chore(deps): update dependency rack to '~>3.2.0'

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
rack (changelog)	'~>3.1.0' -> '~>3.2.0'

---

Release Notes

rack/rack (rack)

v3.2.4

Compare Source

Fixed

• Multipart parser: limit MIME header size check to the unread buffer region to avoid false multipart mime part header too large errors when previously read data accumulates in the scan buffer. (#​2392, @​alpaca-tc, @​willnet, @​krororo)

v3.2.3

Compare Source

v3.2.2

Compare Source

Security

• CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
• CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
• CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)

v3.2.1

Compare Source

Added

• Add support for streaming bodies when using Rack::Events. (#​2375, @​unflxw)

Fixed

• Fix an issue where a NoMethodError would be raised when using Rack::Events with streaming bodies. (#​2375, @​unflxw)

v3.2.0

Compare Source

This release continues Rack's evolution toward a cleaner, more efficient foundation while maintaining backward compatibility for most applications. The breaking changes primarily affect deprecated functionality, so most users should experience a smooth upgrade with improved performance and standards compliance.

SPEC Changes

• Request environment keys must now be strings. (#​2310, [@​jeremyevans])
• Add nil as a valid return from a Response body.to_path (#​2318, [@​MSP-Greg])
• Rack::Lint#check_header_value is relaxed, only disallowing CR/LF/NUL characters. (#​2354, [@​ioquatix])

Added

• Introduce Rack::VERSION constant. (#​2199, [@​ioquatix])
• ISO-2022-JP encoded parts within MIME Multipart sections of an HTTP request body will now be converted to UTF-8. (#​2245, @​nappa)
• Add Rack::Request#query_parser= to allow setting the query parser to use. (#​2349, [@​jeremyevans])
• Add Rack::Request#form_pairs to access form data as raw key-value pairs, preserving duplicate keys. (#​2351, [@​matthewd])

Changed

• Invalid cookie keys will now raise an error. (#​2193, [@​ioquatix])
• Rack::MediaType#params now handles empty strings. (#​2229, [@​jeremyevans])
• Avoid unnecessary calls to the ip_filter lambda to evaluate Request#ip (#​2287, [@​willbryant])
• Only calculate Request#ip once per request (#​2292, [@​willbryant])
• Rack::Builder #use, #map, and #run methods now return nil. (#​2355, [@​ioquatix])
• Directly close the body in Rack::ConditionalGet when the response is 304 Not Modified. (#​2353, [@​ioquatix])
• Directly close the body in Rack::Head when the request method is HEAD(#​2360, @​skipkayhil)

Deprecated

• Rack::Auth::AbstractRequest#request is deprecated without replacement. (#​2229, [@​jeremyevans])
• Rack::Request#parse_multipart (private method designed to be overridden in subclasses) is deprecated without replacement. (#​2229, [@​jeremyevans])

Removed

• Rack::Request#values_at is removed. (#​2200, [@​ioquatix])
• Rack::Logger is removed with no replacement. (#​2196, [@​ioquatix])
• Automatic cache invalidation in Rack::Request#{GET,POST} has been removed. (#​2230, [@​jeremyevans])
• Support for CGI::Cookie has been removed. (#​2332, [@​ioquatix])

Fixed

• Rack::RewindableInput::Middleware no longer wraps a nil input. (#​2259, @​tt)
• Fix NoMethodError in Rack::Request#wrap_ipv6 when x-forwarded-host is empty. (#​2270, @​oieioi)
• Fix the specification for SERVER_PORT which was incorrectly documented as required to be an Integer if present - it must be a String containing digits only. (#​2296, [@​ioquatix])
• SERVER_NAME and HTTP_HOST are now more strictly validated according to the relevant specifications. (#​2298, [@​ioquatix])
• Rack::Lint now disallows PATH_INFO="" SCRIPT_NAME="". (#​2298, [@​jeremyevans])

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.