[dependabot]

Bumps rack from 3.1.21 to 3.1.23.

Changelog

Sourced from rack's changelog.

[3.1.23] - 2026-10-30

Security

• GHSA-5v64-555j-wjxm Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion.
• GHSA-wvg4-6p58-3gh3 Rack::Static header rules were matched against an unnormalized path, allowing dot segments to bypass them.
• GHSA-2j8w-xcrc-x985 Rack::Request#host_with_port, #base_url, and #url returned the raw authority when it was invalid; host_with_port now returns nil in that case.
• GHSA-p8x9-v4hv-2w4g Multipart requests with more than one boundary parameter were accepted when the first value was empty or began with a quote, semicolon, or comma, bypassing the guard added for CVE-2026-26961.

[3.1.22] - 2026-08-13

Security

• CVE-2026-26962 Improper unfolding of folded multipart headers preserves CRLF in parsed parameter values.

Fixed

• Restore Ruby 2.4/2.5 compatibility.

Commits

• 7131b80 Bump patch version.
• 4ce7131 Update changelog.
• 19a1a19 Reject multipart content types with a boundary parameter before the parsed one.
• 4380381 Don't leak invalid Host through host_with_port.
• 9d7f194 Normalize static header rule paths before matching.
• 2eaa5b1 Remove parsed bytes from the multipart buffer while reading parts.
• 528a5e2 Bump patch version.
• ae320b4 Backport OBS unfolding for multipart requests to 3-1-stable (#2486)
• 7625c59 Fix specs on Ruby 2.4
• b325730 Do not ignore Ruby 2.4/2.5 errors in CI
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 412ea304-810a-417a-b8a0-c59b90de1b4a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn