New version of rack (2.2.23) broke the build

[depfu]

We've tested your project with an updated dependency and the build failed.

This version is either within the version range you specified or you haven't specified a version/range. To be able to test your project with the new version, we've taken the liberty of pinning the version for this branch and pull request.

name	version specification	new version
rack	>= 1.0, < 3.0	2.2.23

Unfortunately, we encountered failing tests after pinning. This means that this new version is not compatible with your project and the test failure will potentially also happen on fresh installs.

If you have correctly specified a semantic versioning version range, you should probably also file an issue with the upstream project as they might have released an update that's breaking SemVer rules, which is not cool. (But then again, not all projects explicitly follow SemVer)

We've left the pull request open for you to investigate this issue. Please don't merge it as is, because, again, we've pinned the version of rack for this test run.

What changed?

✳️ rack (>= 1.0, < 3.0 → 2.2.23) · Repo · Changelog

Release Notes

2.2.23 (from changelog)

Security

• CVE-2026-34763 Root directory disclosure via unescaped regex interpolation in Rack::Directory.
• CVE-2026-34230 Avoid O(n^2) algorithm in Rack::Utils.select_best_encoding which could lead to denial of service.
• CVE-2026-26961 Raise error for multipart requests with multiple boundary parameters.
• CVE-2026-34786 Rack::Static header_rules bypass via URL-encoded path mismatch.
• CVE-2026-34831 Content-Length mismatch in Rack::Files error responses.
• CVE-2026-34826 Multipart byte range processing allows denial of service via excessive overlapping ranges.
• CVE-2026-34830 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect.
• CVE-2026-34785 Rack::Static prefix matching can expose unintended files under the static root.
• CVE-2026-34829 Multipart parsing without Content-Length header allows unbounded chunked file uploads.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 19 commits:

• Bump patch version.
• Fix tests for old Rubies.
• Add version guard around non-default gems.
• Fix handling of `Errno::EPIPE` in multipart tests.
• Fix typo in test.
• Add `ostruct` to Gemfile.
• Fix test expectation.
• Add `logger` to gemfile.
• Add Ruby v4.0 to the test matrix.
• Add Content-Length size check in Rack::Multipart::Parser
• Fix root prefix bug in Rack::Static
• Only do a simple substitution on the x-accel-mapping paths
• Use a default limit of 100 byte ranges
• Use `String#bytesize` for `Content-Length` in error responses.
• Fix `header_rules` bypass via URL-encoded paths.
• Raise error for multipart requests with multiple boundary parameters
• Avoid O(n^2) algorithm in Rack::Utils.select_best_encoding
• Root directory disclosure via unescaped regex interpolation in `Rack::Directory`.
• Add missing releases to changelog.