Upgrading uri 0.12 to 0.13
Breaking0.12.5 → 0.13.3Security2Platform1Changed2Fixed3Other15
SecurityLow · CVSS 7.5Fixes a security vulnerability tracked as CVE-2025-61594.GHSA-j4pr-3wm6-xx2r · CVE-2025-61594 ↗
BreakingUpgrade verdict
A platform requirement change and 2 security fixes.
In plain terms
- This version no longer works on Ruby 2.4; you need a newer Ruby.
- This release fixes a security problem in the uri package.
- URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+
Must act 3 items need code or config changes
Ruby requirement changed in 0.13.0: >= 2.4 → >= 2.5.
What you must change
Security2
Fixes a security vulnerability tracked as CVE-2025-61594.
Low · CVSS 7.5URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+
Low · CVSS 3.2Platform1
Drops support for Ruby 2.4.