Bump addressable from 2.7.0 to 2.9.0

[dependabot]

Bumps addressable from 2.7.0 to 2.9.0.

Changelog

Sourced from addressable's changelog.

Addressable 2.9.0

• fixes ReDoS vulnerability in Addressable::Template#match (fixes incomplete remediation in 2.8.10)

Addressable 2.8.10

• fixes ReDoS vulnerability in Addressable::Template#match

Addressable 2.8.9

• Reduce gem size by excluding test files (#569)
• No need for bundler as development dependency (#571, 5fc1d93)
• idna/pure: stop building the useless COMPOSITION_TABLE (removes the Addressable::IDNA::COMPOSITION_TABLE constant) (#564)

#569: sporkmonger/addressable#569 #571: sporkmonger/addressable#571 #564: sporkmonger/addressable#564

Addressable 2.8.8

• Replace the unicode.data blob by a ruby constant (#561)
• Allow public_suffix 7 (#558)

#561: sporkmonger/addressable#561 #558: sporkmonger/addressable#558

Addressable 2.8.7

• Allow public_suffix 6 (#535)

#535: sporkmonger/addressable#535

Addressable 2.8.6

• Memoize regexps for common character classes (#524)

#524: sporkmonger/addressable#524

Addressable 2.8.5

• Fix thread safety issue with encoding tables (#515)
• Define URI::NONE as a module to avoid serialization issues (#509)
• Fix YAML serialization (#508)

#508: sporkmonger/addressable#508 #509: sporkmonger/addressable#509 #515: sporkmonger/addressable#515

Addressable 2.8.4

• Restore Addressable::IDNA.unicode_normalize_kc as a deprecated method (#504)

#504: sporkmonger/addressable#504

Addressable 2.8.3

• Fix template expand level 2 hash support for non-string objects (#499, #498)

... (truncated)

Commits

• 0c3e858 Revving version and changelog
• 91915c1 Fixing additional vulnerable paths
• a091e39 Add many more adversarial test cases to ensure we don't have any ReDoS regres...
• 463a819 Regenerate gemspec on newer rubygems
• 0afcb0b Improve from O(n^2) to O(n)
• c87f768 Fix a ReDoS vulnerability in URI template matching
• 0d7e9b2 Fix links for 2.8.9 in CHANGELOG (#573)
• e209120 Update version, gemspec, and CHANGELOG for 2.8.9 (#572)
• 3875874 Reduce gem size by excluding test files (#569)
• 3e57cc6 CI: back to windows-2022 for MRI job
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Greptile Summary

This PR is a Dependabot-generated security update that bumps addressable from 2.7.0 to 2.9.0 and transitively upgrades public_suffix from 4.0.3 to 5.1.1. The addressable 2.9.0 release fixes a ReDoS vulnerability in Addressable::Template#match (including an incomplete fix from 2.8.10).

• addressable 2.9.0 patches two iterations of a ReDoS vulnerability in Addressable::Template#match; upgrading closes this attack surface.
• public_suffix is bumped from 4.0.3 to 5.1.1 as a result of the relaxed constraint (< 8.0 replaces < 5.0) introduced in addressable 2.9.0.

Confidence Score: 5/5

Safe to merge — this is a security patch update with no application logic changes.

The only change is in Gemfile.lock: addressable is bumped to 2.9.0 (a security patch release fixing ReDoS) and public_suffix is updated to 5.1.1 as a transitive result. No gem APIs were removed between 2.7.0 and 2.9.0 that would break the consuming code, and the Dependabot compatibility score indicates high compatibility. The update closes a known vulnerability with no functional risk.

No files require special attention.

Important Files Changed

Filename	Overview
Gemfile.lock	Bumps addressable from 2.7.0 to 2.9.0 and public_suffix from 4.0.3 to 5.1.1; resolves two ReDoS vulnerabilities in Addressable::Template#match

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[helpscout-api-auth 0.2.0] --> B[webmock ~> 3.8]
    B --> C[addressable >= 2.3.6]
    C -->|was 2.7.0| D["public_suffix >= 2.0.2, < 5.0\n(resolved: 4.0.3)"]
    C -->|now 2.9.0| E["public_suffix >= 2.0.2, < 8.0\n(resolved: 5.1.1)"]
    style D fill:#f96,color:#000
    style E fill:#6f9,color:#000

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[helpscout-api-auth 0.2.0] --> B[webmock ~> 3.8]
    B --> C[addressable >= 2.3.6]
    C -->|was 2.7.0| D["public_suffix >= 2.0.2, < 5.0\n(resolved: 4.0.3)"]
    C -->|now 2.9.0| E["public_suffix >= 2.0.2, < 8.0\n(resolved: 5.1.1)"]
    style D fill:#f96,color:#000
    style E fill:#6f9,color:#000

Loading

_{Reviews (1): Last reviewed commit: "Bump addressable from 2.7.0 to 2.9.0" | Re-trigger Greptile}

[jayco]

@greptile