Log message:
www/ruby-rack: update to 3.1.8

3.1.8 (2024-10-14)

* Resolve deprecation warnings about uri DEFAULT_PARSER.
  (#2249, [@earlopain])

Log message:
www/ruby-rack: update to 3.1.7

3.1.5 (2024-07-02)

Security

* Fix potential ReDoS attack in Rack::Request#parse_http_accept_header.
  (GHSA-cj83-2ww7-mvq7, @dwisiswant0)

3.1.6 (2024-07-03)

* Fix several edge cases in Rack::Request#parse_http_accept_header's
  implementation.  (#2226, @ioquatix)

3.1.7 (2024-07-11)

Fixed

* Do not remove escaped opening/closing quotes for content-disposition
  filenames.  (#2229, @jeremyevans)

* Fix encoding setting for non-binary IO-like objects in
  MockRequest#env_for.  (#2227, @jeremyevans)

* Rack::Response should not generate invalid content-length header.
  (#2219, @ioquatix)

* Allow empty PATH_INFO.  (#2214, @ioquatix)

Log message:
www/ruby-rack: update to 3.1.4

3.1.4 (2024-06-22)

Fixed

* Fix Rack::Lint matching some paths incorrectly as authority form. (#2220,
  @ioquatix)

Log message:
www/ruby-rack: update to 3.1.3

3.1.1 (2024-06-11)

* Oops! I shouldn't have shipped that

3.1.2 (2024-06-11)

* Rack::Response will take in to consideration chunked encoding responses
  (#2204, [@tenderlove])

3.1.3 (2024-06-12)

Fixed

* Fix passing non-strings to Rack::Utils.escape_html. (#2202, [@earlopain])
* Rack::MockResponse gracefully handles empty cookies (#2203
  @wynksaiddestroy)

Log message:
www/ruby-rack: update to 3.1.0

3.1.0 (2024-06-11)

Rack v3.1 is primarily a maintenance release that removes features
deprecated in Rack v3.0.  Alongside these removals, there are several
improvements to the Rack SPEC, mainly focused on enhancing input and output
handling.  These changes aim to make Rack more efficient and align better
with the requirements of server implementations and relevant HTTP
specifications.

SPEC Changes

* rack.input is now optional. (#1997, #2018, @ioquatix)
* PATH_INFO is now validated according to the HTTP/1.1 specification.
  (#2117, #2181, @ioquatix)
    - OPTIONS * is now accepted. (#2114, @doriantaylor)
* Introduce optional rack.protocol request and response header for handling
  connection upgrades.  (#1954, @ioquatix)

Added

* Introduce Rack::Multipart::MissingInputError for improved handling of
  missing input in #parse_multipart.  (#2018, @ioquatix)
* Introduce module Rack::BadRequest which is included in multipart and query
  parser errors.  (#2019, @ioquatix)
* Add .mjs MIME type (#2057, @axilleas)
* set_cookie_header utility now supports the partitioned cookie
  attribute. This is required by Chrome in some embedded contexts.  (#2131,
  @flavio-b)
* Introduce rack.early_hints for sending 103 Early Hints informational
  responses.  (#1831, @casperisfine, @jeremyevans)

Changed

* MIME type for JavaScript files (.js) changed from application/javascript
  to text/javascript (1bd0f15, @ioquatix)
* Update MIME types associated to .ttf, .woff, .woff2 and .otf extensions to
  use mondern font/* types.  (#2065, @davidstosik)
* Rack::Utils.escape_html is now delegated to CGI.escapeHTML. ' is escaped
  to #39; instead of #x27;.  (decimal vs hexadecimal) (#2099, @JunichiIto)
* Clarify use of @buffered and only update content-length when
  Rack::Response#finish is invoked.  (#2149, @ioquatix)

Deprecated

* Deprecate automatic cache invalidation in Request#{GET,POST} (#2073,
  @jeremyevans)
* Only cookie keys that are not valid according to the HTTP specifications
  are escaped.  We are planning to deprecate this behaviour, so now a
  deprecation message will be emitted in this case.  In the future, invalid
  cookie keys may not be accepted.  (#2191, @ioquatix)
* Rack::Logger is deprecated. (#2197, @ioquatix)
* Add fallback lookup and deprecation warning for obsolete status symbols.
  (#2137, @wtn)

Removed

* Remove deprecated Rack::Auth::Digest with no replacement.  (#1966,
  @ioquatix)
* Remove deprecated Rack::Cascade::NotFound with no replacement.  (#1966,
  @ioquatix)
* Remove deprecated Rack::Chunked with no replacement. (#1966, @ioquatix)
* Remove deprecated Rack::File, use Rack::Files instead. (#1966, @ioquatix)
* Remove deprecated Rack::QueryParser key_space_limit parameter with no
  replacement.  (#1966, @ioquatix)
* Remove deprecated Rack::Response#header, use Rack::Response#headers
  instead.  (#1966, @ioquatix)
* Remove deprecated cookie methods from Rack::Utils: add_cookie_to_header,
  make_delete_cookie_header, add_remove_cookie_to_header.  (#1966,
  @ioquatix)
* Remove deprecated Rack::Utils::HeaderHash.  (#1966, @ioquatix)
* Remove deprecated Rack::VERSION, Rack::VERSION_STRING, Rack.version, use
  Rack.release instead.  (#1966, @ioquatix)
* Remove non-standard status codes 306, 509, & 510 and update descriptions
  for 413, 422, & 451.  (#2137, @wtn)
* Remove any dependency on transfer-encoding: chunked. (#2195, @ioquatix)

Fixed

* In Rack::Files, ignore the Range header if served file is 0 bytes.
  (#2159, [@zarqman])

Log message:
www/ruby-rack: update to 3.0.11

3.0.11 (2024-05-10)

* Backport #2062 to 3-0-stable: Do not allow BodyProxy to respond to to_str,
  make to_ary call close. (#2062, @jeremyevans)

Log message:
www/ruby-rack: update to 3.0.10

3.0.10 (2024-03-21)

* Backport #2104 to 3-0-stable: Return empty when parsing a multi-part POST
  with only one end delimiter. (#2164, @JoeDupuis)

Log message:
www/ruby-rack: update to 3.0.9.1

3.0.9.1 (2024-02-21)

What's Changed

* Fixed ReDoS in Accept header parsing [CVE-2024-26146]
* Fixed ReDoS in Content Type header parsing [CVE-2024-25126]
* Reject Range headers which are too large [CVE-2024-26141]