Bump rack from 3.0.11 to 3.1.20

[dependabot]

Bumps rack from 3.0.11 to 3.1.20.

Changelog

Sourced from rack's changelog.

[3.1.20] - 2026-02-16

Security

• CVE-2026-25500 XSS injection via malicious filename in Rack::Directory.
• CVE-2026-22860 Directory traversal via root prefix bypass in Rack::Directory.

[3.1.19] - 2025-11-03

Fixed

• Multipart parser: limit MIME header size check to the unread buffer region to avoid false multipart mime part header too large errors when previously read data accumulates in the scan buffer. (#2392, @​alpaca-tc, @​willnet, @​krororo)

[3.1.18] - 2025-10-10

Security

• CVE-2025-61780 Improper handling of headers in Rack::Sendfile may allow proxy bypass.
• CVE-2025-61919 Unbounded read in Rack::Request form parsing can lead to memory exhaustion.

[3.1.17] - 2025-10-07

Security

• CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
• CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
• CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)

[3.1.16] - 2025-06-04

Security

• CVE-2025-49007 Fix ReDoS in multipart request.

[3.1.15] - 2025-05-18

• Optional support for CGI::Cookie if not available. (#2327, #2333, [@​earlopain])

[3.1.14] - 2025-05-06

⚠️ This release includes a security fix that may cause certain routes in previously working applications to fail if query parameters exceed 4,096 in count or 4 MB in total size. See rack/rack#2356 for more details.

Security

• CVE-2025-46727 Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion.

[3.1.13] - 2025-04-13

• Ensure Rack::ETag correctly updates response body. (#2324, [@​ioquatix])

... (truncated)

Commits

• See full diff in compare view

[yedhink]

@dependabot recreate

[neetogit-bot]

This PR bumps rack which is managed centrally via Gemfile.common.rb in neeto-commons-backend. The upgrade must happen there first, be tested across products, and released via a compliance update.

Tracking issue: https://github.com/neetozone/neeto-commons-backend/issues/4996

Closing this PR.

---

This comment was auto-generated by NeetoGit.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.