[Snyk] Security upgrade rack from 1.6.4 to 2.2.23

[ryanmcmorrowsnyk]

Snyk has created this PR to fix 9 vulnerabilities in the rubygems dependencies of this project.

Snyk changed the following file(s):

• Gemfile
• Gemfile.lock

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Partial String Comparison SNYK-RUBY-RACK-15878254	167
	Denial of Service (DoS) SNYK-RUBY-RACK-15878260	167
	Permissive Regular Expression SNYK-RUBY-RACK-15878256	149
	Improper Handling of Length Parameter Inconsistency SNYK-RUBY-RACK-15878237	104
	Denial of Service (DoS) SNYK-RUBY-RACK-15878255	66
	Denial of Service (DoS) SNYK-RUBY-RACK-15878257	66
	Permissive Regular Expression SNYK-RUBY-RACK-15878258	66
	Incorrect Behavior Order: Validate Before Canonicalize SNYK-RUBY-RACK-15878259	66
	Interpretation Conflict SNYK-RUBY-RACK-15878035	59

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Denial of Service (DoS)

[ryanmcmorrowsnyk]

This major version upgrade from Rack 1.x to 2.x introduces several significant breaking changes to the Rack specification and drops support for older Ruby versions.

Key Breaking Changes:

• Ruby Version Requirement: Rack 2.0 requires Ruby 2.2.2 or newer. [8] Support for Ruby versions below 2.2 was dropped, which could impact older environments.
• Middleware Body Handling: Middleware can no longer call #each on the response body. This is a direct breaking change for any custom middleware that iterates over the body. [7]
• Hijacking API Changes: The API for handling streaming responses and WebSockets has changed. rack.hijack_io has been removed entirely, which will break applications and middleware that used it for full-duplex communication. [7]
• SPEC Environment Changes: Several keys previously required in the Rack environment hash are now optional (e.g., rack.multithread, rack.version), while SERVER_PROTOCOL is now mandatory. [7]
• Session Store Deprecation: Rack::Session::Abstract::ID is deprecated and has been replaced by Rack::Session::Abstract::Persisted. [2]

Recommendation:
This upgrade requires careful review and likely code modifications. Pay close attention to custom middleware, session handling, and any features that rely on response streaming or hijacking (like WebSockets). It is critical to test thoroughly in a staging environment before deploying to production.

Source: Rack CHANGELOG, Rack Upgrade Guide

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[corgea]

🐕 Corgea found the following new SCA issues in the codebase:

Package	CVE	Severity	Version	Fixed Version	Ecosystem	Summary
activesupport	CVE-2020-8165	CRITICAL	5.0.0.1	5.2.4.3	RubyGems	ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
activerecord	CVE-2022-44566	HIGH	5.0.0.1	6.1.7.1	RubyGems	Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapter
nokogiri	N/A	MEDIUM	1.6.8.1	1.19.1	RubyGems	Nokogiri does not check the return value from xmlC14NExecute

Showing 3 out of 8 findings. See full results