best-practices-badge Bump rack from 2.2.14 to 3.1.16

Bumps rack from 2.2.14 to 3.1.16.

Release notes

v3.0.9.1

What's Changed

Fixed ReDoS in Accept header parsing [CVE-2024-26146]

Fixed ReDoS in Content Type header parsing [CVE-2024-25126]

Reject Range headers which are too large [CVE-2024-26141]

Full Changelog: https://github.com/rack/rack/compare/v3.0.9...v3.0.9.1

v3.0.9

What's Changed

Fix content-length calcuation in Rack:Response#write #2150

Full Changelog: https://github.com/rack/rack/compare/v3.0.8...v3.0.9

v3.0.8

What's Changed

Backport "Fix some unused variable verbose warnings" by @skipkayhil in rack/rack#2084

New Contributors

@skipkayhil made their first contribution in rack/rack#2084

Full Changelog: https://github.com/rack/rack/compare/v3.0.7...v3.0.8

v3.0.7

What's Changed

Backport "Make query parameters without = have nil values". by @jeremyevans in rack/rack#2060

Full Changelog: https://github.com/rack/rack/compare/v3.0.6.1...v3.0.7

v3.0.6.1

No release notes provided.

v3.0.4.1

Full Changelog: https://github.com/rack/rack/compare/v3.0.4...v3.0.4.1

v3.0.4

Full Changelog: https://github.com/rack/rack/compare/v3.0.3...v3.0.4

v3.0.3

What's Changed

Release v3.0.3 by @ioquatix in rack/rack#2000

Full Changelog: https://github.com/rack/rack/compare/v3.0.2...v3.0.3

v3.0.2

Full Changelog: https://github.com/rack/rack/compare/v3.0.1...v3.0.2

Changelog

Sourced from rack's changelog.

Changelog

All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference Keep A Changelog.

Unreleased

SPEC Changes

Request environment keys must now be strings. #2310, [@jeremyevans])

Add nil as a valid return from a Response body.to_path (#2318, [@MSP-Greg])

Added

Introduce Rack::VERSION constant. (#2199, [@ioquatix])

ISO-2022-JP encoded parts within MIME Multipart sections of an HTTP request body will now be converted to UTF-8. (#2245, @nappa)

Changed

Invalid cookie keys will now raise an error. (#2193, [@ioquatix])

Rack::MediaType#params now handles empty strings. (#2229, [@jeremyevans])

Avoid unnecessary calls to the ip_filter lambda to evaluate Request#ip (#2287, [@willbryant])

Only calculate Request#ip once per request (#2292, [@willbryant])

Deprecated

Rack::Auth::AbstractRequest#request is deprecated without replacement. (#2229, [@jeremyevans])

Rack::Request#parse_multipart (private method designed to be overridden in subclasses) is deprecated without replacement. (#2229, [@jeremyevans])

Removed

Rack::Request#values_at is removed. (#2200, [@ioquatix])

Rack::Logger is removed with no replacement. (#2196, [@ioquatix])

Automatic cache invalidation in Rack::Request#{GET,POST} has been removed. (#2230, [@jeremyevans])

Support for CGI::Cookie has been removed. (#2332, [@ioquatix])

Fixed

Rack::RewindableInput::Middleware no longer wraps a nil input. (#2259, @tt)

Fix NoMethodError in Rack::Request#wrap_ipv6 when x-forwarded-host is empty. (#2270, @oieioi)

Fix the specification for SERVER_PORT which was incorrectly documented as required to be an Integer if present - it must be a String containing digits only. (#2296, [@ioquatix])

SERVER_NAME and HTTP_HOST are now more strictly validated according to the relevant specifications. (#2298, [@ioquatix])

[3.1.15] - 2025-05-18

Optional support for CGI::Cookie if not available. (#2327, #2333, [@earlopain])

[3.1.14] - 2025-05-06

Security

... (truncated)

Commits

df2f3f2 Bump patch version.
aed514d Fix ReDoS and consistency in multipart regexes
352650a Synchronize changelog.
835e15b Bump patch version.
bd60f6e Feature detect CGI::Cookie. (#2333)
3c1a46d Replace usage of CGI::Cookie (#2328)
0ac5c57 Test on Ruby v3.4.
5440b2c Bump patch version.
cd6b70a Merge commit from fork
0379537 Bump patch version.
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Jun 05 '25 09:06 dependabot[bot]

Codecov Report

:white_check_mark: All modified and coverable lines are covered by tests. :white_check_mark: Project coverage is 99.95%. Comparing base (6373141) to head (704e80c). :warning: Report is 12 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2330   +/-   ##
=======================================
  Coverage   99.95%   99.95%           
=======================================
  Files          55       55           
  Lines        2159     2159           
=======================================
  Hits         2158     2158           
  Misses          1        1

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

:rocket: New features to boost your workflow:

:snowflake: Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
:package: JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Jun 05 '25 09:06 codecov[bot]

Any ideas on how to avoid the regression? Or is that no longer a problem?

Jul 15 '25 14:07 david-a-wheeler

It has to do with the session handling and custom stuff

Jul 15 '25 15:07 andrewfader

Superseded by #2361.

Jul 31 '25 09:07 dependabot[bot]