From 79ffc7e3bb3b3714d7bcc03e63949a9624427a68 Mon Sep 17 00:00:00 2001
From: Mike Dalton <michaelcdalton@gmail.com>
Date: Sun, 5 Jul 2026 11:16:51 -0400
Subject: [PATCH 1/2] Show "Ruby for Good" badge for super admins in members
 admin

Super admins bypass all org-level permission checks but were
visually indistinguishable from other members on the members
admin page. Add a badge next to the name of any member whose
user is a super admin, reusing the existing brand-tint pill style.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 app/views/admin/organization_memberships/index.html.erb | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/app/views/admin/organization_memberships/index.html.erb b/app/views/admin/organization_memberships/index.html.erb
index da18fca..df7ebc1 100644
--- a/app/views/admin/organization_memberships/index.html.erb
+++ b/app/views/admin/organization_memberships/index.html.erb
@@ -42,7 +42,14 @@
           <% @memberships.each do |membership| %>
             <tr class="bg-surface hover:bg-surface-soft transition">
               <td class="px-4 py-2.5">
-                <p class="font-medium text-ink"><%= membership.user.display_name %></p>
+                <div class="flex items-center gap-2">
+                  <p class="font-medium text-ink"><%= membership.user.display_name %></p>
+                  <% if membership.user.super_admin? %>
+                    <span class="inline-flex items-center rounded-md bg-brand-tint px-2 py-0.5 text-xs font-medium text-brand">
+                      Ruby for Good
+                    </span>
+                  <% end %>
+                </div>
                 <% if membership.user.name.present? %>
                   <p class="text-ink-soft"><%= membership.user.email_address %></p>
                 <% end %>

From 6060f08d10573b73584bcaddf6339ec4c6b20b9b Mon Sep 17 00:00:00 2001
From: Mike Dalton <michaelcdalton@gmail.com>
Date: Sun, 5 Jul 2026 11:19:04 -0400
Subject: [PATCH 2/2] Bump json to 2.20.0 to fix bundler-audit CVE-2026-54696

bundler-audit fails CI on json 2.19.8 (GHSA-x2f5-4prf-w687,
heap buffer overflow when streaming to an IO). Update the
transitive dependency to 2.20.0 (>= 2.19.9 fixes the advisory).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 Gemfile.lock | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 5ee8f43..9c47e47 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -185,7 +185,7 @@ GEM
     jbuilder (2.15.1)
       actionview (>= 7.0.0)
       activesupport (>= 7.0.0)
-    json (2.19.8)
+    json (2.20.0)
     kamal (2.11.0)
       activesupport (>= 7.0)
       base64 (~> 0.2)
@@ -531,7 +531,7 @@ CHECKSUMS
   io-console (0.8.2) sha256=d6e3ae7a7cc7574f4b8893b4fca2162e57a825b223a177b7afa236c5ef9814cc
   irb (1.18.0) sha256=de9454a0703a54704b9811a5ef31a60c86949fbf4013fcf244fabc7c775248e3
   jbuilder (2.15.1) sha256=2430bec28fb0cebacb5875b1009cf9d8bc3c303ccb810c4c8b062a4b51457637
-  json (2.19.8) sha256=6354310fd76ef69b87d5bd1f38b40d730613baf90b6803d2d0a48f618d32dfaa
+  json (2.20.0) sha256=9362bc6e55a952b056abf9167cf053358181c904cb70cd6eee0808ea830fc32b
   kamal (2.11.0) sha256=1408864425e0dec7e0a14d712a3b13f614e9f3a425b7661d3f9d287a51d7dd75
   language_server-protocol (3.17.0.5) sha256=fd1e39a51a28bf3eec959379985a72e296e9f9acfce46f6a79d31ca8760803cc
   launchy (3.1.1) sha256=72b847b5cc961589dde2c395af0108c86ff0119f42d4648d25b5440ebb10059e