Skip to content

chore(deps): bump addressable from 2.8.9 to 2.9.0#717

Closed
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/bundler/addressable-2.9.0
Closed

chore(deps): bump addressable from 2.8.9 to 2.9.0#717
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/bundler/addressable-2.9.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 8, 2026

Bumps addressable from 2.8.9 to 2.9.0.

Changelog

Sourced from addressable's changelog.

Addressable 2.9.0

  • fixes ReDoS vulnerability in Addressable::Template#match (fixes incomplete remediation in 2.8.10)

Addressable 2.8.10

  • fixes ReDoS vulnerability in Addressable::Template#match
Commits
  • 0c3e858 Revving version and changelog
  • 91915c1 Fixing additional vulnerable paths
  • a091e39 Add many more adversarial test cases to ensure we don't have any ReDoS regres...
  • 463a819 Regenerate gemspec on newer rubygems
  • 0afcb0b Improve from O(n^2) to O(n)
  • c87f768 Fix a ReDoS vulnerability in URI template matching
  • See full diff in compare view

@dependabot dependabot Bot added dependencies One or more dependencies are being bumped ruby Pull requests that update Ruby code labels Apr 8, 2026
@dependabot dependabot Bot requested a review from a team as a code owner April 8, 2026 09:02
@dependabot dependabot Bot added dependencies One or more dependencies are being bumped ruby Pull requests that update Ruby code labels Apr 8, 2026
Bumps [addressable](https://github.com/sporkmonger/addressable) from 2.8.9 to 2.9.0.
- [Changelog](https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md)
- [Commits](sporkmonger/addressable@addressable-2.8.9...addressable-2.9.0)

---
updated-dependencies:
- dependency-name: addressable
  dependency-version: 2.9.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/bundler/addressable-2.9.0 branch from be4101a to e9035bf Compare April 24, 2026 13:42
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 30, 2026

Looks like addressable is up-to-date now, so this is no longer needed.

@dependabot dependabot Bot closed this Apr 30, 2026
@dependabot dependabot Bot deleted the dependabot/bundler/addressable-2.9.0 branch April 30, 2026 09:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies One or more dependencies are being bumped ruby Pull requests that update Ruby code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants