Skip to content

Upgrading uri 0.13 to 1

Breaking0.13.3 → 1.1.2Breaking4Security2Deprecated2New1Changed10Fixed11Other36

Full comparisonBack to uri
BreakingUpgrade verdict

4 breaking changes and 2 security fixes.

In plain terms
  • Drops the userinfo feature from the library.
  • Makes URI::regexp scheme matching case sensitive.
  • Rejects empty host names, which RFC 3986 does not allow.
  • Turning a URI with a host or port into a string now adds a leading slash to the path, so the output looks different.
Must act Top 5 of 8 that need code or config changes

What you must change

Breaking4
Removes userinfo.
userinfo
1.0.3GitHub ReleaseSummarizedView source
Makes URI::regexp scheme matching case sensitive.
URI::regexp
1.1.0GitHub ReleaseSummarizedView source
Rejects empty host names, which RFC 3986 does not allow.
1.1.0GitHub ReleaseSummarizedView source
Makes URI#to_s prepend a relative path with / when there is a host or port.
URI#to_s
1.0.0GitHub ReleaseSummarizedView source
Security2
Fixes a security issue tracked as CVE-2025-61594.
Low · CVSS 7.5
1.0.4GitHub ReleaseSummarizedView source
URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+
Low · CVSS 3.2
1.0.3GitHub AdvisoryOriginalView source

Deprecations to plan for

Deprecated2
Warns on compatibility methods in RFC3986_PARSER.
RFC3986_PARSER
1.0.0GitHub ReleaseSummarizedView source
Also warns on URI::RFC3986_PARSER.extract.
URI::RFC3986_PARSER.extract
1.0.0GitHub ReleaseSummarizedView source