Do not limit excon version for ruby client

[fatkodima]

Previous attempt mailchimp/mailchimp-marketing-ruby#7.

Allow people to upgrade their excon gem dependency. I looked through the gem's changelog (https://github.com/excon/excon/blob/master/changelog.txt) - nothing stood out, should work as before.

[cla-bot]

Contributor License Agreement Instructions
Thanks for your pull request. Before we can review your work, you’ll need to sign a Contributor License Agreement (CLA).

Please download the appropriate CLA below. Once downloaded, please read, sign, and send back to us at developer-cla@mailchimp.com. Please note, this account is not monitored so please visit https://mailchimp.com/contact/ if you need support.

Individual CLA: Mailchimp Individual CLA
Corporate CLA: Mailchimp Corporate CLA

Once you’ve emailed us the signed CLA, please reply here (e.g. CLA signed and sent!) and we’ll verify it.

What to do if you already signed the CLA
Individual signers
• If you’ve previously sent us a signed CLA, please reply here letting us know and we’ll verify. If we are unable to verify, It’s possible we don’t have your GitHub username or you’re using a different email address on your Git commit. Check that the CLA you previously submitted was sent to us using the email address associated with your GitHub username and verify that your email is set on your Git commits.
Corporate signers
• Your company has a Point of Contact (POC) who decides which employees are authorized to participate. Ask your POC to be added to the group of authorized contributors. If you’ve previously sent us an updated CLA, please reply here letting us know and we’ll verify.
• The email used to register you as an authorized contributor must be the email used for the Git commit.
• The email used to register you as an authorized contributor must also be attached to your GitHub account.

[fatkodima]

Please download the appropriate CLA below. Once downloaded, please read, sign, and send back to us at

I will not do that nonsense.

[brian-kephart]

I saw that a new version was recently released without any change to the excon dependency. This is preventing users from keeping their dependencies up to date, making it more difficult and less safe to keep using your product. Please update to keep your users safe and your product integrations viable.

[toddsiegel]

There is a CVE on excon: CVE-2026-54171.

The fix is on >= 1.5, which this gem explicitly blocks. Please accept this PR.

[fatkodima]

What alternatives do people know? Mailchimp looks like a low quality, poorly supported project.

[JuniorJoanis]

Any updates on this PR? Moving this forward is critical for fixing a major security gap. I actually had to bypass the issue by rewriting the functionality via direct API endpoints, which at least removed the external dependencies...

[jbaxendale-ut]

Yeah would love to see this get merged so we can resolve the CVE. FWIW, I sent this into their contact form

[lancedikson]

Hi @nate-ranson @jmoriarty-mc @mc-keith! Can you guys please prioritize this? 🙏

[allenahner]

Bump on this from our end too!

[steve21168]

We need this as well! Please and thank you!