Version 1.5.2-1 of ruby-doorkeeper-openid-connect is marked for autoremoval from testing on Tue 23 Apr 2019. It is affected by #924747. You should try to prevent the removal by fixing these RC bugs.
CVE-2019-9837: Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in an OAuth authorization request (that results in an error response) with the 'openid' scope and a prompt=none value. This allows phishing attacks against the authorization flow.
Please fix it.
The package has not entered testing even though the delay is over
normal
The package has not entered testing even though the 2-day delay is over.Check why.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/r/ruby-doorkeeper-openid-connect.png){kind=link}