chore(deps): update dependency icalendar to v2.12.2 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
icalendar (changelog)	2.12.1 → 2.12.2

---

iCalendar has ICS injection via unsanitized URI property values

CVE-2026-33635 / GHSA-pv9c-9mfh-hvxq

More information

Details

Summary

.ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output.

Details

Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with value.to_s without removing or escaping \r or \n characters. That value is embedded directly into the final ICS line by the normal serializer, so a payload containing CRLF can terminate the original property and create a new ICS property or component. (It looks like you can inject via url, source, image, organizer, attach, attendee, conference, tzurl because of this)

Relevant code:

• lib/icalendar/values/uri.rb:16

PoC

Run the following with the library loaded:

require "icalendar/value"
require "icalendar/values/uri"

v = Icalendar::Values::Uri.new("https://a.example/ok\r\nATTENDEE:mailto:evil@example.com")
puts v.to_ical(Icalendar::Values::Text)

output:

;VALUE=URI:https://a.example/ok
ATTENDEE:mailto:evil@example.com

Impact

Applications that generate .ics files from partially untrusted metadata are impacted. As a result, downstream calendar clients or importers may process attacker-supplied content as if it were legitimate event data, such as added attendees, modified URLs, alarms, or other calendar fields.

Fix

Reject raw CR and LF characters in URI-typed values before serialization, or escape/encode them so they cannot terminate the current ICS content line.

Severity

• CVSS Score: 4.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

• https://github.com/icalendar/icalendar/security/advisories/GHSA-pv9c-9mfh-hvxq
• https://github.com/icalendar/icalendar/commit/b8d23b490363ee5fffaec1d269a8618a912ca265
• https://nvd.nist.gov/vuln/detail/CVE-2026-33635
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/icalendar/CVE-2026-33635.yml
• https://github.com/advisories/GHSA-pv9c-9mfh-hvxq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

icalendar/icalendar (icalendar)

v2.12.2

Compare Source

• Fix a potential property injection issue through escaping control characters in URI values - Wes Ring

---

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.92%. Comparing base (c2596ee) to head (8506204).

Additional details and impacted files

@@           Coverage Diff            @@
##           staging     #621   +/-   ##
========================================
  Coverage    99.92%   99.92%           
========================================
  Files          200      200           
  Lines         2700     2700           
========================================
  Hits          2698     2698           
  Misses           2        2           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.