🚨 [security] Update uri 1.0.3 → 1.1.1 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ uri (indirect, 1.0.3 → 1.1.1) · Repo

Security Advisories 🚨

🚨 URI Credential Leakage Bypass over CVE-2025-27221

Impact

In affected URI version, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials.

When using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure.

The vulnerability affects the uri gem bundled with the following Ruby series:

• 0.12.4 and earlier (bundled in Ruby 3.2 series)
• 0.13.2 and earlier (bundled in Ruby 3.3 series)
• 1.0.3 and earlier (bundled in Ruby 3.4 series)

Patches

Upgrade to 0.12.5, 0.13.3 or 1.0.4

References

• https://www.ruby-lang.org/en/news/2025/02/26/security-advisories/
• https://hackerone.com/reports/2957667

Release Notes

1.1.1

What's Changed

• Re-allow consecutive, leading and trailing dots in EMAIL_REGEXP by @osyoyu in #189

New Contributors

• @osyoyu made their first contribution in #189

Full Changelog: v1.1.0...v1.1.1

1.1.0

What's Changed

• Update to use the latest version of setup-ruby and bump up to Ruby 3.4 by @hsbt in #158
• Fix the mention to removed URI.escape/URI::Escape by @y-yagi in #146
• Use a fully qualified name in warning messages by @y-yagi in #150
• Support Ractor#value by @hsbt in #163
• Removed unnecessary workaround by @hsbt in #164
• Escape reserved characters in scheme name by @nobu in #148
• [DOC] State that uri library is needed to call Kernel#URI by @nobu in #167
• Prefer dedicated assertion methods by @nobu in #169
• Fix the message for unexpected argument by @nobu in #171
• Make URI::regexp schemes case sensitive (#38) by @nobu in #170
• The local part should not contain leading or trailing dots in the EMAIL_REGEXP by @nlevchuk in #124
• More checks in EMAIL_REGEXP by @nobu in #172
• Do not allow empty host names, as they are not allowed by RFC 3986 by @jeremyevans in #116
• Improve performance of URI::MailTo::EMAIL_REGEXP by @nobu in #173
• Performance test stability by @nobu in #174
• Update documents that used URI::Parser by @nobu in #175
• Add a workflow to sync commits to ruby/ruby by @k0kubun in #183
• Add irb to the Gemfile to fix the warning by @y-yagi in #182
• Replace reference to the obsolete URI.escape with URI::RFC2396_PARSER.escape by @vivshaw in #166
• Switch a parsing behavior completely when switching a parser by @y-yagi in #161
• improve error message by @soda92 in #130
• Use generic version number to VERSION by @hsbt in #187

New Contributors

• @y-yagi made their first contribution in #146
• @nlevchuk made their first contribution in #124
• @vivshaw made their first contribution in #166
• @soda92 made their first contribution in #130

Full Changelog: v1.0.4...v1.1.0

1.0.4

Security fixes

• CVE-2025-61594

---

Full Changelog: v1.0.3...v1.0.4

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 71 commits:

• v1.1.1
• Merge pull request #189 from osyoyu/restore-whatwg-email-regexp
• Re-allow consecutive, leading and trailing dots in EMAIL_REGEXP
• v1.1.0
• Merge pull request #187 from ruby/switch-version-code
• Use generic version number to VERSION and generate VERSION_CODE from that
• Exclude dependabot updates from release note
• Merge pull request #130 from soda92/improve-error-message
• Merge pull request #161 from y-yagi/fix_changing_parser
• Merge pull request #166 from vivshaw/vivshaw/correct-obsolete-parse
• Merge pull request #182 from y-yagi/fix_irb_warning
• Update the latest versions of actions
• Merge tag 'v1.0.4'
• Bump up to v1.0.4
• Merge branch 'CVE-2025-61594-3-4' into HEAD
• Add a workflow to sync commits to ruby/ruby (#183)
• Add `irb` to the Gemfile to fix the warning
• Add authority accessor
• Clear user info totally at setting any of authority info
• Merge pull request #181 from ruby/dependabot/github_actions/step-security/harden-runner-2.13.1
• Bump step-security/harden-runner from 2.13.0 to 2.13.1
• Merge pull request #180 from ruby/dependabot/github_actions/actions/upload-pages-artifact-4
• Bump actions/upload-pages-artifact from 3 to 4
• Merge pull request #179 from ruby/dependabot/github_actions/actions/checkout-5
• Bump actions/checkout from 4 to 5
• Merge pull request #176 from ruby/dependabot/github_actions/step-security/harden-runner-2.13.0
• Bump step-security/harden-runner from 2.12.2 to 2.13.0
• Merge pull request #175 from nobu/doc-uri_parser
• [DOC] Update old use of `URI::Parser`
• [DOC] Document private visibility too
• [DOC] Fix references
• Merge pull request #174 from nobu/performance-test-scale
• Repeat matching to reduce deviations
• Test in exponential scale with rehearsal
• Merge pull request #173 from nobu/email_regexp-refine
• Improve performance of `URI::MailTo::EMAIL_REGEXP`
• Merge pull request #116 from jeremyevans/http-empty-host-reject-20686
• Merge pull request #172 from nobu/more-checks-in-email_regexp
• Prohibit successive dots in email
• More tests for `check_to`
• Merge pull request #124 from nlevchuk/prohibit-leading-and-trailing-dots-in-email-regexp
• Make URI::regexp schemes case sensitive (#38)
• Fix the message for unexpected argument
• Prefer dedicated assertion methods
• Merge pull request #168 from ruby/dependabot/github_actions/step-security/harden-runner-2.12.2
• Bump step-security/harden-runner from 2.12.1 to 2.12.2
• Merge pull request #167 from nobu/doc-Kernel.URI
• [DOC] State that uri library is needed to call Kernel#URI
• Merge pull request #148 from nobu/reserved-char-in-scheme
• Fix a typo
• Use Lo category chars as escaped chars
• Escape reserved characters in scheme name
• Use GITHUB_TOKEN instead of admin credential
• chore(docs): replace reference to the obsolete URI.escape with URI::RFC2396_PARSER.escape
• Merge pull request #165 from ruby/dependabot/github_actions/step-security/harden-runner-2.12.1
• Bump step-security/harden-runner from 2.12.0 to 2.12.1
• Merge pull request #164 from ruby/fixup-ractor-value
• Revert "Alias value or join to take in old Ruby"
• Use the latest version of assert_ractor for Ractor#value
• Merge pull request #163 from ruby/ractor-value
• Alias value or join to take in old Ruby
• `Ractor::Port`
• Merge pull request #162 from ruby/dependabot/github_actions/step-security/harden-runner-2.12.0
• Bump step-security/harden-runner from 2.11.1 to 2.12.0
• Switch a parsing behavior completely when switching a parser
• Merge pull request #159 from ruby/dependabot/github_actions/step-security/harden-runner-2.11.1
• Bump step-security/harden-runner from 2.11.0 to 2.11.1
• Merge pull request #150 from y-yagi/use_fully_qualified_name
• Merge pull request #146 from y-yagi/fix_doc_of_escape
• Merge pull request #158 from ruby/fixed-gh-pages
• Update to use the latest version of setup-ruby and bump up to Ruby 3.4

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

Go to the Depfu Dashboard to see the state of your dependencies and to customize how Depfu works.