◐ Shell
clean mode source ↗

Bump rack from 2.2.22 to 2.2.23 by dependabot[bot] · Pull Request #60 · jruby/jruby.github.io

dependabot

Bumps rack from 2.2.22 to 2.2.23.

Changelog

Sourced from rack's changelog.

[2.2.23] - 2026-04-01

Security

  • CVE-2026-34763 Root directory disclosure via unescaped regex interpolation in Rack::Directory.
  • CVE-2026-34230 Avoid O(n^2) algorithm in Rack::Utils.select_best_encoding which could lead to denial of service.
  • CVE-2026-26961 Raise error for multipart requests with multiple boundary parameters.
  • CVE-2026-34786 Rack::Static header_rules bypass via URL-encoded path mismatch.
  • CVE-2026-34831 Content-Length mismatch in Rack::Files error responses.
  • CVE-2026-34826 Multipart byte range processing allows denial of service via excessive overlapping ranges.
  • CVE-2026-34830 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect.
  • CVE-2026-34785 Rack::Static prefix matching can expose unintended files under the static root.
  • CVE-2026-34829 Multipart parsing without Content-Length header allows unbounded chunked file uploads.
Commits
  • f2af0c8 Bump patch version.
  • 345b744 Fix tests for old Rubies.
  • e2d8e30 Add version guard around non-default gems.
  • add1a80 Fix handling of Errno::EPIPE in multipart tests.
  • 54261ec Fix typo in test.
  • a36f48b Add ostruct to Gemfile.
  • 8883f0d Fix test expectation.
  • 2287a3b Add logger to gemfile.
  • e6540e5 Add Ruby v4.0 to the test matrix.
  • c42e357 Add Content-Length size check in Rack::Multipart::Parser
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.