[dependabot]

Bumps addressable from 2.9.0 to 2.9.2.

Changelog

Sourced from addressable's changelog.

Addressable 2.9.2

• fixes Addressable::URI returning stale values after a component was changed: e.g. after host=, #site, #normalized_site, #normalized_authority and #normalize could still use the old host, and after scheme=, #normalized_port could keep a port that's the new scheme's default (#613)
• fixes Addressable::URI#normalized_query reusing the result of an earlier call with different flags: e.g. after normalized_query(:sorted), normalized_query and #normalize gave a sorted query, and after normalized_query, normalized_query(:sorted) gave an unsorted one (#608)
• fixes Addressable::Template#expand and #partial_expand changing the arrays given as values: e.g. [1, :a] became ["1", "a"]; a frozen array raised FrozenError, and an object that responds to to_ary raised TypeError (#605)
• fixes Addressable::URI#clone sharing component strings with the original: e.g. appending to the clone's #host also changed the original's host, but not its cached normalized values; #dup already made a separate copy (#617)
• fixes the pure-Ruby Addressable::IDNA.to_unicode raising ZeroDivisionError on some malformed labels, e.g. xn--rp3=, which also made Addressable::URI#display_uri raise, because the Punycode decoder treated punctuation as digits; such labels are now returned unchanged (#614)
• speeds up the pure-Ruby Addressable::IDNA.to_unicode, which became up to 25 times slower in 2.9.1 on long labels with many non-ASCII characters; Punycode encoding no longer takes quadratic time (#645)
• fixes the "character class has duplicated range" warnings that 2.9.1 gave when Addressable::IDNA was loaded with warnings enabled
• fixes the "instance variable @​validation_deferred not initialized" warning that 2.9.1 gave for every new Addressable::URI on Ruby before 3.0 with warnings enabled, and a "shadowing outer local variable" warning from Addressable::Template on Ruby 2.4 and 2.5

Addressable 2.9.1

• fixes denial of service in Addressable::URI.normalize_path, which took quadratic time on paths with many dot segments; URI#normalize, #join, #== and #=== were affected (GHSA-qq38-m9mg-xjj5)
• fixes Addressable::URI.normalize_path keeping segments that a .. should have removed after a .. above the root, e.g. /../../public/x/../../secret normalized to /public/x/secret instead of /secret (GHSA-8gmh-2hhj-2hv9)
• fixes Addressable::URI.normalize_path treating a raw line feed as a segment boundary, e.g. joining ..\n/secret onto /public/ gave /\n/secret
• deprecates Addressable::URI::RULE_2A, RULE_2B_2C, RULE_2D and RULE_PREFIXED_PARENT, which are no longer used; they will be removed in 2.10.0
• fixes denial of service in Addressable::Template#match and #extract, which still backtracked exponentially in 2.9.0 for exploded /, ., ;, ? and & expressions (e.g. {/path*}) on regex engines without match memoization, such as JRuby, TruffleRuby and MRI before 3.2; match results are unchanged (GHSA-j82w-28jv-3pmj)

... (truncated)

Commits

• 4a84535 Revving version and changelog (#646)
• 809e3af Encode Punycode in O(n log n) time (#645)
• 11f8aa7 Add specs and a changelog entry for Punycode digits (#644)
• bf75ca7 Reject non-alphanumeric Punycode digits (#614)
• 60d1815 Add specs and a changelog entry for URI#clone (#643)
• dde6cd6 Give URI clones independent string state (#617)
• 5135130 Add specs and a changelog entry for template array values (#642)
• ac57a52 Preserve input arrays during template normalization (#605)
• b407e0c Add specs and a changelog entry for normalized_query flags (#641)
• b6893ad Keep query normalization flags out of the default cache (#608)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)