Bump addressable to 2.9.0 (CVE-2026-35611) - #87
Merged
Conversation
addressable >= 2.3.0 and < 2.9.0 has a ReDoS via URI templates that use the * (explode) modifier or multi-variable + / # operators. Both patterns are fully remediated in 2.9.0. The Gemfile constraint stays at addressable (~> 2.4) (jekyll's), and the new addressable runtime broadens public_suffix to < 8.0 — our already-locked public_suffix 6.0.1 satisfies both bounds, so only addressable's two lines change in Gemfile.lock. Refs: GHSA on this repo (#32), https://rubygems.org/gems/addressable
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
VatsalSy
added a commit
that referenced
this pull request
Jun 29, 2026
Bump addressable to 2.9.0 (CVE-2026-35611)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
addressablefrom 2.8.7 → 2.9.0 to close GHSA vs-branch-4 #32 / CVE-2026-35611 (ReDoS in URI templates).Gemfileconstraint (~> 2.4, set by Jekyll) is unchanged.public_suffixruntime bound widens from< 7.0to< 8.0in 2.9.0; the already-pinnedpublic_suffix 6.0.1still satisfies both bounds, so no transitive bump is needed.Lockfile was hand-edited because the repo pins Bundler 2.5.23 / Ruby 3.2.2 and a clean
bundle updaterequires those. CI will run the fullbundle installand validate.Test plan
Jekyll site CIbuild job passes (this exercisesbundle installagainst the new lockfile)Maintenance Regression Checkspasses