Changelog
*Sourced from [rack's changelog](https://github.com/rack/rack/blob/master/CHANGELOG.md).*
> # Changelog
>
> All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
>
> ## Unreleased
>
> ### SPEC Changes
>
> - `rack.session` request environment entry must respond to `to_hash` and return unfrozen Hash. ([@jeremyevans](https://github.com/jeremyevans))
> - Request environment cannot be frozen. ([@jeremyevans](https://github.com/jeremyevans))
> - CGI values in the request environment with non-ASCII characters must use ASCII-8BIT encoding. ([@jeremyevans](https://github.com/jeremyevans))
>
> ### Added
>
> - `rackup` supports multiple `-r` options and will require all arguments. ([@jeremyevans](https://github.com/jeremyevans))
> - `Server` supports an array of paths to require for the `:require` option. ([@khotta](https://github.com/khotta))
> - `Files` supports multipart range requests. ([@fatkodima](https://github.com/fatkodima))
> - `Multipart::UploadedFile` supports an IO-like object instead of using the filesystem, using `:filename` and `:io` options. ([@jeremyevans](https://github.com/jeremyevans))
> - `Multipart::UploadedFile` supports keyword arguments `:path`, `:content_type`, and `:binary` in addition to positional arguments. ([@jeremyevans](https://github.com/jeremyevans))
> - `Static` supports a `:cascade` option for calling the app if there is no matching file. ([@jeremyevans](https://github.com/jeremyevans))
> - `Session::Abstract::SessionHash#dig`. ([@jeremyevans](https://github.com/jeremyevans))
> - `Response.[]` and `MockResponse.[]` for creating instances using status, headers, and body. ([@ioquatix](https://github.com/ioquatix))
>
> ### Changed
>
> - `Etag` will continue sending ETag even if the response should not be cached. ([@henm](https://github.com/henm))
> - `Request#host_with_port` no longer includes a colon for a missing or empty port. ([@AlexWayfer](https://github.com/AlexWayfer))
> - All handlers uses keywords arguments instead of an options hash argument. ([@ioquatix](https://github.com/ioquatix))
> - `Files` handling of range requests no longer return a body that supports `to_path`, to ensure range requests are handled correctly. ([@jeremyevans](https://github.com/jeremyevans))
> - `Multipart::Generator` only includes `Content-Length` for files with paths, and `Content-Disposition` `filename` if the `UploadedFile` instance has one. ([@jeremyevans](https://github.com/jeremyevans))
> - `Request#ssl?` is true for the `wss` scheme (secure websockets). ([@jeremyevans](https://github.com/jeremyevans))
>
> ### Removed
>
> - `Session::Abstract::SessionHash#transform_keys`, no longer needed. (pavel)
> - `URLMap::INFINITY` and `URLMap::NEGATIVE_INFINITY`, in favor of `Float::INFINITY`. ([@ch1c0t](https://github.com/ch1c0t))
> - Deprecation of `Rack::File`. It will be deprecated again in rack 2.2 or 3.0. ([@rafaelfranca](https://github.com/rafaelfranca))
> - Support for Ruby 2.2 as it is well past EOL. ([@ioquatix](https://github.com/ioquatix))
>
> ### Fixed
>
> - `CommonLogger` includes `SCRIPT_NAME` when logging. ([@Erol](https://github.com/Erol))
> - `Utils.parse_nested_query` correctly handles empty queries, using an empty instance of the params class instead of a hash. ([@jeremyevans](https://github.com/jeremyevans))
> - `Directory` correctly escapes paths in links. ([@yous](https://github.com/yous))
> - `Request#delete_cookie` and related `Utils` methods handle `:domain` and `:path` options in same call. ([@jeremyevans](https://github.com/jeremyevans))
> - `Request#delete_cookie` and related `Utils` methods do an exact match on `:domain` and `:path` options. ([@jeremyevans](https://github.com/jeremyevans))
> - `Static` no longer adds headers when a gzipped file request has a 304 response. ([@chooh](https://github.com/chooh))
> - `ContentLength` sets `Content-Length` response header even for bodies not responding to `to_ary`. ([@jeremyevans](https://github.com/jeremyevans))
> - `Multipart::Parser` uses a slightly modified parser to avoid denial of service when parsing MIME boundaries. ([@aiomaster](https://github.com/aiomaster))
> - Thin handler supports options passed directly to `Thin::Controllers::Controller`. ([@jeremyevans](https://github.com/jeremyevans))
> ... (truncated)
Commits
- [`16a51d8`](https://github.com/rack/rack/commit/16a51d8e0b64964323c3719b8154106af5cc0feb) Bump for 2.1.2 release
- [`0a2c927`](https://github.com/rack/rack/commit/0a2c9273b5ab93f56cc636fec5bf0dc35e607fe0) Update changelog in preparation for 2.1.2
- [`b50bc8b`](https://github.com/rack/rack/commit/b50bc8b5c48a6cad298befffc7a66189d79e6aef) Fix multipart parser for special files [#1308](https://github-redirect.dependabot.com/rack/rack/issues/1308)
- [`f9ef9a0`](https://github.com/rack/rack/commit/f9ef9a02a1264d032dbfe4fe5b0fe79241d93cb2) Fix `use` with kwargs
- [`75d178c`](https://github.com/rack/rack/commit/75d178cd76a6d6444c1865b4c5ab189e86ae4e35) Skip deflating in Rack::Deflater if Content-Length is 0
- [`e758a11`](https://github.com/rack/rack/commit/e758a11241d1e07069180b73acc01b1c7f623097) #transform_keys no longer necessary, reverts [#1401](https://github-redirect.dependabot.com/rack/rack/issues/1401)
- [`c423510`](https://github.com/rack/rack/commit/c42351006b0b7f92c99da8153dbc034673c76954) Fix: Add to_hash to wrap Hash and Session classes
- [`8f57e83`](https://github.com/rack/rack/commit/8f57e8380b65a0199f82267e383c3c633d374dc0) Handle case where session id key is requested but it is missing
- [`799a520`](https://github.com/rack/rack/commit/799a520a015de5938bc01faa8e90b76589c6e7d3) Updating changelog for 2-1-stable
- [`4fabf4d`](https://github.com/rack/rack/commit/4fabf4d70bb890d15a903ae4995c0349b0c69324) Bump version.
- Additional commits viewable in [compare view](https://github.com/rack/rack/compare/2.0.6...2.1.2)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/mpgn/Rails-doubletap-RCE/network/alerts).
dependabot[bot]
commented
4 years ago
Bumps rack from 2.0.6 to 2.1.2.
Changelog
*Sourced from [rack's changelog](https://github.com/rack/rack/blob/master/CHANGELOG.md).* > # Changelog > > All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/). > > ## Unreleased > > ### SPEC Changes > > - `rack.session` request environment entry must respond to `to_hash` and return unfrozen Hash. ([@jeremyevans](https://github.com/jeremyevans)) > - Request environment cannot be frozen. ([@jeremyevans](https://github.com/jeremyevans)) > - CGI values in the request environment with non-ASCII characters must use ASCII-8BIT encoding. ([@jeremyevans](https://github.com/jeremyevans)) > > ### Added > > - `rackup` supports multiple `-r` options and will require all arguments. ([@jeremyevans](https://github.com/jeremyevans)) > - `Server` supports an array of paths to require for the `:require` option. ([@khotta](https://github.com/khotta)) > - `Files` supports multipart range requests. ([@fatkodima](https://github.com/fatkodima)) > - `Multipart::UploadedFile` supports an IO-like object instead of using the filesystem, using `:filename` and `:io` options. ([@jeremyevans](https://github.com/jeremyevans)) > - `Multipart::UploadedFile` supports keyword arguments `:path`, `:content_type`, and `:binary` in addition to positional arguments. ([@jeremyevans](https://github.com/jeremyevans)) > - `Static` supports a `:cascade` option for calling the app if there is no matching file. ([@jeremyevans](https://github.com/jeremyevans)) > - `Session::Abstract::SessionHash#dig`. ([@jeremyevans](https://github.com/jeremyevans)) > - `Response.[]` and `MockResponse.[]` for creating instances using status, headers, and body. ([@ioquatix](https://github.com/ioquatix)) > > ### Changed > > - `Etag` will continue sending ETag even if the response should not be cached. ([@henm](https://github.com/henm)) > - `Request#host_with_port` no longer includes a colon for a missing or empty port. ([@AlexWayfer](https://github.com/AlexWayfer)) > - All handlers uses keywords arguments instead of an options hash argument. ([@ioquatix](https://github.com/ioquatix)) > - `Files` handling of range requests no longer return a body that supports `to_path`, to ensure range requests are handled correctly. ([@jeremyevans](https://github.com/jeremyevans)) > - `Multipart::Generator` only includes `Content-Length` for files with paths, and `Content-Disposition` `filename` if the `UploadedFile` instance has one. ([@jeremyevans](https://github.com/jeremyevans)) > - `Request#ssl?` is true for the `wss` scheme (secure websockets). ([@jeremyevans](https://github.com/jeremyevans)) > > ### Removed > > - `Session::Abstract::SessionHash#transform_keys`, no longer needed. (pavel) > - `URLMap::INFINITY` and `URLMap::NEGATIVE_INFINITY`, in favor of `Float::INFINITY`. ([@ch1c0t](https://github.com/ch1c0t)) > - Deprecation of `Rack::File`. It will be deprecated again in rack 2.2 or 3.0. ([@rafaelfranca](https://github.com/rafaelfranca)) > - Support for Ruby 2.2 as it is well past EOL. ([@ioquatix](https://github.com/ioquatix)) > > ### Fixed > > - `CommonLogger` includes `SCRIPT_NAME` when logging. ([@Erol](https://github.com/Erol)) > - `Utils.parse_nested_query` correctly handles empty queries, using an empty instance of the params class instead of a hash. ([@jeremyevans](https://github.com/jeremyevans)) > - `Directory` correctly escapes paths in links. ([@yous](https://github.com/yous)) > - `Request#delete_cookie` and related `Utils` methods handle `:domain` and `:path` options in same call. ([@jeremyevans](https://github.com/jeremyevans)) > - `Request#delete_cookie` and related `Utils` methods do an exact match on `:domain` and `:path` options. ([@jeremyevans](https://github.com/jeremyevans)) > - `Static` no longer adds headers when a gzipped file request has a 304 response. ([@chooh](https://github.com/chooh)) > - `ContentLength` sets `Content-Length` response header even for bodies not responding to `to_ary`. ([@jeremyevans](https://github.com/jeremyevans)) > - `Multipart::Parser` uses a slightly modified parser to avoid denial of service when parsing MIME boundaries. ([@aiomaster](https://github.com/aiomaster)) > - Thin handler supports options passed directly to `Thin::Controllers::Controller`. ([@jeremyevans](https://github.com/jeremyevans)) > ... (truncated)Commits
- [`16a51d8`](https://github.com/rack/rack/commit/16a51d8e0b64964323c3719b8154106af5cc0feb) Bump for 2.1.2 release - [`0a2c927`](https://github.com/rack/rack/commit/0a2c9273b5ab93f56cc636fec5bf0dc35e607fe0) Update changelog in preparation for 2.1.2 - [`b50bc8b`](https://github.com/rack/rack/commit/b50bc8b5c48a6cad298befffc7a66189d79e6aef) Fix multipart parser for special files [#1308](https://github-redirect.dependabot.com/rack/rack/issues/1308) - [`f9ef9a0`](https://github.com/rack/rack/commit/f9ef9a02a1264d032dbfe4fe5b0fe79241d93cb2) Fix `use` with kwargs - [`75d178c`](https://github.com/rack/rack/commit/75d178cd76a6d6444c1865b4c5ab189e86ae4e35) Skip deflating in Rack::Deflater if Content-Length is 0 - [`e758a11`](https://github.com/rack/rack/commit/e758a11241d1e07069180b73acc01b1c7f623097) #transform_keys no longer necessary, reverts [#1401](https://github-redirect.dependabot.com/rack/rack/issues/1401) - [`c423510`](https://github.com/rack/rack/commit/c42351006b0b7f92c99da8153dbc034673c76954) Fix: Add to_hash to wrap Hash and Session classes - [`8f57e83`](https://github.com/rack/rack/commit/8f57e8380b65a0199f82267e383c3c633d374dc0) Handle case where session id key is requested but it is missing - [`799a520`](https://github.com/rack/rack/commit/799a520a015de5938bc01faa8e90b76589c6e7d3) Updating changelog for 2-1-stable - [`4fabf4d`](https://github.com/rack/rack/commit/4fabf4d70bb890d15a903ae4995c0349b0c69324) Bump version. - Additional commits viewable in [compare view](https://github.com/rack/rack/compare/2.0.6...2.1.2)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/mpgn/Rails-doubletap-RCE/network/alerts).