otto 2.8.1 → 2.10.0

data/lib/otto.rb

@@ -76,7 +76,7 @@ class Otto
            end
   @logger = Logger.new($stdout, Logger::INFO)
 
-  attr_reader :routes, :routes_literal, :routes_static, :route_definitions,
+  attr_reader :routes, :routes_literal, :route_definitions,
               :routes_by_definition, :option,
               :static_route, :security_config, :locale_config, :auth_config,
               :route_handler_factory, :mcp_server, :caddy_tls_server, :security, :middleware,
@@ -84,6 +84,7 @@ class Otto
   attr_accessor :not_found, :server_error
 
   def initialize(path = nil, opts = {})
+    constructed = false
     initialize_core_state
     initialize_options(path, opts)
     initialize_configurations(opts)
@@ -106,6 +107,13 @@ class Otto
     # but before processing requests.
     @freeze_mutex = Mutex.new
     @configuration_frozen = false
+    constructed = true
+  ensure
+    # A config that committed to a forwarding family during configure_security
+    # is held process-wide; withdraw it if construction failed afterwards
+    # (e.g. a bad routes path), or the dead app would keep vetoing other
+    # families for the life of the process.
+    Otto::Security::Config.release_rack_forwarding_family!(@security_config) if @security_config && !constructed
   end
   alias options option
 
@@ -172,16 +180,6 @@ class Otto
   private
 
   def initialize_core_state
-    # The GET cache is a Concurrent::Map, not a plain Hash: lazy static-file
-    # discovery (Core::Router#handle_request, Core::FileSafety#add_static_path)
-    # writes into it at request time, after freeze_configuration! has already
-    # deep-frozen the rest of the routing state. Deep-freezing this cache too
-    # would turn every as-yet-uncached static file request into a 500
-    # (FrozenError) in production (issue #185), so it is intentionally excluded
-    # from deep_freeze_value in Configuration#freeze_configuration! and kept as
-    # a structure that is both mutable post-freeze and safe under concurrent
-    # request threads.
-    @routes_static     = { GET: Concurrent::Map.new }
     @routes            = { GET: [] }
     @routes_literal    = { GET: {} }
     @route_definitions = {}

data/otto.gemspec

@@ -34,8 +34,6 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'logger', '~> 1', '< 2.0'
 
   spec.add_dependency 'rack', '~> 3.1', '< 4.0'
-  spec.add_dependency 'rack-parser', '~> 0.7'
-  spec.add_dependency 'rexml', '~> 3.4'
 
   # Security dependencies
   spec.add_dependency 'loofah', '~> 2.20'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: otto
 version: !ruby/object:Gem::Version
-  version: 2.8.1
+  version: 2.10.0
 platform: ruby
 authors:
 - Delano Mandelbaum
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-16 00:00:00.000000000 Z
+date: 2026-09-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -70,34 +70,6 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '4.0'
-- !ruby/object:Gem::Dependency
-  name: rack-parser
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.7'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.7'
-- !ruby/object:Gem::Dependency
-  name: rexml
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.4'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.4'
 - !ruby/object:Gem::Dependency
   name: loofah
   requirement: !ruby/object:Gem::Requirement
@@ -144,18 +116,32 @@ files:
 - bin/rspec
 - changelog.d/README.md
 - changelog.d/scriv.ini
-- docs/.gitignore
-- docs/1108-STREAMING_ARCHITECTURE_ANALYSIS.md
-- docs/1108-STREAMING_SUPPORT_SUMMARY.md
-- docs/enrichment.md
-- docs/geo-country.md
-- docs/ipaddr-encoding-quirk.md
-- docs/migrating/v2.0.0-pre1.md
-- docs/migrating/v2.0.0-pre2.md
+- docs/README.md
+- docs/adr/README.md
+- docs/adr/adr-001-route-authentication-at-handler-boundary.md
+- docs/adr/adr-002-multi-strategy-authentication-and-authorization.md
+- docs/adr/adr-003-caddy-tls-route-based-integration.md
+- docs/adr/adr-004-separate-compatibility-from-security-maintenance.md
+- docs/guides/authentication.md
+- docs/guides/caddy-tls.md
+- docs/guides/configuration_freezing.md
+- docs/guides/enrichment.md
+- docs/guides/forwarded-authority.md
+- docs/guides/geo-country.md
+- docs/guides/ip_privacy.md
+- docs/guides/ipaddr-encoding-quirk.md
+- docs/guides/mcp.md
+- docs/guides/privacy.md
+- docs/guides/routing.md
+- docs/guides/structured_logging.md
+- docs/guides/testing-guide.md
+- docs/maintainers/github-actions.md
+- docs/maintainers/investigations/.gitignore
+- docs/migrating/v2.0.0.md
 - docs/migrating/v2.3.0.md
-- docs/modern-authentication-authorization-landscape.md
-- docs/multi-strategy-authentication-design.md
-- docs/reverse-proxy-network-services.md
+- docs/reference/authentication.md
+- docs/reference/route-syntax.md
+- docs/reference/runtime-and-dependency-security.md
 - examples/.gitignore
 - examples/advanced_routes/README.md
 - examples/advanced_routes/app.rb
@@ -251,12 +237,16 @@ files:
 - lib/otto/mcp.rb
 - lib/otto/mcp/auth/token.rb
 - lib/otto/mcp/core.rb
+- lib/otto/mcp/endpoint.rb
+- lib/otto/mcp/errors.rb
+- lib/otto/mcp/options.rb
 - lib/otto/mcp/protocol.rb
 - lib/otto/mcp/rate_limiting.rb
 - lib/otto/mcp/registry.rb
 - lib/otto/mcp/route_parser.rb
 - lib/otto/mcp/schema_validation.rb
 - lib/otto/mcp/server.rb
+- lib/otto/optional_dependency.rb
 - lib/otto/privacy.rb
 - lib/otto/privacy/anonymizer_resolver.rb
 - lib/otto/privacy/asn_resolver.rb
@@ -312,6 +302,7 @@ files:
 - lib/otto/security/csp/policy.rb
 - lib/otto/security/csp/report.rb
 - lib/otto/security/csp/report_middleware.rb
+- lib/otto/security/csp/request_extras.rb
 - lib/otto/security/csp/writer.rb
 - lib/otto/security/csrf.rb
 - lib/otto/security/csrf_enforcement_wrapper.rb

data/docs/.gitignore

@@ -1,10 +0,0 @@
-*
-!.gitignore
-!migrating/
-!migrating/*.md
-!ipaddr-encoding-quirk.md
-!enrichment.md
-!geo-country.md
-!modern-authentication-authorization-landscape.md
-!multi-strategy-authentication-design.md
-!reverse-proxy-network-services.md