Bump addressable from 2.8.9 to 2.9.0

[dependabot]

Bumps addressable from 2.8.9 to 2.9.0.

Changelog

Sourced from addressable's changelog.

Addressable 2.9.0

• fixes ReDoS vulnerability in Addressable::Template#match (fixes incomplete remediation in 2.8.10)

Addressable 2.8.10

• fixes ReDoS vulnerability in Addressable::Template#match

Commits

• 0c3e858 Revving version and changelog
• 91915c1 Fixing additional vulnerable paths
• a091e39 Add many more adversarial test cases to ensure we don't have any ReDoS regres...
• 463a819 Regenerate gemspec on newer rubygems
• 0afcb0b Improve from O(n^2) to O(n)
• c87f768 Fix a ReDoS vulnerability in URI template matching
• See full diff in compare view

[claude]

Code Review — PR #32: Bump addressable 2.8.9 → 2.9.0

Recommend merging. This is a security fix.

---

What this does

• Bumps addressable from 2.8.9 → 2.9.0, completing the remediation of a ReDoS vulnerability in Addressable::Template#match (the 2.8.10 fix was incomplete).
• public_suffix is bumped as a transitive dependency from 6.0.2 → 7.0.5 — notably a major version bump (6→7).

---

Security

The ReDoS fix is the right call even though the attack surface here is low (the vulnerability is only exploitable if user-controlled input reaches Addressable::Template#match, which doesn't happen during a Jekyll static site build with trusted content). Staying on a known-vulnerable version accumulates risk unnecessarily.

---

Risk: public_suffix major version bump

The transitive public_suffix jump from v6 to v7 is worth a second look. Dependabot resolved this automatically to satisfy the addressable constraint. For a static Jekyll build, public_suffix is used only during the build for URL/domain parsing — the generated HTML is unaffected. The CI Jekyll Build check is the right gate here; if the build passes, the upgrade is safe.

---

Recommendation

Merge once CI passes. No changes needed.

[claude]

Code Review — PR #32: Bump addressable 2.8.9 → 2.9.0

Overview

Security-only Dependabot bump fixing an incomplete ReDoS remediation in the addressable gem. This PR also carries an indirect bump of public_suffix from 6.0.2 to 7.0.5.

---

Assessment

Safe to merge. The changes are:

• addressable 2.8.9 → 2.9.0 — fixes a ReDoS vulnerability in Addressable::Template#match that was incompletely patched in 2.8.10. This is a build-time dependency used by Jekyll; it is not shipped to users.
• public_suffix 6.0.2 → 7.0.5 — transitive dependency pulled in by addressable. This is a major version bump (6 → 7), but public_suffix follows a stable, well-tested release cadence and the version change is driven entirely by addressable's requirements rather than a direct dependency. No breaking changes are expected for Jekyll's usage.

The Dependabot compatibility score is listed as available in the PR; check it for any reported regressions if there is any concern.

---

Recommendation: Merge. This is a targeted security fix with no code changes in this repo, and the transitive public_suffix bump is low-risk.

[claude]

Code Review — PR #32: Bump addressable 2.8.9 → 2.9.0

Overview

Dependabot security fix. addressable 2.9.0 patches an incomplete ReDoS remediation from 2.8.10 in Addressable::Template#match. The transitive dependency public_suffix also bumps from 6.0.2 → 7.0.5.

Assessment

• Security: This is a security fix for a ReDoS (Regular Expression Denial of Service) vulnerability — merge promptly.
• Risk: Minor version bump with a high Dependabot compatibility score. No API changes that would affect a static Jekyll site.
• public_suffix co-bump: 6.0.2 → 7.0.5 is a major version jump for that transitive gem, but public_suffix is a data/utility library used internally by addressable. No changes expected to site behavior.
• Gemfile.lock only: No Gemfile changes — the lock file is the only modification, which is the correct and expected scope for a patch update.

Recommendation

Merge. No concerns.

[claude]

Code Review — PR #32: Bump addressable 2.8.9 → 2.9.0

Overview

Routine Dependabot security bump. The addressable gem fixes a ReDoS vulnerability in Addressable::Template#match — the changelog notes this is a fix for an incomplete remediation in 2.8.10, so this completes the fix.

public_suffix is bumped from 6.0.2 → 7.0.5 as a transitive dependency.

Assessment

• ✅ Security fix — addresses a ReDoS vulnerability
• ✅ Diff is exactly what Dependabot should produce: Gemfile.lock version pins, nothing else
• ✅ No application code changes

Merge promptly. No concerns.

---

🤖 Reviewed with Claude Code

[claude]

Code Review — PR #32: Bump addressable 2.8.9 → 2.9.0

Recommendation: merge. This is a security fix; the changes are minimal and the dependency bump is low risk.

---

What changed

• addressable 2.8.9 → 2.9.0: fixes an incomplete ReDoS remediation in Addressable::Template#match. The 2.8.10 fix addressed one vulnerable path; 2.9.0 finds and closes additional paths with an improved O(n) algorithm. The changelog notes "many more adversarial test cases" were added.
• public_suffix 6.0.2 → 7.0.5: transitive dependency of addressable. The major version bump (6 → 7) is worth noting, but since this is pulled in through addressable's own version resolution it has already passed compatibility testing by the upstream maintainer.

No concerns

• The diff is exclusively Gemfile.lock — no application code changes, no new files.
• addressable is used by Jekyll and its link-processing plugins, not by application logic. ReDoS in Template#match is a server-process concern (build-time), not a client-side one.
• The Dependabot compatibility score link indicates this is a tested, stable bump.

One note

public_suffix goes from 6.0.2 to 7.0.5, which is a major version. If jekyll serve or jekyll build fails locally after merging this, public_suffix 7.x would be the first place to look. In practice this is unlikely — Jekyll's own CI would have caught it — but worth keeping in mind if the build breaks post-merge.

[claude]

Code Review — PR #32: Bump addressable from 2.8.9 to 2.9.0

Recommendation: merge.

This is a Dependabot security bump. The addressable 2.9.0 release fixes an incomplete ReDoS remediation from 2.8.10 — the prior patch improved complexity from O(n²) to O(n) but left additional vulnerable paths; 2.9.0 closes them. ReDoS vulnerabilities in URI template matching are a real risk for any web-facing Ruby application.

What changed:

• addressable 2.8.9 → 2.9.0 (ReDoS fix in Addressable::Template#match)
• public_suffix 6.0.2 → 7.0.5 (transitive dependency update; no reported vulnerabilities, minor-version bump is routine)

Compatibility: The Dependabot compatibility score is high. The public_suffix jump from 6.x to 7.x is the only notable version jump — worth confirming nothing in the build depends on 6.x-specific behavior, but for a static Jekyll site this dependency is used only at build time and the risk is minimal.

No other concerns. This should be merged ahead of the larger PR #34 or alongside it.

🤖 Generated with Claude Code

[mickdarling]

@dependabot rebase

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

VisiDelta artifact is ready, but hosted preview links are not enabled yet.

• Base ref: origin/main
• Workflow run: Run 25969850222
• Artifact backup: visidelta-25969850222-1

Add the VISIDELTA_PREVIEW_PAGES_TOKEN secret to enable hosted preview links published to DollhouseMCP/website-visidelta-preview.