Upgrade addressable gem to 2.9.0 to fix CVE-2026-35611 (ReDoS)

[antonioalwan]

Describe the bug

The Gemfile.lock pins addressable at version 2.8.0, which is vulnerable to [CVE-2026-35611](https://nvd.nist.gov/vuln/detail/CVE-2026-35611) (GHSA-h27x-rffw-24p4) — a High severity Regular Expression Denial of Service (ReDoS) in URI template matching. Two classes of URI templates generate regex patterns with catastrophic backtracking (O(2^n) and O(n^k)) when matched against maliciously crafted URIs, leading to denial of service.

To Reproduce

1. Inspect Gemfile.lock — addressable is pinned at 2.8.0
2. Run bundle audit or check against [GHSA-h27x-rffw-24p4](GHSA-h27x-rffw-24p4)
3. Vulnerability is flagged for any version < 2.9.0

Expected behavior

addressable should be upgraded to 2.9.0 where both ReDoS patterns are fully remediated. The existing cocoapods constraint (~> 2.8) is compatible with 2.9.0.

Screenshots

N/A — dependency vulnerability, not a UI issue.

Environment

• Device: N/A (build/CI tooling dependency)
• OS: Any
• Browser: N/A

Additional context

• CVE: CVE-2026-35611
• Advisory: GHSA-h27x-rffw-24p4
• Fix: bundle update addressable (upgrades 2.8.0 → 2.9.0)
• Affected: addressable >= 2.3.0, < 2.9.0
• References: https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

---

Want me to file this on openid/AppAuth-iOS?