Bump savon from 2.15.1 to 2.17.2

[dependabot]

Bumps savon from 2.15.1 to 2.17.2.

Release notes

Sourced from savon's releases.

v2.17.2

Fix CVE-2026-53510 and restore 2.17.0 cookie regressions

Fixed

• Fix CVE-2026-53510 Savon::Model generated SOAP operation methods by interpolating operation names into Ruby source passed to module_eval. An attacker who can control the operation names of a WSDL, can inject Ruby code that executes in the application process. This affects only the .all_operations class method provided by Savon::Model to automatically register all operations provided by the WSDL. Configuring Savon::Model with trusted operation names via .operations is safe. Thanks to @​connorshea for securely disclosing this, providing a proof and a great report.
• :cookies request option works again. The 2.17.0 transport refactor reimplemented cookie handling on top of Array#map, which broke callers passing an object that responds to #cookies and lost cookie-name de-duplication via HTTPI::CookieStore. The HTTPI transport delegates to HTTPI::Request#set_cookies again, restoring both shapes.
• response.http.cookies works again. 2.17.0's Savon::Transport::Response only exposed code, headers, and body. The HTTPI transport now returns Array<HTTPI::Cookie> (matching 2.12.1). The Faraday transport returns Hash<String, String> so Faraday callers do not need HTTPI types.
• :attachments now works with a user-supplied :xml envelope (#761). Multipart support shipped in 2.13.0 but only wrapped envelopes Savon built itself. When a caller passed their own :xml, attachments were silently dropped.

Added

• Faraday :cookies option accepts a String or Hash. Strings are used verbatim, Hashes are formatted as "name=value; name=value". Round-trippable with the Faraday response shape.
• Three Nori response-parsing options exposed as Savon globals: :empty_tag_value (default nil), :convert_dashes_to_underscores (default true), and :scrub_xml (default true). Defaults match Nori's own for backwards compatibility.

Changed

• Minimum Nori version is now ~> 2.7 (was ~> 2.4). Needed for the new parsing options (:empty_tag_value arrived in Nori 2.6.0, :scrub_xml in 2.7.0). The 2.5–2.7 series also brings fixes callers benefit from automatically: invalid byte sequences parse instead of raising, REXML no longer turns < inside CDATA into <, xs:date/xs:time/xs:dateTime typecasting was corrected, and Nori stopped monkey-patching String and Object.
• Faraday migration hints are now value-aware and verified. Each hint prints the caller's actual option value and spells out the full gem/require/setup where needed. Fixed several incorrect examples and added tests to verify every hint.

Deprecated

• Deprecated the global and local :multipart options. They have been no-ops since v2.13.0. Specifically since commit 4e7ae5e. Savon detects multipart responses by checking the Content-Type header.

---

Security advisory: GHSA-mx5j-mp4f-g8jg Changelog: https://github.com/savonrb/savon/blob/main/CHANGELOG.md Commits: savonrb/savon@v2.17.1...v2.17.2

v2.17.1

• Fix: savonrb/savon#1008 - The HTTPI and Faraday transports no longer set an explicit Content-Length request header. The underlying HTTP library already computes it from the body; sending it as well produced a duplicate header on adapters that do not deduplicate (e.g. httpclient), which some servers reject.
• Fix: Requests using attachments were sent with a plain text/xml Content-Type instead of multipart/related. The 2.17.0 transport refactor assembled the request headers before the multipart body was built, leaving Builder#multipart empty at header time, so servers received a multipart body labelled as plain XML. 2.16.x and earlier are unaffected.

Changelog: https://github.com/savonrb/savon/blob/main/CHANGELOG.md Commits: savonrb/savon@v2.17.0...v2.17.1

v2.17.0

Add opt-in Faraday transport

Callers who set transport: :faraday get a memoized Faraday::Connection via client.faraday and full control over middleware, SSL, auth, and timeouts. Callers who do not set this option see no behavior change. HTTPI remains the default for 2.x.

• Add: transport: :faraday global option. Defaults to :httpi (#992).
• Add: client.faraday returns a memoized Faraday::Connection for configuring middleware, SSL, auth, and timeouts when using the Faraday transport.
• Add: Savon.client raises if transport: :faraday is set but the faraday gem is not installed, or if any httpi-specific global option (proxy, timeouts, ssl, auth, adapter) is set alongside it. All conflicts are reported with their Faraday equivalents.
• Change: Observers must return Savon::Transport::Response (or nil) instead of HTTPI::Response. Returning HTTPI::Response still works but emits a deprecation warning.
• Unblocks:
  • redirect following for WSDL fetches via faraday-follow-redirects middleware (#1033, savonrb/wasabi#18)
  • digest authentication via faraday-digestauth middleware (#1021, savonrb/httpi#250)
  • proxy authentication with special characters in passwords (#941)

... (truncated)

Changelog

Sourced from savon's changelog.

[2.17.2] - 2026-06-10

Fix CVE-2026-53510 and restore 2.17.0 cookie regressions

Fixed

• Fix CVE-2026-53510 Savon::Model generated SOAP operation methods by interpolating operation names into Ruby source passed to module_eval. An attacker who can control the operation names of a WSDL, can inject Ruby code that executes in the application process. This affects only the .all_operations class method provided by Savon::Model to automatically register all operations provided by the WSDL. Configuring Savon::Model with trusted operation names via .operations is safe. Thanks to @​connorshea for securely disclosing this, providing a proof and a great report.
• :cookies request option works again. The 2.17.0 transport refactor reimplemented cookie handling on top of Array#map, which broke callers passing an object that responds to #cookies and lost cookie-name de-duplication via HTTPI::CookieStore. The HTTPI transport delegates to HTTPI::Request#set_cookies again, restoring both shapes.
• response.http.cookies works again. 2.17.0's Savon::Transport::Response only exposed code, headers, and body. The HTTPI transport now returns Array<HTTPI::Cookie> (matching 2.12.1). The Faraday transport returns Hash<String, String> so Faraday callers do not need HTTPI types.
• :attachments now works with a user-supplied :xml envelope (#761). Multipart support shipped in 2.13.0 but only wrapped envelopes Savon built itself. When a caller passed their own :xml, attachments were silently dropped.

Added

• Faraday :cookies option accepts a String or Hash. Strings are used verbatim, Hashes are formatted as "name=value; name=value". Round-trippable with the Faraday response shape.
• Three Nori response-parsing options exposed as Savon globals: :empty_tag_value (default nil), :convert_dashes_to_underscores (default true), and :scrub_xml (default true). Defaults match Nori's own for backwards compatibility.

Changed

• Minimum Nori version is now ~> 2.7 (was ~> 2.4). Needed for the new parsing options (:empty_tag_value arrived in Nori 2.6.0, :scrub_xml in 2.7.0). The 2.5–2.7 series also brings fixes callers benefit from automatically: invalid byte sequences parse instead of raising, REXML no longer turns < inside CDATA into <, xs:date/xs:time/xs:dateTime typecasting was corrected, and Nori stopped monkey-patching String and Object.
• Faraday migration hints are now value-aware and verified. Each hint prints the caller's actual option value and spells out the full gem/require/setup where needed. Fixed several incorrect examples and added tests to verify every hint.

Deprecated

• Deprecated the global and local :multipart options. They have been no-ops since v2.13.0. Specifically since commit 4e7ae5e. Savon detects multipart responses by checking the Content-Type header.

[2.17.1] - 2026-05-21

Fixed

• #1008 - The HTTPI and Faraday transports no longer set an explicit Content-Length request header. The underlying HTTP library already computes it from the body. Sending it as well produced a duplicate header on adapters that do not deduplicate (e.g. httpclient), which some servers reject.
• Requests using attachments were sent with a plain text/xml Content-Type instead of multipart/related. The 2.17.0 transport refactor assembled the request headers before the multipart body was built, leaving Builder#multipart empty at header time, so servers received a multipart body labelled as plain XML. 2.16.x and earlier are unaffected.

[2.17.0] - 2026-05-19

Add opt-in Faraday transport

Callers who set transport: :faraday get a memoized Faraday::Connection via client.faraday and full control over middleware, SSL, auth, and timeouts. Callers who do not set this option see no behavior change. HTTPI remains the default for 2.x.

Added

• transport: :faraday global option. Defaults to :httpi (#992).
• client.faraday returns a memoized Faraday::Connection for configuring middleware, SSL, auth, and timeouts when using the Faraday transport.
• Savon.client raises if transport: :faraday is set but the faraday gem is not installed, or if any httpi-specific global option (proxy, timeouts, ssl, auth, adapter) is set alongside it. All conflicts are reported with their Faraday equivalents.

Changed

• Observers must return Savon::Transport::Response (or nil) instead of HTTPI::Response.

Deprecated

... (truncated)

Commits

• 7fdbe8a Exclude head build failures
• c158e7f Prepare 2.17.2
• 186b7c1 Update Puma dev dependency
• 8f22eb5 Fix Savon::Model CVE-2026-53510
• 3309d9a Bump actions/checkout from 6.0.2 to 6.0.3 (#1051)
• e1cf48d Fix changelog URI
• a890001 Add integration spec for HTTPI digest_auth option
• 7af7acd Verify Gyoku handling of Hashes and Arrays
• b4396e9 Add a bundle install step.
• 24a5156 Disable bundler cache in gem push workflow
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.