Update dependency rack to v2.2.23

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
rack (changelog)	'3.2.4' → '2.2.23'

---

Release Notes

rack/rack (rack)

v2.2.23

Compare Source

Security

• CVE-2026-34763 Root directory disclosure via unescaped regex interpolation in Rack::Directory.
• CVE-2026-34230 Avoid O(n^2) algorithm in Rack::Utils.select_best_encoding which could lead to denial of service.
• CVE-2026-26961 Raise error for multipart requests with multiple boundary parameters.
• CVE-2026-34786 Rack::Static header_rules bypass via URL-encoded path mismatch.
• CVE-2026-34831 Content-Length mismatch in Rack::Files error responses.
• CVE-2026-34826 Multipart byte range processing allows denial of service via excessive overlapping ranges.
• CVE-2026-34830 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect.
• CVE-2026-34785 Rack::Static prefix matching can expose unintended files under the static root.
• CVE-2026-34829 Multipart parsing without Content-Length header allows unbounded chunked file uploads.

v2.2.22

Compare Source

Security

• CVE-2026-25500 XSS injection via malicious filename in Rack::Directory.
• CVE-2026-22860 Directory traversal via root prefix bypass in Rack::Directory.

v2.2.21

Compare Source

Fixed

• Multipart parser: limit MIME header size check to the unread buffer region to avoid false multipart mime part header too large errors when previously read data accumulates in the scan buffer. (#​2392, @​alpaca-tc, @​willnet, @​krororo)

v2.2.20

Compare Source

Security

• CVE-2025-61780 Improper handling of headers in Rack::Sendfile may allow proxy bypass.
• CVE-2025-61919 Unbounded read in Rack::Request form parsing can lead to memory exhaustion.

v2.2.19

Compare Source

Security

• CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
• CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
• CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)

v2.2.18

Compare Source

Security

• CVE-2025-59830 Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion via semicolon-separated parameters.

v2.2.17

Compare Source

• Backport Rack::MediaType#params now handles parameters without values. (#​2263, @​AllyMarthaJ)

v2.2.16

Compare Source

• Fix incorrect backport of optional CGI::Cookie support. (#​2335, [@​jeremyevans])

v2.2.15

Compare Source

• Optional support for CGI::Cookie if not available. (#​2327, #​2333, [@​earlopain])

v2.2.14

Compare Source

⚠️ This release includes a security fix that may cause certain routes in previously working applications to fail if query parameters exceed 4,096 in count or 4 MB in total size. See https://redirect.github.com/rack/rack/discussions/2356 for more details.

Security

• CVE-2025-46727 Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion.

v2.2.13

Compare Source

Security

• CVE-2025-27610 Local file inclusion in Rack::Static.

v2.2.12

Compare Source

Security

• CVE-2025-27111 Possible Log Injection in Rack::Sendfile.

v2.2.11

Compare Source

Security

• CVE-2025-25184 Possible Log Injection in Rack::CommonLogger.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Gemfile.lock

/opt/containerbase/tools/bundler/2.2.25/4.0.4/gems/bundler-2.2.25/lib/bundler/vendor/thor/lib/thor/error.rb:105:in '<class:Thor>': uninitialized constant DidYouMean::SPELL_CHECKERS (NameError)

    DidYouMean::SPELL_CHECKERS.merge!(
              ^^^^^^^^^^^^^^^^
Did you mean?  DidYouMean::SpellChecker
	from /opt/containerbase/tools/bundler/2.2.25/4.0.4/gems/bundler-2.2.25/lib/bundler/vendor/thor/lib/thor/error.rb:1:in '<top (required)>'
	from /opt/containerbase/tools/bundler/2.2.25/4.0.4/gems/bundler-2.2.25/lib/bundler/vendor/thor/lib/thor/base.rb:3:in 'Kernel#require_relative'
	from /opt/containerbase/tools/bundler/2.2.25/4.0.4/gems/bundler-2.2.25/lib/bundler/vendor/thor/lib/thor/base.rb:3:in '<top (required)>'
	from /opt/containerbase/tools/bundler/2.2.25/4.0.4/gems/bundler-2.2.25/lib/bundler/vendor/thor/lib/thor.rb:1:in 'Kernel#require_relative'
	from /opt/containerbase/tools/bundler/2.2.25/4.0.4/gems/bundler-2.2.25/lib/bundler/vendor/thor/lib/thor.rb:1:in '<top (required)>'
	from /opt/containerbase/tools/bundler/2.2.25/4.0.4/gems/bundler-2.2.25/lib/bundler/vendored_thor.rb:8:in 'Kernel#require_relative'
	from /opt/containerbase/tools/bundler/2.2.25/4.0.4/gems/bundler-2.2.25/lib/bundler/vendored_thor.rb:8:in '<top (required)>'
	from /opt/containerbase/tools/bundler/2.2.25/4.0.4/gems/bundler-2.2.25/lib/bundler/friendly_errors.rb:3:in 'Kernel#require_relative'
	from /opt/containerbase/tools/bundler/2.2.25/4.0.4/gems/bundler-2.2.25/lib/bundler/friendly_errors.rb:3:in '<top (required)>'
	from /opt/containerbase/tools/bundler/2.2.25/4.0.4/gems/bundler-2.2.25/exe/bundle:32:in 'Kernel#require_relative'
	from /opt/containerbase/tools/bundler/2.2.25/4.0.4/gems/bundler-2.2.25/exe/bundle:32:in '<top (required)>'
	from /opt/containerbase/tools/bundler/2.2.25/4.0.4/gems/bundler-2.2.25/exe/bundler:4:in 'Kernel#load'
	from /opt/containerbase/tools/bundler/2.2.25/4.0.4/gems/bundler-2.2.25/exe/bundler:4:in '<top (required)>'
	from /opt/containerbase/tools/ruby/4.0.4/lib/ruby/4.0.0/rubygems.rb:305:in 'Kernel#load'
	from /opt/containerbase/tools/ruby/4.0.4/lib/ruby/4.0.0/rubygems.rb:305:in 'Gem.activate_and_load_bin_path'
	from /opt/containerbase/tools/bundler/2.2.25/4.0.4/bin/bundler:25:in '<main>'