Skip to content

🚨 [security] Update webmock 3.25.2 → 3.26.3 (minor) - #83

Closed
depfu[bot] wants to merge 1 commit into
masterfrom
depfu/update/webmock-3.26.3
Closed

🚨 [security] Update webmock 3.25.2 → 3.26.3 (minor)#83
depfu[bot] wants to merge 1 commit into
masterfrom
depfu/update/webmock-3.26.3

Conversation

@depfu

@depfu depfu Bot commented Aug 22, 2026

Copy link
Copy Markdown
Contributor

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ webmock (3.25.2 → 3.26.3) · Repo · Changelog

Release Notes

3.26.3

  • Confirm to work with curb 1.3.7

    Thanks to Josch Bockler

  • Fix NameError in async-http adapter on protocol-http1 >= 0.40

    Thanks to Leslie Hoare

3.26.2

  • Add support to parse http/2 request on curb adapter

    Thanks to Christoph Rieß

  • CurbAdapter alias code from response_code

    Thanks to Christoph Rieß

  • Add HTTP.rb v6.0.0 compatibility to http_rb adapter

    Thanks to Erik Berlin

3.26.1 (from changelog)

Fix compatibility with recent async-http versions

Thanks to [Mikhail Doronin](https://github.com/misdoro)

3.26.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 40 commits:

↗️ addressable (indirect, 2.8.7 → 2.9.0) · Repo · Changelog

Security Advisories 🚨

🚨 Addressable has a Regular Expression Denial of Service in Addressable templates

Impact

Within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking:

  1. Templates using the * (explode) modifier with any expansion operator (e.g., {foo*}, {+var*}, {#var*}, {/var*}, {.var*}, {;var*}, {?var*}, {&var*}) generate patterns with nested unbounded quantifiers that are O(2^n) when matched against a maliciously crafted URI.
  2. Templates using multiple variables with the + or # operators (e.g., {+v1,v2,v3}) generate patterns with O(n^k) complexity due to the comma separator being within the matched character class, causing ambiguous backtracking across k variables.

When matched against a maliciously crafted URI, this can result in catastrophic backtracking and uncontrolled resource consumption, leading to denial of service. The first pattern was partially addressed in 2.8.10 for certain operator combinations. Both patterns are fully remediated in 2.9.0.

Users of the URI parsing capabilities in Addressable but not the URI template matching capabilities are unaffected.

Affected Versions

This vulnerability affects Addressable >= 2.3.0 (note: 2.3.0 and 2.3.1 were yanked; the earliest installable release is 2.3.2). It was partially fixed in version 2.8.10 and fully remediated in 2.9.0.

The vulnerability is more exploitable on MRI Ruby < 3.2 and on all versions of JRuby and TruffleRuby. MRI Ruby 3.2 and later ship with Onigmo 6.9, which introduces memoization that prevents catastrophic backtracking for the first class of template. JRuby and TruffleRuby do not implement equivalent memoization and remain vulnerable to all patterns.

This has been confirmed on the following runtimes:

Runtime Status
MRI Ruby 2.6 Vulnerable
MRI Ruby 2.7 Vulnerable
MRI Ruby 3.0 Vulnerable
MRI Ruby 3.1 Vulnerable
MRI Ruby 3.2 Partially vulnerable
MRI Ruby 3.3 Partially vulnerable
MRI Ruby 3.4 Partially vulnerable
MRI Ruby 4.0 Partially vulnerable
JRuby 10.0 Vulnerable
TruffleRuby 21.2 Vulnerable

Workarounds

  • Upgrade to MRI Ruby 3.2 or later, if your application does not use JRuby or TruffleRuby. The Onigmo memoization introduced in MRI Ruby 3.2 prevents catastrophic backtracking from nested unbounded quantifiers (pattern 1 above — templates using the * modifier). It does not reliably mitigate the O(n^k) multi-variable case (pattern 2), so upgrading Ruby alone may not be sufficient if your templates use {+v1,v2,...} or {#v1,v2,...} syntax.

  • Avoid using vulnerable template patterns when matching user-supplied input on unpatched versions of the library:

    • Templates using the * (explode) modifier: {foo*}, {+var*}, {#var*}, {.var*}, {/var*}, {;var*}, {?var*}, {&var*}
    • Templates using multiple variables with the + or # operators: {+v1,v2}, {#v1,v2,v3}, etc.

  • Apply a short timeout around any call to Template#match or Template#extract that processes user-supplied data.

References

Credits

Discovered in collaboration with @jamfish.

For more information

If you have any questions or comments about this advisory:

Release Notes

2.9.0 (from changelog)

  • fixes ReDoS vulnerability in Addressable::Template#match (fixes incomplete remediation in 2.8.10)

2.8.10 (from changelog)

  • fixes ReDoS vulnerability in Addressable::Template#match

2.8.9 (from changelog)

  • Reduce gem size by excluding test files (#569)
  • No need for bundler as development dependency (#571, 5fc1d93)
  • idna/pure: stop building the useless COMPOSITION_TABLE (removes the Addressable::IDNA::COMPOSITION_TABLE constant) (#564)

2.8.8 (from changelog)

  • Replace the unicode.data blob by a ruby constant (#561)
  • Allow public_suffix 7 (#558)

Does any of this look wrong? Please let us know.

↗️ bigdecimal (indirect, 3.3.1 → 4.1.2) · Repo · Changelog

Release Notes

4.1.2

What's Changed

  • Optimize BigDecimal#to_s by @byroot in #519
  • Fix calloc-transposed-args warning by @nobu in #520
  • Use '0'+n for converting single digit to char by @tompng in #521
  • Revert "Add a workaround for slow BigDecimal#to_f when it has large N_significant_digits" by @tompng in #522
  • BigMath.exp overflow/underflow check by @tompng in #523
  • Fix unary minus on unsigned type warning by @tompng in #525
  • Update dtoa to version from Ruby 4.0 by @jhawthorn in #528
  • Bump version to v4.1.2 by @tompng in #529

New Contributors

Full Changelog: v4.1.1...v4.1.2

4.1.1

What's Changed

New Contributors

Full Changelog: v4.1.0...v4.1.1

4.1.0

What's Changed

  • Remove ENABLE_NUMERIC_STRING flag by @tompng in #479
  • Sample code without deprecated modules by @tompng in #480
  • Improve performance of add/sub when exponent of two bigdecimals have huge difference by @tompng in #478
  • Change frozen_string_literal from false to true by @tompng in #481
  • NTT multiplication and Newton-Raphson division by @tompng in #407
  • Implement BigMath::PI with Gauss-Legendre algorithm by @tompng in #434
  • Improve taylor series calculation of exp and sin by bit burst algorithm by @tompng in #433
  • Remove calculating log(10) in BigMath.log for large/small x by @tompng in #484
  • Add missing call-seq by @tompng in #485
  • Split internal extra calculation prec and BigDecimal.double_fig usage by @tompng in #486
  • Add RBS signature and testing by @ksss in #488
  • Add missing sig file by @ksss in #492
  • Simplify butterfly operation of Number Theoretic Transform by @tompng in #496
  • Assume always have uint64_t by @tompng in #497
  • Use bit_length to calculate NTT bit size by @tompng in #498
  • Update depend files, etc by @tompng in #499
  • Fix erfc(x,prec) precision when x is huge by @tompng in #502
  • Increase BigMath converge test precisions by @tompng in #503
  • Fix error compiling with ruby.wasm by @tompng in #504
  • Bump version to 4.1.0 by @tompng in #505

New Contributors

  • @ksss made their first contribution in #488

Full Changelog: v4.0.1...v4.1.0

4.0.1

What's Changed

  • Exclude dependabot updates from release note by @hsbt in #474
  • Remove unused variable (and add test for it) by @tompng in #475
  • Remove "Which version should you select" section by @tompng in #476
  • Bump version to v4.0.1 by @tompng in #477

Full Changelog: v4.0.0...v4.0.1

4.0.0

What's Changed

  • Fix x**y, x.power(y, 0) and x.sqrt(0) calculates huge digits if precision limit is huge by @tompng in #445
  • Implement major math functions by @tompng in #336
  • Fix fast-path of frac and _decimal_shift affected by BigDecimal.limit by @tompng in #447
  • Update the latest versions of actions by @hsbt in #449
  • Add missing bigmath precision test, add missing indent by @tompng in #450
  • Make BigMath.exp and log also a module_method by @tompng in #452
  • Fix incorrect exception when exponent is fractional for Infinity base by @troy-dunamu in #453
  • Bump step-security/harden-runner from 2.13.1 to 2.13.2 by @dependabot[bot] in #454
  • Don't use assert_separatly if not needed by @tompng in #455
  • Bump actions/checkout from 5.0.0 to 6.0.0 by @dependabot[bot] in #456
  • Bump actions/checkout from 5.0.1 to 6.0.0 by @dependabot[bot] in #457
  • Add missing BigMath test for jruby by @tompng in #459
  • Change remainder/modulo/divmod test of +0/-0 type tolerant by @tompng in #460
  • Cast divmod quotient to int by @mrzasa in #312
  • Bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in #462
  • Bump step-security/harden-runner from 2.13.2 to 2.13.3 by @dependabot[bot] in #461
  • Implement BigMath.erf(x, prec) and BigMath.erfc(x, prec) by @tompng in #357
  • Implement BigMath.gamma and BigMath.lgamma by @tompng in #451
  • Fix typos + improve copy/paste in readme by @tas50 in #463
  • Fix inaccurate calculation (last digit) and add a workaround for add/sub hang bug by @tompng in #465
  • Fix lgamma precision around 1 and 2 by @tompng in #466
  • Fix lgamma precision when gamma(negative_x).abs nearly equals 1 by @tompng in #467
  • Implement BigMath.frexp and ldexp with exponent of 10 by @tompng in #448
  • Bump step-security/harden-runner from 2.13.3 to 2.14.0 by @dependabot[bot] in #468
  • Better rounding of BigMath.atan(nearly_one, prec) by @tompng in #469
  • Remove deprecated method BigDecimal#precs by @tompng in #470
  • Deprecate ludcmp, jacobian and newton by @tompng in #471
  • Bump version to v4.0.0 by @tompng in #472

New Contributors

Full Changelog: v3.3.1...v4.0.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ public_suffix (indirect, 6.0.2 → 7.0.5) · Repo · Changelog

Release Notes

7.0.5 (from changelog)

Fixed

  • Fix release crash caused by unconditional rubocop/yard requires in Rakefile.

7.0.2 (from changelog)

Changed

  • Excluded symlinks and unnecessary files from gem packaging. On Windows symlinks cannot be created without Administrator privileges or with developer mode enabled #496.

7.0.1 (from changelog)

Changed

  • Updated definitions.

7.0.0 (from changelog)

Changed

  • Updated definitions.
  • Minimum Ruby version is 3.2

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu Bot added the depfu label Aug 22, 2026
@depfu depfu Bot mentioned this pull request Aug 22, 2026
Closed
@depfu

depfu Bot commented Aug 30, 2026

Copy link
Copy Markdown
Contributor Author

Closed in favor of #84.

@depfu depfu Bot closed this Aug 30, 2026
@depfu
depfu Bot deleted the depfu/update/webmock-3.26.3 branch August 30, 2026 11:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

depfu

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants