From 8908ee46f87347990daf6c17975aefe6033b6d38 Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Wed, 8 Apr 2026 15:45:23 -0400
Subject: [PATCH] Upgrade addressable to 2.9.0 (#2815)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Upgrade addressable from 2.8.9 to 2.9.0

Security release fixing ReDoS vulnerabilities in Addressable::Template#match.
No application impact — fizzy does not use Addressable::Template directly.

* dep: fix saas drift
---
 Gemfile.lock      | 2 +-
 Gemfile.saas.lock | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 686d8f245..36482e6e0 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -129,7 +129,7 @@ GEM
   specs:
     action_text-trix (2.1.18)
       railties
-    addressable (2.8.9)
+    addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
     ast (2.4.3)
     autotuner (1.1.0)
diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index ea51835f6..96c36298a 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -217,7 +217,7 @@ GEM
       activemodel (>= 7.0)
       activemodel-serializers-xml (~> 1.0)
       activesupport (>= 7.0)
-    addressable (2.8.9)
+    addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
     anyway_config (2.7.2)
       ruby-next-core (~> 1.0)
@@ -724,7 +724,7 @@ DEPENDENCIES
   jbuilder
   kamal
   letter_opener
-  lexxy (= 0.9.0.beta)
+  lexxy (= 0.9.2.beta)
   mission_control-jobs
   mittens
   mocha
@@ -750,7 +750,7 @@ DEPENDENCIES
   stackprof
   stimulus-rails
   thruster
-  trilogy (~> 2.10)
+  trilogy (~> 2.11)
   turbo-rails!
   useragent!
   vcr