[dependabot]

Bumps the bundler group with 1 update in the /example/site-with-errors directory: addressable.

Updates addressable from 2.9.0 to 2.9.1

Changelog

Sourced from addressable's changelog.

Addressable 2.9.1

Addressable::URI

• fixes denial of service in Addressable::URI.normalize_path, which took quadratic time on paths with many dot segments; URI#normalize, #join, #== and #=== were affected ([GHSA-qq38-m9mg-xjj5])
• fixes Addressable::URI.normalize_path keeping segments that a .. should have removed after a .. above the root, e.g. /../../public/x/../../secret normalized to /public/x/secret instead of /secret ([GHSA-8gmh-2hhj-2hv9])
• fixes Addressable::URI.normalize_path treating a raw line feed as a segment boundary, e.g. joining ..\n/secret onto /public/ gave /\n/secret
• deprecates Addressable::URI::RULE_2A, RULE_2B_2C, RULE_2D and RULE_PREFIXED_PARENT, which are no longer used; they will be removed in 2.10.0
• fixes Addressable::URI#route_from and #route_to raising InvalidURIError when the route's first segment contains a colon (e.g. /a:b from /a); the route is now ./a:b (#625)
• fixes Addressable::URI#display_uri raising InvalidURIError for URIs without a host, such as abc or mailto:user@example.com; relative URIs are also no longer displayed with an empty authority (e.g. /path/to was displayed as ///path/to) (#610)
• fixes Addressable::URI#origin= raising InvalidURIError for an origin with an empty port (e.g. http://example.com:), which is the same as no port (#627)

Addressable::Template

• fixes denial of service in Addressable::Template#match and #extract, which still backtracked exponentially in 2.9.0 for exploded /, ., ;, ? and & expressions (e.g. {/path*}) on regex engines without match memoization, such as JRuby, TruffleRuby and MRI before 3.2; match results are unchanged ([GHSA-j82w-28jv-3pmj])
• fixes denial of service in Addressable::Template#match and #extract, which backtracked polynomially or exponentially on the same regex engines for expressions with several variables (e.g. {/owner,repo,ref}, or {+a,b,c} with many variables), for ; expressions, and for adjacent expressions (e.g. {+a}{+b}{+c} or {+a}{b}); match results are unchanged ([GHSA-9f42-57jx-vpp3])
• fixes denial of service in Addressable::Template#match and #extract, which backtracked polynomially for expressions with several exploded variables (e.g. {+a*,b*}), including on MRI 3.2; match results are unchanged ([GHSA-4w5q-wg7v-w6gp])
• fixes Addressable::Template#match and #extract raising Addressable::URI::InvalidURIError for a string that isn't a valid URI; they now return nil, as for any other URI that doesn't match (#621)

Addressable::IDNA

... (truncated)

Commits

• afa6663 Revving version and changelog (#631)
• 60455d3 Merge commit from fork
• b8a59cc Merge commit from fork
• 49aecf9 Merge commit from fork
• 1c6540d Compare template match captures without MatchData#named_captures (#630)
• f2b27b3 Merge commit from fork
• 26d1e9e Merge commit from fork
• 25c7c41 Merge commit from fork
• 4583e8a Add AGENTS.md and SECURITY.md (#629)
• e733b11 Run CI before publishing a release (#628)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.