Bump the bundler group across 1 directory with 2 updates

[dependabot]

Bumps the bundler group with 2 updates in the / directory: addressable and mcp.

Updates addressable from 2.8.9 to 2.9.0

Changelog

Sourced from addressable's changelog.

Addressable 2.9.0

• fixes ReDoS vulnerability in Addressable::Template#match (fixes incomplete remediation in 2.8.10)

Addressable 2.8.10

• fixes ReDoS vulnerability in Addressable::Template#match

Commits

• 0c3e858 Revving version and changelog
• 91915c1 Fixing additional vulnerable paths
• a091e39 Add many more adversarial test cases to ensure we don't have any ReDoS regres...
• 463a819 Regenerate gemspec on newer rubygems
• 0afcb0b Improve from O(n^2) to O(n)
• c87f768 Fix a ReDoS vulnerability in URI template matching
• See full diff in compare view

Updates mcp from 0.7.1 to 0.9.2

Release notes

Sourced from mcp's releases.

v0.9.2

Fixed

• Use accessor method in server_context_with_meta instead of ivar (#273)
• Reject duplicate SSE connections with 409 to prevent stream hijacking

v0.9.1

Added

• Allow Client#call_tool to accept a tool name (#266)

Fixed

• Return 404 for invalid session ID in handle_delete (#261)

v0.9.0

Added

• MCP::Client::Stdio transport (#262)
• Progress notifications per MCP specification (#254)
• Automatic _meta parameter extraction support (#172)
• CORS and Accept wildcard support for browser-based MCP clients (#253)

Changed

• Use autoload to defer loading of unused subsystems (#255)
• Reduce release package size (#239)

Fixed

• Return 404 for invalid session ID in handle_regular_request (#257)
• Use mutex-protected session_exists? in handle_regular_request (#258)

v0.8.0

Added

• Content::EmbeddedResource class for embedded resource content type (#244)
• Content::Audio class for audio content type (#243)
• $ref support in Tool::Schema for protocol version 2025-11-25 (#242)
• MCP conformance test suite (#248)

Fixed

• Handle Errno::ECONNRESET in SSE stream operations (#249)
• Fix default handler return values to comply with MCP spec (#247)
• Fix Prompt#validate_arguments! crash when arguments are nil (#246)
• Return 202 Accepted for SSE responses per MCP spec (#245)
• Fix Content::Image#to_h to return mimeType (camelCase) per MCP spec (#241)

Changelog

Sourced from mcp's changelog.

[0.9.2] - 2026-03-27

Fixed

• Use accessor method in server_context_with_meta instead of ivar (#273)
• Reject duplicate SSE connections with 409 to prevent stream hijacking

[0.9.1] - 2026-03-23

Added

• Allow Client#call_tool to accept a tool name (#266)

Fixed

• Return 404 for invalid session ID in handle_delete (#261)

[0.9.0] - 2026-03-20

Added

• MCP::Client::Stdio transport (#262)
• Progress notifications per MCP specification (#254)
• Automatic _meta parameter extraction support (#172)
• CORS and Accept wildcard support for browser-based MCP clients (#253)

Changed

• Use autoload to defer loading of unused subsystems (#255)
• Reduce release package size (#239)

Fixed

• Return 404 for invalid session ID in handle_regular_request (#257)
• Use mutex-protected session_exists? in handle_regular_request (#258)

[0.8.0] - 2026-03-03

Added

• Content::EmbeddedResource class for embedded resource content type (#244)
• Content::Audio class for audio content type (#243)
• $ref support in Tool::Schema for protocol version 2025-11-25 (#242)
• MCP conformance test suite (#248)

Fixed

• Handle Errno::ECONNRESET in SSE stream operations (#249)
• Fix default handler return values to comply with MCP spec (#247)
• Fix Prompt#validate_arguments! crash when arguments are nil (#246)

... (truncated)

Commits

• 3fc7bcd Merge pull request #272 from koic/release_0_9_2
• 8fbc2b4 Release 0.9.2
• 6b09279 Merge pull request #273 from koic/use_accessor_in_server_context_with_meta
• a2575b2 Use accessor method in server_context_with_meta instead of ivar
• e189d78 Merge commit from fork
• db40143 Reject duplicate SSE connections with 409 to prevent stream hijacking
• 3b1fc72 Merge pull request #267 from koic/release_0_9_1
• f29259c Release 0.9.1
• ccddd87 Merge pull request #266 from koic/allow_client_call_tool_to_accept_a_tool_name
• 73070f1 Allow Client#call_tool to accept a tool name
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.