Bump maxmind-db from 1.4.0 to 1.5.0

[dependabot]

Bumps maxmind-db from 1.4.0 to 1.5.0.

Release notes

Sourced from maxmind-db's releases.

1.5.0

• Fixed two denial-of-service issues in the decoder. A crafted database could nest data-section pointers to shared targets so that decoding one record cost exponential time and memory from a small file, or point many times at one large string or bytes value so that a record with few values materialized gigabytes. The decoder now bounds each record it decodes and the metadata decoded when a database is opened. A database that exceeds a limit raises InvalidDatabaseError. The limits are:
  • 65,536 decoded values, as the MaxMind DB specification recommends.
  • 512 levels of nesting, as the specification recommends. This also stops pointer cycles.
  • 2 MiB of string, bytes, and integer payload. The specification leaves this limit to the reader. 2 MiB matches libmaxminddb.
• The decoder limits can be changed with the new max_values, max_payload_bytes, and max_depth options to MaxMind::DB.new.
• Pointers that target other pointers are now rejected as invalid, as required by the MaxMind DB specification.
• Lookups are faster. The decoder allocates fewer strings and dispatches on the data type with a jump table. GeoLite City lookups in memory mode on CRuby 3.4 are about 18% faster than in 1.4.0.
• Unnecessary files were removed from the published .gem.

Changelog

Sourced from maxmind-db's changelog.

1.5.0 (2026-09-10)

• Fixed two denial-of-service issues in the decoder. A crafted database could nest data-section pointers to shared targets so that decoding one record cost exponential time and memory from a small file, or point many times at one large string or bytes value so that a record with few values materialized gigabytes. The decoder now bounds each record it decodes and the metadata decoded when a database is opened. A database that exceeds a limit raises InvalidDatabaseError. The limits are:
  • 65,536 decoded values, as the MaxMind DB specification recommends.
  • 512 levels of nesting, as the specification recommends. This also stops pointer cycles.
  • 2 MiB of string, bytes, and integer payload. The specification leaves this limit to the reader. 2 MiB matches libmaxminddb.
• The decoder limits can be changed with the new max_values, max_payload_bytes, and max_depth options to MaxMind::DB.new.
• Pointers that target other pointers are now rejected as invalid, as required by the MaxMind DB specification.
• Lookups are faster. The decoder allocates fewer strings and dispatches on the data type with a jump table. GeoLite City lookups in memory mode on CRuby 3.4 are about 18% faster than in 1.4.0.
• Unnecessary files were removed from the published .gem.

Commits

• 34d226b Update for v1.5.0
• 9bcf52c Set release date and copyright year
• d57bf77 Merge pull request #239 from maxmind/dependabot/github_actions/codeql-f1ba23a83b
• 6e1c7d5 Merge pull request #241 from maxmind/dependabot/github_actions/zizmorcore/ziz...
• 42a4b95 Merge pull request #240 from maxmind/dependabot/github_actions/jdx/mise-actio...
• 5052fb3 Bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3
• cc71a34 Bump jdx/mise-action from 4.2.5 to 4.3.0
• 8355144 Bump the codeql group with 2 updates
• 8257bfc Merge pull request #235 from maxmind/greg/stf-1488
• 8816e5c Make map budget test regression-sensitive
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)