[dependabot]

Bumps addressable from 2.9.0 to 2.9.1.

Changelog

Sourced from addressable's changelog.

Addressable 2.9.1

Addressable::URI

• fixes denial of service in Addressable::URI.normalize_path, which took quadratic time on paths with many dot segments; URI#normalize, #join, #== and #=== were affected ([GHSA-qq38-m9mg-xjj5])
• fixes Addressable::URI.normalize_path keeping segments that a .. should have removed after a .. above the root, e.g. /../../public/x/../../secret normalized to /public/x/secret instead of /secret ([GHSA-8gmh-2hhj-2hv9])
• fixes Addressable::URI.normalize_path treating a raw line feed as a segment boundary, e.g. joining ..\n/secret onto /public/ gave /\n/secret
• deprecates Addressable::URI::RULE_2A, RULE_2B_2C, RULE_2D and RULE_PREFIXED_PARENT, which are no longer used; they will be removed in 2.10.0
• fixes Addressable::URI#route_from and #route_to raising InvalidURIError when the route's first segment contains a colon (e.g. /a:b from /a); the route is now ./a:b (#625)
• fixes Addressable::URI#display_uri raising InvalidURIError for URIs without a host, such as abc or mailto:user@example.com; relative URIs are also no longer displayed with an empty authority (e.g. /path/to was displayed as ///path/to) (#610)
• fixes Addressable::URI#origin= raising InvalidURIError for an origin with an empty port (e.g. http://example.com:), which is the same as no port (#627)

Addressable::Template

• fixes denial of service in Addressable::Template#match and #extract, which still backtracked exponentially in 2.9.0 for exploded /, ., ;, ? and & expressions (e.g. {/path*}) on regex engines without match memoization, such as JRuby, TruffleRuby and MRI before 3.2; match results are unchanged ([GHSA-j82w-28jv-3pmj])
• fixes denial of service in Addressable::Template#match and #extract, which backtracked polynomially or exponentially on the same regex engines for expressions with several variables (e.g. {/owner,repo,ref}, or {+a,b,c} with many variables), for ; expressions, and for adjacent expressions (e.g. {+a}{+b}{+c} or {+a}{b}); match results are unchanged ([GHSA-9f42-57jx-vpp3])
• fixes denial of service in Addressable::Template#match and #extract, which backtracked polynomially for expressions with several exploded variables (e.g. {+a*,b*}), including on MRI 3.2; match results are unchanged ([GHSA-4w5q-wg7v-w6gp])
• fixes Addressable::Template#match and #extract raising Addressable::URI::InvalidURIError for a string that isn't a valid URI; they now return nil, as for any other URI that doesn't match (#621)

Addressable::IDNA

... (truncated)

Commits

• afa6663 Revving version and changelog (#631)
• 60455d3 Merge commit from fork
• b8a59cc Merge commit from fork
• 49aecf9 Merge commit from fork
• 1c6540d Compare template match captures without MatchData#named_captures (#630)
• f2b27b3 Merge commit from fork
• 26d1e9e Merge commit from fork
• 25c7c41 Merge commit from fork
• 4583e8a Add AGENTS.md and SECURITY.md (#629)
• e733b11 Run CI before publishing a release (#628)
• Additional commits viewable in compare view