From 8e14eb461257908b7b1cd18c0595f162da94e86f Mon Sep 17 00:00:00 2001 From: Burkhard Vogel-Kreykenbohm Date: Thu, 26 Feb 2026 17:32:35 +0100 Subject: [PATCH 1/2] fix: replace CGI.parse with Rack::Utils.parse_query for Ruby 4.0 compatibility CGI.parse was removed from Ruby's standard library in Ruby 4.0, causing a NoMethodError in LoginProtection#return_address_with_params on every OAuth callback, breaking authentication entirely on Ruby 4.0. Replace with Rack::Utils.parse_query, which is already available as a transitive dependency of Rails. It returns a plain hash with string values directly, so the .transform_values unwrapping step is no longer needed either. Fixes #2057 --- lib/shopify_app/controller_concerns/login_protection.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/lib/shopify_app/controller_concerns/login_protection.rb b/lib/shopify_app/controller_concerns/login_protection.rb index 4327df455..05467afa6 100644 --- a/lib/shopify_app/controller_concerns/login_protection.rb +++ b/lib/shopify_app/controller_concerns/login_protection.rb @@ -225,9 +225,8 @@ def base_return_address def return_address_with_params(params) uri = URI(base_return_address) - uri.query = CGI.parse(uri.query.to_s) + uri.query = Rack::Utils.parse_query(uri.query.to_s) .symbolize_keys - .transform_values { |v| v.one? ? v.first : v } .merge(params) .to_query uri.to_s From b1c6104b4891715a29a2b74169f4bb2590f130b4 Mon Sep 17 00:00:00 2001 From: Burkhard Vogel-Kreykenbohm Date: Thu, 26 Feb 2026 17:38:23 +0100 Subject: [PATCH 2/2] chore: trigger CI after signing CLA