rack 2.0.9.2 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bc237005e0685c87558593892557c95cd2b19a69344a5e7730861c4737710068
-  data.tar.gz: c6f06fabfb75b648b39013635615bb0c234b46e06bb21ee0d34fa984bc8a4327
+  metadata.gz: e12f073e1e04051923534a08cf31f175959a4217f1a793f43283e1bb902a7225
+  data.tar.gz: e96008a1e0f77466d55c3834da7df2a4c640ec213306bab87e19bad5a9042c2c
 SHA512:
-  metadata.gz: 91d96b990c872a04ed4dfc6eeea2ee24c7229d1bc382fb19ee56a2d63df67ef155e76e2ff760b5fce600101bf49f4359ed021959f1d72789821c71db4653e67a
-  data.tar.gz: bf4aceee4f04788e44dac8838ff210be458f6869264c380da218ad1d8f60651900212c6f2b6e1909666d9861a2d7865a85da8b4ff836b5ad075d3fe7cf9293f2
+  metadata.gz: f73e64b61cd21153bb90d23811b28026caa652f8eb4c682ebc02d8d5967b537f07c08d3d1b6d70cc14482d687637a2e539b384b119eb5b9be0d40c994577a2e7
+  data.tar.gz: 512be9498bf6b40a18a7c4d3bcce2e2bc1818185e30e522def5c9461cfaa8ad68282b09f6457f40a38779e7711b732cc9dc0b126f96b35f3b451b8709cc45f9b

data/{HISTORY.md → CHANGELOG.md}

@@ -1,173 +1,229 @@
-Tue Jan 17 12:27:04 2023  Aaron Patterson <tenderlove@ruby-lang.org>
+# Changelog
 
-        * [CVE-2022-44571] Fix ReDoS vulnerability in multipart parser
-        * [CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges
-        * [CVE-2022-44572] Forbid control characters in attributes (also ReDoS)
+All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
 
-Fri May 27 08:27:04 2022  Aaron Patterson <tenderlove@ruby-lang.org>
+## Unreleased
 
-	* [CVE-2022-30123] Fix shell escaping issue in Common Logger
-	* [CVE-2022-30122] Restrict parsing of broken MIME attachments
+_Note: There are many unreleased changes in Rack (`master` is around 300 commits ahead of `2-0-stable`), and below is not an exhaustive list. If you would like to help out and document some of the unreleased changes, PRs are welcome._ 
 
-Sun Dec 4 18:48:03 2015  Jeremy Daer <jeremydaer@gmail.com>
+### Added
 
-	* First-party "SameSite" cookies. Browsers omit SameSite cookies
-	from third-party requests, closing the door on many CSRF attacks.
+- Add support for `SameSite=None` cookie value. ([@hennikul](https://github.com/hennikul))
+- Add trailer headers. ([@eileencodes](https://github.com/eileencodes))
+- Add MIME Types for video streaming. ([@styd](https://github.com/styd))
+- Add MIME Type for WASM. ([@buildrtech](https://github.com/buildrtech))
+- Add `Early Hints(103)` to status codes. ([@egtra](https://github.com/egtra))
+- Add `Too Early(425)` to status codes. ([@y-yagi]((https://github.com/y-yagi)))
+- Add `Bandwidth Limit Exceeded(509)` to status codes. ([@CJKinni](https://github.com/CJKinni))
+- Add method for custom `ip_filter`. ([@svcastaneda](https://github.com/svcastaneda))
+- Add boot-time profiling capabilities to `rackup`. ([@tenderlove](https://github.com/tenderlove))
+- Add multi mapping support for `X-Accel-Mappings` header. ([@yoshuki](https://github.com/yoshuki))
+- Add `sync: false` option to `Rack::Deflater`. (Eric Wong)
+- Add `Builder#freeze_app` to freeze application and all middleware instances. ([@jeremyevans](https://github.com/jeremyevans))
+- Add API to extract cookies from `Rack::MockResponse`. ([@petercline](https://github.com/petercline))
 
-	Pass `same_site: true` (or `:strict`) to enable:
-	    response.set_cookie 'foo', value: 'bar', same_site: true
-	or `same_site: :lax` to use Lax enforcement:
-	    response.set_cookie 'foo', value: 'bar', same_site: :lax
+### Changed
 
-	Based on version 7 of the Same-site Cookies internet draft:
-	https://tools.ietf.org/html/draft-west-first-party-cookies-07
+- Don't propagate nil values from middleware. ([@ioquatix](https://github.com/ioquatix))
+- Lazily initialize the response body and only buffer it if required. ([@ioquatix](https://github.com/ioquatix))
+- Fix deflater zlib buffer errors on empty body part. ([@felixbuenemann](https://github.com/felixbuenemann))
+- Set `X-Accel-Redirect` to percent-encoded path. ([@diskkid](https://github.com/diskkid))
+- Remove unnecessary buffer growing when parsing multipart. ([@tainoe](https://github.com/tainoe))
+- Expand the root path in `Rack::Static` upon initialization. ([@rosenfeld](https://github.com/rosenfeld))
+- Make `ShowExceptions` work with binary data. ([@axyjo](https://github.com/axyjo))
+- Use buffer string when parsing multipart requests. ([@janko-m](https://github.com/janko-m))
+- Support optional UTF-8 Byte Order Mark (BOM) in config.ru. ([@mikegee](https://github.com/mikegee))
+- Handle `X-Forwarded-For` with optional port. ([@dpritchett](https://github.com/dpritchett))
+- Use `Time#httpdate` format for Expires, as proposed by RFC 7231. ([@nanaya](https://github.com/nanaya))
+- Make `Utils.status_code` raise an error when the status symbol is invalid instead of `500`. ([@adambutler](https://github.com/adambutler))
+- Rename `Request::SCHEME_WHITELIST` to `Request::ALLOWED_SCHEMES`.
+- Make `Multipart::Parser.get_filename` accept files with `+` in their name. ([@lucaskanashiro](https://github.com/lucaskanashiro))
+- Add Falcon to the default handler fallbacks. ([@ioquatix](https://github.com/ioquatix))
+- Update codebase to avoid string mutations in preparation for `frozen_string_literals`. ([@pat](https://github.com/pat))
+- Change `MockRequest#env_for` to rely on the input optionally responding to `#size` instead of `#length`. ([@janko](https://github.com/janko))
+- Rename `Rack::File` -> `Rack::Files` and add deprecation notice. ([@postmodern](https://github.com/postmodern)).
 
-	Thanks to Ben Toews (@mastahyeti) and Bob Long (@bobjflong) for
-	updating to drafts 5 and 7.
+### Removed
 
-Tue Nov  3 16:17:26 2015  Aaron Patterson <tenderlove@ruby-lang.org>
+- Remove `to_ary` from Response ([@tenderlove](https://github.com/tenderlove))
+- Deprecate `Rack::Session::Memcache` in favor of `Rack::Session::Dalli` from dalli gem ([@fatkodima](https://github.com/fatkodima))
 
-	* Add `Rack::Events` middleware for adding event based middleware:
-	middleware that does not care about the response body, but only cares
-	about doing work at particular points in the request / response
-	lifecycle.
+### Documentation
 
-Thu Oct  8 14:58:46 2015  Aaron Patterson <tenderlove@ruby-lang.org>
+- Update broken example in `Session::Abstract::ID` documentation. ([tonytonyjan](https://github.com/tonytonyjan))
+- Add Padrino to the list of frameworks implmenting Rack. ([@wikimatze](https://github.com/wikimatze))
+- Remove Mongrel from the suggested server options in the help output. ([@tricknotes](https://github.com/tricknotes))
+- Replace `HISTORY.md` and `NEWS.md` with `CHANGELOG.md`. ([@twitnithegirl](https://github.com/twitnithegirl))
+- Backfill `CHANGELOG.md` from 2.0.1 to 2.0.7 releases. ([@drenmi](https://github.com/Drenmi))
 
-	* Add `Rack::Request#authority` to calculate the authority under which
-	the response is being made (this will be handy for h2 pushes).
+## [2.0.8] - 2019-12-08
 
-Tue Oct  6 13:19:04 2015  Aaron Patterson <tenderlove@ruby-lang.org>
+- [[CVE-2019-16782](https://nvd.nist.gov/vuln/detail/CVE-2019-16782)] Prevent timing attacks targeted at session ID lookup. BREAKING CHANGE: Session ID is now a SessionId instance instead of a String. ([@tenderlove](https://github.com/tenderlove), [@rafaelfranca](https://github.com/rafaelfranca))
 
-	* Add `Rack::Response::Helpers#cache_control` and `cache_control=`.
-	Use this for setting cache control headers on your response objects.
+## [1.6.12] - 2019-12-08
 
-Tue Oct  6 13:12:21 2015  Aaron Patterson <tenderlove@ruby-lang.org>
+- [[CVE-2019-16782](https://nvd.nist.gov/vuln/detail/CVE-2019-16782)] Prevent timing attacks targeted at session ID lookup. BREAKING CHANGE: Session ID is now a SessionId instance instead of a String. ([@tenderlove](https://github.com/tenderlove), [@rafaelfranca](https://github.com/rafaelfranca))
 
-	* Add `Rack::Response::Helpers#etag` and `etag=`.  Use this for
-	setting etag values on the response.
+## [2.0.7] - 2019-04-02
 
-Sun Oct 3 18:25:03 2015  Jeremy Daer <jeremydaer@gmail.com>
+### Fixed
 
-	* Introduce `Rack::Response::Helpers#add_header` to add a value to a
-	multi-valued response header. Implemented in terms of other
-	`Response#*_header` methods, so it's available to any response-like
-	class that includes the `Helpers` module.
+- Remove calls to `#eof?` on Rack input in `Multipart::Parser`, as this breaks the specification. ([@matthewd](https://github.com/matthewd))
+- Preserve forwarded IP addresses for trusted proxy chains. ([@SamSaffron](https://github.com/SamSaffron))
 
-	* Add `Rack::Request#add_header` to match.
+## [2.0.6] - 2018-11-05
 
-Fri Sep  4 18:34:53 2015  Aaron Patterson <tenderlove@ruby-lang.org>
+### Fixed
 
-	* `Rack::Session::Abstract::ID` IS DEPRECATED.  Please switch to
-	`Rack::Session::Abstract::Persisted`.
-	`Rack::Session::Abstract::Persisted` uses a request object rather than
-	the `env` hash.
+- [[CVE-2018-16470](https://nvd.nist.gov/vuln/detail/CVE-2018-16470)] Reduce buffer size of `Multipart::Parser` to avoid pathological parsing. ([@tenderlove](https://github.com/tenderlove))
+- Fix a call to a non-existing method `#accepts_html` in the `ShowExceptions` middleware. ([@tomelm](https://github.com/tomelm))
+- [[CVE-2018-16471](https://nvd.nist.gov/vuln/detail/CVE-2018-16471)] Whitelist HTTP and HTTPS schemes in `Request#scheme` to prevent a possible XSS attack. ([@PatrickTulskie](https://github.com/PatrickTulskie))
 
-Fri Sep  4 17:32:12 2015  Aaron Patterson <tenderlove@ruby-lang.org>
+## [2.0.5] - 2018-04-23
 
-	* Pull `ENV` access inside the request object in to a module.  This
-	will help with legacy Request objects that are ENV based but don't
-	want to inherit from Rack::Request
+### Fixed
 
-Fri Sep  4 16:09:11 2015  Aaron Patterson <tenderlove@ruby-lang.org>
+- Record errors originating from invalid UTF8 in `MethodOverride` middleware instead of breaking. ([@mclark](https://github.com/mclark))
 
-	* Move most methods on the `Rack::Request` to a module
-	`Rack::Request::Helpers` and use public API to get values from the
-	request object.  This enables users to mix `Rack::Request::Helpers` in
-	to their own objects so they can implement
-	`(get|set|fetch|each)_header` as they see fit (for example a proxy
-	object).
+## [2.0.4] - 2018-01-31
 
-Fri Sep  4 14:15:32 2015  Aaron Patterson <tenderlove@ruby-lang.org>
+### Changed
 
-	* Files and directories with + in the name are served correctly.
-	Rather than unescaping paths like a form, we unescape with a URI
-	parser using `Rack::Utils.unescape_path`. Fixes #265
+- Ensure the `Lock` middleware passes the original `env` object. ([@lugray](https://github.com/lugray))
+- Improve performance of `Multipart::Parser` when uploading large files. ([@tompng](https://github.com/tompng))
+- Increase buffer size in `Multipart::Parser` for better performance. ([@jkowens](https://github.com/jkowens))
+- Reduce memory usage of `Multipart::Parser` when uploading large files. ([@tompng](https://github.com/tompng))
+- Replace ConcurrentRuby dependency with native `Queue`. ([@devmchakan](https://github.com/devmchakan))
 
-Thu Aug 27 15:43:48 2015  Aaron Patterson <tenderlove@ruby-lang.org>
+### Fixed
 
-	* Tempfiles are automatically closed in the case that there were too
-	many posted.
+- Require the correct digest algorithm in the `ETag` middleware. ([@matthewd](https://github.com/matthewd))
 
-Thu Aug 27 11:00:03 2015  Aaron Patterson <tenderlove@ruby-lang.org>
+### Documentation
 
-	* Added methods for manipulating response headers that don't assume
-	they're stored as a Hash. Response-like classes may include the
-	Rack::Response::Helpers module if they define these methods:
+- Update homepage links to use SSL. ([@hugoabonizio](https://github.com/hugoabonizio))
 
-	  * Rack::Response#has_header?
-	  * Rack::Response#get_header
-	  * Rack::Response#set_header
-	  * Rack::Response#delete_header
+## [2.0.3] - 2017-05-15
 
-Mon Aug 24 18:05:23 2015  Aaron Patterson <tenderlove@ruby-lang.org>
+### Changed
 
-	* Introduce Util.get_byte_ranges that will parse the value of the
-	HTTP_RANGE string passed to it without depending on the `env` hash.
-	`byte_ranges` is deprecated in favor of this method.
+- Ensure `env` values are ASCII 8-bit encoded. ([@eileencodes](https://github.com/eileencodes))
 
-Sat Aug 22 17:49:49 2015  Aaron Patterson <tenderlove@ruby-lang.org>
+### Fixed
 
-	* Change Session internals to use Request objects for looking up
-	session information. This allows us to only allocate one request
-	object when dealing with session objects (rather than doing it every
-	time we need to manipulate cookies, etc).
+- Prevent exceptions when a class with mixins inherits from `Session::Abstract::ID`. ([@jnraine](https://github.com/jnraine))
 
-Fri Aug 21 16:30:51 2015  Aaron Patterson <tenderlove@ruby-lang.org>
+## [2.0.2] - 2017-05-08
 
-	* Add `Rack::Request#initialize_copy` so that the env is duped when
-	the request gets duped.
+### Added
 
-Thu Aug 20 16:20:58 2015  Aaron Patterson <tenderlove@ruby-lang.org>
+- Allow `Session::Abstract::SessionHash#fetch` to accept a block with a default value. ([@yannvanhalewyn](https://github.com/yannvanhalewyn))
+- Add `Builder#freeze_app` to freeze application and all middleware. ([@jeremyevans](https://github.com/jeremyevans))
 
-	* Added methods for manipulating request specific data.  This includes
-	data set as CGI parameters, and just any arbitrary data the user wants
-	to associate with a particular request.  New methods:
+### Changed
+
+- Freeze default session options to avoid accidental mutation. ([@kirs](https://github.com/kirs))
+- Detect partial hijack without hash headers. ([@devmchakan](https://github.com/devmchakan))
+- Update tests to use MiniTest 6 matchers. ([@tonytonyjan](https://github.com/tonytonyjan))
+- Allow 205 Reset Content responses to set a Content-Length, as RFC 7231 proposes setting this to 0. ([@devmchakan](https://github.com/devmchakan))
+
+### Fixed
+
+- Handle `NULL` bytes in multipart filenames. ([@casperisfine](https://github.com/casperisfine))
+- Remove warnings due to miscapitalized global. ([@ioquatix](https://github.com/ioquatix))
+- Prevent exceptions caused by a race condition on multi-threaded servers. ([@sophiedeziel](https://github.com/sophiedeziel))
+- Add RDoc as an explicit depencency for `doc` group. ([@tonytonyjan](https://github.com/tonytonyjan))
+- Record errors originating from `Multipart::Parser` in the `MethodOverride` middleware instead of letting them bubble up. ([@carlzulauf](https://github.com/carlzulauf))
+- Remove remaining use of removed `Utils#bytesize` method from the `File` middleware. ([@brauliomartinezlm](https://github.com/brauliomartinezlm))
+
+### Removed
+
+- Remove `deflate` encoding support to reduce caching overhead. ([@devmchakan](https://github.com/devmchakan))
+
+### Documentation
+
+- Update broken example in `Deflater` documentation. ([@mwpastore](https://github.com/mwpastore))
 
-	  * Rack::Request#has_header?
-	  * Rack::Request#get_header
-	  * Rack::Request#fetch_header
-	  * Rack::Request#each_header
-	  * Rack::Request#set_header
-	  * Rack::Request#delete_header
+## [2.0.1] - 2016-06-30
 
-Thu Jun 18 16:00:05 2015  Aaron Patterson <tenderlove@ruby-lang.org>
+### Changed
 
-	*  lib/rack/utils.rb: add a method for constructing "delete" cookie
+- Remove JSON as an explicit dependency. ([@mperham](https://github.com/mperham))
+
+
+# History/News Archive
+Items below this line are from the previously maintained HISTORY.md and NEWS.md files.
+
+## [2.0.0.rc1] 2016-05-06
+- Rack::Session::Abstract::ID is deprecated. Please change to use Rack::Session::Abstract::Persisted
+
+## [2.0.0.alpha] 2015-12-04
+- First-party "SameSite" cookies. Browsers omit SameSite cookies from third-party requests, closing the door on many CSRF attacks.
+- Pass `same_site: true` (or `:strict`) to enable: response.set_cookie 'foo', value: 'bar', same_site: true or `same_site: :lax` to use Lax enforcement: response.set_cookie 'foo', value: 'bar', same_site: :lax
+- Based on version 7 of the Same-site Cookies internet draft:
+	https://tools.ietf.org/html/draft-west-first-party-cookies-07
+- Thanks to Ben Toews (@mastahyeti) and Bob Long (@bobjflong) for updating to drafts 5 and 7.
+- Add `Rack::Events` middleware for adding event based middleware: middleware that does not care about the response body, but only cares about doing work at particular points in the request / response lifecycle.
+- Add `Rack::Request#authority` to calculate the authority under which the response is being made (this will be handy for h2 pushes).
+- Add `Rack::Response::Helpers#cache_control` and `cache_control=`. Use this for setting cache control headers on your response objects.
+- Add `Rack::Response::Helpers#etag` and `etag=`.  Use this for setting etag values on the response.
+- Introduce `Rack::Response::Helpers#add_header` to add a value to a multi-valued response header. Implemented in terms of other `Response#*_header` methods, so it's available to any response-like class that includes the `Helpers` module.
+- Add `Rack::Request#add_header` to match.
+- `Rack::Session::Abstract::ID` IS DEPRECATED.  Please switch to `Rack::Session::Abstract::Persisted`. `Rack::Session::Abstract::Persisted` uses a request object rather than the `env` hash.
+- Pull `ENV` access inside the request object in to a module.  This will help with legacy Request objects that are ENV based but don't want to inherit from Rack::Request
+- Move most methods on the `Rack::Request` to a module `Rack::Request::Helpers` and use public API to get values from the request object.  This enables users to mix `Rack::Request::Helpers` in to their own objects so they can implement `(get|set|fetch|each)_header` as they see fit (for example a proxy object).
+- Files and directories with + in the name are served correctly. Rather than unescaping paths like a form, we unescape with a URI parser using `Rack::Utils.unescape_path`. Fixes #265
+- Tempfiles are automatically closed in the case that there were too
+	many posted.
+- Added methods for manipulating response headers that don't assume
+	they're stored as a Hash. Response-like classes may include the
+	Rack::Response::Helpers module if they define these methods:
+    - Rack::Response#has_header?
+	- Rack::Response#get_header
+	- Rack::Response#set_header
+	- Rack::Response#delete_header
+- Introduce Util.get_byte_ranges that will parse the value of the HTTP_RANGE string passed to it without depending on the `env` hash. `byte_ranges` is deprecated in favor of this method.
+- Change Session internals to use Request objects for looking up session information. This allows us to only allocate one request object when dealing with session objects (rather than doing it every time we need to manipulate cookies, etc).
+- Add `Rack::Request#initialize_copy` so that the env is duped when the request gets duped.
+- Added methods for manipulating request specific data.  This includes
+	data set as CGI parameters, and just any arbitrary data the user wants
+	to associate with a particular request.  New methods:
+	 - Rack::Request#has_header?
+	 - Rack::Request#get_header
+	 - Rack::Request#fetch_header
+	 - Rack::Request#each_header
+	 - Rack::Request#set_header
+	 - Rack::Request#delete_header
+- lib/rack/utils.rb: add a method for constructing "delete" cookie
 	headers.  This allows us to construct cookie headers without depending
 	on the side effects of mutating a hash.
-
-Fri Jun 12 11:37:41 2015  Aaron Patterson <tenderlove@ruby-lang.org>
-
-	* Prevent extremely deep parameters from being parsed. CVE-2015-3225
-
-### May 6th, 2015, Thirty seventh public release 1.6.1
-  - Fix CVE-2014-9490, denial of service attack in OkJson ([8cd610](https://github.com/rack/rack/commit/8cd61062954f70e0a03e2855704e95ff4bdd4f6e))
-  - Use a monotonic time for Rack::Runtime, if available ([d170b2](https://github.com/rack/rack/commit/d170b2363c949dce60871f9d5a6bfc83da2bedb5))
-  - RACK_MULTIPART_LIMIT changed to RACK_MULTIPART_PART_LIMIT (RACK_MULTIPART_LIMIT is deprecated and will be removed in 1.7.0) ([c096c5](https://github.com/rack/rack/commit/c096c50c00230d8eee13ad5f79ad027d9a3f3ca9))
-  - See the full [git history](https://github.com/rack/rack/compare/1.6.0...1.6.1) and [milestone tag](https://github.com/rack/rack/issues?utf8=%E2%9C%93&q=milestone%3A%22Rack+1.6%22)
-
-### May 6th, 2015, Thirty seventh public release 1.5.3
-  - Fix CVE-2014-9490, denial of service attack in OkJson ([99f725](https://github.com/rack/rack/commit/99f725b583b357376ffbb7b3b042c5daa3106ad6))
-  - Backport bug fixes to 1.5 series ([#585](https://github.com/rack/rack/pull/585), [#711](https://github.com/rack/rack/pull/711), [#756](https://github.com/rack/rack/pull/756))
-  - See the full [git history](https://github.com/rack/rack/compare/1.5.2...1.5.3) and [milestone tag](https://github.com/rack/rack/issues?utf8=%E2%9C%93&q=milestone%3A%22Rack+1.5.3%22)
-
-### December 18th, 2014, Thirty sixth public release 1.6.0
-  - Response#unauthorized? helper ([#580](https://github.com/rack/rack/pull/580))
-  - Deflater now accepts an options hash to control compression on a per-request level ([#457](https://github.com/rack/rack/pull/457))
-  - Builder#warmup method for app preloading ([#617](https://github.com/rack/rack/pull/617))
-  - Request#accept_language method to extract HTTP_ACCEPT_LANGUAGE ([#623](https://github.com/rack/rack/pull/623))
-  - Add quiet mode of rack server, rackup --quiet ([#674](https://github.com/rack/rack/pull/674))
-  - Update HTTP Status Codes to RFC 7231 ([#754](https://github.com/rack/rack/pull/754))
-  - Less strict header name validation according to [RFC 2616](https://tools.ietf.org/html/rfc2616) ([#399](https://github.com/rack/rack/pull/399))
-    - SPEC updated to specify headers conform to RFC7230 specification ([6839fc](https://github.com/rack/rack/commit/6839fc203339f021cb3267fb09cba89410f086e9))
-  - Etag correctly marks etags as weak ([#681](https://github.com/rack/rack/issues/681))
-  - Request#port supports multiple x-http-forwarded-proto values ([#669](https://github.com/rack/rack/pull/669))
-  - Utils#multipart_part_limit configures the maximum number of parts a request can contain ([#684](https://github.com/rack/rack/pull/684))
-  - Default host to localhost when in development mode ([#514](https://github.com/rack/rack/pull/514))
-  - Various bugfixes and performance improvements (See the full [git history](https://github.com/rack/rack/compare/1.5.2...1.6.0) and [milestone tag](https://github.com/rack/rack/issues?utf8=%E2%9C%93&q=milestone%3A%22Rack+1.6%22))
-
-### February 7th, 2013, Thirty fifth public release 1.5.2
+- Prevent extremely deep parameters from being parsed. CVE-2015-3225
+
+## [1.6.1] 2015-05-06
+  - Fix CVE-2014-9490, denial of service attack in OkJson
+  - Use a monotonic time for Rack::Runtime, if available
+  - RACK_MULTIPART_LIMIT changed to RACK_MULTIPART_PART_LIMIT (RACK_MULTIPART_LIMIT is deprecated and will be removed in 1.7.0)
+
+## [1.5.3] 2015-05-06
+  - Fix CVE-2014-9490, denial of service attack in OkJson
+  - Backport bug fixes to 1.5 series
+
+## [1.6.0] 2014-01-18
+  - Response#unauthorized? helper
+  - Deflater now accepts an options hash to control compression on a per-request level
+  - Builder#warmup method for app preloading
+  - Request#accept_language method to extract HTTP_ACCEPT_LANGUAGE
+  - Add quiet mode of rack server, rackup --quiet
+  - Update HTTP Status Codes to RFC 7231
+  - Less strict header name validation according to RFC 2616
+  - SPEC updated to specify headers conform to RFC7230 specification
+  - Etag correctly marks etags as weak
+  - Request#port supports multiple x-http-forwarded-proto values
+  - Utils#multipart_part_limit configures the maximum number of parts a request can contain
+  - Default host to localhost when in development mode
+  - Various bugfixes and performance improvements
+
+## [1.5.2] 2013-02-07
   - Fix CVE-2013-0263, timing attack against Rack::Session::Cookie
   - Fix CVE-2013-0262, symlink path traversal in Rack::File
   - Add various methods to Session for enhanced Rails compatibility
@@ -177,26 +233,26 @@ Fri Jun 12 11:37:41 2015  Aaron Patterson <tenderlove@ruby-lang.org>
   - Fix a race condition that could result in overwritten pidfiles
   - Various documentation additions
 
-### February 7th, 2013, Thirty fifth public release 1.4.5
+## [1.4.5] 2013-02-07
   - Fix CVE-2013-0263, timing attack against Rack::Session::Cookie
   - Fix CVE-2013-0262, symlink path traversal in Rack::File
 
-### February 7th, Thirty fifth public release 1.1.6, 1.2.8, 1.3.10
+## [1.1.6, 1.2.8, 1.3.10] 2013-02-07
   - Fix CVE-2013-0263, timing attack against Rack::Session::Cookie
 
-### January 28th, 2013: Thirty fourth public release 1.5.1
+## [1.5.1] 2013-01-28
   - Rack::Lint check_hijack now conforms to other parts of SPEC
   - Added hash-like methods to Abstract::ID::SessionHash for compatibility
   - Various documentation corrections
 
-### January 21st, 2013: Thirty third public release 1.5.0
+## [1.5.0] 2013-01-21
   - Introduced hijack SPEC, for before-response and after-response hijacking
   - SessionHash is no longer a Hash subclass
   - Rack::File cache_control parameter is removed, in place of headers options
   - Rack::Auth::AbstractRequest#scheme now yields strings, not symbols
   - Rack::Utils cookie functions now format expires in RFC 2822 format
   - Rack::File now has a default mime type
-  - rackup -b 'run Rack::File.new(".")', option provides command line configs
+  - rackup -b 'run Rack::Files.new(".")', option provides command line configs
   - Rack::Deflater will no longer double encode bodies
   - Rack::Mime#match? provides convenience for Accept header matching
   - Rack::Utils#q_values provides splitting for Accept headers
@@ -213,17 +269,17 @@ Fri Jun 12 11:37:41 2015  Aaron Patterson <tenderlove@ruby-lang.org>
   - Updated HTTP status codes
   - Ruby 1.8.6 likely no longer passes tests, and is no longer fully supported
 
-### January 13th, 2013: Thirty second public release 1.4.4, 1.3.9, 1.2.7, 1.1.5
+## [1.4.4, 1.3.9, 1.2.7, 1.1.5] 2013-01-13
   - [SEC] Rack::Auth::AbstractRequest no longer symbolizes arbitrary strings
   - Fixed erroneous test case in the 1.3.x series
 
-### January 7th, 2013: Thirty first public release 1.4.3
+## [1.4.3] 2013-01-07
   - Security: Prevent unbounded reads in large multipart boundaries
 
-### January 7th, 2013: Thirtieth public release 1.3.8
+## [1.3.8] 2013-01-07
   - Security: Prevent unbounded reads in large multipart boundaries
 
-### January 6th, 2013: Twenty ninth public release 1.4.2
+## [1.4.2] 2013-01-06
   - Add warnings when users do not provide a session secret
   - Fix parsing performance for unquoted filenames
   - Updated URI backports
@@ -253,7 +309,7 @@ Fri Jun 12 11:37:41 2015  Aaron Patterson <tenderlove@ruby-lang.org>
   - Rack::BodyProxy now explicitly defines #each, useful for C extensions
   - Cookies that are not URI escaped no longer cause exceptions
 
-### January 6th, 2013: Twenty eighth public release 1.3.7
+## [1.3.7] 2013-01-06
   - Add warnings when users do not provide a session secret
   - Fix parsing performance for unquoted filenames
   - Updated URI backports
@@ -270,14 +326,14 @@ Fri Jun 12 11:37:41 2015  Aaron Patterson <tenderlove@ruby-lang.org>
   - Additional notes regarding ECMA escape compatibility issues
   - Fix the parsing of multiple ranges in range headers
 
-### January 6th, 2013: Twenty seventh public release 1.2.6
+## [1.2.6] 2013-01-06
   - Add warnings when users do not provide a session secret
   - Fix parsing performance for unquoted filenames
 
-### January 6th, 2013: Twenty sixth public release 1.1.4
+## [1.1.4] 2013-01-06
   - Add warnings when users do not provide a session secret
 
-### January 22nd, 2012: Twenty fifth public release 1.4.1
+## [1.4.1] 2012-01-22
   - Alter the keyspace limit calculations to reduce issues with nested params
   - Add a workaround for multipart parsing where files contain unescaped "%"
   - Added Rack::Response::Helpers#method_not_allowed? (code 405)
@@ -293,7 +349,7 @@ Fri Jun 12 11:37:41 2015  Aaron Patterson <tenderlove@ruby-lang.org>
   - Rack::Static no longer defaults to serving index files
   - Rack.release was fixed
 
-### December 28th, 2011: Twenty fourth public release 1.4.0
+## [1.4.0] 2011-12-28
   - Ruby 1.8.6 support has officially been dropped. Not all tests pass.
   - Raise sane error messages for broken config.ru
   - Allow combining run and map in a config.ru
@@ -312,32 +368,32 @@ Fri Jun 12 11:37:41 2015  Aaron Patterson <tenderlove@ruby-lang.org>
   - Support added for HTTP_X_FORWARDED_SCHEME
   - Numerous bug fixes, including many fixes for new and alternate rubies
 
-### December 28th, 2011: Twenty first public release: 1.1.3.
+## [1.1.3] 2011-12-28
   - Security fix. http://www.ocert.org/advisories/ocert-2011-003.html
     Further information here: http://jruby.org/2011/12/27/jruby-1-6-5-1
 
-### October 17, 2011: Twentieth public release 1.3.5
+## [1.3.5] 2011-10-17
   - Fix annoying warnings caused by the backport in 1.3.4
 
-### October 1, 2011: Nineteenth public release 1.3.4
+## [1.3.4] 2011-10-01
   - Backport security fix from 1.9.3, also fixes some roundtrip issues in URI
   - Small documentation update
   - Fix an issue where BodyProxy could cause an infinite recursion
   - Add some supporting files for travis-ci
 
-### September 16, 2011: Eighteenth public release 1.2.4
+## [1.2.4] 2011-09-16
   - Fix a bug with MRI regex engine to prevent XSS by malformed unicode
 
-### September 16, 2011: Seventeenth public release 1.3.3
+## [1.3.3] 2011-09-16
   - Fix bug with broken query parameters in Rack::ShowExceptions
   - Rack::Request#cookies no longer swallows exceptions on broken input
   - Prevents XSS attacks enabled by bug in Ruby 1.8's regexp engine
   - Rack::ConditionalGet handles broken If-Modified-Since helpers
 
-### July 16, 2011: Sixteenth public release 1.3.2
+## [1.3.2] 2011-07-16
   - Fix for Rails and rack-test, Rack::Utils#escape calls to_s
 
-### July 13, 2011: Fifteenth public release 1.3.1
+## [1.3.1] 2011-07-13
   - Fix 1.9.1 support
   - Fix JRuby support
   - Properly handle $KCODE in Rack::Utils.escape
@@ -348,11 +404,11 @@ Fri Jun 12 11:37:41 2015  Aaron Patterson <tenderlove@ruby-lang.org>
   - Rack::MockResponse calls close on the body object
   - Fix a DOS vector from MRI stdlib backport
 
-### May 22nd, 2011: Fourteenth public release 1.2.3
+## [1.2.3] 2011-05-22
   - Pulled in relevant bug fixes from 1.3
   - Fixed 1.8.6 support
 
-### May 22nd, 2011: Thirteenth public release 1.3.0
+## [1.3.0] 2011-05-22
   - Various performance optimizations
   - Various multipart fixes
   - Various multipart refactors
@@ -372,16 +428,16 @@ Fri Jun 12 11:37:41 2015  Aaron Patterson <tenderlove@ruby-lang.org>
   - Cookies respect renew
   - Session middleware uses SecureRandom.hex
 
-### March 13th, 2011: Twelfth public release 1.2.2/1.1.2.
+## [1.2.2, 1.1.2] 2011-03-13
   - Security fix in Rack::Auth::Digest::MD5: when authenticator
     returned nil, permission was granted on empty password.
 
-### June 15th, 2010: Eleventh public release 1.2.1.
+## [1.2.1] 2010-06-15
   - Make CGI handler rewindable
   - Rename spec/ to test/ to not conflict with SPEC on lesser
     operating systems
 
-### June 13th, 2010: Tenth public release 1.2.0.
+## [1.2.0] 2010-06-13
   - Removed Camping adapter: Camping 2.0 supports Rack as-is
   - Removed parsing of quoted values
   - Add Request.trace? and Request.options?
@@ -390,7 +446,7 @@ Fri Jun 12 11:37:41 2015  Aaron Patterson <tenderlove@ruby-lang.org>
   - Various multipart fixes
   - Switch test suite to bacon
 
-### January 3rd, 2010: Ninth public release 1.1.0.
+## [1.1.0] 2010-01-03
   - Moved Auth::OpenID to rack-contrib.
   - SPEC change that relaxes Lint slightly to allow subclasses of the
     required types
@@ -425,7 +481,7 @@ Fri Jun 12 11:37:41 2015  Aaron Patterson <tenderlove@ruby-lang.org>
   - Enforce binary encoding in RewindableInput
   - Set correct external_encoding for handlers that don't use RewindableInput
 
-### October 18th, 2009: Eighth public release 1.0.1.
+## [1.0.1] 2009-10-18
   - Bump remainder of rack.versions.
   - Support the pure Ruby FCGI implementation.
   - Fix for form names containing "=": split first then unescape components
@@ -436,7 +492,7 @@ Fri Jun 12 11:37:41 2015  Aaron Patterson <tenderlove@ruby-lang.org>
   - Make sure WEBrick respects the :Host option
   - Many Ruby 1.9 fixes.
 
-### April 25th, 2009: Seventh public release 1.0.0.
+## [1.0.0] 2009-04-25
   - SPEC change: Rack::VERSION has been pushed to [1,0].
   - SPEC change: header values must be Strings now, split on "\n".
   - SPEC change: Content-Length can be missing, in this case chunked transfer
@@ -458,10 +514,10 @@ Fri Jun 12 11:37:41 2015  Aaron Patterson <tenderlove@ruby-lang.org>
   - The Rakefile has been rewritten.
   - Many bugfixes and small improvements.
 
-### January 9th, 2009: Sixth public release 0.9.1.
+## [0.9.1] 2009-01-09
   - Fix directory traversal exploits in Rack::File and Rack::Directory.
 
-### January 6th, 2009: Fifth public release 0.9.
+## [0.9] 2009-01-06
   - Rack is now managed by the Rack Core Team.
   - Rack::Lint is stricter and follows the HTTP RFCs more closely.
   - Added ConditionalGet middleware.
@@ -477,7 +533,7 @@ Fri Jun 12 11:37:41 2015  Aaron Patterson <tenderlove@ruby-lang.org>
   - Made HeaderHash case-preserving.
   - Many bugfixes and small improvements.
 
-### August 21st, 2008: Fourth public release 0.4.
+## [0.4] 2008-08-21
   - New middleware, Rack::Deflater, by Christoffer Sawicki.
   - OpenID authentication now needs ruby-openid 2.
   - New Memcache sessions, by blink.
@@ -489,7 +545,7 @@ Fri Jun 12 11:37:41 2015  Aaron Patterson <tenderlove@ruby-lang.org>
   - Improved tests.
   - Rack moved to Git.
 
-### February 26th, 2008: Third public release 0.3.
+## [0.3] 2008-02-26
   - LiteSpeed handler, by Adrian Madrid.
   - SCGI handler, by Jeremy Evans.
   - Pool sessions, by blink.
@@ -501,7 +557,7 @@ Fri Jun 12 11:37:41 2015  Aaron Patterson <tenderlove@ruby-lang.org>
   - HTTP status 201 can contain a Content-Type and a body now.
   - Many bugfixes, especially related to Cookie handling.
 
-### May 16th, 2007: Second public release 0.2.
+## [0.2] 2007-05-16
   - HTTP Basic authentication.
   - Cookie Sessions.
   - Static file handler.
@@ -511,6 +567,4 @@ Fri Jun 12 11:37:41 2015  Aaron Patterson <tenderlove@ruby-lang.org>
   - Bug fixes in the Camping adapter.
   - Removed Rails adapter, was too alpha.
 
-### March 3rd, 2007: First public release 0.1.
-
-/* vim: set filetype=changelog */
+## [0.1] 2007-03-03

data/{COPYING → MIT-LICENSE}

@@ -1,4 +1,6 @@
-Copyright (c) 2007-2016 Christian Neukirchen <purl.org/net/chneukirchen>
+The MIT License (MIT)
+
+Copyright (C) 2007-2019 Leah Neukirchen <http://leahneukirchen.org/infopage.html>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to
@@ -13,6 +15,6 @@ all copies or substantial portions of the Software.
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER 
+THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
 IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.