rack 3.0.0 → 3.2.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (50) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +592 -1
  3. data/CONTRIBUTING.md +11 -9
  4. data/README.md +120 -29
  5. data/SPEC.rdoc +206 -288
  6. data/lib/rack/auth/abstract/request.rb +2 -0
  7. data/lib/rack/auth/basic.rb +1 -4
  8. data/lib/rack/bad_request.rb +8 -0
  9. data/lib/rack/body_proxy.rb +18 -2
  10. data/lib/rack/builder.rb +61 -40
  11. data/lib/rack/cascade.rb +0 -3
  12. data/lib/rack/common_logger.rb +3 -2
  13. data/lib/rack/conditional_get.rb +4 -3
  14. data/lib/rack/constants.rb +6 -1
  15. data/lib/rack/directory.rb +6 -3
  16. data/lib/rack/etag.rb +3 -0
  17. data/lib/rack/events.rb +21 -6
  18. data/lib/rack/files.rb +1 -1
  19. data/lib/rack/head.rb +2 -3
  20. data/lib/rack/headers.rb +98 -14
  21. data/lib/rack/lint.rb +491 -428
  22. data/lib/rack/media_type.rb +18 -9
  23. data/lib/rack/method_override.rb +2 -2
  24. data/lib/rack/mime.rb +6 -5
  25. data/lib/rack/mock_request.rb +10 -15
  26. data/lib/rack/mock_response.rb +50 -20
  27. data/lib/rack/multipart/parser.rb +279 -80
  28. data/lib/rack/multipart/uploaded_file.rb +42 -5
  29. data/lib/rack/multipart.rb +34 -1
  30. data/lib/rack/query_parser.rb +88 -80
  31. data/lib/rack/request.rb +98 -65
  32. data/lib/rack/response.rb +35 -20
  33. data/lib/rack/rewindable_input.rb +4 -1
  34. data/lib/rack/sendfile.rb +53 -23
  35. data/lib/rack/show_exceptions.rb +10 -4
  36. data/lib/rack/show_status.rb +0 -2
  37. data/lib/rack/static.rb +9 -4
  38. data/lib/rack/urlmap.rb +1 -1
  39. data/lib/rack/utils.rb +205 -133
  40. data/lib/rack/version.rb +3 -20
  41. data/lib/rack.rb +11 -17
  42. metadata +6 -15
  43. data/lib/rack/auth/digest/md5.rb +0 -1
  44. data/lib/rack/auth/digest/nonce.rb +0 -1
  45. data/lib/rack/auth/digest/params.rb +0 -1
  46. data/lib/rack/auth/digest/request.rb +0 -1
  47. data/lib/rack/auth/digest.rb +0 -256
  48. data/lib/rack/chunked.rb +0 -120
  49. data/lib/rack/file.rb +0 -9
  50. data/lib/rack/logger.rb +0 -22
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: c02c25dfc02deefcbf95de53b538f14db0fa0a4c06d73755ce68062959cfd74f
4
- data.tar.gz: e333965aa9cc102988178745dea18821e05b19f49a0d0fc7d5b7fc266f40d20e
3
+ metadata.gz: 0b014fbf1db40db15c30606f5c150bdbdb15f55c5ff15f74474e9aa690c750c7
4
+ data.tar.gz: d2b99b05d8bcc088ba88373dce20615e7f6bd027f19e718fb6bd2f92518ba80f
5
5
  SHA512:
6
- metadata.gz: f99ef35191516b033f16271abae7a3b5acce3d774c761c41ce0d1f29aa10b4e3e4c530a2495a7ad5bfed10073f19a7c87cec7b526bc33c57e2ff8623e528ea24
7
- data.tar.gz: e498a5646da200b21ce1ce48893f5c59de580bddf1f33f8c85c3a344afb6ae37979259564b38bce50f6d699fcd574b8bcd08eb4e277d0926bcfcfc6762886909
6
+ metadata.gz: ab6284c2a463d710f7fcd32366220f8ba61c188810b726846108ad742af5b99ce6430ad880571debac3fb7539e2cb701da74eed468a2393f3398c7d06d0fcd89
7
+ data.tar.gz: cb55817f309d78e138365a755ecbcf2f5fd32a285b702f1a69e356e53685b841914d7e8ee9467b1daf7a58c0d90bac9b3066f25fce2af3501161c6d88a5d99c1
data/CHANGELOG.md CHANGED
@@ -2,8 +2,455 @@
2
2
 
3
3
  All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
4
4
 
5
+ ## [3.2.7] - 2026-08-13
6
+
7
+ ### Fixed
8
+
9
+ - Restore Ruby 2.4/2.5 compatibility.
10
+
11
+ ## [3.2.6] - 2026-04-01
12
+
13
+ ### Security
14
+
15
+ - [CVE-2026-34763](https://github.com/advisories/GHSA-7mqq-6cf9-v2qp) Root directory disclosure via unescaped regex interpolation in `Rack::Directory`.
16
+ - [CVE-2026-34230](https://github.com/advisories/GHSA-v569-hp3g-36wr) Avoid O(n^2) algorithm in `Rack::Utils.select_best_encoding` which could lead to denial of service.
17
+ - [CVE-2026-32762](https://github.com/advisories/GHSA-qfgr-crr9-7r49) Forwarded header semicolon injection enables Host and Scheme spoofing.
18
+ - [CVE-2026-26961](https://github.com/advisories/GHSA-vgpv-f759-9wx3) Raise error for multipart requests with multiple boundary parameters.
19
+ - [CVE-2026-34786](https://github.com/advisories/GHSA-q4qf-9j86-f5mh) `Rack::Static` `header_rules` bypass via URL-encoded path mismatch.
20
+ - [CVE-2026-34831](https://github.com/advisories/GHSA-q2ww-5357-x388) `Content-Length` mismatch in `Rack::Files` error responses.
21
+ - [CVE-2026-34826](https://github.com/advisories/GHSA-x8cg-fq8g-mxfx) Multipart byte range processing allows denial of service via excessive overlapping ranges.
22
+ - [CVE-2026-34835](https://github.com/advisories/GHSA-g2pf-xv49-m2h5) `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass.
23
+ - [CVE-2026-34830](https://github.com/advisories/GHSA-qv7j-4883-hwh7) `Rack::Sendfile` header-based `X-Accel-Mapping` regex injection enables unauthorized `X-Accel-Redirect`.
24
+ - [CVE-2026-34785](https://github.com/advisories/GHSA-h2jq-g4cq-5ppq) `Rack::Static` prefix matching can expose unintended files under the static root.
25
+ - [CVE-2026-34829](https://github.com/advisories/GHSA-8vqr-qjwx-82mw) Multipart parsing without `Content-Length` header allows unbounded chunked file uploads.
26
+ - [CVE-2026-34827](https://github.com/advisories/GHSA-v6x5-cg8r-vv6x) Multipart header parsing allows denial of service via escape-heavy quoted parameters.
27
+ - [CVE-2026-26962](https://github.com/advisories/GHSA-rx22-g9mx-qrhv) Improper unfolding of folded multipart headers preserves CRLF in parsed parameter values.
28
+
29
+ ## [3.2.5] - 2026-02-16
30
+
31
+ ### Security
32
+
33
+ - [CVE-2026-25500](https://github.com/advisories/GHSA-whrj-4476-wvmp) XSS injection via malicious filename in `Rack::Directory`.
34
+ - [CVE-2026-22860](https://github.com/advisories/GHSA-mxw3-3hh2-x2mh) Directory traversal via root prefix bypass in `Rack::Directory`.
35
+
36
+ ### Fixed
37
+
38
+ - Fix `Rack::MockResponse#body` when the body is a Proc. ([#2420](https://github.com/rack/rack/pull/2420), [#2423](https://github.com/rack/rack/pull/2423), [@tavianator](https://github.com/tavianator), [@ioquatix])
39
+
40
+ ## [3.2.4] - 2025-11-03
41
+
42
+ ### Fixed
43
+
44
+ - Multipart parser: limit MIME header size check to the unread buffer region to avoid false `multipart mime part header too large` errors when previously read data accumulates in the scan buffer. ([#2392](https://github.com/rack/rack/pull/2392), [@alpaca-tc](https://github.com/alpaca-tc), [@willnet](https://github.com/willnet), [@krororo](https://github.com/krororo))
45
+
46
+ ## [3.2.3] - 2025-10-10
47
+
48
+ ### Security
49
+
50
+ - [CVE-2025-61780](https://github.com/advisories/GHSA-r657-rxjc-j557) Improper handling of headers in `Rack::Sendfile` may allow proxy bypass.
51
+ - [CVE-2025-61919](https://github.com/advisories/GHSA-6xw4-3v39-52mm) Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion.
52
+
53
+ ## [3.2.2] - 2025-10-07
54
+
55
+ ### Security
56
+
57
+ - [CVE-2025-61772](https://github.com/advisories/GHSA-wpv5-97wm-hp9c) Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
58
+ - [CVE-2025-61771](https://github.com/advisories/GHSA-w9pc-fmgc-vxvw) Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
59
+ - [CVE-2025-61770](https://github.com/advisories/GHSA-p543-xpfm-54cp) Unbounded multipart preamble buffering enables DoS (memory exhaustion)
60
+
61
+ ## [3.2.1] -- 2025-09-02
62
+
63
+ ### Added
64
+
65
+ - Add support for streaming bodies when using `Rack::Events`. ([#2375](github.com/rack/rack/pull/2375), [@unflxw](https://github.com/unflxw))
66
+
67
+ ### Fixed
68
+
69
+ - Fix an issue where a `NoMethodError` would be raised when using `Rack::Events` with streaming bodies. ([#2375](github.com/rack/rack/pull/2375), [@unflxw](https://github.com/unflxw))
70
+
71
+ ## [3.2.0] - 2025-07-31
72
+
73
+ This release continues Rack's evolution toward a cleaner, more efficient foundation while maintaining backward compatibility for most applications. The breaking changes primarily affect deprecated functionality, so most users should experience a smooth upgrade with improved performance and standards compliance.
74
+
75
+ ### SPEC Changes
76
+
77
+ - Request environment keys must now be strings. ([#2310](https://github.com/rack/rack/issues/2310), [@jeremyevans])
78
+ - Add `nil` as a valid return from a Response `body.to_path` ([#2318](https://github.com/rack/rack/pull/2318), [@MSP-Greg])
79
+ - `Rack::Lint#check_header_value` is relaxed, only disallowing CR/LF/NUL characters. ([#2354](https://github.com/rack/rack/pull/2354), [@ioquatix])
80
+
81
+ ### Added
82
+
83
+ - Introduce `Rack::VERSION` constant. ([#2199](https://github.com/rack/rack/pull/2199), [@ioquatix])
84
+ - `ISO-2022-JP` encoded parts within MIME Multipart sections of an HTTP request body will now be converted to `UTF-8`. ([#2245](https://github.com/rack/rack/pull/2245), [@nappa](https://github.com/nappa))
85
+ - Add `Rack::Request#query_parser=` to allow setting the query parser to use. ([#2349](https://github.com/rack/rack/pull/2349), [@jeremyevans])
86
+ - Add `Rack::Request#form_pairs` to access form data as raw key-value pairs, preserving duplicate keys. ([#2351](https://github.com/rack/rack/pull/2351), [@matthewd])
87
+
88
+ ### Changed
89
+
90
+ - Invalid cookie keys will now raise an error. ([#2193](https://github.com/rack/rack/pull/2193), [@ioquatix])
91
+ - `Rack::MediaType#params` now handles empty strings. ([#2229](https://github.com/rack/rack/pull/2229), [@jeremyevans])
92
+ - Avoid unnecessary calls to the `ip_filter` lambda to evaluate `Request#ip` ([#2287](https://github.com/rack/rack/pull/2287), [@willbryant])
93
+ - Only calculate `Request#ip` once per request ([#2292](https://github.com/rack/rack/pull/2292), [@willbryant])
94
+ - `Rack::Builder` `#use`, `#map`, and `#run` methods now return `nil`. ([#2355](https://github.com/rack/rack/pull/2355), [@ioquatix])
95
+ - Directly close the body in `Rack::ConditionalGet` when the response is `304 Not Modified`. ([#2353](https://github.com/rack/rack/pull/2353), [@ioquatix])
96
+ - Directly close the body in `Rack::Head` when the request method is `HEAD`([#2360](https://github.com/rack/rack/pull/2360), [@skipkayhil](https://github.com/skipkayhil))
97
+
98
+ ### Deprecated
99
+
100
+ - `Rack::Auth::AbstractRequest#request` is deprecated without replacement. ([#2229](https://github.com/rack/rack/pull/2229), [@jeremyevans])
101
+ - `Rack::Request#parse_multipart` (private method designed to be overridden in subclasses) is deprecated without replacement. ([#2229](https://github.com/rack/rack/pull/2229), [@jeremyevans])
102
+
103
+ ### Removed
104
+
105
+ - `Rack::Request#values_at` is removed. ([#2200](https://github.com/rack/rack/pull/2200), [@ioquatix])
106
+ - `Rack::Logger` is removed with no replacement. ([#2196](https://github.com/rack/rack/pull/2196), [@ioquatix])
107
+ - Automatic cache invalidation in `Rack::Request#{GET,POST}` has been removed. ([#2230](https://github.com/rack/rack/pull/2230), [@jeremyevans])
108
+ - Support for `CGI::Cookie` has been removed. ([#2332](https://github.com/rack/rack/pull/2332), [@ioquatix])
109
+
110
+ ### Fixed
111
+
112
+ - `Rack::RewindableInput::Middleware` no longer wraps a nil input. ([#2259](https://github.com/rack/rack/pull/2259), [@tt](https://github.com/tt))
113
+ - Fix `NoMethodError` in `Rack::Request#wrap_ipv6` when `x-forwarded-host` is empty. ([#2270](https://github.com/rack/rack/pull/2270), [@oieioi](https://github.com/oieioi))
114
+ - Fix the specification for `SERVER_PORT` which was incorrectly documented as required to be an `Integer` if present - it must be a `String` containing digits only. ([#2296](https://github.com/rack/rack/pull/2296), [@ioquatix])
115
+ - `SERVER_NAME` and `HTTP_HOST` are now more strictly validated according to the relevant specifications. ([#2298](https://github.com/rack/rack/pull/2298), [@ioquatix])
116
+ - `Rack::Lint` now disallows `PATH_INFO="" SCRIPT_NAME=""`. ([#2298](https://github.com/rack/rack/issues/2307), [@jeremyevans])
117
+
118
+ ## [3.1.22] - 2026-08-13
119
+
120
+ ### Security
121
+
122
+ - [CVE-2026-26962](https://github.com/advisories/GHSA-rx22-g9mx-qrhv) Improper unfolding of folded multipart headers preserves CRLF in parsed parameter values.
123
+
124
+ ### Fixed
125
+
126
+ - Restore Ruby 2.4/2.5 compatibility.
127
+
128
+ ## [3.1.21] - 2026-04-01
129
+
130
+ ### Security
131
+
132
+ - [CVE-2026-34763](https://github.com/advisories/GHSA-7mqq-6cf9-v2qp) Root directory disclosure via unescaped regex interpolation in `Rack::Directory`.
133
+ - [CVE-2026-34230](https://github.com/advisories/GHSA-v569-hp3g-36wr) Avoid O(n^2) algorithm in `Rack::Utils.select_best_encoding` which could lead to denial of service.
134
+ - [CVE-2026-32762](https://github.com/advisories/GHSA-qfgr-crr9-7r49) Forwarded header semicolon injection enables Host and Scheme spoofing.
135
+ - [CVE-2026-26961](https://github.com/advisories/GHSA-vgpv-f759-9wx3) Raise error for multipart requests with multiple boundary parameters.
136
+ - [CVE-2026-34786](https://github.com/advisories/GHSA-q4qf-9j86-f5mh) `Rack::Static` `header_rules` bypass via URL-encoded path mismatch.
137
+ - [CVE-2026-34831](https://github.com/advisories/GHSA-q2ww-5357-x388) `Content-Length` mismatch in `Rack::Files` error responses.
138
+ - [CVE-2026-34826](https://github.com/advisories/GHSA-x8cg-fq8g-mxfx) Multipart byte range processing allows denial of service via excessive overlapping ranges.
139
+ - [CVE-2026-34835](https://github.com/advisories/GHSA-g2pf-xv49-m2h5) `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass.
140
+ - [CVE-2026-34830](https://github.com/advisories/GHSA-qv7j-4883-hwh7) `Rack::Sendfile` header-based `X-Accel-Mapping` regex injection enables unauthorized `X-Accel-Redirect`.
141
+ - [CVE-2026-34785](https://github.com/advisories/GHSA-h2jq-g4cq-5ppq) `Rack::Static` prefix matching can expose unintended files under the static root.
142
+ - [CVE-2026-34829](https://github.com/advisories/GHSA-8vqr-qjwx-82mw) Multipart parsing without `Content-Length` header allows unbounded chunked file uploads.
143
+ - [CVE-2026-34827](https://github.com/advisories/GHSA-v6x5-cg8r-vv6x) Multipart header parsing allows denial of service via escape-heavy quoted parameters.
144
+
145
+ ## [3.1.20] - 2026-02-16
146
+
147
+ ### Security
148
+
149
+ - [CVE-2026-25500](https://github.com/advisories/GHSA-whrj-4476-wvmp) XSS injection via malicious filename in `Rack::Directory`.
150
+ - [CVE-2026-22860](https://github.com/advisories/GHSA-mxw3-3hh2-x2mh) Directory traversal via root prefix bypass in `Rack::Directory`.
151
+
152
+ ## [3.1.19] - 2025-11-03
153
+
154
+ ### Fixed
155
+
156
+ - Multipart parser: limit MIME header size check to the unread buffer region to avoid false `multipart mime part header too large` errors when previously read data accumulates in the scan buffer. ([#2392](https://github.com/rack/rack/pull/2392), [@alpaca-tc](https://github.com/alpaca-tc), [@willnet](https://github.com/willnet), [@krororo](https://github.com/krororo))
157
+
158
+ ## [3.1.18] - 2025-10-10
159
+
160
+ ### Security
161
+
162
+ - [CVE-2025-61780](https://github.com/advisories/GHSA-r657-rxjc-j557) Improper handling of headers in `Rack::Sendfile` may allow proxy bypass.
163
+ - [CVE-2025-61919](https://github.com/advisories/GHSA-6xw4-3v39-52mm) Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion.
164
+
165
+ ## [3.1.17] - 2025-10-07
166
+
167
+ ### Security
168
+
169
+ - [CVE-2025-61772](https://github.com/advisories/GHSA-wpv5-97wm-hp9c) Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
170
+ - [CVE-2025-61771](https://github.com/advisories/GHSA-w9pc-fmgc-vxvw) Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
171
+ - [CVE-2025-61770](https://github.com/advisories/GHSA-p543-xpfm-54cp) Unbounded multipart preamble buffering enables DoS (memory exhaustion)
172
+
173
+ ## [3.1.16] - 2025-06-04
174
+
175
+ ### Security
176
+
177
+ - [CVE-2025-49007](https://github.com/advisories/GHSA-47m2-26rw-j2jw) Fix ReDoS in multipart request.
178
+
179
+ ## [3.1.15] - 2025-05-18
180
+
181
+ - Optional support for `CGI::Cookie` if not available. ([#2327](https://github.com/rack/rack/pull/2327), [#2333](https://github.com/rack/rack/pull/2333), [@earlopain])
182
+
183
+ ## [3.1.14] - 2025-05-06
184
+
185
+ :warning: **This release includes a security fix that may cause certain routes in previously working applications to fail if query parameters exceed 4,096 in count or 4 MB in total size. See <https://github.com/rack/rack/discussions/2356> for more details.**
186
+
187
+ ### Security
188
+
189
+ - [CVE-2025-46727](https://github.com/advisories/GHSA-gjh7-p2fx-99vx) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion.
190
+
191
+ ## [3.1.13] - 2025-04-13
192
+
193
+ - Ensure `Rack::ETag` correctly updates response body. ([#2324](https://github.com/rack/rack/pull/2324), [@ioquatix])
194
+
195
+ ## [3.1.12] - 2025-03-11
196
+
197
+ ### Security
198
+
199
+ - [CVE-2025-27610](https://github.com/advisories/GHSA-7wqh-767x-r66v) Local file inclusion in `Rack::Static`.
200
+
201
+ ## [3.1.11] - 2025-03-04
202
+
203
+ ### Security
204
+
205
+ - [CVE-2025-27111](https://github.com/advisories/GHSA-8cgq-6mh2-7j6v) Possible Log Injection in `Rack::Sendfile`.
206
+
207
+ ## [3.1.10] - 2025-02-12
208
+
209
+ ### Security
210
+
211
+ - [CVE-2025-25184](https://github.com/advisories/GHSA-7g2v-jj9q-g3rg) Possible Log Injection in `Rack::CommonLogger`.
212
+
213
+ ## [3.1.9] - 2025-01-31
214
+
215
+ ### Fixed
216
+
217
+ - `Rack::MediaType#params` now handles parameters without values. ([#2263](https://github.com/rack/rack/pull/2263), [@AllyMarthaJ](https://github.com/AllyMarthaJ))
218
+
219
+ ## [3.1.8] - 2024-10-14
220
+
221
+ ### Fixed
222
+
223
+ - Resolve deprecation warnings about uri `DEFAULT_PARSER`. ([#2249](https://github.com/rack/rack/pull/2249), [@earlopain])
224
+
225
+ ## [3.1.7] - 2024-07-11
226
+
227
+ ### Fixed
228
+
229
+ - Do not remove escaped opening/closing quotes for content-disposition filenames. ([#2229](https://github.com/rack/rack/pull/2229), [@jeremyevans])
230
+ - Fix encoding setting for non-binary IO-like objects in MockRequest#env_for. ([#2227](https://github.com/rack/rack/pull/2227), [@jeremyevans])
231
+ - `Rack::Response` should not generate invalid `content-length` header. ([#2219](https://github.com/rack/rack/pull/2219), [@ioquatix])
232
+ - Allow empty PATH_INFO. ([#2214](https://github.com/rack/rack/pull/2214), [@ioquatix])
233
+
234
+ ## [3.1.6] - 2024-07-03
235
+
236
+ ### Fixed
237
+
238
+ - Fix several edge cases in `Rack::Request#parse_http_accept_header`'s implementation. ([#2226](https://github.com/rack/rack/pull/2226), [@ioquatix])
239
+
240
+ ## [3.1.5] - 2024-07-02
241
+
242
+ ### Security
243
+
244
+ - Fix potential ReDoS attack in `Rack::Request#parse_http_accept_header`. ([GHSA-cj83-2ww7-mvq7](https://github.com/advisories/GHSA-cj83-2ww7-mvq7), [@dwisiswant0](https://github.com/dwisiswant0))
245
+
246
+ ## [3.1.4] - 2024-06-22
247
+
248
+ ### Fixed
249
+
250
+ - Fix `Rack::Lint` matching some paths incorrectly as authority form. ([#2220](https://github.com/rack/rack/pull/2220), [@ioquatix])
251
+
252
+ ## [3.1.3] - 2024-06-12
253
+
254
+ ### Fixed
255
+
256
+ - Fix passing non-strings to `Rack::Utils.escape_html`. ([#2202](https://github.com/rack/rack/pull/2202), [@earlopain])
257
+ - `Rack::MockResponse` gracefully handles empty cookies ([#2203](https://github.com/rack/rack/pull/2203) [@wynksaiddestroy])
258
+
259
+ ## [3.1.2] - 2024-06-11
260
+
261
+ - `Rack::Response` will take in to consideration chunked encoding responses ([#2204](https://github.com/rack/rack/pull/2204), [@tenderlove])
262
+
263
+ ## [3.1.1] - 2024-06-11
264
+
265
+ - Oops! I shouldn't have shipped that
266
+
267
+ ## [3.1.0] - 2024-06-11
268
+
269
+ :warning: **This release includes several breaking changes.** Refer to the **Removed** section below for the list of deprecated methods that have been removed in this release.
270
+
271
+ This release is primarily a maintenance release that removes features deprecated in Rack v3.0. Alongside these removals, there are several improvements to the Rack SPEC, mainly focused on enhancing input and output handling. These changes aim to make Rack more efficient and align better with the requirements of server implementations and relevant HTTP specifications.
272
+
273
+ ### SPEC Changes
274
+
275
+ - `rack.input` is now optional. ([#1997](https://github.com/rack/rack/pull/1997), [#2018](https://github.com/rack/rack/pull/2018), [@ioquatix])
276
+ - `PATH_INFO` is now validated according to the HTTP/1.1 specification. ([#2117](https://github.com/rack/rack/pull/2117), [#2181](https://github.com/rack/rack/pull/2181), [@ioquatix])
277
+ - `OPTIONS *` is now accepted. ([#2114](https://github.com/rack/rack/pull/2114), [@doriantaylor](https://github.com/doriantaylor))
278
+ - Introduce optional `rack.protocol` request and response header for handling connection upgrades. ([#1954](https://github.com/rack/rack/pull/1954), [@ioquatix])
279
+
280
+ ### Added
281
+
282
+ - Introduce `Rack::Multipart::MissingInputError` for improved handling of missing input in `#parse_multipart`. ([#2018](https://github.com/rack/rack/pull/2018), [@ioquatix])
283
+ - Introduce `module Rack::BadRequest` which is included in multipart and query parser errors. ([#2019](https://github.com/rack/rack/pull/2019), [@ioquatix])
284
+ - Add `.mjs` MIME type ([#2057](https://github.com/rack/rack/pull/2057), [@axilleas](https://github.com/axilleas))
285
+ - `set_cookie_header` utility now supports the `partitioned` cookie attribute. This is required by Chrome in some embedded contexts. ([#2131](https://github.com/rack/rack/pull/2131), [@flavio-b](https://github.com/flavio-b))
286
+ - Introduce `rack.early_hints` for sending `103 Early Hints` informational responses. ([#1831](https://github.com/rack/rack/pull/1831), [@casperisfine](https://github.com/casperisfine), [@jeremyevans])
287
+
288
+ ### Changed
289
+
290
+ - MIME type for JavaScript files (`.js`) changed from `application/javascript` to `text/javascript` ([`1bd0f15`](https://github.com/rack/rack/commit/1bd0f1597d8f4a90d47115f3e156a8ce7870c9c8), [@ioquatix])
291
+ - Update MIME types associated to `.ttf`, `.woff`, `.woff2` and `.otf` extensions to use mondern `font/*` types. ([#2065](https://github.com/rack/rack/pull/2065), [@davidstosik])
292
+ - `Rack::Utils.escape_html` is now delegated to `CGI.escapeHTML`. `'` is escaped to `#39;` instead of `#x27;`. (decimal vs hexadecimal) ([#2099](https://github.com/rack/rack/pull/2099), [@JunichiIto](https://github.com/JunichiIto))
293
+ - Clarify use of `@buffered` and only update `content-length` when `Rack::Response#finish` is invoked. ([#2149](https://github.com/rack/rack/pull/2149), [@ioquatix])
294
+
295
+ ### Deprecated
296
+
297
+ - Deprecate automatic cache invalidation in `Request#{GET,POST}` ([#2073](https://github.com/rack/rack/pull/2073), [@jeremyevans])
298
+ - Only cookie keys that are not valid according to the HTTP specifications are escaped. We are planning to deprecate this behaviour, so now a deprecation message will be emitted in this case. In the future, invalid cookie keys may not be accepted. ([#2191](https://github.com/rack/rack/pull/2191), [@ioquatix])
299
+ - `Rack::Logger` is deprecated. ([#2197](https://github.com/rack/rack/pull/2197), [@ioquatix])
300
+ - Add fallback lookup and deprecation warning for obsolete status symbols. ([#2137](https://github.com/rack/rack/pull/2137), [@wtn](https://github.com/wtn))
301
+ - Deprecate `Rack::Request#values_at`, use `request.params.values_at` instead ([#2183](https://github.com/rack/rack/pull/2183), [@ioquatix])
302
+
303
+ ### Removed
304
+
305
+ - Remove deprecated `Rack::Auth::Digest` with no replacement. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
306
+ - Remove deprecated `Rack::Cascade::NotFound` with no replacement. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
307
+ - Remove deprecated `Rack::Chunked` with no replacement. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
308
+ - Remove deprecated `Rack::File`, use `Rack::Files` instead. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
309
+ - Remove deprecated `Rack::QueryParser` `key_space_limit` parameter with no replacement. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
310
+ - Remove deprecated `Rack::Response#header`, use `Rack::Response#headers` instead. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
311
+ - Remove deprecated cookie methods from `Rack::Utils`: `add_cookie_to_header`, `make_delete_cookie_header`, `add_remove_cookie_to_header`. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
312
+ - Remove deprecated `Rack::Utils::HeaderHash`. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
313
+ - Remove deprecated `Rack::VERSION`, `Rack::VERSION_STRING`, `Rack.version`, use `Rack.release` instead. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
314
+ - Remove non-standard status codes 306, 509, & 510 and update descriptions for 413, 422, & 451. ([#2137](https://github.com/rack/rack/pull/2137), [@wtn](https://github.com/wtn))
315
+ - Remove any dependency on `transfer-encoding: chunked`. ([#2195](https://github.com/rack/rack/pull/2195), [@ioquatix])
316
+ - Remove deprecated `Rack::Request#[]`, use `request.params[key]` instead ([#2183](https://github.com/rack/rack/pull/2183), [@ioquatix])
317
+
318
+ ### Fixed
319
+
320
+ - In `Rack::Files`, ignore the `Range` header if served file is 0 bytes. ([#2159](https://github.com/rack/rack/pull/2159), [@zarqman])
321
+
322
+ ## [3.0.18] - 2025-05-22
323
+
324
+ - Fix incorrect backport of optional `CGI::Cookie` support. ([#2335](https://github.com/rack/rack/pull/2335), [@jeremyevans])
325
+
326
+ ## [3.0.17] - 2025-05-18
327
+
328
+ - Optional support for `CGI::Cookie` if not available. ([#2327](https://github.com/rack/rack/pull/2327), [#2333](https://github.com/rack/rack/pull/2333), [@earlopain])
329
+
330
+ ## [3.0.16] - 2025-05-06
331
+
332
+ :warning: **This release includes a security fix that may cause certain routes in previously working applications to fail if query parameters exceed 4,096 in count or 4 MB in total size. See <https://github.com/rack/rack/discussions/2356> for more details.**
333
+
334
+ ### Security
335
+
336
+ - [CVE-2025-46727](https://github.com/advisories/GHSA-gjh7-p2fx-99vx) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion.
337
+
338
+ ## [3.0.15] - 2025-04-13
339
+
340
+ - Ensure `Rack::ETag` correctly updates response body. ([#2324](https://github.com/rack/rack/pull/2324), [@ioquatix])
341
+
342
+ ## [3.0.14] - 2025-03-11
343
+
344
+ ### Security
345
+
346
+ - [CVE-2025-27610](https://github.com/advisories/GHSA-7wqh-767x-r66v) Local file inclusion in `Rack::Static`.
347
+
348
+ ## [3.0.13] - 2025-03-04
349
+
350
+ ### Security
351
+
352
+ - [CVE-2025-27111](https://github.com/advisories/GHSA-8cgq-6mh2-7j6v) Possible Log Injection in `Rack::Sendfile`.
353
+
354
+ ### Fixed
355
+
356
+ - Remove autoloads for constants no longer shipped with Rack. ([#2269](https://github.com/rack/rack/pull/2269), [@ccutrer](https://github.com/ccutrer))
357
+
358
+ ## [3.0.12] - 2025-02-12
359
+
360
+ ### Security
361
+
362
+ - [CVE-2025-25184](https://github.com/advisories/GHSA-7g2v-jj9q-g3rg) Possible Log Injection in `Rack::CommonLogger`.
363
+
364
+ ## [3.0.11] - 2024-05-10
365
+
366
+ - Backport #2062 to 3-0-stable: Do not allow `BodyProxy` to respond to `to_str`, make `to_ary` call close . ([#2062](https://github.com/rack/rack/pull/2062), [@jeremyevans](https://github.com/jeremyevans))
367
+
368
+ ## [3.0.10] - 2024-03-21
369
+
370
+ - Backport #2104 to 3-0-stable: Return empty when parsing a multi-part POST with only one end delimiter. ([#2164](https://github.com/rack/rack/pull/2164), [@JoeDupuis](https://github.com/JoeDupuis))
371
+
372
+ ## [3.0.9.1] - 2024-02-21
373
+
374
+ ### Security
375
+
376
+ * [CVE-2024-26146] Fixed ReDoS in Accept header parsing
377
+ * [CVE-2024-25126] Fixed ReDoS in Content Type header parsing
378
+ * [CVE-2024-26141] Reject Range headers which are too large
379
+
380
+ [CVE-2024-26146]: https://github.com/advisories/GHSA-54rr-7fvw-6x8f
381
+ [CVE-2024-25126]: https://github.com/advisories/GHSA-22f2-v57c-j9cx
382
+ [CVE-2024-26141]: https://github.com/advisories/GHSA-xj5v-6v4g-jfw6
383
+
384
+ ## [3.0.9] - 2024-01-31
385
+
386
+ - Fix incorrect content-length header that was emitted when `Rack::Response#write` was used in some situations. ([#2150](https://github.com/rack/rack/pull/2150), [@mattbrictson](https://github.com/mattbrictson))
387
+
388
+ ## [3.0.8] - 2023-06-14
389
+
390
+ - Fix some unused variable verbose warnings. ([#2084](https://github.com/rack/rack/pull/2084), [@jeremyevans], [@skipkayhil](https://github.com/skipkayhil))
391
+
392
+ ## [3.0.7] - 2023-03-16
393
+
394
+ - Make query parameters without `=` have `nil` values. ([#2059](https://github.com/rack/rack/pull/2059), [@jeremyevans])
395
+
396
+ ## [3.0.6.1] - 2023-03-13
397
+
398
+ ### Security
399
+
400
+ - [CVE-2023-27539] Avoid ReDoS in header parsing
401
+
402
+ ## [3.0.6] - 2023-03-13
403
+
404
+ - Add `QueryParser#missing_value` for handling missing values + tests. ([#2052](https://github.com/rack/rack/pull/2052), [@ioquatix])
405
+
406
+ ## [3.0.5] - 2023-03-13
407
+
408
+ - Split form/query parsing into two steps. ([#2038](https://github.com/rack/rack/pull/2038), [@matthewd](https://github.com/matthewd))
409
+
410
+ ## [3.0.4.2] - 2023-03-02
411
+
412
+ ### Security
413
+
414
+ - [CVE-2023-27530] Introduce multipart_total_part_limit to limit total parts
415
+
416
+ ## [3.0.4.1] - 2023-01-17
417
+
418
+ ### Security
419
+
420
+ - [CVE-2022-44571] Fix ReDoS vulnerability in multipart parser
421
+ - [CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges
422
+ - [CVE-2022-44572] Forbid control characters in attributes (also ReDoS)
423
+
424
+ ## [3.0.4] - 2023-01-17
425
+
426
+ - `Rack::Request#POST` should consistently raise errors. Cache errors that occur when invoking `Rack::Request#POST` so they can be raised again later. ([#2010](https://github.com/rack/rack/pull/2010), [@ioquatix])
427
+ - Fix `Rack::Lint` error message for `HTTP_CONTENT_TYPE` and `HTTP_CONTENT_LENGTH`. ([#2007](https://github.com/rack/rack/pull/2007), [@byroot](https://github.com/byroot))
428
+ - Extend `Rack::MethodOverride` to handle `QueryParser::ParamsTooDeepError` error. ([#2006](https://github.com/rack/rack/pull/2006), [@byroot](https://github.com/byroot))
429
+
430
+ ## [3.0.3] - 2022-12-27
431
+
432
+ ### Fixed
433
+
434
+ - `Rack::URLMap` uses non-deprecated form of `Regexp.new`. ([#1998](https://github.com/rack/rack/pull/1998), [@weizheheng](https://github.com/weizheheng))
435
+
436
+ ## [3.0.2] - 2022-12-05
437
+
438
+ ### Fixed
439
+
440
+ - `Utils.build_nested_query` URL-encodes nested field names including the square brackets.
441
+ - Allow `Rack::Response` to pass through streaming bodies. ([#1993](https://github.com/rack/rack/pull/1993), [@ioquatix])
442
+
443
+ ## [3.0.1] - 2022-11-18
444
+
445
+ ### Fixed
446
+
447
+ - `MethodOverride` does not look for an override if a request does not include form/parseable data.
448
+ - `Rack::Lint::Wrapper` correctly handles `respond_to?` with `to_ary`, `each`, `call` and `to_path`, forwarding to the body. ([#1981](https://github.com/rack/rack/pull/1981), [@ioquatix])
449
+
5
450
  ## [3.0.0] - 2022-09-06
6
451
 
452
+ This release introduces major improvements to Rack, including enhanced support for streaming responses, expanded protocol handling, and stricter compliance with HTTP standards. It refines middleware interfaces, improves multipart and hijack handling, and strengthens security and error reporting. The update also brings performance optimizations, better compatibility with modern Ruby versions, and numerous bug fixes, making Rack more robust and flexible for web application development.
453
+
7
454
  - No changes
8
455
 
9
456
  ## [3.0.0.rc1] - 2022-09-04
@@ -34,7 +481,7 @@ All notable changes to this project will be documented in this file. For info on
34
481
  - `SERVER_PROTOCOL` is now a required environment key, matching the HTTP protocol used in the request.
35
482
  - `rack.hijack?` (partial hijack) and `rack.hijack` (full hijack) are now independently optional.
36
483
  - `rack.hijack_io` has been removed completely.
37
- - `rack.response_finished` is an optional environment key which contains an array of callable objects that must accept `#call(env, status, headers, error)` and are invoked after the response is finished (either successfully or unsucessfully).
484
+ - `rack.response_finished` is an optional environment key which contains an array of callable objects that must accept `#call(env, status, headers, error)` and are invoked after the response is finished (either successfully or unsuccessfully).
38
485
  - It is okay to call `#close` on `rack.input` to indicate that you no longer need or care about the input.
39
486
  - The stream argument supplied to the streaming body and hijack must support `#<<` for writing output.
40
487
 
@@ -92,6 +539,144 @@ All notable changes to this project will be documented in this file. For info on
92
539
  - Fix multipart filename generation for filenames that contain spaces. Encode spaces as "%20" instead of "+" which will be decoded properly by the multipart parser. ([#1736](https://github.com/rack/rack/pull/1645), [@muirdm](https://github.com/muirdm))
93
540
  - `Rack::Request#scheme` returns `ws` or `wss` when one of the `X-Forwarded-Scheme` / `X-Forwarded-Proto` headers is set to `ws` or `wss`, respectively. ([#1730](https://github.com/rack/rack/issues/1730), [@erwanst](https://github.com/erwanst))
94
541
 
542
+ ## [2.2.24] - 2026-08-13
543
+
544
+ ### Security
545
+
546
+ - [CVE-2026-26962](https://github.com/advisories/GHSA-rx22-g9mx-qrhv) Improper unfolding of folded multipart headers preserves CRLF in parsed parameter values.
547
+
548
+ ## [2.2.23] - 2026-04-01
549
+
550
+ ### Security
551
+
552
+ - [CVE-2026-34763](https://github.com/advisories/GHSA-7mqq-6cf9-v2qp) Root directory disclosure via unescaped regex interpolation in `Rack::Directory`.
553
+ - [CVE-2026-34230](https://github.com/advisories/GHSA-v569-hp3g-36wr) Avoid O(n^2) algorithm in `Rack::Utils.select_best_encoding` which could lead to denial of service.
554
+ - [CVE-2026-26961](https://github.com/advisories/GHSA-vgpv-f759-9wx3) Raise error for multipart requests with multiple boundary parameters.
555
+ - [CVE-2026-34786](https://github.com/advisories/GHSA-q4qf-9j86-f5mh) `Rack::Static` `header_rules` bypass via URL-encoded path mismatch.
556
+ - [CVE-2026-34831](https://github.com/advisories/GHSA-q2ww-5357-x388) `Content-Length` mismatch in `Rack::Files` error responses.
557
+ - [CVE-2026-34826](https://github.com/advisories/GHSA-x8cg-fq8g-mxfx) Multipart byte range processing allows denial of service via excessive overlapping ranges.
558
+ - [CVE-2026-34830](https://github.com/advisories/GHSA-qv7j-4883-hwh7) `Rack::Sendfile` header-based `X-Accel-Mapping` regex injection enables unauthorized `X-Accel-Redirect`.
559
+ - [CVE-2026-34785](https://github.com/advisories/GHSA-h2jq-g4cq-5ppq) `Rack::Static` prefix matching can expose unintended files under the static root.
560
+ - [CVE-2026-34829](https://github.com/advisories/GHSA-8vqr-qjwx-82mw) Multipart parsing without `Content-Length` header allows unbounded chunked file uploads.
561
+
562
+ ## [2.2.22] - 2026-02-16
563
+
564
+ ### Security
565
+
566
+ - [CVE-2026-25500](https://github.com/advisories/GHSA-whrj-4476-wvmp) XSS injection via malicious filename in `Rack::Directory`.
567
+ - [CVE-2026-22860](https://github.com/advisories/GHSA-mxw3-3hh2-x2mh) Directory traversal via root prefix bypass in `Rack::Directory`.
568
+
569
+ ## [2.2.21] - 2025-11-03
570
+
571
+ ### Fixed
572
+
573
+ - Multipart parser: limit MIME header size check to the unread buffer region to avoid false `multipart mime part header too large` errors when previously read data accumulates in the scan buffer. ([#2392](https://github.com/rack/rack/pull/2392), [@alpaca-tc](https://github.com/alpaca-tc), [@willnet](https://github.com/willnet), [@krororo](https://github.com/krororo))
574
+
575
+ ## [2.2.20] - 2025-10-10
576
+
577
+ ### Security
578
+
579
+ - [CVE-2025-61780](https://github.com/advisories/GHSA-r657-rxjc-j557) Improper handling of headers in `Rack::Sendfile` may allow proxy bypass.
580
+ - [CVE-2025-61919](https://github.com/advisories/GHSA-6xw4-3v39-52mm) Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion.
581
+
582
+ ## [2.2.19] - 2025-10-07
583
+
584
+ ### Security
585
+
586
+ - [CVE-2025-61772](https://github.com/advisories/GHSA-wpv5-97wm-hp9c) Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
587
+ - [CVE-2025-61771](https://github.com/advisories/GHSA-w9pc-fmgc-vxvw) Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
588
+ - [CVE-2025-61770](https://github.com/advisories/GHSA-p543-xpfm-54cp) Unbounded multipart preamble buffering enables DoS (memory exhaustion)
589
+
590
+ ## [2.2.18] - 2025-09-25
591
+
592
+ ### Security
593
+
594
+ - [CVE-2025-59830](https://github.com/advisories/GHSA-625h-95r8-8xpm) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion via semicolon-separated parameters.
595
+
596
+ ## [2.2.17] - 2025-06-03
597
+
598
+ - Backport `Rack::MediaType#params` now handles parameters without values. ([#2263](https://github.com/rack/rack/pull/2263), [@AllyMarthaJ](https://github.com/AllyMarthaJ))
599
+
600
+ ## [2.2.16] - 2025-05-22
601
+
602
+ - Fix incorrect backport of optional `CGI::Cookie` support. ([#2335](https://github.com/rack/rack/pull/2335), [@jeremyevans])
603
+
604
+ ## [2.2.15] - 2025-05-18
605
+
606
+ - Optional support for `CGI::Cookie` if not available. ([#2327](https://github.com/rack/rack/pull/2327), [#2333](https://github.com/rack/rack/pull/2333), [@earlopain])
607
+
608
+ ## [2.2.14] - 2025-05-06
609
+
610
+ :warning: **This release includes a security fix that may cause certain routes in previously working applications to fail if query parameters exceed 4,096 in count or 4 MB in total size. See <https://github.com/rack/rack/discussions/2356> for more details.**
611
+
612
+ ### Security
613
+
614
+ - [CVE-2025-46727](https://github.com/advisories/GHSA-gjh7-p2fx-99vx) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion.
615
+
616
+ ## [2.2.13] - 2025-03-11
617
+
618
+ ### Security
619
+
620
+ - [CVE-2025-27610](https://github.com/advisories/GHSA-7wqh-767x-r66v) Local file inclusion in `Rack::Static`.
621
+
622
+ ## [2.2.12] - 2025-03-04
623
+
624
+ ### Security
625
+
626
+ - [CVE-2025-27111](https://github.com/advisories/GHSA-8cgq-6mh2-7j6v) Possible Log Injection in `Rack::Sendfile`.
627
+
628
+ ## [2.2.11] - 2025-02-12
629
+
630
+ ### Security
631
+
632
+ - [CVE-2025-25184](https://github.com/advisories/GHSA-7g2v-jj9q-g3rg) Possible Log Injection in `Rack::CommonLogger`.
633
+
634
+ ## [2.2.10] - 2024-10-14
635
+
636
+ - Fix compatibility issues with Ruby v3.4.0. ([#2248](https://github.com/rack/rack/pull/2248), [@byroot](https://github.com/byroot))
637
+
638
+ ## [2.2.9] - 2023-03-21
639
+
640
+ - Return empty when parsing a multi-part POST with only one end delimiter. ([#2104](https://github.com/rack/rack/pull/2104), [@alpaca-tc])
641
+
642
+ ## [2.2.8] - 2023-07-31
643
+
644
+ - Regenerate SPEC ([#2102](https://github.com/rack/rack/pull/2102), [@skipkayhil](https://github.com/skipkayhil))
645
+ - Limit file extension length of multipart tempfiles ([#2015](https://github.com/rack/rack/pull/2015), [@dentarg](https://github.com/dentarg))
646
+ - Fix "undefined method DelegateClass for Rack::Session::Cookie:Class" ([#2092](https://github.com/rack/rack/pull/2092), [@onigra](https://github.com/onigra) [@dchandekstark](https://github.com/dchandekstark))
647
+
648
+ ## [2.2.7] - 2023-03-13
649
+
650
+ - Correct the year number in the changelog ([#2015](https://github.com/rack/rack/pull/2015), [@kimulab](https://github.com/kimulab))
651
+ - Support underscore in host names for Rack 2.2 (Fixes [#2070](https://github.com/rack/rack/issues/2070)) ([#2015](https://github.com/rack/rack/pull/2071), [@jeremyevans](https://github.com/jeremyevans))
652
+
653
+ ## [2.2.6.4] - 2023-03-13
654
+
655
+ - [CVE-2023-27539] Avoid ReDoS in header parsing
656
+
657
+ ## [2.2.6.3] - 2023-03-02
658
+
659
+ - [CVE-2023-27530] Introduce multipart_total_part_limit to limit total parts
660
+
661
+ ## [2.2.6.2] - 2023-01-17
662
+
663
+ - [CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges
664
+
665
+ ## [2.2.6.1] - 2023-01-17
666
+
667
+ - [CVE-2022-44571] Fix ReDoS vulnerability in multipart parser
668
+ - [CVE-2022-44572] Forbid control characters in attributes (also ReDoS)
669
+
670
+ ## [2.2.6] - 2023-01-17
671
+
672
+ - Extend `Rack::MethodOverride` to handle `QueryParser::ParamsTooDeepError` error. ([#2011](https://github.com/rack/rack/pull/2011), [@byroot](https://github.com/byroot))
673
+
674
+ ## [2.2.5] - 2022-12-27
675
+
676
+ ### Fixed
677
+
678
+ - `Rack::URLMap` uses non-deprecated form of `Regexp.new`. ([#1998](https://github.com/rack/rack/pull/1998), [@weizheheng](https://github.com/weizheheng))
679
+
95
680
  ## [2.2.4] - 2022-06-30
96
681
 
97
682
  - Better support for lower case headers in `Rack::ETag` middleware. ([#1919](https://github.com/rack/rack/pull/1919), [@ioquatix](https://github.com/ioquatix))
@@ -99,6 +684,8 @@ All notable changes to this project will be documented in this file. For info on
99
684
 
100
685
  ## [2.2.3.1] - 2022-05-27
101
686
 
687
+ ### Security
688
+
102
689
  - [CVE-2022-30123] Fix shell escaping issue in Common Logger
103
690
  - [CVE-2022-30122] Restrict parsing of broken MIME attachments
104
691
 
@@ -806,3 +1393,7 @@ Items below this line are from the previously maintained HISTORY.md and NEWS.md
806
1393
  [@amatsuda]: https://github.com/amatsuda "Akira Matsuda"
807
1394
  [@wjordan]: https://github.com/wjordan "Will Jordan"
808
1395
  [@BlakeWilliams]: https://github.com/BlakeWilliams "Blake Williams"
1396
+ [@davidstosik]: https://github.com/davidstosik "David Stosik"
1397
+ [@earlopain]: https://github.com/earlopain "Earlopain"
1398
+ [@wynksaiddestroy]: https://github.com/wynksaiddestroy "Fabian Winkler"
1399
+ [@matthewd]: https://github.com/matthewd "Matthew Draper"