Bump rack from 3.1.7 to 3.1.20

[dependabot]

Bumps rack from 3.1.7 to 3.1.20.

Changelog

Sourced from rack's changelog.

[3.1.20] - 2026-02-16

Security

• CVE-2026-25500 XSS injection via malicious filename in Rack::Directory.
• CVE-2026-22860 Directory traversal via root prefix bypass in Rack::Directory.

[3.1.19] - 2025-11-03

Fixed

• Multipart parser: limit MIME header size check to the unread buffer region to avoid false multipart mime part header too large errors when previously read data accumulates in the scan buffer. (#2392, @​alpaca-tc, @​willnet, @​krororo)

[3.1.18] - 2025-10-10

Security

• CVE-2025-61780 Improper handling of headers in Rack::Sendfile may allow proxy bypass.
• CVE-2025-61919 Unbounded read in Rack::Request form parsing can lead to memory exhaustion.

[3.1.17] - 2025-10-07

Security

• CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
• CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
• CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)

[3.1.16] - 2025-06-04

Security

• CVE-2025-49007 Fix ReDoS in multipart request.

[3.1.15] - 2025-05-18

• Optional support for CGI::Cookie if not available. (#2327, #2333, [@​earlopain])

[3.1.14] - 2025-05-06

⚠️ This release includes a security fix that may cause certain routes in previously working applications to fail if query parameters exceed 4,096 in count or 4 MB in total size. See rack/rack#2356 for more details.

Security

• CVE-2025-46727 Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion.

[3.1.13] - 2025-04-13

• Ensure Rack::ETag correctly updates response body. (#2324, [@​ioquatix])

... (truncated)

Commits

• 6504434 Bump patch version.
• 48e9030 Prevent directory traversal via root prefix bypass.
• ed0f455 XSS injection via malicious filename in Rack::Directory.
• b29df31 Bump patch version.
• 72719a8 Allow Multipart head to span read boundary. (#2392)
• 96cf078 Bump patch version.
• cbd541e Unbounded read in Rack::Request form parsing can lead to memory exhaustion.
• 7e69f65 Improper handling of proxy headers in Rack::Sendfile may allow proxy bypass.
• db6bc0f Normalize adivsories links.
• ad81f80 Fix handling of Errno::EPIPE in multipart tests.
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Superseded by #21.