Skip to content

build(deps): bump addressable from 2.8.9 to 2.9.0#250

Merged
1 commit merged into
mainfrom
dependabot/bundler/addressable-2.9.0
May 20, 2026
Merged

build(deps): bump addressable from 2.8.9 to 2.9.0#250
1 commit merged into
mainfrom
dependabot/bundler/addressable-2.9.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 8, 2026

Bumps addressable from 2.8.9 to 2.9.0.

Changelog

Sourced from addressable's changelog.

Addressable 2.9.0

  • fixes ReDoS vulnerability in Addressable::Template#match (fixes incomplete remediation in 2.8.10)

Addressable 2.8.10

  • fixes ReDoS vulnerability in Addressable::Template#match
Commits
  • 0c3e858 Revving version and changelog
  • 91915c1 Fixing additional vulnerable paths
  • a091e39 Add many more adversarial test cases to ensure we don't have any ReDoS regres...
  • 463a819 Regenerate gemspec on newer rubygems
  • 0afcb0b Improve from O(n^2) to O(n)
  • c87f768 Fix a ReDoS vulnerability in URI template matching
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Apr 8, 2026
Bumps [addressable](https://github.com/sporkmonger/addressable) from 2.8.9 to 2.9.0.
- [Changelog](https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md)
- [Commits](sporkmonger/addressable@addressable-2.8.9...addressable-2.9.0)

---
updated-dependencies:
- dependency-name: addressable
  dependency-version: 2.9.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/bundler/addressable-2.9.0 branch from 2d51b48 to 7bbb36e Compare May 5, 2026 22:08
This was referenced May 7, 2026
This was referenced May 14, 2026
@nobe4 nobe4 closed this pull request by merging all changes into main in b0cfe0c May 20, 2026
@nobe4 nobe4 closed this in #263 May 20, 2026
@nobe4 nobe4 deleted the dependabot/bundler/addressable-2.9.0 branch May 20, 2026 07:48
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 20, 2026

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant