Skip to content

Bump addressable from 2.8.8 to 2.9.0 in /examples/react-native#6504

Merged
penberg merged 1 commit into
mainfrom
dependabot/bundler/examples/react-native/addressable-2.9.0
Apr 21, 2026
Merged

Bump addressable from 2.8.8 to 2.9.0 in /examples/react-native#6504
penberg merged 1 commit into
mainfrom
dependabot/bundler/examples/react-native/addressable-2.9.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 21, 2026

Copy link
Copy Markdown
Contributor

Bumps addressable from 2.8.8 to 2.9.0.

Changelog

Sourced from addressable's changelog.

Addressable 2.9.0

  • fixes ReDoS vulnerability in Addressable::Template#match (fixes incomplete remediation in 2.8.10)

Addressable 2.8.10

  • fixes ReDoS vulnerability in Addressable::Template#match

Addressable 2.8.9

  • Reduce gem size by excluding test files (#569)
  • No need for bundler as development dependency (#571, 5fc1d93)
  • idna/pure: stop building the useless COMPOSITION_TABLE (removes the Addressable::IDNA::COMPOSITION_TABLE constant) (#564)

#569: sporkmonger/addressable#569 #571: sporkmonger/addressable#571 #564: sporkmonger/addressable#564

Commits
  • 0c3e858 Revving version and changelog
  • 91915c1 Fixing additional vulnerable paths
  • a091e39 Add many more adversarial test cases to ensure we don't have any ReDoS regres...
  • 463a819 Regenerate gemspec on newer rubygems
  • 0afcb0b Improve from O(n^2) to O(n)
  • c87f768 Fix a ReDoS vulnerability in URI template matching
  • 0d7e9b2 Fix links for 2.8.9 in CHANGELOG (#573)
  • e209120 Update version, gemspec, and CHANGELOG for 2.8.9 (#572)
  • 3875874 Reduce gem size by excluding test files (#569)
  • 3e57cc6 CI: back to windows-2022 for MRI job
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump addressable from 2.8.8 to 2.9.0 in /examples/react-native
b73a0c1 
Bumps [addressable](https://github.com/sporkmonger/addressable) from 2.8.8 to 2.9.0.
- [Changelog](https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md)
- [Commits](sporkmonger/addressable@addressable-2.8.8...addressable-2.9.0)

---
updated-dependencies:
- dependency-name: addressable
  dependency-version: 2.9.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Apr 21, 2026
@dependabot dependabot Bot requested a review from penberg as a code owner April 21, 2026 10:51
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Apr 21, 2026
@github-actions

github-actions Bot commented Apr 21, 2026

Copy link
Copy Markdown
Contributor

Fossier: PR Auto-Closed

This PR was automatically closed because @dependabot[bot] did not meet the trust threshold for this repository.

Score Breakdown

Total Score: 23.4/100 | Confidence: 94% | Outcome: DENY

Signal Value Score Weight
account_age 2561 0.30 0.07
public_repos 0 0.00 0.04
contribution_history 0 0.00 0.04
follower_ratio 0.0 0.00 0.04
bot_signals True 0.00 0.03
open_prs_elsewhere 60125635 0.00 0.07
closed_prs_elsewhere 48906974 0.00 0.08
merged_prs_elsewhere 0 FAILED (Search failed) 0.06
prior_interaction 0 0.00 0.24
activity_velocity 0 1.00 0.06
pr_content ... 0.70 0.06
commit_email no_email 0.50 0.03
pr_description ... 0.50 0.04
repo_stars 18313 0.30 0.03
org_membership 0 0.20 0.02
commit_verification ... 1.00 0.03
contributor_stars 0 0.20 0.03

Appeal

If you believe this is a mistake, please open an issue to request manual review. A maintainer can vouch for you by adding your username to the VOUCHED.td file.

You can also reach the maintainers at: https://discord.gg/mNUkCHs2R to appeal this decision

@github-actions github-actions Bot closed this Apr 21, 2026
@dependabot @github

dependabot Bot commented on behalf of github Apr 21, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot Bot deleted the dependabot/bundler/examples/react-native/addressable-2.9.0 branch April 21, 2026 10:52
@penberg penberg restored the dependabot/bundler/examples/react-native/addressable-2.9.0 branch April 21, 2026 10:53
@penberg penberg reopened this Apr 21, 2026
@penberg penberg merged commit 3c9ad49 into main Apr 21, 2026
152 of 214 checks passed
@penberg penberg deleted the dependabot/bundler/examples/react-native/addressable-2.9.0 branch April 21, 2026 12:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@penberg penberg Awaiting requested review from penberg penberg is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file fossier:spam-likely ruby Pull requests that update ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@penberg