From 475fb63c6d66e3e3a84d5187da04dcbcb95179e8 Mon Sep 17 00:00:00 2001
From: Jeremy Daer <jeremy@37signals.com>
Date: Tue, 17 Feb 2026 20:34:33 -0800
Subject: [PATCH] Add actionpack-xml_parser for Queenbee sync request support
 (#2563)

Queenbee sends account sync/cancel/etc requests as XML via
ActiveResource, including the queenbee_signature in the XML body.
Rails removed built-in XML parameter parsing in Rails 4.0, so without
this gem the XML body is silently ignored and the signature check
always fails with 403.
---
 saas/Gemfile      | 1 +
 saas/Gemfile.lock | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/saas/Gemfile b/saas/Gemfile
index bb3829719..ae814a2ef 100644
--- a/saas/Gemfile
+++ b/saas/Gemfile
@@ -5,5 +5,6 @@ git_source(:bc) { |repo| "https://github.com/basecamp/#{repo}" }
 gem "queenbee", bc: "queenbee-plugin", ref: "14312a940471e20617b38cdec7c092a01567d18b"
 gem "rails_structured_logging", bc: "rails-structured-logging"
 gem "activeresource", require: "active_resource" # needed by queenbee
+gem "actionpack-xml_parser" # needed by queenbee for XML request body parsing
 
 gem "rubocop-rails-omakase", require: false
diff --git a/saas/Gemfile.lock b/saas/Gemfile.lock
index 16c647b27..1a9426209 100644
--- a/saas/Gemfile.lock
+++ b/saas/Gemfile.lock
@@ -51,6 +51,9 @@ GEM
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
       useragent (~> 0.16)
+    actionpack-xml_parser (2.0.1)
+      actionpack (>= 5.0)
+      railties (>= 5.0)
     actiontext (8.1.1)
       action_text-trix (~> 2.1.15)
       actionpack (= 8.1.1)
@@ -282,6 +285,7 @@ PLATFORMS
   x86_64-linux-musl
 
 DEPENDENCIES
+  actionpack-xml_parser
   activeresource
   queenbee!
   rails_structured_logging!