- CVE-2023-28755: fix ReDoS in the bundler-vendored uri RFC3986 parser (lib/bundler/vendor/uri/lib/uri/rfc3986_parser.rb, Bundler::URI 0.10.1) by clamping the unbounded quantifiers in RFC3986_URI and RFC3986_relative_ref to their possessive forms; backport of upstream ruby commit 14f025a7 (URI 0.10.0.2 for bundler) - The same patch carries the two-part follow-up hardening that upstream ships together (both dated 2023-04-22, HackerOne #1958260), covering the per-component validation regexps the first fix left unclamped: rfc3986_parser.rb gets a possessive leading whitespace run in default_regexp's PORT entry (upstream ruby/uri commit 9d7bcef1), so an attacker-supplied port assigned via Bundler::URI::Generic#port= (check_port) no longer goes quadratic; and rfc2396_parser.rb gets a possessive leading whitespace quantifier on the ABS_URI and REL_URI patterns, '\A\s*' -> '\A\s*+' (upstream ruby/uri commit 9010ee25), so Bundler::URI::RFC2396_Parser#split / #parse -- reached via the public Bundler::URI::DEFAULT_PARSER and Bundler::URI::Parser constants -- no longer go quadratic on crafted input with a long run of leading whitespace. Both parsers of a uri copy are hardened together; patching only one would leave the copy half-fixed - The primary uri default gem (0.12.4) was already hardened upstream in both parsers and is untouched, and the vendored VERSION_CODE stays 001001 so the build-time %{bundler_uri_version} assertion keeps passing