[dependabot]

Bumps rack from 3.2.7 to 3.2.8.

Changelog

Sourced from rack's changelog.

[3.2.8] - 2026-10-30

Security

• GHSA-5v64-555j-wjxm Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion.
• GHSA-wvg4-6p58-3gh3 Rack::Static header rules were matched against an unnormalized path, allowing dot segments to bypass them.
• GHSA-2j8w-xcrc-x985 Rack::Request#host_with_port, #base_url, and #url returned the raw authority when it was invalid; host_with_port now returns nil in that case.
• GHSA-p8x9-v4hv-2w4g Multipart requests with more than one boundary parameter were accepted when the first value was empty or began with a quote, semicolon, or comma, bypassing the guard added for CVE-2026-26961.

Fixed

• Rack::Multipart::UploadedFile now delegates keyword arguments to the wrapped tempfile. Calls such as uploaded_file.readlines(chomp: true) raised TypeError on Ruby 3.0+. (#2481, #2501, @​SeanLF)

Commits

• 5f511d7 Bump patch version.
• 3e01d71 Update changelog.
• a295123 Reject multipart content types with a boundary parameter before the parsed one.
• 49386f4 Don't leak invalid Host through host_with_port.
• 18a07fe Normalize static header rule paths before matching.
• 244e75a Remove parsed bytes from the multipart buffer while reading parts.
• 3519905 Backport UploadedFile keyword forwarding fix (#2501)
• See full diff in compare view