Bump the prod-minor-patch group in /ruby with 2 updates

[dependabot]

Bumps the prod-minor-patch group in /ruby with 2 updates: excon and mechanize.

Updates excon from 1.5.0 to 1.7.1

Changelog

Sourced from excon's changelog.

1.7.1 2026-08-28

• updated bundled certs

1.7.0 2026-08-06

• update bundled certs
• use weak keys for socket cache to improve memory usage

1.6.0 2026-07-16

• bump actions/checkout
• fix incorrect e vs error (x2)
• add read_buffer_scratch to optimize memory/GC

Commits

• b6ca287 v1.7.1
• 18ec428 update bundled certs
• ac022b6 v1.7.0
• e39ec87 Use weak keys for thread-safe socket caches (#906)
• bde847a update bundled certs
• c81513d v1.6.0
• afe503f Introduce read_buffer_scratch (#903)
• 5356039 fix an erroneous e vs error reference in error handling (#905)
• bbad91b Fix incorrect variable name (#904)
• 30167a4 Bump actions/checkout from 6 to 7 (#902)
• See full diff in compare view

Updates mechanize from 2.14.0 to 2.14.1

Release notes

Sourced from mechanize's releases.

2.14.1 / 2026-08-22

Security

• Strip both Proxy-Authorization and Cookie2 headers on a cross-origin redirect. GHSA-2mwr-xjcg-37j7
• Headers set through Mechanize#request_headers= now obey the same cross-origin redirect rules as per-request headers, instead of being re-applied unconditionally to every request. GHSA-2mwr-xjcg-37j7
• A redirect is now considered cross-origin when the scheme, the host or the port changes, per RFC 6454. Previously only a host change discarded cookies, and an https: to http: redirect to the same host carried credentials in cleartext. GHSA-5jgv-wc2m-xv99
• A meta refresh that points cross-origin now discards sensitive request headers, the same as an HTTP redirect. Previously headers set through Mechanize#request_headers= followed it unconditionally. GHSA-c6rp-p8xm-4q9f

Improved

• A meta refresh now carries the original request's headers, minus any credential withheld for crossing an origin and minus the entity headers of the original request. Previously it carried only the headers set through Mechanize#request_headers=.
• robots.txt is fetched without any caller-supplied request headers, on any origin. Previously it received the headers set through Mechanize#request_headers=. It is a request mechanize makes on its own behalf.

Changelog

Sourced from mechanize's changelog.

2.14.1 / 2026-08-22

Security

• Strip both Proxy-Authorization and Cookie2 headers on a cross-origin redirect. GHSA-2mwr-xjcg-37j7
• Headers set through Mechanize#request_headers= now obey the same cross-origin redirect rules as per-request headers, instead of being re-applied unconditionally to every request. GHSA-2mwr-xjcg-37j7
• A redirect is now considered cross-origin when the scheme, the host or the port changes, per RFC 6454. Previously only a host change discarded cookies, and an https: to http: redirect to the same host carried credentials in cleartext. GHSA-5jgv-wc2m-xv99
• A meta refresh that points cross-origin now discards sensitive request headers, the same as an HTTP redirect. Previously headers set through Mechanize#request_headers= followed it unconditionally. GHSA-c6rp-p8xm-4q9f

Improved

• A meta refresh now carries the original request's headers, minus any credential withheld for crossing an origin and minus the entity headers of the original request. Previously it carried only the headers set through Mechanize#request_headers=.
• robots.txt is fetched without any caller-supplied request headers, on any origin. Previously it received the headers set through Mechanize#request_headers=. It is a request mechanize makes on its own behalf.

Commits

• a40941e version bump to 2.14.1
• 79c38dc Merge pull request #676 from sparklemotion/card-227-redirect-header-leak
• 3d0436e doc: target a patch release
• 401b5c9 doc: CHANGELOG describes only released-to-released changes
• 6ce26d2 fix: repair three regressions from the header merge
• 02a1235 fix: a withheld credential stays withheld for the whole operation
• f80a781 doc: Clean up CHANGELOG
• f7e2fe8 doc: request_headers documents the cross-origin rule
• 84c74df fix: a meta refresh to another origin drops sensitive headers
• 2f97fe3 fix: a redirect crosses an origin when scheme or port changes
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: automerge. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.