ENV.fetch('LDAP_GROUP_ATTRIBUTE', 'umichGroupEmail')
 end

From 4d310308150beffc7da453e0f20e7ed933b0253a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 28 Jan 2026 03:25:45 +0000
Subject: [PATCH 2/2] Bump @hotwired/turbo from 8.0.4 to 8.0.21

Bumps [@hotwired/turbo](https://github.com/hotwired/turbo) from 8.0.4 to 8.0.21.
- [Release notes](https://github.com/hotwired/turbo/releases)
- [Commits](https://github.com/hotwired/turbo/compare/v8.0.4...v8.0.21)

---
updated-dependencies:
- dependency-name: "@hotwired/turbo"
  dependency-version: 8.0.21
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 yarn.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/yarn.lock b/yarn.lock
index 37e6e782..fb0f6f47 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -141,9 +141,9 @@
     "@rails/actioncable" "^7.0"
 
 "@hotwired/turbo@^8.0.4":
-  version "8.0.4"
-  resolved "https://registry.yarnpkg.com/@hotwired/turbo/-/turbo-8.0.4.tgz#5c5361c06a37cdf10dcba4223f1afd0ca1c75091"
-  integrity sha512-mlZEFUZrJnpfj+g/XeCWWuokvQyN68WvM78JM+0jfSFc98wegm259vCbC1zSllcspRwbgXK31ibehCy5PA78/Q==
+  version "8.0.21"
+  resolved "https://registry.yarnpkg.com/@hotwired/turbo/-/turbo-8.0.21.tgz#a3e80c01d70048200f64bbe3582b84f9bfac034e"
+  integrity sha512-fJTv3JnzFHeDxBb23esZSOhT4r142xf5o3lKMFMvzPC6AllkqbBKk5Yb31UZhtIsKQCwmO/pUQrtTUlYl5CHAQ==
 
 "@kurkle/color@^0.3.0":
   version "0.3.2"