[dependabot]

Bumps addressable from 2.9.0 to 2.9.1.

Changelog

Sourced from addressable's changelog.

Addressable 2.9.1

Addressable::URI

• fixes denial of service in Addressable::URI.normalize_path, which took quadratic time on paths with many dot segments; URI#normalize, #join, #== and #=== were affected ([GHSA-qq38-m9mg-xjj5])
• fixes Addressable::URI.normalize_path keeping segments that a .. should have removed after a .. above the root, e.g. /../../public/x/../../secret normalized to /public/x/secret instead of /secret ([GHSA-8gmh-2hhj-2hv9])
• fixes Addressable::URI.normalize_path treating a raw line feed as a segment boundary, e.g. joining ..\n/secret onto /public/ gave /\n/secret
• deprecates Addressable::URI::RULE_2A, RULE_2B_2C, RULE_2D and RULE_PREFIXED_PARENT, which are no longer used; they will be removed in 2.10.0
• fixes Addressable::URI#route_from and #route_to raising InvalidURIError when the route's first segment contains a colon (e.g. /a:b from /a); the route is now ./a:b (#625)
• fixes Addressable::URI#display_uri raising InvalidURIError for URIs without a host, such as abc or mailto:user@example.com; relative URIs are also no longer displayed with an empty authority (e.g. /path/to was displayed as ///path/to) (#610)
• fixes Addressable::URI#origin= raising InvalidURIError for an origin with an empty port (e.g. http://example.com:), which is the same as no port (#627)

Addressable::Template

• fixes denial of service in Addressable::Template#match and #extract, which still backtracked exponentially in 2.9.0 for exploded /, ., ;, ? and & expressions (e.g. {/path*}) on regex engines without match memoization, such as JRuby, TruffleRuby and MRI before 3.2; match results are unchanged ([GHSA-j82w-28jv-3pmj])
• fixes denial of service in Addressable::Template#match and #extract, which backtracked polynomially or exponentially on the same regex engines for expressions with several variables (e.g. {/owner,repo,ref}, or {+a,b,c} with many variables), for ; expressions, and for adjacent expressions (e.g. {+a}{+b}{+c} or {+a}{b}); match results are unchanged ([GHSA-9f42-57jx-vpp3])
• fixes denial of service in Addressable::Template#match and #extract, which backtracked polynomially for expressions with several exploded variables (e.g. {+a*,b*}), including on MRI 3.2; match results are unchanged ([GHSA-4w5q-wg7v-w6gp])
• fixes Addressable::Template#match and #extract raising Addressable::URI::InvalidURIError for a string that isn't a valid URI; they now return nil, as for any other URI that doesn't match (#621)

Addressable::IDNA

... (truncated)

Commits

• afa6663 Revving version and changelog (#631)
• 60455d3 Merge commit from fork
• b8a59cc Merge commit from fork
• 49aecf9 Merge commit from fork
• 1c6540d Compare template match captures without MatchData#named_captures (#630)
• f2b27b3 Merge commit from fork
• 26d1e9e Merge commit from fork
• 25c7c41 Merge commit from fork
• 4583e8a Add AGENTS.md and SECURITY.md (#629)
• e733b11 Run CI before publishing a release (#628)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

🔴 e2e: 2 failed, 1 flaky, 42 passed

🔴 basic pager › in LTR › pages horizontally
tests/basic-pager.e2e.ts:13

LAUNCH_TIMEOUT (launch)

starting an attempt on engine mobile timed out

• Failed on both attempts: ACTION_FAILED at step 1, then LAUNCH_TIMEOUT.

🔴 basic pager › in LTR › pages vertically
tests/support/basic-pager.ts:16

ACTION_FAILED at step 6 of 6: expect.toBeVisible getByTestId("pager-view-vertical"), after 10.8s

operation timed out: getByTestId("pager-view-vertical")

• Failed on both attempts: ACTION_FAILED at step 23, then at step 6.

⚠️ 1 flaky test passed on a retry

⚠️ basic pager › in RTL › pages horizontally with the reversed gesture
tests/support/app.ts:13

ACTION_FAILED at step 2 of 5: expect.toBeVisible getByTestId("example-basic-horizontal"), after 30.1s

operation timed out: getByTestId("example-basic-horizontal")

• Screen: com.pagerviewexample / PagerView

Evidence: log

All 45 tests in 18 files

	Test	Time
🔴	tests/basic-pager.e2e.ts · 2 failed, 1 flaky	2m 59s
🔴	basic pager › in LTR › pages horizontally	1m 0s
🔴	basic pager › in LTR › pages vertically	1m 0s
⚠️	basic pager › in RTL › pages horizontally with the reversed gesture (1 failed attempt first)	58.7s
🟢	tests/issues/issue-1050-back-gesture.e2e.ts · 8 passed	2m 59s
🟢	back gesture over the pager › in LTR › a back swipe on the first page pops the screen	16.3s
🟢	back gesture over the pager › in LTR › a back swipe on a later page goes to the previous page	15.6s
🟢	back gesture over the pager › in LTR › a forward swipe on the first page still goes to the next page	14.0s
🟢	back gesture over the pager › in RTL › a back swipe on the first page pops the screen	34.1s
🟢	back gesture over the pager › in RTL › a back swipe on a later page goes to the previous page	29.2s
🟢	back gesture over the pager › in RTL › a forward swipe on the first page still goes to the next page	40.0s
🟢	back gesture over a pager in a nested stack › a back swipe on the first page pops the outer stack	16.8s
🟢	back gesture over a pager in a nested stack › a forward swipe on the first page still goes to the next page	12.9s
🟢	tests/issues/issue-1083-modal-set-page.e2e.ts · 1 passed	18.1s
🟢	setPage called behind a native-stack modal lands on the requested page	18.1s
🟢	tests/issues/issue-1096-keyboard-shrink.e2e.ts · 1 passed	34.2s
🟢	keyboard avoidance does not shrink the page under the keyboard	34.2s
🟢	tests/issues/issue-1098-nested-pager.e2e.ts · 1 passed	19.4s
🟢	outer pager stays responsive after its page count changes around a nested pager	19.4s
🟢	tests/issues/issue-1142-search-bar-inset.e2e.ts · 1 passed	16.7s
🟢	FlatList inside the pager gets the search bar safe-area insets	16.7s
🟢	tests/issues/issue-1154-page-change-focus.e2e.ts · 13 passed	5m 6s
🟢	leaving a page with setPage blurs its input	13.0s
🟢	setPage with an input focused lands on the target page	16.9s
🟢	a setPage two pages away lands on the far page	40.2s
🟢	a setPage repeated during the slide changes nothing	27.5s
🟢	leaving a page with a swipe blurs its input	21.8s
🟢	an input focused on the new page keeps focus	22.5s
🟢	a swipe keeps the focus the new page takes from onPageSelected	26.7s
🟢	a setPage that interrupts another lands on the page asked for last	19.2s
🟢	a setPage that interrupts another still lands on the later page	15.6s
🟢	a setPage redirected once the focus has landed blurs it	25.4s
🟢	two setPage calls that cancel out land on the first page	22.5s
🟢	right to left › leaving a page with a swipe blurs its input	36.9s
🟢	a page that grows with the keyboard still lands on the target page	18.2s
🟢	tests/issues/issue-1230-pager-between-pages.e2e.ts · 1 passed	17.9s
🟢	a pager scrolled to a focused field still lands on the page asked for	17.9s
🟢	tests/issues/pr-1194-remount-initial-page.e2e.ts · 1 passed	20.4s
🟢	a pager remounted after its screen was covered starts on its own initialPage	20.4s
🟢	tests/keyboard-dismiss-mode.e2e.ts · 3 passed	43.8s
🟢	on-drag: dragging the pager blurs the input	15.3s
🟢	on-drag: setPage keeps the input focused	14.3s
🟢	none: dragging the pager keeps the input focused	14.2s
🟢	tests/material-top-bar.e2e.ts · 1 passed	21.1s
🟢	material top tabs survive a native-stack push and pop	21.1s
🟢	tests/native-driver-events.e2e.ts · 2 passed	22.0s
🟢	native driver events › setPage through the Animated ref drives the native value	11.5s
🟢	native driver events › a swipe drives the native value	10.5s
🟢	tests/nested-pager-view.e2e.ts · 1 passed	19.6s
🟢	nested horizontal and vertical pagers scroll independently	19.6s
🟢	tests/on-page-selected.e2e.ts · 1 passed	40.6s
🟢	onPageSelected fires an alert for every page change	40.6s
🟢	tests/scrollable-pager-view.e2e.ts · 1 passed	29.8s
🟢	pager inside a ScrollView keeps its page across vertical scrolls	29.8s
🟢	tests/set-page-animation.e2e.ts · 4 passed	1m 5s
🟢	ltr › direct setPage selects only the target page (ltr)	13.1s
🟢	rtl › direct setPage selects only the target page (rtl)	31.2s
🟢	the page next to the target is selectable after a direct setPage	11.3s
🟢	scroll setPage passes the pages in between, direct setPage does not	9.8s
🟢	tests/smoke.e2e.ts · 1 passed	9.7s
🟢	horizontal pager pages with the panel buttons	9.7s
🟢	tests/tab-view-inside-scroll-view.e2e.ts · 1 passed	23.4s
🟢	TabView inside a ScrollView swipes tabs and scrolls the page	23.4s

_{Tested by e2e 0.23.0 · 21m 43s · ios · run artifacts}