* SECURITY UPDATE: ReDoS in the bundler-vendored uri parsers - debian/patches/CVE-2023-28755.patch: clamp the unbounded quantifiers in RFC3986_URI and RFC3986_relative_ref to their possessive forms and group IPv6address inside the IP-literal alternation, in the bundler-vendored uri 0.10.1 (lib/bundler/vendor/uri/lib/uri/rfc3986_parser.rb), so a crafted URI no longer drives quadratic backtracking; backport of upstream ruby commit 14f025a7 (URI 0.10.0.2 for bundler). - CVE-2023-28755 * The same patch carries the two-part follow-up hardening that upstream ships together (both dated 2023-04-22, HackerOne #1958260), covering the per-component validation regexps the first fix left unclamped: - rfc3986_parser.rb: default_regexp's PORT entry gets a possessive leading whitespace run (upstream ruby/uri commit 9d7bcef1), so an attacker-supplied port assigned via Bundler::URI::Generic#port= (check_port) no longer drives quadratic backtracking. - rfc2396_parser.rb: the ABS_URI and REL_URI patterns get a possessive leading whitespace quantifier, '\A\s*' -> '\A\s*+' (upstream ruby/uri commit 9010ee25), so Bundler::URI::RFC2396_Parser#split / #parse -- reached through the public Bundler::URI::DEFAULT_PARSER and Bundler::URI::Parser constants -- no longer go quadratic on crafted input with a long run of leading whitespace. Both parsers of a uri copy are hardened together: patching only one would leave the copy half-fixed and still exploitable through the other. * The primary uri default gem is already hardened upstream (0.12.4) in both parsers and is not touched, and the vendored VERSION_CODE deliberately stays 001001 to keep the build-time bundler_uri_version assertion passing.