[dependabot]

Bumps addressable from 2.9.0 to 2.9.1.

Changelog

Sourced from addressable's changelog.

Addressable 2.9.1

• fixes denial of service in Addressable::URI.normalize_path, which took quadratic time on paths with many dot segments; URI#normalize, #join, #== and #=== were affected (GHSA-qq38-m9mg-xjj5)
• fixes Addressable::URI.normalize_path keeping segments that a .. should have removed after a .. above the root, e.g. /../../public/x/../../secret normalized to /public/x/secret instead of /secret (GHSA-8gmh-2hhj-2hv9)
• fixes Addressable::URI.normalize_path treating a raw line feed as a segment boundary, e.g. joining ..\n/secret onto /public/ gave /\n/secret
• deprecates Addressable::URI::RULE_2A, RULE_2B_2C, RULE_2D and RULE_PREFIXED_PARENT, which are no longer used; they will be removed in 2.10.0
• fixes denial of service in Addressable::Template#match and #extract, which still backtracked exponentially in 2.9.0 for exploded /, ., ;, ? and & expressions (e.g. {/path*}) on regex engines without match memoization, such as JRuby, TruffleRuby and MRI before 3.2; match results are unchanged (GHSA-j82w-28jv-3pmj)
• fixes denial of service in Addressable::Template#match and #extract, which backtracked polynomially or exponentially on the same regex engines for expressions with several variables (e.g. {/owner,repo,ref}, or {+a,b,c} with many variables), for ; expressions, and for adjacent expressions (e.g. {+a}{+b}{+c} or {+a}{b}); match results are unchanged (GHSA-9f42-57jx-vpp3)
• fixes denial of service in Addressable::Template#match and #extract, which backtracked polynomially for expressions with several exploded variables (e.g. {+a*,b*}), including on MRI 3.2; match results are unchanged (GHSA-4w5q-wg7v-w6gp)
• fixes Addressable::IDNA.to_unicode in the pure-Ruby backend decoding Punycode labels that aren't valid A-labels: labels that decode to only ASCII characters (e.g. xn--google- decoded to google) and labels that don't convert back to themselves; such a label is now returned unchanged, as with libidn, so Addressable::URI#display_uri no longer shows a host that differs from #normalized_host (GHSA-9crm-g4mf-wc5j)
• fixes Addressable::IDNA.to_unicode decoding Punycode labels with characters that change how a host displays without being visible themselves, such as bidi overrides and isolates (e.g. U+202E and U+2066), zero width characters and control characters; such a label is now returned unchanged, so Addressable::URI#display_uri no longer shows them. The pure-Ruby backend also no longer decodes labels with other characters that nameprep prohibits, as with libidn (GHSA-539f-xcgw-2gjg)
• fixes Addressable::URI#route_from and #route_to raising InvalidURIError when the route's first segment contains a colon (e.g. /a:b from /a); the route is now ./a:b (#625)
• fixes Addressable::IDNA.to_unicode raising in the pure-Ruby backend for Punycode labels that are too long, overflow the decoder, or decode past U+10FFFF; the label is now returned unchanged, as with libidn, so Addressable::URI#display_uri no longer raises for such hosts (#620)
• fixes Addressable::URI#display_uri raising InvalidURIError for URIs

... (truncated)

Commits

• afa6663 Revving version and changelog (#631)
• 60455d3 Merge commit from fork
• b8a59cc Merge commit from fork
• 49aecf9 Merge commit from fork
• 1c6540d Compare template match captures without MatchData#named_captures (#630)
• f2b27b3 Merge commit from fork
• 26d1e9e Merge commit from fork
• 25c7c41 Merge commit from fork
• 4583e8a Add AGENTS.md and SECURITY.md (#629)
• e733b11 Run CI before publishing a release (#628)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)