[estcarisimo]

What changes

The scheduled Security workflow (bundler-audit job) has been failing on main since 2026-11-09: seven new advisories against addressable 2.9.0 (ReDoS in URI templates, a DoS in URI path normalization, misleading hosts from display_uri), all fixed in 2.9.1. This bumps addressable to 2.9.2 with bundle update --conservative addressable; only Gemfile.lock changes (two lines). addressable is a transitive dependency of the Jekyll build only and never runs in visitors' browsers, so the live site was not exposed.

Locally: bundle exec bundle-audit check --update reports "No vulnerabilities found", and JEKYLL_ENV=production bundle exec jekyll build succeeds.

Checklist

• ES / EN / FR kept in lock-step (no content change)
• bundle exec jekyll build passes locally (or the Build site check is green)
• New external links verified to open the intended page (none)
• English text, code, comments and names use American English (see AGENTS.md)
• No e-mail addresses and no new links into cnet.fi.uba.ar
• New publications carry topics = {…} from _data/publication_topics.yml (none)
• Screenshots attached for visual changes (none)

🤖 Generated with Claude Code

[estcarisimo]

Independent review (fresh-context reviewer, .github/REVIEW.md)

VERDICT: APPROVE
CHECKS: build=pass ci-steps=n.a. (diff touches only Gemfile.lock; Build site check is green on the PR) internal-links=n.a. (no content change) pre-commit=n.a. zizmor=pass (PR run job green; no workflow changes)

FINDINGS
none

VERIFIED CLAIMS

• The lockfile diff is limited to addressable. git diff origin/main...HEAD --stat shows one file, Gemfile.lock, with 2 insertions and 2 deletions. The changed lines are the addressable (2.9.0) to (2.9.2) spec line and its CHECKSUMS line. Its dependency line (public_suffix >= 2.0.2, < 8.0) is unchanged. No other gem moved.
• The checksum is correct. The rubygems.org v2 API for addressable 2.9.2 returns sha 9117c7e7d6ee07230e75ce41fb9401ae55354dc654fcd0e862ba41d539e9a610, which equals the lockfile value. The release is dated 2026-11-01, so it is not brand new.
• bundle install on Ruby 3.3 succeeded. bundle exec bundle-audit check --update ran against the advisory DB updated 2026-11-09 (1353 advisories) and reports "No vulnerabilities found".
• JEKYLL_ENV=production bundle exec jekyll build completed ("done in 40.49 seconds"). Only the known _layouts/single warnings appeared.
• gh pr checks 20: Build site, Analyze (actions) and zizmor pass; CodeQL is skipped.

SECURITY RUN ANOMALY (run 42673444523)

• The run conclusion is "failure", but the API lists only the zizmor job, which succeeded. The bundler-audit job was never created or recorded.
• The workflow is not at fault: the workflow file is unchanged by the PR, the audit job has no conditions or needs, and the workflow_dispatch run 42673781603 on the same branch and commit ran both jobs green. That run, plus the local bundle-audit result, is the real evidence that the fix works.
• Likely a GitHub-side glitch in how the pull_request run was recorded; not a code defect.
• It does not block merging: the ruleset requires only Build site, which is green. After merging, confirm the push-triggered Security run on main shows both jobs green.

NOTES

• addressable is a build-time transitive dependency only, so the live site is unaffected either way.
• The review ran from a detached checkout of origin/fix/addressable-security at 3671e8a.