chore(deps-dev): Bump mechanize from 2.14.0 to 2.14.1

[dependabot]

Bumps mechanize from 2.14.0 to 2.14.1.

Release notes

Sourced from mechanize's releases.

2.14.1 / 2026-08-22

Security

• Strip both Proxy-Authorization and Cookie2 headers on a cross-origin redirect. GHSA-2mwr-xjcg-37j7
• Headers set through Mechanize#request_headers= now obey the same cross-origin redirect rules as per-request headers, instead of being re-applied unconditionally to every request. GHSA-2mwr-xjcg-37j7
• A redirect is now considered cross-origin when the scheme, the host or the port changes, per RFC 6454. Previously only a host change discarded cookies, and an https: to http: redirect to the same host carried credentials in cleartext. GHSA-5jgv-wc2m-xv99
• A meta refresh that points cross-origin now discards sensitive request headers, the same as an HTTP redirect. Previously headers set through Mechanize#request_headers= followed it unconditionally. GHSA-c6rp-p8xm-4q9f

Improved

• A meta refresh now carries the original request's headers, minus any credential withheld for crossing an origin and minus the entity headers of the original request. Previously it carried only the headers set through Mechanize#request_headers=.
• robots.txt is fetched without any caller-supplied request headers, on any origin. Previously it received the headers set through Mechanize#request_headers=. It is a request mechanize makes on its own behalf.

Changelog

Sourced from mechanize's changelog.

2.14.1 / 2026-08-22

Security

• Strip both Proxy-Authorization and Cookie2 headers on a cross-origin redirect. GHSA-2mwr-xjcg-37j7
• Headers set through Mechanize#request_headers= now obey the same cross-origin redirect rules as per-request headers, instead of being re-applied unconditionally to every request. GHSA-2mwr-xjcg-37j7
• A redirect is now considered cross-origin when the scheme, the host or the port changes, per RFC 6454. Previously only a host change discarded cookies, and an https: to http: redirect to the same host carried credentials in cleartext. GHSA-5jgv-wc2m-xv99
• A meta refresh that points cross-origin now discards sensitive request headers, the same as an HTTP redirect. Previously headers set through Mechanize#request_headers= followed it unconditionally. GHSA-c6rp-p8xm-4q9f

Improved

• A meta refresh now carries the original request's headers, minus any credential withheld for crossing an origin and minus the entity headers of the original request. Previously it carried only the headers set through Mechanize#request_headers=.
• robots.txt is fetched without any caller-supplied request headers, on any origin. Previously it received the headers set through Mechanize#request_headers=. It is a request mechanize makes on its own behalf.

Commits

• a40941e version bump to 2.14.1
• 79c38dc Merge pull request #676 from sparklemotion/card-227-redirect-header-leak
• 3d0436e doc: target a patch release
• 401b5c9 doc: CHANGELOG describes only released-to-released changes
• 6ce26d2 fix: repair three regressions from the header merge
• 02a1235 fix: a withheld credential stays withheld for the whole operation
• f80a781 doc: Clean up CHANGELOG
• f7e2fe8 doc: request_headers documents the cross-origin rule
• 84c74df fix: a meta refresh to another origin drops sensitive headers
• 2f97fe3 fix: a redirect crosses an origin when scheme or port changes
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[cursor]

Approved this Dependabot patch bump of mechanize 2.14.0 → 2.14.1 (with nokogiri kept at 1.19.4 for Ruby 4). Required checks passed; Cursor Bugbot and Cursor Security Agent were not running. No extra reviewers assigned; auto-merge is enabled.

  

_{Sent by Cursor Approval Agent: dependabot approver}