dependabot[bot] opened a new pull request, #774: URL: https://github.com/apache/doris-opentelemetry-demo/pull/774
Bumps [addressable](https://github.com/sporkmonger/addressable) from 2.8.7 to 2.9.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md";>addressable's changelog</a>.</em></p> <blockquote> <h2>Addressable 2.9.1 <!-- raw HTML omitted --></h2> <h3><code>Addressable::URI</code></h3> <ul> <li>fixes denial of service in <code>Addressable::URI.normalize_path</code>, which took quadratic time on paths with many dot segments; <code>URI#normalize</code>, <code>#join</code>, <code>#==</code> and <code>#===</code> were affected ([GHSA-qq38-m9mg-xjj5])</li> <li>fixes <code>Addressable::URI.normalize_path</code> keeping segments that a <code>..</code> should have removed after a <code>..</code> above the root, e.g. <code>/../../public/x/../../secret</code> normalized to <code>/public/x/secret</code> instead of <code>/secret</code> ([GHSA-8gmh-2hhj-2hv9])</li> <li>fixes <code>Addressable::URI.normalize_path</code> treating a raw line feed as a segment boundary, e.g. joining <code>..\n/secret</code> onto <code>/public/</code> gave <code>/\n/secret</code></li> <li>deprecates <code>Addressable::URI::RULE_2A</code>, <code>RULE_2B_2C</code>, <code>RULE_2D</code> and <code>RULE_PREFIXED_PARENT</code>, which are no longer used; they will be removed in 2.10.0</li> <li>fixes <code>Addressable::URI#route_from</code> and <code>#route_to</code> raising <code>InvalidURIError</code> when the route's first segment contains a colon (e.g. <code>/a:b</code> from <code>/a</code>); the route is now <code>./a:b</code> (<a href="https://redirect.github.com/sporkmonger/addressable/issues/625";>#625</a>)</li> <li>fixes <code>Addressable::URI#display_uri</code> raising <code>InvalidURIError</code> for URIs without a host, such as <code>abc</code> or <code>mailto:[email protected]</code>; relative URIs are also no longer displayed with an empty authority (e.g. <code>/path/to</code> was displayed as <code>///path/to</code>) (<a href="https://redirect.github.com/sporkmonger/addressable/issues/610";>#610</a>)</li> <li>fixes <code>Addressable::URI#origin=</code> raising <code>InvalidURIError</code> for an origin with an empty port (e.g. <code>http://example.com:</code>), which is the same as no port (<a href="https://redirect.github.com/sporkmonger/addressable/issues/627";>#627</a>)</li> </ul> <h3><code>Addressable::Template</code></h3> <ul> <li>fixes denial of service in <code>Addressable::Template#match</code> and <code>#extract</code>, which still backtracked exponentially in 2.9.0 for exploded <code>/</code>, <code>.</code>, <code>;</code>, <code>?</code> and <code>&</code> expressions (e.g. <code>{/path*}</code>) on regex engines without match memoization, such as JRuby, TruffleRuby and MRI before 3.2; match results are unchanged ([GHSA-j82w-28jv-3pmj])</li> <li>fixes denial of service in <code>Addressable::Template#match</code> and <code>#extract</code>, which backtracked polynomially or exponentially on the same regex engines for expressions with several variables (e.g. <code>{/owner,repo,ref}</code>, or <code>{+a,b,c}</code> with many variables), for <code>;</code> expressions, and for adjacent expressions (e.g. <code>{+a}{+b}{+c}</code> or <code>{+a}{b}</code>); match results are unchanged ([GHSA-9f42-57jx-vpp3])</li> <li>fixes denial of service in <code>Addressable::Template#match</code> and <code>#extract</code>, which backtracked polynomially for expressions with several exploded variables (e.g. <code>{+a*,b*}</code>), including on MRI 3.2; match results are unchanged ([GHSA-4w5q-wg7v-w6gp])</li> <li>fixes <code>Addressable::Template#match</code> and <code>#extract</code> raising <code>Addressable::URI::InvalidURIError</code> for a string that isn't a valid URI; they now return <code>nil</code>, as for any other URI that doesn't match (<a href="https://redirect.github.com/sporkmonger/addressable/issues/621";>#621</a>)</li> </ul> <h3><code>Addressable::IDNA</code></h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sporkmonger/addressable/commit/afa66636d9fdcca11e03c85cf166651e0efa68ef";><code>afa6663</code></a> Revving version and changelog (<a href="https://redirect.github.com/sporkmonger/addressable/issues/631";>#631</a>)</li> <li><a href="https://github.com/sporkmonger/addressable/commit/60455d32bb59fda2585a0e1865a9fcb21e8e55b1";><code>60455d3</code></a> Merge commit from fork</li> <li><a href="https://github.com/sporkmonger/addressable/commit/b8a59cc0e03f8704f1d7c8122fc8f7ef8548362d";><code>b8a59cc</code></a> Merge commit from fork</li> <li><a href="https://github.com/sporkmonger/addressable/commit/49aecf97bf6f6675717f1078a0b45f95c428e103";><code>49aecf9</code></a> Merge commit from fork</li> <li><a href="https://github.com/sporkmonger/addressable/commit/1c6540d7bdf2904a1d972d99e8fcdad39c060a51";><code>1c6540d</code></a> Compare template match captures without MatchData#named_captures (<a href="https://redirect.github.com/sporkmonger/addressable/issues/630";>#630</a>)</li> <li><a href="https://github.com/sporkmonger/addressable/commit/f2b27b3ab252e56b3fa3519f7ebb491d54cf7b7c";><code>f2b27b3</code></a> Merge commit from fork</li> <li><a href="https://github.com/sporkmonger/addressable/commit/26d1e9e8409a861571f9d0029022b6e9b9158b5e";><code>26d1e9e</code></a> Merge commit from fork</li> <li><a href="https://github.com/sporkmonger/addressable/commit/25c7c412a2f7e06c3cac92872e831f6d053703c5";><code>25c7c41</code></a> Merge commit from fork</li> <li><a href="https://github.com/sporkmonger/addressable/commit/4583e8a0199cac31cc2fe3585899f93825241cd9";><code>4583e8a</code></a> Add AGENTS.md and SECURITY.md (<a href="https://redirect.github.com/sporkmonger/addressable/issues/629";>#629</a>)</li> <li><a href="https://github.com/sporkmonger/addressable/commit/e733b1181d236863bc535b5ad8a4ec48cfb0669c";><code>e733b11</code></a> Run CI before publishing a release (<a href="https://redirect.github.com/sporkmonger/addressable/issues/628";>#628</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sporkmonger/addressable/compare/addressable-2.8.7...addressable-2.9.1";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/doris-opentelemetry-demo/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
