rack 2.2.3 → 3.2.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (87) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +774 -69
  3. data/CONTRIBUTING.md +63 -55
  4. data/MIT-LICENSE +1 -1
  5. data/README.md +384 -0
  6. data/SPEC.rdoc +243 -277
  7. data/lib/rack/auth/abstract/handler.rb +3 -1
  8. data/lib/rack/auth/abstract/request.rb +5 -1
  9. data/lib/rack/auth/basic.rb +1 -4
  10. data/lib/rack/bad_request.rb +8 -0
  11. data/lib/rack/body_proxy.rb +21 -3
  12. data/lib/rack/builder.rb +108 -69
  13. data/lib/rack/cascade.rb +2 -3
  14. data/lib/rack/common_logger.rb +26 -17
  15. data/lib/rack/conditional_get.rb +20 -16
  16. data/lib/rack/constants.rb +68 -0
  17. data/lib/rack/content_length.rb +12 -16
  18. data/lib/rack/content_type.rb +8 -5
  19. data/lib/rack/deflater.rb +40 -26
  20. data/lib/rack/directory.rb +15 -6
  21. data/lib/rack/etag.rb +17 -21
  22. data/lib/rack/events.rb +25 -6
  23. data/lib/rack/files.rb +16 -18
  24. data/lib/rack/head.rb +8 -8
  25. data/lib/rack/headers.rb +238 -0
  26. data/lib/rack/lint.rb +863 -705
  27. data/lib/rack/lock.rb +2 -5
  28. data/lib/rack/media_type.rb +18 -9
  29. data/lib/rack/method_override.rb +6 -2
  30. data/lib/rack/mime.rb +14 -5
  31. data/lib/rack/mock.rb +1 -271
  32. data/lib/rack/mock_request.rb +161 -0
  33. data/lib/rack/mock_response.rb +156 -0
  34. data/lib/rack/multipart/generator.rb +7 -5
  35. data/lib/rack/multipart/parser.rb +349 -92
  36. data/lib/rack/multipart/uploaded_file.rb +45 -4
  37. data/lib/rack/multipart.rb +53 -41
  38. data/lib/rack/null_logger.rb +9 -0
  39. data/lib/rack/query_parser.rb +150 -106
  40. data/lib/rack/recursive.rb +2 -0
  41. data/lib/rack/reloader.rb +0 -2
  42. data/lib/rack/request.rb +272 -141
  43. data/lib/rack/response.rb +151 -66
  44. data/lib/rack/rewindable_input.rb +27 -5
  45. data/lib/rack/runtime.rb +7 -6
  46. data/lib/rack/sendfile.rb +70 -35
  47. data/lib/rack/show_exceptions.rb +25 -6
  48. data/lib/rack/show_status.rb +17 -9
  49. data/lib/rack/static.rb +17 -12
  50. data/lib/rack/tempfile_reaper.rb +15 -4
  51. data/lib/rack/urlmap.rb +4 -2
  52. data/lib/rack/utils.rb +351 -250
  53. data/lib/rack/version.rb +3 -15
  54. data/lib/rack.rb +13 -90
  55. metadata +16 -45
  56. data/README.rdoc +0 -306
  57. data/Rakefile +0 -130
  58. data/bin/rackup +0 -5
  59. data/contrib/rack.png +0 -0
  60. data/contrib/rack.svg +0 -150
  61. data/contrib/rack_logo.svg +0 -164
  62. data/contrib/rdoc.css +0 -412
  63. data/example/lobster.ru +0 -6
  64. data/example/protectedlobster.rb +0 -16
  65. data/example/protectedlobster.ru +0 -10
  66. data/lib/rack/auth/digest/md5.rb +0 -131
  67. data/lib/rack/auth/digest/nonce.rb +0 -54
  68. data/lib/rack/auth/digest/params.rb +0 -54
  69. data/lib/rack/auth/digest/request.rb +0 -43
  70. data/lib/rack/chunked.rb +0 -117
  71. data/lib/rack/core_ext/regexp.rb +0 -14
  72. data/lib/rack/file.rb +0 -7
  73. data/lib/rack/handler/cgi.rb +0 -59
  74. data/lib/rack/handler/fastcgi.rb +0 -100
  75. data/lib/rack/handler/lsws.rb +0 -61
  76. data/lib/rack/handler/scgi.rb +0 -71
  77. data/lib/rack/handler/thin.rb +0 -36
  78. data/lib/rack/handler/webrick.rb +0 -129
  79. data/lib/rack/handler.rb +0 -104
  80. data/lib/rack/lobster.rb +0 -70
  81. data/lib/rack/logger.rb +0 -20
  82. data/lib/rack/server.rb +0 -466
  83. data/lib/rack/session/abstract/id.rb +0 -523
  84. data/lib/rack/session/cookie.rb +0 -203
  85. data/lib/rack/session/memcache.rb +0 -10
  86. data/lib/rack/session/pool.rb +0 -85
  87. data/rack.gemspec +0 -46
data/CHANGELOG.md CHANGED
@@ -2,16 +2,705 @@
2
2
 
3
3
  All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
4
4
 
5
- ## [2.2.3] - 2020-02-11
5
+ ## [3.2.7] - 2026-08-13
6
6
 
7
- - [CVE-2020-8184] Only decode cookie values
7
+ ### Fixed
8
+
9
+ - Restore Ruby 2.4/2.5 compatibility.
10
+
11
+ ## [3.2.6] - 2026-04-01
12
+
13
+ ### Security
14
+
15
+ - [CVE-2026-34763](https://github.com/advisories/GHSA-7mqq-6cf9-v2qp) Root directory disclosure via unescaped regex interpolation in `Rack::Directory`.
16
+ - [CVE-2026-34230](https://github.com/advisories/GHSA-v569-hp3g-36wr) Avoid O(n^2) algorithm in `Rack::Utils.select_best_encoding` which could lead to denial of service.
17
+ - [CVE-2026-32762](https://github.com/advisories/GHSA-qfgr-crr9-7r49) Forwarded header semicolon injection enables Host and Scheme spoofing.
18
+ - [CVE-2026-26961](https://github.com/advisories/GHSA-vgpv-f759-9wx3) Raise error for multipart requests with multiple boundary parameters.
19
+ - [CVE-2026-34786](https://github.com/advisories/GHSA-q4qf-9j86-f5mh) `Rack::Static` `header_rules` bypass via URL-encoded path mismatch.
20
+ - [CVE-2026-34831](https://github.com/advisories/GHSA-q2ww-5357-x388) `Content-Length` mismatch in `Rack::Files` error responses.
21
+ - [CVE-2026-34826](https://github.com/advisories/GHSA-x8cg-fq8g-mxfx) Multipart byte range processing allows denial of service via excessive overlapping ranges.
22
+ - [CVE-2026-34835](https://github.com/advisories/GHSA-g2pf-xv49-m2h5) `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass.
23
+ - [CVE-2026-34830](https://github.com/advisories/GHSA-qv7j-4883-hwh7) `Rack::Sendfile` header-based `X-Accel-Mapping` regex injection enables unauthorized `X-Accel-Redirect`.
24
+ - [CVE-2026-34785](https://github.com/advisories/GHSA-h2jq-g4cq-5ppq) `Rack::Static` prefix matching can expose unintended files under the static root.
25
+ - [CVE-2026-34829](https://github.com/advisories/GHSA-8vqr-qjwx-82mw) Multipart parsing without `Content-Length` header allows unbounded chunked file uploads.
26
+ - [CVE-2026-34827](https://github.com/advisories/GHSA-v6x5-cg8r-vv6x) Multipart header parsing allows denial of service via escape-heavy quoted parameters.
27
+ - [CVE-2026-26962](https://github.com/advisories/GHSA-rx22-g9mx-qrhv) Improper unfolding of folded multipart headers preserves CRLF in parsed parameter values.
28
+
29
+ ## [3.2.5] - 2026-02-16
30
+
31
+ ### Security
32
+
33
+ - [CVE-2026-25500](https://github.com/advisories/GHSA-whrj-4476-wvmp) XSS injection via malicious filename in `Rack::Directory`.
34
+ - [CVE-2026-22860](https://github.com/advisories/GHSA-mxw3-3hh2-x2mh) Directory traversal via root prefix bypass in `Rack::Directory`.
35
+
36
+ ### Fixed
37
+
38
+ - Fix `Rack::MockResponse#body` when the body is a Proc. ([#2420](https://github.com/rack/rack/pull/2420), [#2423](https://github.com/rack/rack/pull/2423), [@tavianator](https://github.com/tavianator), [@ioquatix])
39
+
40
+ ## [3.2.4] - 2025-11-03
41
+
42
+ ### Fixed
43
+
44
+ - Multipart parser: limit MIME header size check to the unread buffer region to avoid false `multipart mime part header too large` errors when previously read data accumulates in the scan buffer. ([#2392](https://github.com/rack/rack/pull/2392), [@alpaca-tc](https://github.com/alpaca-tc), [@willnet](https://github.com/willnet), [@krororo](https://github.com/krororo))
45
+
46
+ ## [3.2.3] - 2025-10-10
47
+
48
+ ### Security
49
+
50
+ - [CVE-2025-61780](https://github.com/advisories/GHSA-r657-rxjc-j557) Improper handling of headers in `Rack::Sendfile` may allow proxy bypass.
51
+ - [CVE-2025-61919](https://github.com/advisories/GHSA-6xw4-3v39-52mm) Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion.
52
+
53
+ ## [3.2.2] - 2025-10-07
54
+
55
+ ### Security
56
+
57
+ - [CVE-2025-61772](https://github.com/advisories/GHSA-wpv5-97wm-hp9c) Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
58
+ - [CVE-2025-61771](https://github.com/advisories/GHSA-w9pc-fmgc-vxvw) Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
59
+ - [CVE-2025-61770](https://github.com/advisories/GHSA-p543-xpfm-54cp) Unbounded multipart preamble buffering enables DoS (memory exhaustion)
60
+
61
+ ## [3.2.1] -- 2025-09-02
62
+
63
+ ### Added
64
+
65
+ - Add support for streaming bodies when using `Rack::Events`. ([#2375](github.com/rack/rack/pull/2375), [@unflxw](https://github.com/unflxw))
66
+
67
+ ### Fixed
68
+
69
+ - Fix an issue where a `NoMethodError` would be raised when using `Rack::Events` with streaming bodies. ([#2375](github.com/rack/rack/pull/2375), [@unflxw](https://github.com/unflxw))
70
+
71
+ ## [3.2.0] - 2025-07-31
72
+
73
+ This release continues Rack's evolution toward a cleaner, more efficient foundation while maintaining backward compatibility for most applications. The breaking changes primarily affect deprecated functionality, so most users should experience a smooth upgrade with improved performance and standards compliance.
74
+
75
+ ### SPEC Changes
76
+
77
+ - Request environment keys must now be strings. ([#2310](https://github.com/rack/rack/issues/2310), [@jeremyevans])
78
+ - Add `nil` as a valid return from a Response `body.to_path` ([#2318](https://github.com/rack/rack/pull/2318), [@MSP-Greg])
79
+ - `Rack::Lint#check_header_value` is relaxed, only disallowing CR/LF/NUL characters. ([#2354](https://github.com/rack/rack/pull/2354), [@ioquatix])
80
+
81
+ ### Added
82
+
83
+ - Introduce `Rack::VERSION` constant. ([#2199](https://github.com/rack/rack/pull/2199), [@ioquatix])
84
+ - `ISO-2022-JP` encoded parts within MIME Multipart sections of an HTTP request body will now be converted to `UTF-8`. ([#2245](https://github.com/rack/rack/pull/2245), [@nappa](https://github.com/nappa))
85
+ - Add `Rack::Request#query_parser=` to allow setting the query parser to use. ([#2349](https://github.com/rack/rack/pull/2349), [@jeremyevans])
86
+ - Add `Rack::Request#form_pairs` to access form data as raw key-value pairs, preserving duplicate keys. ([#2351](https://github.com/rack/rack/pull/2351), [@matthewd])
87
+
88
+ ### Changed
89
+
90
+ - Invalid cookie keys will now raise an error. ([#2193](https://github.com/rack/rack/pull/2193), [@ioquatix])
91
+ - `Rack::MediaType#params` now handles empty strings. ([#2229](https://github.com/rack/rack/pull/2229), [@jeremyevans])
92
+ - Avoid unnecessary calls to the `ip_filter` lambda to evaluate `Request#ip` ([#2287](https://github.com/rack/rack/pull/2287), [@willbryant])
93
+ - Only calculate `Request#ip` once per request ([#2292](https://github.com/rack/rack/pull/2292), [@willbryant])
94
+ - `Rack::Builder` `#use`, `#map`, and `#run` methods now return `nil`. ([#2355](https://github.com/rack/rack/pull/2355), [@ioquatix])
95
+ - Directly close the body in `Rack::ConditionalGet` when the response is `304 Not Modified`. ([#2353](https://github.com/rack/rack/pull/2353), [@ioquatix])
96
+ - Directly close the body in `Rack::Head` when the request method is `HEAD`([#2360](https://github.com/rack/rack/pull/2360), [@skipkayhil](https://github.com/skipkayhil))
97
+
98
+ ### Deprecated
99
+
100
+ - `Rack::Auth::AbstractRequest#request` is deprecated without replacement. ([#2229](https://github.com/rack/rack/pull/2229), [@jeremyevans])
101
+ - `Rack::Request#parse_multipart` (private method designed to be overridden in subclasses) is deprecated without replacement. ([#2229](https://github.com/rack/rack/pull/2229), [@jeremyevans])
102
+
103
+ ### Removed
104
+
105
+ - `Rack::Request#values_at` is removed. ([#2200](https://github.com/rack/rack/pull/2200), [@ioquatix])
106
+ - `Rack::Logger` is removed with no replacement. ([#2196](https://github.com/rack/rack/pull/2196), [@ioquatix])
107
+ - Automatic cache invalidation in `Rack::Request#{GET,POST}` has been removed. ([#2230](https://github.com/rack/rack/pull/2230), [@jeremyevans])
108
+ - Support for `CGI::Cookie` has been removed. ([#2332](https://github.com/rack/rack/pull/2332), [@ioquatix])
109
+
110
+ ### Fixed
111
+
112
+ - `Rack::RewindableInput::Middleware` no longer wraps a nil input. ([#2259](https://github.com/rack/rack/pull/2259), [@tt](https://github.com/tt))
113
+ - Fix `NoMethodError` in `Rack::Request#wrap_ipv6` when `x-forwarded-host` is empty. ([#2270](https://github.com/rack/rack/pull/2270), [@oieioi](https://github.com/oieioi))
114
+ - Fix the specification for `SERVER_PORT` which was incorrectly documented as required to be an `Integer` if present - it must be a `String` containing digits only. ([#2296](https://github.com/rack/rack/pull/2296), [@ioquatix])
115
+ - `SERVER_NAME` and `HTTP_HOST` are now more strictly validated according to the relevant specifications. ([#2298](https://github.com/rack/rack/pull/2298), [@ioquatix])
116
+ - `Rack::Lint` now disallows `PATH_INFO="" SCRIPT_NAME=""`. ([#2298](https://github.com/rack/rack/issues/2307), [@jeremyevans])
117
+
118
+ ## [3.1.22] - 2026-08-13
119
+
120
+ ### Security
121
+
122
+ - [CVE-2026-26962](https://github.com/advisories/GHSA-rx22-g9mx-qrhv) Improper unfolding of folded multipart headers preserves CRLF in parsed parameter values.
123
+
124
+ ### Fixed
125
+
126
+ - Restore Ruby 2.4/2.5 compatibility.
127
+
128
+ ## [3.1.21] - 2026-04-01
129
+
130
+ ### Security
131
+
132
+ - [CVE-2026-34763](https://github.com/advisories/GHSA-7mqq-6cf9-v2qp) Root directory disclosure via unescaped regex interpolation in `Rack::Directory`.
133
+ - [CVE-2026-34230](https://github.com/advisories/GHSA-v569-hp3g-36wr) Avoid O(n^2) algorithm in `Rack::Utils.select_best_encoding` which could lead to denial of service.
134
+ - [CVE-2026-32762](https://github.com/advisories/GHSA-qfgr-crr9-7r49) Forwarded header semicolon injection enables Host and Scheme spoofing.
135
+ - [CVE-2026-26961](https://github.com/advisories/GHSA-vgpv-f759-9wx3) Raise error for multipart requests with multiple boundary parameters.
136
+ - [CVE-2026-34786](https://github.com/advisories/GHSA-q4qf-9j86-f5mh) `Rack::Static` `header_rules` bypass via URL-encoded path mismatch.
137
+ - [CVE-2026-34831](https://github.com/advisories/GHSA-q2ww-5357-x388) `Content-Length` mismatch in `Rack::Files` error responses.
138
+ - [CVE-2026-34826](https://github.com/advisories/GHSA-x8cg-fq8g-mxfx) Multipart byte range processing allows denial of service via excessive overlapping ranges.
139
+ - [CVE-2026-34835](https://github.com/advisories/GHSA-g2pf-xv49-m2h5) `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass.
140
+ - [CVE-2026-34830](https://github.com/advisories/GHSA-qv7j-4883-hwh7) `Rack::Sendfile` header-based `X-Accel-Mapping` regex injection enables unauthorized `X-Accel-Redirect`.
141
+ - [CVE-2026-34785](https://github.com/advisories/GHSA-h2jq-g4cq-5ppq) `Rack::Static` prefix matching can expose unintended files under the static root.
142
+ - [CVE-2026-34829](https://github.com/advisories/GHSA-8vqr-qjwx-82mw) Multipart parsing without `Content-Length` header allows unbounded chunked file uploads.
143
+ - [CVE-2026-34827](https://github.com/advisories/GHSA-v6x5-cg8r-vv6x) Multipart header parsing allows denial of service via escape-heavy quoted parameters.
144
+
145
+ ## [3.1.20] - 2026-02-16
146
+
147
+ ### Security
148
+
149
+ - [CVE-2026-25500](https://github.com/advisories/GHSA-whrj-4476-wvmp) XSS injection via malicious filename in `Rack::Directory`.
150
+ - [CVE-2026-22860](https://github.com/advisories/GHSA-mxw3-3hh2-x2mh) Directory traversal via root prefix bypass in `Rack::Directory`.
151
+
152
+ ## [3.1.19] - 2025-11-03
153
+
154
+ ### Fixed
155
+
156
+ - Multipart parser: limit MIME header size check to the unread buffer region to avoid false `multipart mime part header too large` errors when previously read data accumulates in the scan buffer. ([#2392](https://github.com/rack/rack/pull/2392), [@alpaca-tc](https://github.com/alpaca-tc), [@willnet](https://github.com/willnet), [@krororo](https://github.com/krororo))
157
+
158
+ ## [3.1.18] - 2025-10-10
159
+
160
+ ### Security
161
+
162
+ - [CVE-2025-61780](https://github.com/advisories/GHSA-r657-rxjc-j557) Improper handling of headers in `Rack::Sendfile` may allow proxy bypass.
163
+ - [CVE-2025-61919](https://github.com/advisories/GHSA-6xw4-3v39-52mm) Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion.
164
+
165
+ ## [3.1.17] - 2025-10-07
166
+
167
+ ### Security
168
+
169
+ - [CVE-2025-61772](https://github.com/advisories/GHSA-wpv5-97wm-hp9c) Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
170
+ - [CVE-2025-61771](https://github.com/advisories/GHSA-w9pc-fmgc-vxvw) Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
171
+ - [CVE-2025-61770](https://github.com/advisories/GHSA-p543-xpfm-54cp) Unbounded multipart preamble buffering enables DoS (memory exhaustion)
172
+
173
+ ## [3.1.16] - 2025-06-04
174
+
175
+ ### Security
176
+
177
+ - [CVE-2025-49007](https://github.com/advisories/GHSA-47m2-26rw-j2jw) Fix ReDoS in multipart request.
178
+
179
+ ## [3.1.15] - 2025-05-18
180
+
181
+ - Optional support for `CGI::Cookie` if not available. ([#2327](https://github.com/rack/rack/pull/2327), [#2333](https://github.com/rack/rack/pull/2333), [@earlopain])
182
+
183
+ ## [3.1.14] - 2025-05-06
184
+
185
+ :warning: **This release includes a security fix that may cause certain routes in previously working applications to fail if query parameters exceed 4,096 in count or 4 MB in total size. See <https://github.com/rack/rack/discussions/2356> for more details.**
186
+
187
+ ### Security
188
+
189
+ - [CVE-2025-46727](https://github.com/advisories/GHSA-gjh7-p2fx-99vx) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion.
190
+
191
+ ## [3.1.13] - 2025-04-13
192
+
193
+ - Ensure `Rack::ETag` correctly updates response body. ([#2324](https://github.com/rack/rack/pull/2324), [@ioquatix])
194
+
195
+ ## [3.1.12] - 2025-03-11
196
+
197
+ ### Security
198
+
199
+ - [CVE-2025-27610](https://github.com/advisories/GHSA-7wqh-767x-r66v) Local file inclusion in `Rack::Static`.
200
+
201
+ ## [3.1.11] - 2025-03-04
202
+
203
+ ### Security
204
+
205
+ - [CVE-2025-27111](https://github.com/advisories/GHSA-8cgq-6mh2-7j6v) Possible Log Injection in `Rack::Sendfile`.
206
+
207
+ ## [3.1.10] - 2025-02-12
208
+
209
+ ### Security
210
+
211
+ - [CVE-2025-25184](https://github.com/advisories/GHSA-7g2v-jj9q-g3rg) Possible Log Injection in `Rack::CommonLogger`.
212
+
213
+ ## [3.1.9] - 2025-01-31
214
+
215
+ ### Fixed
216
+
217
+ - `Rack::MediaType#params` now handles parameters without values. ([#2263](https://github.com/rack/rack/pull/2263), [@AllyMarthaJ](https://github.com/AllyMarthaJ))
218
+
219
+ ## [3.1.8] - 2024-10-14
220
+
221
+ ### Fixed
222
+
223
+ - Resolve deprecation warnings about uri `DEFAULT_PARSER`. ([#2249](https://github.com/rack/rack/pull/2249), [@earlopain])
224
+
225
+ ## [3.1.7] - 2024-07-11
226
+
227
+ ### Fixed
228
+
229
+ - Do not remove escaped opening/closing quotes for content-disposition filenames. ([#2229](https://github.com/rack/rack/pull/2229), [@jeremyevans])
230
+ - Fix encoding setting for non-binary IO-like objects in MockRequest#env_for. ([#2227](https://github.com/rack/rack/pull/2227), [@jeremyevans])
231
+ - `Rack::Response` should not generate invalid `content-length` header. ([#2219](https://github.com/rack/rack/pull/2219), [@ioquatix])
232
+ - Allow empty PATH_INFO. ([#2214](https://github.com/rack/rack/pull/2214), [@ioquatix])
233
+
234
+ ## [3.1.6] - 2024-07-03
235
+
236
+ ### Fixed
237
+
238
+ - Fix several edge cases in `Rack::Request#parse_http_accept_header`'s implementation. ([#2226](https://github.com/rack/rack/pull/2226), [@ioquatix])
239
+
240
+ ## [3.1.5] - 2024-07-02
241
+
242
+ ### Security
243
+
244
+ - Fix potential ReDoS attack in `Rack::Request#parse_http_accept_header`. ([GHSA-cj83-2ww7-mvq7](https://github.com/advisories/GHSA-cj83-2ww7-mvq7), [@dwisiswant0](https://github.com/dwisiswant0))
245
+
246
+ ## [3.1.4] - 2024-06-22
247
+
248
+ ### Fixed
249
+
250
+ - Fix `Rack::Lint` matching some paths incorrectly as authority form. ([#2220](https://github.com/rack/rack/pull/2220), [@ioquatix])
251
+
252
+ ## [3.1.3] - 2024-06-12
253
+
254
+ ### Fixed
255
+
256
+ - Fix passing non-strings to `Rack::Utils.escape_html`. ([#2202](https://github.com/rack/rack/pull/2202), [@earlopain])
257
+ - `Rack::MockResponse` gracefully handles empty cookies ([#2203](https://github.com/rack/rack/pull/2203) [@wynksaiddestroy])
258
+
259
+ ## [3.1.2] - 2024-06-11
260
+
261
+ - `Rack::Response` will take in to consideration chunked encoding responses ([#2204](https://github.com/rack/rack/pull/2204), [@tenderlove])
262
+
263
+ ## [3.1.1] - 2024-06-11
264
+
265
+ - Oops! I shouldn't have shipped that
266
+
267
+ ## [3.1.0] - 2024-06-11
268
+
269
+ :warning: **This release includes several breaking changes.** Refer to the **Removed** section below for the list of deprecated methods that have been removed in this release.
270
+
271
+ This release is primarily a maintenance release that removes features deprecated in Rack v3.0. Alongside these removals, there are several improvements to the Rack SPEC, mainly focused on enhancing input and output handling. These changes aim to make Rack more efficient and align better with the requirements of server implementations and relevant HTTP specifications.
272
+
273
+ ### SPEC Changes
274
+
275
+ - `rack.input` is now optional. ([#1997](https://github.com/rack/rack/pull/1997), [#2018](https://github.com/rack/rack/pull/2018), [@ioquatix])
276
+ - `PATH_INFO` is now validated according to the HTTP/1.1 specification. ([#2117](https://github.com/rack/rack/pull/2117), [#2181](https://github.com/rack/rack/pull/2181), [@ioquatix])
277
+ - `OPTIONS *` is now accepted. ([#2114](https://github.com/rack/rack/pull/2114), [@doriantaylor](https://github.com/doriantaylor))
278
+ - Introduce optional `rack.protocol` request and response header for handling connection upgrades. ([#1954](https://github.com/rack/rack/pull/1954), [@ioquatix])
279
+
280
+ ### Added
281
+
282
+ - Introduce `Rack::Multipart::MissingInputError` for improved handling of missing input in `#parse_multipart`. ([#2018](https://github.com/rack/rack/pull/2018), [@ioquatix])
283
+ - Introduce `module Rack::BadRequest` which is included in multipart and query parser errors. ([#2019](https://github.com/rack/rack/pull/2019), [@ioquatix])
284
+ - Add `.mjs` MIME type ([#2057](https://github.com/rack/rack/pull/2057), [@axilleas](https://github.com/axilleas))
285
+ - `set_cookie_header` utility now supports the `partitioned` cookie attribute. This is required by Chrome in some embedded contexts. ([#2131](https://github.com/rack/rack/pull/2131), [@flavio-b](https://github.com/flavio-b))
286
+ - Introduce `rack.early_hints` for sending `103 Early Hints` informational responses. ([#1831](https://github.com/rack/rack/pull/1831), [@casperisfine](https://github.com/casperisfine), [@jeremyevans])
287
+
288
+ ### Changed
289
+
290
+ - MIME type for JavaScript files (`.js`) changed from `application/javascript` to `text/javascript` ([`1bd0f15`](https://github.com/rack/rack/commit/1bd0f1597d8f4a90d47115f3e156a8ce7870c9c8), [@ioquatix])
291
+ - Update MIME types associated to `.ttf`, `.woff`, `.woff2` and `.otf` extensions to use mondern `font/*` types. ([#2065](https://github.com/rack/rack/pull/2065), [@davidstosik])
292
+ - `Rack::Utils.escape_html` is now delegated to `CGI.escapeHTML`. `'` is escaped to `#39;` instead of `#x27;`. (decimal vs hexadecimal) ([#2099](https://github.com/rack/rack/pull/2099), [@JunichiIto](https://github.com/JunichiIto))
293
+ - Clarify use of `@buffered` and only update `content-length` when `Rack::Response#finish` is invoked. ([#2149](https://github.com/rack/rack/pull/2149), [@ioquatix])
294
+
295
+ ### Deprecated
296
+
297
+ - Deprecate automatic cache invalidation in `Request#{GET,POST}` ([#2073](https://github.com/rack/rack/pull/2073), [@jeremyevans])
298
+ - Only cookie keys that are not valid according to the HTTP specifications are escaped. We are planning to deprecate this behaviour, so now a deprecation message will be emitted in this case. In the future, invalid cookie keys may not be accepted. ([#2191](https://github.com/rack/rack/pull/2191), [@ioquatix])
299
+ - `Rack::Logger` is deprecated. ([#2197](https://github.com/rack/rack/pull/2197), [@ioquatix])
300
+ - Add fallback lookup and deprecation warning for obsolete status symbols. ([#2137](https://github.com/rack/rack/pull/2137), [@wtn](https://github.com/wtn))
301
+ - Deprecate `Rack::Request#values_at`, use `request.params.values_at` instead ([#2183](https://github.com/rack/rack/pull/2183), [@ioquatix])
302
+
303
+ ### Removed
304
+
305
+ - Remove deprecated `Rack::Auth::Digest` with no replacement. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
306
+ - Remove deprecated `Rack::Cascade::NotFound` with no replacement. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
307
+ - Remove deprecated `Rack::Chunked` with no replacement. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
308
+ - Remove deprecated `Rack::File`, use `Rack::Files` instead. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
309
+ - Remove deprecated `Rack::QueryParser` `key_space_limit` parameter with no replacement. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
310
+ - Remove deprecated `Rack::Response#header`, use `Rack::Response#headers` instead. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
311
+ - Remove deprecated cookie methods from `Rack::Utils`: `add_cookie_to_header`, `make_delete_cookie_header`, `add_remove_cookie_to_header`. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
312
+ - Remove deprecated `Rack::Utils::HeaderHash`. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
313
+ - Remove deprecated `Rack::VERSION`, `Rack::VERSION_STRING`, `Rack.version`, use `Rack.release` instead. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
314
+ - Remove non-standard status codes 306, 509, & 510 and update descriptions for 413, 422, & 451. ([#2137](https://github.com/rack/rack/pull/2137), [@wtn](https://github.com/wtn))
315
+ - Remove any dependency on `transfer-encoding: chunked`. ([#2195](https://github.com/rack/rack/pull/2195), [@ioquatix])
316
+ - Remove deprecated `Rack::Request#[]`, use `request.params[key]` instead ([#2183](https://github.com/rack/rack/pull/2183), [@ioquatix])
317
+
318
+ ### Fixed
319
+
320
+ - In `Rack::Files`, ignore the `Range` header if served file is 0 bytes. ([#2159](https://github.com/rack/rack/pull/2159), [@zarqman])
321
+
322
+ ## [3.0.18] - 2025-05-22
323
+
324
+ - Fix incorrect backport of optional `CGI::Cookie` support. ([#2335](https://github.com/rack/rack/pull/2335), [@jeremyevans])
325
+
326
+ ## [3.0.17] - 2025-05-18
327
+
328
+ - Optional support for `CGI::Cookie` if not available. ([#2327](https://github.com/rack/rack/pull/2327), [#2333](https://github.com/rack/rack/pull/2333), [@earlopain])
329
+
330
+ ## [3.0.16] - 2025-05-06
331
+
332
+ :warning: **This release includes a security fix that may cause certain routes in previously working applications to fail if query parameters exceed 4,096 in count or 4 MB in total size. See <https://github.com/rack/rack/discussions/2356> for more details.**
333
+
334
+ ### Security
335
+
336
+ - [CVE-2025-46727](https://github.com/advisories/GHSA-gjh7-p2fx-99vx) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion.
337
+
338
+ ## [3.0.15] - 2025-04-13
339
+
340
+ - Ensure `Rack::ETag` correctly updates response body. ([#2324](https://github.com/rack/rack/pull/2324), [@ioquatix])
341
+
342
+ ## [3.0.14] - 2025-03-11
343
+
344
+ ### Security
345
+
346
+ - [CVE-2025-27610](https://github.com/advisories/GHSA-7wqh-767x-r66v) Local file inclusion in `Rack::Static`.
347
+
348
+ ## [3.0.13] - 2025-03-04
349
+
350
+ ### Security
351
+
352
+ - [CVE-2025-27111](https://github.com/advisories/GHSA-8cgq-6mh2-7j6v) Possible Log Injection in `Rack::Sendfile`.
353
+
354
+ ### Fixed
355
+
356
+ - Remove autoloads for constants no longer shipped with Rack. ([#2269](https://github.com/rack/rack/pull/2269), [@ccutrer](https://github.com/ccutrer))
357
+
358
+ ## [3.0.12] - 2025-02-12
359
+
360
+ ### Security
361
+
362
+ - [CVE-2025-25184](https://github.com/advisories/GHSA-7g2v-jj9q-g3rg) Possible Log Injection in `Rack::CommonLogger`.
363
+
364
+ ## [3.0.11] - 2024-05-10
365
+
366
+ - Backport #2062 to 3-0-stable: Do not allow `BodyProxy` to respond to `to_str`, make `to_ary` call close . ([#2062](https://github.com/rack/rack/pull/2062), [@jeremyevans](https://github.com/jeremyevans))
367
+
368
+ ## [3.0.10] - 2024-03-21
369
+
370
+ - Backport #2104 to 3-0-stable: Return empty when parsing a multi-part POST with only one end delimiter. ([#2164](https://github.com/rack/rack/pull/2164), [@JoeDupuis](https://github.com/JoeDupuis))
371
+
372
+ ## [3.0.9.1] - 2024-02-21
373
+
374
+ ### Security
375
+
376
+ * [CVE-2024-26146] Fixed ReDoS in Accept header parsing
377
+ * [CVE-2024-25126] Fixed ReDoS in Content Type header parsing
378
+ * [CVE-2024-26141] Reject Range headers which are too large
379
+
380
+ [CVE-2024-26146]: https://github.com/advisories/GHSA-54rr-7fvw-6x8f
381
+ [CVE-2024-25126]: https://github.com/advisories/GHSA-22f2-v57c-j9cx
382
+ [CVE-2024-26141]: https://github.com/advisories/GHSA-xj5v-6v4g-jfw6
383
+
384
+ ## [3.0.9] - 2024-01-31
385
+
386
+ - Fix incorrect content-length header that was emitted when `Rack::Response#write` was used in some situations. ([#2150](https://github.com/rack/rack/pull/2150), [@mattbrictson](https://github.com/mattbrictson))
387
+
388
+ ## [3.0.8] - 2023-06-14
389
+
390
+ - Fix some unused variable verbose warnings. ([#2084](https://github.com/rack/rack/pull/2084), [@jeremyevans], [@skipkayhil](https://github.com/skipkayhil))
391
+
392
+ ## [3.0.7] - 2023-03-16
393
+
394
+ - Make query parameters without `=` have `nil` values. ([#2059](https://github.com/rack/rack/pull/2059), [@jeremyevans])
395
+
396
+ ## [3.0.6.1] - 2023-03-13
397
+
398
+ ### Security
399
+
400
+ - [CVE-2023-27539] Avoid ReDoS in header parsing
401
+
402
+ ## [3.0.6] - 2023-03-13
403
+
404
+ - Add `QueryParser#missing_value` for handling missing values + tests. ([#2052](https://github.com/rack/rack/pull/2052), [@ioquatix])
405
+
406
+ ## [3.0.5] - 2023-03-13
407
+
408
+ - Split form/query parsing into two steps. ([#2038](https://github.com/rack/rack/pull/2038), [@matthewd](https://github.com/matthewd))
409
+
410
+ ## [3.0.4.2] - 2023-03-02
411
+
412
+ ### Security
413
+
414
+ - [CVE-2023-27530] Introduce multipart_total_part_limit to limit total parts
415
+
416
+ ## [3.0.4.1] - 2023-01-17
417
+
418
+ ### Security
419
+
420
+ - [CVE-2022-44571] Fix ReDoS vulnerability in multipart parser
421
+ - [CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges
422
+ - [CVE-2022-44572] Forbid control characters in attributes (also ReDoS)
423
+
424
+ ## [3.0.4] - 2023-01-17
425
+
426
+ - `Rack::Request#POST` should consistently raise errors. Cache errors that occur when invoking `Rack::Request#POST` so they can be raised again later. ([#2010](https://github.com/rack/rack/pull/2010), [@ioquatix])
427
+ - Fix `Rack::Lint` error message for `HTTP_CONTENT_TYPE` and `HTTP_CONTENT_LENGTH`. ([#2007](https://github.com/rack/rack/pull/2007), [@byroot](https://github.com/byroot))
428
+ - Extend `Rack::MethodOverride` to handle `QueryParser::ParamsTooDeepError` error. ([#2006](https://github.com/rack/rack/pull/2006), [@byroot](https://github.com/byroot))
429
+
430
+ ## [3.0.3] - 2022-12-27
431
+
432
+ ### Fixed
433
+
434
+ - `Rack::URLMap` uses non-deprecated form of `Regexp.new`. ([#1998](https://github.com/rack/rack/pull/1998), [@weizheheng](https://github.com/weizheheng))
435
+
436
+ ## [3.0.2] - 2022-12-05
437
+
438
+ ### Fixed
439
+
440
+ - `Utils.build_nested_query` URL-encodes nested field names including the square brackets.
441
+ - Allow `Rack::Response` to pass through streaming bodies. ([#1993](https://github.com/rack/rack/pull/1993), [@ioquatix])
442
+
443
+ ## [3.0.1] - 2022-11-18
444
+
445
+ ### Fixed
446
+
447
+ - `MethodOverride` does not look for an override if a request does not include form/parseable data.
448
+ - `Rack::Lint::Wrapper` correctly handles `respond_to?` with `to_ary`, `each`, `call` and `to_path`, forwarding to the body. ([#1981](https://github.com/rack/rack/pull/1981), [@ioquatix])
449
+
450
+ ## [3.0.0] - 2022-09-06
451
+
452
+ This release introduces major improvements to Rack, including enhanced support for streaming responses, expanded protocol handling, and stricter compliance with HTTP standards. It refines middleware interfaces, improves multipart and hijack handling, and strengthens security and error reporting. The update also brings performance optimizations, better compatibility with modern Ruby versions, and numerous bug fixes, making Rack more robust and flexible for web application development.
453
+
454
+ - No changes
455
+
456
+ ## [3.0.0.rc1] - 2022-09-04
457
+
458
+ ### SPEC Changes
459
+
460
+ - Stream argument must implement `<<` https://github.com/rack/rack/pull/1959
461
+ - `close` may be called on `rack.input` https://github.com/rack/rack/pull/1956
462
+ - `rack.response_finished` may be used for executing code after the response has been finished https://github.com/rack/rack/pull/1952
463
+
464
+ ## [3.0.0.beta1] - 2022-08-08
465
+
466
+ ### Security
467
+
468
+ - Do not use semicolon as GET parameter separator. ([#1733](https://github.com/rack/rack/pull/1733), [@jeremyevans])
469
+
470
+ ### SPEC Changes
471
+
472
+ - Response array must now be non-frozen.
473
+ - Response `status` must now be an integer greater than or equal to 100.
474
+ - Response `headers` must now be an unfrozen hash.
475
+ - Response header keys can no longer include uppercase characters.
476
+ - Response header values can be an `Array` to handle multiple values (and no longer supports `\n` encoded headers).
477
+ - Response body can now respond to `#call` (streaming body) instead of `#each` (enumerable body), for the equivalent of response hijacking in previous versions.
478
+ - Middleware must no longer call `#each` on the body, but they can call `#to_ary` on the body if it responds to `#to_ary`.
479
+ - `rack.input` is no longer required to be rewindable.
480
+ - `rack.multithread`/`rack.multiprocess`/`rack.run_once`/`rack.version` are no longer required environment keys.
481
+ - `SERVER_PROTOCOL` is now a required environment key, matching the HTTP protocol used in the request.
482
+ - `rack.hijack?` (partial hijack) and `rack.hijack` (full hijack) are now independently optional.
483
+ - `rack.hijack_io` has been removed completely.
484
+ - `rack.response_finished` is an optional environment key which contains an array of callable objects that must accept `#call(env, status, headers, error)` and are invoked after the response is finished (either successfully or unsuccessfully).
485
+ - It is okay to call `#close` on `rack.input` to indicate that you no longer need or care about the input.
486
+ - The stream argument supplied to the streaming body and hijack must support `#<<` for writing output.
487
+
488
+ ### Removed
489
+
490
+ - Remove `rack.multithread`/`rack.multiprocess`/`rack.run_once`. These variables generally come too late to be useful. ([#1720](https://github.com/rack/rack/pull/1720), [@ioquatix], [@jeremyevans]))
491
+ - Remove deprecated Rack::Request::SCHEME_WHITELIST. ([@jeremyevans])
492
+ - Remove internal cookie deletion using pattern matching, there are very few practical cases where it would be useful and browsers handle it correctly without us doing anything special. ([#1844](https://github.com/rack/rack/pull/1844), [@ioquatix])
493
+ - Remove `rack.version` as it comes too late to be useful. ([#1938](https://github.com/rack/rack/pull/1938), [@ioquatix])
494
+ - Extract `rackup` command, `Rack::Server`, `Rack::Handler` and related code into a separate gem. ([#1937](https://github.com/rack/rack/pull/1937), [@ioquatix])
495
+
496
+ ### Added
497
+
498
+ - `Rack::Headers` added to support lower-case header keys. ([@jeremyevans])
499
+ - `Rack::Utils#set_cookie_header` now supports `escape_key: false` to avoid key escaping. ([@jeremyevans])
500
+ - `Rack::RewindableInput` supports size. ([@ahorek](https://github.com/ahorek))
501
+ - `Rack::RewindableInput::Middleware` added for making `rack.input` rewindable. ([@jeremyevans])
502
+ - The RFC 7239 Forwarded header is now supported and considered by default when looking for information on forwarding, falling back to the X-Forwarded-* headers. `Rack::Request.forwarded_priority` accessor has been added for configuring the priority of which header to check. ([#1423](https://github.com/rack/rack/issues/1423), [@jeremyevans])
503
+ - Allow response headers to contain array of values. ([#1598](https://github.com/rack/rack/issues/1598), [@ioquatix])
504
+ - Support callable body for explicit streaming support and clarify streaming response body behaviour. ([#1745](https://github.com/rack/rack/pull/1745), [@ioquatix], [#1748](https://github.com/rack/rack/pull/1748), [@wjordan])
505
+ - Allow `Rack::Builder#run` to take a block instead of an argument. ([#1942](https://github.com/rack/rack/pull/1942), [@ioquatix])
506
+ - Add `rack.response_finished` to `Rack::Lint`. ([#1802](https://github.com/rack/rack/pull/1802), [@BlakeWilliams], [#1952](https://github.com/rack/rack/pull/1952), [@ioquatix])
507
+ - The stream argument must implement `#<<`. ([#1959](https://github.com/rack/rack/pull/1959), [@ioquatix])
508
+
509
+ ### Changed
510
+
511
+ - BREAKING CHANGE: Require `status` to be an Integer. ([#1662](https://github.com/rack/rack/pull/1662), [@olleolleolle](https://github.com/olleolleolle))
512
+ - BREAKING CHANGE: Query parsing now treats parameters without `=` as having the empty string value instead of nil value, to conform to the URL spec. ([#1696](https://github.com/rack/rack/issues/1696), [@jeremyevans])
513
+ - Relax validations around `Rack::Request#host` and `Rack::Request#hostname`. ([#1606](https://github.com/rack/rack/issues/1606), [@pvande](https://github.com/pvande))
514
+ - Removed antiquated handlers: FCGI, LSWS, SCGI, Thin. ([#1658](https://github.com/rack/rack/pull/1658), [@ioquatix])
515
+ - Removed options from `Rack::Builder.parse_file` and `Rack::Builder.load_file`. ([#1663](https://github.com/rack/rack/pull/1663), [@ioquatix])
516
+ - `Rack::HTTP_VERSION` has been removed and the `HTTP_VERSION` env setting is no longer set in the CGI and Webrick handlers. ([#970](https://github.com/rack/rack/issues/970), [@jeremyevans])
517
+ - `Rack::Request#[]` and `#[]=` now warn even in non-verbose mode. ([#1277](https://github.com/rack/rack/issues/1277), [@jeremyevans])
518
+ - Decrease default allowed parameter recursion level from 100 to 32. ([#1640](https://github.com/rack/rack/issues/1640), [@jeremyevans])
519
+ - Attempting to parse a multipart response with an empty body now raises Rack::Multipart::EmptyContentError. ([#1603](https://github.com/rack/rack/issues/1603), [@jeremyevans])
520
+ - `Rack::Utils.secure_compare` uses OpenSSL's faster implementation if available. ([#1711](https://github.com/rack/rack/pull/1711), [@bdewater](https://github.com/bdewater))
521
+ - `Rack::Request#POST` now caches an empty hash if input content type is not parseable. ([#749](https://github.com/rack/rack/pull/749), [@jeremyevans])
522
+ - BREAKING CHANGE: Updated `trusted_proxy?` to match full 127.0.0.0/8 network. ([#1781](https://github.com/rack/rack/pull/1781), [@snbloch](https://github.com/snbloch))
523
+ - Explicitly deprecate `Rack::File` which was an alias for `Rack::Files`. ([#1811](https://github.com/rack/rack/pull/1720), [@ioquatix]).
524
+ - Moved `Rack::Session` into [separate gem](https://github.com/rack/rack-session). ([#1805](https://github.com/rack/rack/pull/1805), [@ioquatix])
525
+ - `rackup -D` option to daemonizes no longer changes the working directory to the root. ([#1813](https://github.com/rack/rack/pull/1813), [@jeremyevans])
526
+ - The `x-forwarded-proto` header is now considered before the `x-forwarded-scheme` header for determining the forwarded protocol. `Rack::Request.x_forwarded_proto_priority` accessor has been added for configuring the priority of which header to check. ([#1809](https://github.com/rack/rack/issues/1809), [@jeremyevans])
527
+ - `Rack::Request.forwarded_authority` (and methods that call it, such as `host`) now returns the last authority in the forwarded header, instead of the first, as earlier forwarded authorities can be forged by clients. This restores the Rack 2.1 behavior. ([#1829](https://github.com/rack/rack/issues/1809), [@jeremyevans])
528
+ - Use lower case cookie attributes when creating cookies, and fold cookie attributes to lower case when reading cookies (specifically impacting `secure` and `httponly` attributes). ([#1849](https://github.com/rack/rack/pull/1849), [@ioquatix])
529
+ - The response array must now be mutable (non-frozen) so middleware can modify it without allocating a new Array,therefore reducing object allocations. ([#1887](https://github.com/rack/rack/pull/1887), [#1927](https://github.com/rack/rack/pull/1927), [@amatsuda], [@ioquatix])
530
+ - `rack.hijack?` (partial hijack) and `rack.hijack` (full hijack) are now independently optional. `rack.hijack_io` is no longer required/specified. ([#1939](https://github.com/rack/rack/pull/1939), [@ioquatix])
531
+ - Allow calling close on `rack.input`. ([#1956](https://github.com/rack/rack/pull/1956), [@ioquatix])
532
+
533
+ ### Fixed
534
+
535
+ - Make Rack::MockResponse handle non-hash headers. ([#1629](https://github.com/rack/rack/issues/1629), [@jeremyevans])
536
+ - TempfileReaper now deletes temp files if application raises an exception. ([#1679](https://github.com/rack/rack/issues/1679), [@jeremyevans])
537
+ - Handle cookies with values that end in '=' ([#1645](https://github.com/rack/rack/pull/1645), [@lukaso](https://github.com/lukaso))
538
+ - Make `Rack::NullLogger` respond to `#fatal!` [@jeremyevans])
539
+ - Fix multipart filename generation for filenames that contain spaces. Encode spaces as "%20" instead of "+" which will be decoded properly by the multipart parser. ([#1736](https://github.com/rack/rack/pull/1645), [@muirdm](https://github.com/muirdm))
540
+ - `Rack::Request#scheme` returns `ws` or `wss` when one of the `X-Forwarded-Scheme` / `X-Forwarded-Proto` headers is set to `ws` or `wss`, respectively. ([#1730](https://github.com/rack/rack/issues/1730), [@erwanst](https://github.com/erwanst))
541
+
542
+ ## [2.2.24] - 2026-08-13
543
+
544
+ ### Security
545
+
546
+ - [CVE-2026-26962](https://github.com/advisories/GHSA-rx22-g9mx-qrhv) Improper unfolding of folded multipart headers preserves CRLF in parsed parameter values.
547
+
548
+ ## [2.2.23] - 2026-04-01
549
+
550
+ ### Security
551
+
552
+ - [CVE-2026-34763](https://github.com/advisories/GHSA-7mqq-6cf9-v2qp) Root directory disclosure via unescaped regex interpolation in `Rack::Directory`.
553
+ - [CVE-2026-34230](https://github.com/advisories/GHSA-v569-hp3g-36wr) Avoid O(n^2) algorithm in `Rack::Utils.select_best_encoding` which could lead to denial of service.
554
+ - [CVE-2026-26961](https://github.com/advisories/GHSA-vgpv-f759-9wx3) Raise error for multipart requests with multiple boundary parameters.
555
+ - [CVE-2026-34786](https://github.com/advisories/GHSA-q4qf-9j86-f5mh) `Rack::Static` `header_rules` bypass via URL-encoded path mismatch.
556
+ - [CVE-2026-34831](https://github.com/advisories/GHSA-q2ww-5357-x388) `Content-Length` mismatch in `Rack::Files` error responses.
557
+ - [CVE-2026-34826](https://github.com/advisories/GHSA-x8cg-fq8g-mxfx) Multipart byte range processing allows denial of service via excessive overlapping ranges.
558
+ - [CVE-2026-34830](https://github.com/advisories/GHSA-qv7j-4883-hwh7) `Rack::Sendfile` header-based `X-Accel-Mapping` regex injection enables unauthorized `X-Accel-Redirect`.
559
+ - [CVE-2026-34785](https://github.com/advisories/GHSA-h2jq-g4cq-5ppq) `Rack::Static` prefix matching can expose unintended files under the static root.
560
+ - [CVE-2026-34829](https://github.com/advisories/GHSA-8vqr-qjwx-82mw) Multipart parsing without `Content-Length` header allows unbounded chunked file uploads.
561
+
562
+ ## [2.2.22] - 2026-02-16
563
+
564
+ ### Security
565
+
566
+ - [CVE-2026-25500](https://github.com/advisories/GHSA-whrj-4476-wvmp) XSS injection via malicious filename in `Rack::Directory`.
567
+ - [CVE-2026-22860](https://github.com/advisories/GHSA-mxw3-3hh2-x2mh) Directory traversal via root prefix bypass in `Rack::Directory`.
568
+
569
+ ## [2.2.21] - 2025-11-03
570
+
571
+ ### Fixed
572
+
573
+ - Multipart parser: limit MIME header size check to the unread buffer region to avoid false `multipart mime part header too large` errors when previously read data accumulates in the scan buffer. ([#2392](https://github.com/rack/rack/pull/2392), [@alpaca-tc](https://github.com/alpaca-tc), [@willnet](https://github.com/willnet), [@krororo](https://github.com/krororo))
574
+
575
+ ## [2.2.20] - 2025-10-10
576
+
577
+ ### Security
578
+
579
+ - [CVE-2025-61780](https://github.com/advisories/GHSA-r657-rxjc-j557) Improper handling of headers in `Rack::Sendfile` may allow proxy bypass.
580
+ - [CVE-2025-61919](https://github.com/advisories/GHSA-6xw4-3v39-52mm) Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion.
581
+
582
+ ## [2.2.19] - 2025-10-07
583
+
584
+ ### Security
585
+
586
+ - [CVE-2025-61772](https://github.com/advisories/GHSA-wpv5-97wm-hp9c) Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
587
+ - [CVE-2025-61771](https://github.com/advisories/GHSA-w9pc-fmgc-vxvw) Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
588
+ - [CVE-2025-61770](https://github.com/advisories/GHSA-p543-xpfm-54cp) Unbounded multipart preamble buffering enables DoS (memory exhaustion)
589
+
590
+ ## [2.2.18] - 2025-09-25
591
+
592
+ ### Security
593
+
594
+ - [CVE-2025-59830](https://github.com/advisories/GHSA-625h-95r8-8xpm) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion via semicolon-separated parameters.
595
+
596
+ ## [2.2.17] - 2025-06-03
597
+
598
+ - Backport `Rack::MediaType#params` now handles parameters without values. ([#2263](https://github.com/rack/rack/pull/2263), [@AllyMarthaJ](https://github.com/AllyMarthaJ))
599
+
600
+ ## [2.2.16] - 2025-05-22
601
+
602
+ - Fix incorrect backport of optional `CGI::Cookie` support. ([#2335](https://github.com/rack/rack/pull/2335), [@jeremyevans])
603
+
604
+ ## [2.2.15] - 2025-05-18
605
+
606
+ - Optional support for `CGI::Cookie` if not available. ([#2327](https://github.com/rack/rack/pull/2327), [#2333](https://github.com/rack/rack/pull/2333), [@earlopain])
607
+
608
+ ## [2.2.14] - 2025-05-06
609
+
610
+ :warning: **This release includes a security fix that may cause certain routes in previously working applications to fail if query parameters exceed 4,096 in count or 4 MB in total size. See <https://github.com/rack/rack/discussions/2356> for more details.**
611
+
612
+ ### Security
613
+
614
+ - [CVE-2025-46727](https://github.com/advisories/GHSA-gjh7-p2fx-99vx) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion.
615
+
616
+ ## [2.2.13] - 2025-03-11
617
+
618
+ ### Security
619
+
620
+ - [CVE-2025-27610](https://github.com/advisories/GHSA-7wqh-767x-r66v) Local file inclusion in `Rack::Static`.
621
+
622
+ ## [2.2.12] - 2025-03-04
623
+
624
+ ### Security
625
+
626
+ - [CVE-2025-27111](https://github.com/advisories/GHSA-8cgq-6mh2-7j6v) Possible Log Injection in `Rack::Sendfile`.
627
+
628
+ ## [2.2.11] - 2025-02-12
629
+
630
+ ### Security
631
+
632
+ - [CVE-2025-25184](https://github.com/advisories/GHSA-7g2v-jj9q-g3rg) Possible Log Injection in `Rack::CommonLogger`.
633
+
634
+ ## [2.2.10] - 2024-10-14
635
+
636
+ - Fix compatibility issues with Ruby v3.4.0. ([#2248](https://github.com/rack/rack/pull/2248), [@byroot](https://github.com/byroot))
637
+
638
+ ## [2.2.9] - 2023-03-21
639
+
640
+ - Return empty when parsing a multi-part POST with only one end delimiter. ([#2104](https://github.com/rack/rack/pull/2104), [@alpaca-tc])
641
+
642
+ ## [2.2.8] - 2023-07-31
643
+
644
+ - Regenerate SPEC ([#2102](https://github.com/rack/rack/pull/2102), [@skipkayhil](https://github.com/skipkayhil))
645
+ - Limit file extension length of multipart tempfiles ([#2015](https://github.com/rack/rack/pull/2015), [@dentarg](https://github.com/dentarg))
646
+ - Fix "undefined method DelegateClass for Rack::Session::Cookie:Class" ([#2092](https://github.com/rack/rack/pull/2092), [@onigra](https://github.com/onigra) [@dchandekstark](https://github.com/dchandekstark))
647
+
648
+ ## [2.2.7] - 2023-03-13
649
+
650
+ - Correct the year number in the changelog ([#2015](https://github.com/rack/rack/pull/2015), [@kimulab](https://github.com/kimulab))
651
+ - Support underscore in host names for Rack 2.2 (Fixes [#2070](https://github.com/rack/rack/issues/2070)) ([#2015](https://github.com/rack/rack/pull/2071), [@jeremyevans](https://github.com/jeremyevans))
652
+
653
+ ## [2.2.6.4] - 2023-03-13
654
+
655
+ - [CVE-2023-27539] Avoid ReDoS in header parsing
656
+
657
+ ## [2.2.6.3] - 2023-03-02
658
+
659
+ - [CVE-2023-27530] Introduce multipart_total_part_limit to limit total parts
660
+
661
+ ## [2.2.6.2] - 2023-01-17
662
+
663
+ - [CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges
664
+
665
+ ## [2.2.6.1] - 2023-01-17
666
+
667
+ - [CVE-2022-44571] Fix ReDoS vulnerability in multipart parser
668
+ - [CVE-2022-44572] Forbid control characters in attributes (also ReDoS)
669
+
670
+ ## [2.2.6] - 2023-01-17
671
+
672
+ - Extend `Rack::MethodOverride` to handle `QueryParser::ParamsTooDeepError` error. ([#2011](https://github.com/rack/rack/pull/2011), [@byroot](https://github.com/byroot))
673
+
674
+ ## [2.2.5] - 2022-12-27
675
+
676
+ ### Fixed
677
+
678
+ - `Rack::URLMap` uses non-deprecated form of `Regexp.new`. ([#1998](https://github.com/rack/rack/pull/1998), [@weizheheng](https://github.com/weizheheng))
679
+
680
+ ## [2.2.4] - 2022-06-30
681
+
682
+ - Better support for lower case headers in `Rack::ETag` middleware. ([#1919](https://github.com/rack/rack/pull/1919), [@ioquatix](https://github.com/ioquatix))
683
+ - Use custom exception on params too deep error. ([#1838](https://github.com/rack/rack/pull/1838), [@simi](https://github.com/simi))
684
+
685
+ ## [2.2.3.1] - 2022-05-27
686
+
687
+ ### Security
688
+
689
+ - [CVE-2022-30123] Fix shell escaping issue in Common Logger
690
+ - [CVE-2022-30122] Restrict parsing of broken MIME attachments
691
+
692
+ ## [2.2.3] - 2020-06-15
693
+
694
+ ### Security
695
+
696
+ - [[CVE-2020-8184](https://nvd.nist.gov/vuln/detail/CVE-2020-8184)] Do not allow percent-encoded cookie name to override existing cookie names. BREAKING CHANGE: Accessing cookie names that require URL encoding with decoded name no longer works. ([@fletchto99](https://github.com/fletchto99))
8
697
 
9
698
  ## [2.2.2] - 2020-02-11
10
699
 
11
700
  ### Fixed
12
701
 
13
- - Fix incorrect `Rack::Request#host` value. ([#1591](https://github.com/rack/rack/pull/1591), [@ioquatix](https://github.com/ioquatix))
14
- - Revert `Rack::Handler::Thin` implementation. ([#1583](https://github.com/rack/rack/pull/1583), [@jeremyevans](https://github.com/jeremyevans))
702
+ - Fix incorrect `Rack::Request#host` value. ([#1591](https://github.com/rack/rack/pull/1591), [@ioquatix])
703
+ - Revert `Rack::Handler::Thin` implementation. ([#1583](https://github.com/rack/rack/pull/1583), [@jeremyevans])
15
704
  - Double assignment is still needed to prevent an "unused variable" warning. ([#1589](https://github.com/rack/rack/pull/1589), [@kamipo](https://github.com/kamipo))
16
705
  - Fix to handle same_site option for session pool. ([#1587](https://github.com/rack/rack/pull/1587), [@kamipo](https://github.com/kamipo))
17
706
 
@@ -19,105 +708,111 @@ All notable changes to this project will be documented in this file. For info on
19
708
 
20
709
  ### Fixed
21
710
 
22
- - Rework `Rack::Request#ip` to handle empty `forwarded_for`. ([#1577](https://github.com/rack/rack/pull/1577), [@ioquatix](https://github.com/ioquatix))
711
+ - Rework `Rack::Request#ip` to handle empty `forwarded_for`. ([#1577](https://github.com/rack/rack/pull/1577), [@ioquatix])
23
712
 
24
713
  ## [2.2.0] - 2020-02-08
25
714
 
26
715
  ### SPEC Changes
27
716
 
28
- - `rack.session` request environment entry must respond to `to_hash` and return unfrozen Hash. ([@jeremyevans](https://github.com/jeremyevans))
29
- - Request environment cannot be frozen. ([@jeremyevans](https://github.com/jeremyevans))
30
- - CGI values in the request environment with non-ASCII characters must use ASCII-8BIT encoding. ([@jeremyevans](https://github.com/jeremyevans))
31
- - Improve SPEC/lint relating to SERVER_NAME, SERVER_PORT and HTTP_HOST. ([#1561](https://github.com/rack/rack/pull/1561), [@ioquatix](https://github.com/ioquatix))
717
+ - `rack.session` request environment entry must respond to `to_hash` and return unfrozen Hash. ([@jeremyevans])
718
+ - Request environment cannot be frozen. ([@jeremyevans])
719
+ - CGI values in the request environment with non-ASCII characters must use ASCII-8BIT encoding. ([@jeremyevans])
720
+ - Improve SPEC/lint relating to SERVER_NAME, SERVER_PORT and HTTP_HOST. ([#1561](https://github.com/rack/rack/pull/1561), [@ioquatix])
32
721
 
33
722
  ### Added
34
723
 
35
- - `rackup` supports multiple `-r` options and will require all arguments. ([@jeremyevans](https://github.com/jeremyevans))
724
+ - `rackup` supports multiple `-r` options and will require all arguments. ([@jeremyevans])
36
725
  - `Server` supports an array of paths to require for the `:require` option. ([@khotta](https://github.com/khotta))
37
726
  - `Files` supports multipart range requests. ([@fatkodima](https://github.com/fatkodima))
38
- - `Multipart::UploadedFile` supports an IO-like object instead of using the filesystem, using `:filename` and `:io` options. ([@jeremyevans](https://github.com/jeremyevans))
39
- - `Multipart::UploadedFile` supports keyword arguments `:path`, `:content_type`, and `:binary` in addition to positional arguments. ([@jeremyevans](https://github.com/jeremyevans))
40
- - `Static` supports a `:cascade` option for calling the app if there is no matching file. ([@jeremyevans](https://github.com/jeremyevans))
41
- - `Session::Abstract::SessionHash#dig`. ([@jeremyevans](https://github.com/jeremyevans))
42
- - `Response.[]` and `MockResponse.[]` for creating instances using status, headers, and body. ([@ioquatix](https://github.com/ioquatix))
43
- - Convenient cache and content type methods for `Rack::Response`. ([#1555](https://github.com/rack/rack/pull/1555), [@ioquatix](https://github.com/ioquatix))
727
+ - `Multipart::UploadedFile` supports an IO-like object instead of using the filesystem, using `:filename` and `:io` options. ([@jeremyevans])
728
+ - `Multipart::UploadedFile` supports keyword arguments `:path`, `:content_type`, and `:binary` in addition to positional arguments. ([@jeremyevans])
729
+ - `Static` supports a `:cascade` option for calling the app if there is no matching file. ([@jeremyevans])
730
+ - `Session::Abstract::SessionHash#dig`. ([@jeremyevans])
731
+ - `Response.[]` and `MockResponse.[]` for creating instances using status, headers, and body. ([@ioquatix])
732
+ - Convenient cache and content type methods for `Rack::Response`. ([#1555](https://github.com/rack/rack/pull/1555), [@ioquatix])
44
733
 
45
734
  ### Changed
46
735
 
47
- - `Request#params` no longer rescues EOFError. ([@jeremyevans](https://github.com/jeremyevans))
48
- - `Directory` uses a streaming approach, significantly improving time to first byte for large directories. ([@jeremyevans](https://github.com/jeremyevans))
49
- - `Directory` no longer includes a Parent directory link in the root directory index. ([@jeremyevans](https://github.com/jeremyevans))
50
- - `QueryParser#parse_nested_query` uses original backtrace when reraising exception with new class. ([@jeremyevans](https://github.com/jeremyevans))
51
- - `ConditionalGet` follows RFC 7232 precedence if both If-None-Match and If-Modified-Since headers are provided. ([@jeremyevans](https://github.com/jeremyevans))
736
+ - `Request#params` no longer rescues EOFError. ([@jeremyevans])
737
+ - `Directory` uses a streaming approach, significantly improving time to first byte for large directories. ([@jeremyevans])
738
+ - `Directory` no longer includes a Parent directory link in the root directory index. ([@jeremyevans])
739
+ - `QueryParser#parse_nested_query` uses original backtrace when reraising exception with new class. ([@jeremyevans])
740
+ - `ConditionalGet` follows RFC 7232 precedence if both If-None-Match and If-Modified-Since headers are provided. ([@jeremyevans])
52
741
  - `.ru` files supports the `frozen-string-literal` magic comment. ([@eregon](https://github.com/eregon))
53
- - Rely on autoload to load constants instead of requiring internal files, make sure to require 'rack' and not just 'rack/...'. ([@jeremyevans](https://github.com/jeremyevans))
54
- - `Etag` will continue sending ETag even if the response should not be cached. ([@henm](https://github.com/henm))
742
+ - Rely on autoload to load constants instead of requiring internal files, make sure to require 'rack' and not just 'rack/...'. ([@jeremyevans])
743
+ - BREAKING CHANGE: `Etag` will continue sending ETag even if the response should not be cached. Streaming no longer works without a workaround, see [#1619](https://github.com/rack/rack/issues/1619#issuecomment-848460528). ([@henm](https://github.com/henm))
55
744
  - `Request#host_with_port` no longer includes a colon for a missing or empty port. ([@AlexWayfer](https://github.com/AlexWayfer))
56
- - All handlers uses keywords arguments instead of an options hash argument. ([@ioquatix](https://github.com/ioquatix))
57
- - `Files` handling of range requests no longer return a body that supports `to_path`, to ensure range requests are handled correctly. ([@jeremyevans](https://github.com/jeremyevans))
58
- - `Multipart::Generator` only includes `Content-Length` for files with paths, and `Content-Disposition` `filename` if the `UploadedFile` instance has one. ([@jeremyevans](https://github.com/jeremyevans))
59
- - `Request#ssl?` is true for the `wss` scheme (secure websockets). ([@jeremyevans](https://github.com/jeremyevans))
60
- - `Rack::HeaderHash` is memoized by default. ([#1549](https://github.com/rack/rack/pull/1549), [@ioquatix](https://github.com/ioquatix))
745
+ - All handlers uses keywords arguments instead of an options hash argument. ([@ioquatix])
746
+ - `Files` handling of range requests no longer return a body that supports `to_path`, to ensure range requests are handled correctly. ([@jeremyevans])
747
+ - `Multipart::Generator` only includes `Content-Length` for files with paths, and `Content-Disposition` `filename` if the `UploadedFile` instance has one. ([@jeremyevans])
748
+ - `Request#ssl?` is true for the `wss` scheme (secure websockets). ([@jeremyevans])
749
+ - `Rack::HeaderHash` is memoized by default. ([#1549](https://github.com/rack/rack/pull/1549), [@ioquatix])
61
750
  - `Rack::Directory` allow directory traversal inside root directory. ([#1417](https://github.com/rack/rack/pull/1417), [@ThomasSevestre](https://github.com/ThomasSevestre))
62
- - Sort encodings by server preference. ([#1184](https://github.com/rack/rack/pull/1184), [@ioquatix](https://github.com/ioquatix), [@wjordan](https://github.com/wjordan))
63
- - Rework host/hostname/authority implementation in `Rack::Request`. `#host` and `#host_with_port` have been changed to correctly return IPv6 addresses formatted with square brackets, as defined by [RFC3986](https://tools.ietf.org/html/rfc3986#section-3.2.2). ([#1561](https://github.com/rack/rack/pull/1561), [@ioquatix](https://github.com/ioquatix))
64
- - `Rack::Builder` parsing options on first `#\` line is deprecated. ([#1574](https://github.com/rack/rack/pull/1574), [@ioquatix](https://github.com/ioquatix))
751
+ - Sort encodings by server preference. ([#1184](https://github.com/rack/rack/pull/1184), [@ioquatix], [@wjordan](https://github.com/wjordan))
752
+ - Rework host/hostname/authority implementation in `Rack::Request`. `#host` and `#host_with_port` have been changed to correctly return IPv6 addresses formatted with square brackets, as defined by [RFC3986](https://tools.ietf.org/html/rfc3986#section-3.2.2). ([#1561](https://github.com/rack/rack/pull/1561), [@ioquatix])
753
+ - `Rack::Builder` parsing options on first `#\` line is deprecated. ([#1574](https://github.com/rack/rack/pull/1574), [@ioquatix])
65
754
 
66
755
  ### Removed
67
756
 
68
- - `Directory#path` as it was not used and always returned nil. ([@jeremyevans](https://github.com/jeremyevans))
69
- - `BodyProxy#each` as it was only needed to work around a bug in Ruby <1.9.3. ([@jeremyevans](https://github.com/jeremyevans))
757
+ - `Directory#path` as it was not used and always returned nil. ([@jeremyevans])
758
+ - `BodyProxy#each` as it was only needed to work around a bug in Ruby <1.9.3. ([@jeremyevans])
70
759
  - `URLMap::INFINITY` and `URLMap::NEGATIVE_INFINITY`, in favor of `Float::INFINITY`. ([@ch1c0t](https://github.com/ch1c0t))
71
760
  - Deprecation of `Rack::File`. It will be deprecated again in rack 2.2 or 3.0. ([@rafaelfranca](https://github.com/rafaelfranca))
72
- - Support for Ruby 2.2 as it is well past EOL. ([@ioquatix](https://github.com/ioquatix))
73
- - Remove `Rack::Files#response_body` as the implementation was broken. ([#1153](https://github.com/rack/rack/pull/1153), [@ioquatix](https://github.com/ioquatix))
74
- - Remove `SERVER_ADDR` which was never part of the original SPEC. ([#1573](https://github.com/rack/rack/pull/1573), [@ioquatix](https://github.com/ioquatix))
761
+ - Support for Ruby 2.2 as it is well past EOL. ([@ioquatix])
762
+ - Remove `Rack::Files#response_body` as the implementation was broken. ([#1153](https://github.com/rack/rack/pull/1153), [@ioquatix])
763
+ - Remove `SERVER_ADDR` which was never part of the original SPEC. ([#1573](https://github.com/rack/rack/pull/1573), [@ioquatix])
75
764
 
76
765
  ### Fixed
77
766
 
78
- - `Directory` correctly handles root paths containing glob metacharacters. ([@jeremyevans](https://github.com/jeremyevans))
79
- - `Cascade` uses a new response object for each call if initialized with no apps. ([@jeremyevans](https://github.com/jeremyevans))
80
- - `BodyProxy` correctly delegates keyword arguments to the body object on Ruby 2.7+. ([@jeremyevans](https://github.com/jeremyevans))
81
- - `BodyProxy#method` correctly handles methods delegated to the body object. ([@jeremyevans](https://github.com/jeremyevans))
767
+ - `Directory` correctly handles root paths containing glob metacharacters. ([@jeremyevans])
768
+ - `Cascade` uses a new response object for each call if initialized with no apps. ([@jeremyevans])
769
+ - `BodyProxy` correctly delegates keyword arguments to the body object on Ruby 2.7+. ([@jeremyevans])
770
+ - `BodyProxy#method` correctly handles methods delegated to the body object. ([@jeremyevans])
82
771
  - `Request#host` and `Request#host_with_port` handle IPv6 addresses correctly. ([@AlexWayfer](https://github.com/AlexWayfer))
83
- - `Lint` checks when response hijacking that `rack.hijack` is called with a valid object. ([@jeremyevans](https://github.com/jeremyevans))
84
- - `Response#write` correctly updates `Content-Length` if initialized with a body. ([@jeremyevans](https://github.com/jeremyevans))
772
+ - `Lint` checks when response hijacking that `rack.hijack` is called with a valid object. ([@jeremyevans])
773
+ - `Response#write` correctly updates `Content-Length` if initialized with a body. ([@jeremyevans])
85
774
  - `CommonLogger` includes `SCRIPT_NAME` when logging. ([@Erol](https://github.com/Erol))
86
- - `Utils.parse_nested_query` correctly handles empty queries, using an empty instance of the params class instead of a hash. ([@jeremyevans](https://github.com/jeremyevans))
775
+ - `Utils.parse_nested_query` correctly handles empty queries, using an empty instance of the params class instead of a hash. ([@jeremyevans])
87
776
  - `Directory` correctly escapes paths in links. ([@yous](https://github.com/yous))
88
- - `Request#delete_cookie` and related `Utils` methods handle `:domain` and `:path` options in same call. ([@jeremyevans](https://github.com/jeremyevans))
89
- - `Request#delete_cookie` and related `Utils` methods do an exact match on `:domain` and `:path` options. ([@jeremyevans](https://github.com/jeremyevans))
777
+ - `Request#delete_cookie` and related `Utils` methods handle `:domain` and `:path` options in same call. ([@jeremyevans])
778
+ - `Request#delete_cookie` and related `Utils` methods do an exact match on `:domain` and `:path` options. ([@jeremyevans])
90
779
  - `Static` no longer adds headers when a gzipped file request has a 304 response. ([@chooh](https://github.com/chooh))
91
- - `ContentLength` sets `Content-Length` response header even for bodies not responding to `to_ary`. ([@jeremyevans](https://github.com/jeremyevans))
92
- - Thin handler supports options passed directly to `Thin::Controllers::Controller`. ([@jeremyevans](https://github.com/jeremyevans))
93
- - WEBrick handler no longer ignores `:BindAddress` option. ([@jeremyevans](https://github.com/jeremyevans))
94
- - `ShowExceptions` handles invalid POST data. ([@jeremyevans](https://github.com/jeremyevans))
95
- - Basic authentication requires a password, even if the password is empty. ([@jeremyevans](https://github.com/jeremyevans))
96
- - `Lint` checks response is array with 3 elements, per SPEC. ([@jeremyevans](https://github.com/jeremyevans))
780
+ - `ContentLength` sets `Content-Length` response header even for bodies not responding to `to_ary`. ([@jeremyevans])
781
+ - Thin handler supports options passed directly to `Thin::Controllers::Controller`. ([@jeremyevans])
782
+ - WEBrick handler no longer ignores `:BindAddress` option. ([@jeremyevans])
783
+ - `ShowExceptions` handles invalid POST data. ([@jeremyevans])
784
+ - Basic authentication requires a password, even if the password is empty. ([@jeremyevans])
785
+ - `Lint` checks response is array with 3 elements, per SPEC. ([@jeremyevans])
97
786
  - Support for using `:SSLEnable` option when using WEBrick handler. (Gregor Melhorn)
98
- - Close response body after buffering it when buffering. ([@ioquatix](https://github.com/ioquatix))
787
+ - Close response body after buffering it when buffering. ([@ioquatix])
99
788
  - Only accept `;` as delimiter when parsing cookies. ([@mrageh](https://github.com/mrageh))
100
- - `Utils::HeaderHash#clear` clears the name mapping as well. ([@raxoft](https://github.com/raxoft))
101
- - Support for passing `nil` `Rack::Files.new`, which notably fixes Rails' current `ActiveStorage::FileServer` implementation. ([@ioquatix](https://github.com/ioquatix))
789
+ - `Utils::HeaderHash#clear` clears the name mapping as well. ([@raxoft](https://github.com/raxoft))
790
+ - Support for passing `nil` `Rack::Files.new`, which notably fixes Rails' current `ActiveStorage::FileServer` implementation. ([@ioquatix])
102
791
 
103
792
  ### Documentation
104
793
 
105
794
  - CHANGELOG updates. ([@aupajo](https://github.com/aupajo))
106
795
  - Added [CONTRIBUTING](CONTRIBUTING.md). ([@dblock](https://github.com/dblock))
107
796
 
797
+ ## [2.0.9] - 2020-02-08
798
+
799
+ - Handle case where session id key is requested but missing ([@jeremyevans])
800
+ - Restore support for code relying on `SessionId#to_s`. ([@jeremyevans])
801
+ - Add support for `SameSite=None` cookie value. ([@hennikul](https://github.com/hennikul))
802
+
108
803
  ## [2.1.2] - 2020-01-27
109
804
 
110
805
  - Fix multipart parser for some files to prevent denial of service ([@aiomaster](https://github.com/aiomaster))
111
806
  - Fix `Rack::Builder#use` with keyword arguments ([@kamipo](https://github.com/kamipo))
112
- - Skip deflating in Rack::Deflater if Content-Length is 0 ([@jeremyevans](https://github.com/jeremyevans))
807
+ - Skip deflating in Rack::Deflater if Content-Length is 0 ([@jeremyevans])
113
808
  - Remove `SessionHash#transform_keys`, no longer needed ([@pavel](https://github.com/pavel))
114
809
  - Add to_hash to wrap Hash and Session classes ([@oleh-demyanyuk](https://github.com/oleh-demyanyuk))
115
- - Handle case where session id key is requested but missing ([@jeremyevans](https://github.com/jeremyevans))
810
+ - Handle case where session id key is requested but missing ([@jeremyevans])
116
811
 
117
812
  ## [2.1.1] - 2020-01-12
118
813
 
119
- - Remove `Rack::Chunked` from `Rack::Server` default middleware. ([#1475](https://github.com/rack/rack/pull/1475), [@ioquatix](https://github.com/ioquatix))
120
- - Restore support for code relying on `SessionId#to_s`. ([@jeremyevans](https://github.com/jeremyevans))
814
+ - Remove `Rack::Chunked` from `Rack::Server` default middleware. ([#1475](https://github.com/rack/rack/pull/1475), [@ioquatix])
815
+ - Restore support for code relying on `SessionId#to_s`. ([@jeremyevans])
121
816
 
122
817
  ## [2.1.0] - 2020-01-10
123
818
 
@@ -134,13 +829,13 @@ All notable changes to this project will be documented in this file. For info on
134
829
  - Add boot-time profiling capabilities to `rackup`. ([@tenderlove](https://github.com/tenderlove))
135
830
  - Add multi mapping support for `X-Accel-Mappings` header. ([@yoshuki](https://github.com/yoshuki))
136
831
  - Add `sync: false` option to `Rack::Deflater`. (Eric Wong)
137
- - Add `Builder#freeze_app` to freeze application and all middleware instances. ([@jeremyevans](https://github.com/jeremyevans))
832
+ - Add `Builder#freeze_app` to freeze application and all middleware instances. ([@jeremyevans])
138
833
  - Add API to extract cookies from `Rack::MockResponse`. ([@petercline](https://github.com/petercline))
139
834
 
140
835
  ### Changed
141
836
 
142
- - Don't propagate nil values from middleware. ([@ioquatix](https://github.com/ioquatix))
143
- - Lazily initialize the response body and only buffer it if required. ([@ioquatix](https://github.com/ioquatix))
837
+ - Don't propagate nil values from middleware. ([@ioquatix])
838
+ - Lazily initialize the response body and only buffer it if required. ([@ioquatix])
144
839
  - Fix deflater zlib buffer errors on empty body part. ([@felixbuenemann](https://github.com/felixbuenemann))
145
840
  - Set `X-Accel-Redirect` to percent-encoded path. ([@diskkid](https://github.com/diskkid))
146
841
  - Remove unnecessary buffer growing when parsing multipart. ([@tainoe](https://github.com/tainoe))
@@ -153,15 +848,15 @@ All notable changes to this project will be documented in this file. For info on
153
848
  - Make `Utils.status_code` raise an error when the status symbol is invalid instead of `500`. ([@adambutler](https://github.com/adambutler))
154
849
  - Rename `Request::SCHEME_WHITELIST` to `Request::ALLOWED_SCHEMES`.
155
850
  - Make `Multipart::Parser.get_filename` accept files with `+` in their name. ([@lucaskanashiro](https://github.com/lucaskanashiro))
156
- - Add Falcon to the default handler fallbacks. ([@ioquatix](https://github.com/ioquatix))
851
+ - Add Falcon to the default handler fallbacks. ([@ioquatix])
157
852
  - Update codebase to avoid string mutations in preparation for `frozen_string_literals`. ([@pat](https://github.com/pat))
158
853
  - Change `MockRequest#env_for` to rely on the input optionally responding to `#size` instead of `#length`. ([@janko](https://github.com/janko))
159
- - Rename `Rack::File` -> `Rack::Files` and add deprecation notice. ([@postmodern](https://github.com/postmodern)).
160
- - Prefer Base64 “strict encoding” for Base64 cookies. ([@ioquatix](https://github.com/ioquatix))
854
+ - Rename `Rack::File` -> `Rack::Files` and add deprecation notice. ([@postmodern](https://github.com/postmodern))
855
+ - Prefer Base64 “strict encoding” for Base64 cookies. ([@ioquatix])
161
856
 
162
857
  ### Removed
163
858
 
164
- - Remove `to_ary` from Response ([@tenderlove](https://github.com/tenderlove))
859
+ - BREAKING CHANGE: Remove `to_ary` from Response ([@tenderlove](https://github.com/tenderlove))
165
860
  - Deprecate `Rack::Session::Memcache` in favor of `Rack::Session::Dalli` from dalli gem ([@fatkodima](https://github.com/fatkodima))
166
861
 
167
862
  ### Fixed
@@ -242,7 +937,7 @@ All notable changes to this project will be documented in this file. For info on
242
937
  ### Added
243
938
 
244
939
  - Allow `Session::Abstract::SessionHash#fetch` to accept a block with a default value. ([@yannvanhalewyn](https://github.com/yannvanhalewyn))
245
- - Add `Builder#freeze_app` to freeze application and all middleware. ([@jeremyevans](https://github.com/jeremyevans))
940
+ - Add `Builder#freeze_app` to freeze application and all middleware. ([@jeremyevans])
246
941
 
247
942
  ### Changed
248
943
 
@@ -254,9 +949,9 @@ All notable changes to this project will be documented in this file. For info on
254
949
  ### Fixed
255
950
 
256
951
  - Handle `NULL` bytes in multipart filenames. ([@casperisfine](https://github.com/casperisfine))
257
- - Remove warnings due to miscapitalized global. ([@ioquatix](https://github.com/ioquatix))
952
+ - Remove warnings due to miscapitalized global. ([@ioquatix])
258
953
  - Prevent exceptions caused by a race condition on multi-threaded servers. ([@sophiedeziel](https://github.com/sophiedeziel))
259
- - Add RDoc as an explicit depencency for `doc` group. ([@tonytonyjan](https://github.com/tonytonyjan))
954
+ - Add RDoc as an explicit dependency for `doc` group. ([@tonytonyjan](https://github.com/tonytonyjan))
260
955
  - Record errors originating from `Multipart::Parser` in the `MethodOverride` middleware instead of letting them bubble up. ([@carlzulauf](https://github.com/carlzulauf))
261
956
  - Remove remaining use of removed `Utils#bytesize` method from the `File` middleware. ([@brauliomartinezlm](https://github.com/brauliomartinezlm))
262
957
 
@@ -574,7 +1269,7 @@ Items below this line are from the previously maintained HISTORY.md and NEWS.md
574
1269
  - Moved Auth::OpenID to rack-contrib.
575
1270
  - SPEC change that relaxes Lint slightly to allow subclasses of the
576
1271
  required types
577
- - SPEC change to document rack.input binary mode in greator detail
1272
+ - SPEC change to document rack.input binary mode in greater detail
578
1273
  - SPEC define optional rack.logger specification
579
1274
  - File servers support X-Cascade header
580
1275
  - Imported Config middleware
@@ -692,3 +1387,13 @@ Items below this line are from the previously maintained HISTORY.md and NEWS.md
692
1387
  - Removed Rails adapter, was too alpha.
693
1388
 
694
1389
  ## [0.1] 2007-03-03
1390
+
1391
+ [@ioquatix]: https://github.com/ioquatix "Samuel Williams"
1392
+ [@jeremyevans]: https://github.com/jeremyevans "Jeremy Evans"
1393
+ [@amatsuda]: https://github.com/amatsuda "Akira Matsuda"
1394
+ [@wjordan]: https://github.com/wjordan "Will Jordan"
1395
+ [@BlakeWilliams]: https://github.com/BlakeWilliams "Blake Williams"
1396
+ [@davidstosik]: https://github.com/davidstosik "David Stosik"
1397
+ [@earlopain]: https://github.com/earlopain "Earlopain"
1398
+ [@wynksaiddestroy]: https://github.com/wynksaiddestroy "Fabian Winkler"
1399
+ [@matthewd]: https://github.com/matthewd "Matthew Draper"