#174 chore(deps): bump rack from 3.1.12 to 3.1.16 in /packaging Pull request opened by dependabot[bot] Bumps rack from 3.1.12 to 3.1.16. Changelog Sourced from rack's changelog.

# Changelog

All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference Keep A Changelog.

## Unreleased

### SPEC Changes

• Request environment keys must now be strings. #2310, [`@​jeremyevans`])

• Add

nil

as a valid return from a Response

body.to_path

(#2318, [`@​MSP-Greg`])

### Added

• Introduce

Rack::VERSION

constant. (#2199, [`@​ioquatix`])

• ISO-2022-JP encoded parts within MIME Multipart sections of an HTTP request body will now be converted to UTF-8. (#2245, `@​nappa`)

### Changed

• Invalid cookie keys will now raise an error. (#2193, [`@​ioquatix`])

•

Rack::MediaType#params

now handles empty strings. (#2229, [`@​jeremyevans`])

• Avoid unnecessary calls to the

ip_filter

lambda to evaluate

Request#ip

(#2287, [`@​willbryant`])

• Only calculate

Request#ip

once per request (#2292, [`@​willbryant`])

### Deprecated

•

Rack::Auth::AbstractRequest#request

is deprecated without replacement. (#2229, [`@​jeremyevans`])

•

Rack::Request#parse_multipart

(private method designed to be overridden in subclasses) is deprecated without replacement. (#2229, [`@​jeremyevans`])

### Removed

•

Rack::Request#values_at

is removed. (#2200, [`@​ioquatix`])

•

Rack::Logger

is removed with no replacement. (#2196, [`@​ioquatix`])

• Automatic cache invalidation in

Rack::Request#{GET,POST}

has been removed. (#2230, [`@​jeremyevans`])

• Support for

CGI::Cookie

has been removed. (#2332, [`@​ioquatix`])

### Fixed

•

Rack::RewindableInput::Middleware

no longer wraps a nil input. (#2259, `@​tt`)

• Fix

NoMethodError

in

Rack::Request#wrap_ipv6

when

x-forwarded-host

is empty. (#2270, `@​oieioi`)

• Fix the specification for

SERVER_PORT

which was incorrectly documented as required to be an

Integer

if present - it must be a

String

containing digits only. (#2296, [`@​ioquatix`])

•

SERVER_NAME

and

HTTP_HOST

are now more strictly validated according to the relevant specifications. (#2298, [`@​ioquatix`])

## [3.1.15] - 2025-05-18

• Optional support for

CGI::Cookie

if not available. (#2327, #2333, [`@​earlopain`])

## [3.1.14] - 2025-05-06

### Security

... (truncated) Commits • `df2f3f2` Bump patch version. • `aed514d` Fix ReDoS and consistency in multipart regexes • `352650a` Synchronize changelog. • `835e15b` Bump patch version. • `bd60f6e` Feature detect

CGI::Cookie

. (#2333) • `3c1a46d` Replace usage of

CGI::Cookie

(#2328) • `0ac5c57` Test on Ruby v3.4. • `5440b2c` Bump patch version. • `cd6b70a` Merge commit from fork • `0379537` Bump patch version. • Additional commits viewable in compare view [Dependabot compatibility score](https://camo.githubusercontent.com/c49aa7a84c90f74362b7bb80decbcad5586c1034bcf6751affa08b2bd31c55db/68747470733a2f2f646570656e6461626f742d6261646765732e6769746875626170702e636f6d2f6261646765732f636f6d7061746962696c6974795f73636f72653f646570656e64656e63792d6e616d653d7261636b267061636b6167652d6d616e616765723d62756e646c65722670726576696f75732d76657273696f6e3d332e312e3132266e65772d76657273696f6e3d332e312e3136) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting

@dependabot rebase

. --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: •

@dependabot rebase

will rebase this PR •

@dependabot recreate

will recreate this PR, overwriting any edits that have been made to it •

@dependabot merge

will merge this PR after your CI passes on it •

@dependabot squash and merge

will squash and merge this PR after your CI passes on it •

@dependabot cancel merge

will cancel a previously requested merge and block automerging •

@dependabot reopen

will reopen this PR if it is closed •

@dependabot close

will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually •

@dependabot show <dependency name> ignore conditions

will show all of the ignore conditions of the specified dependency •

@dependabot ignore this major version

will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) •

@dependabot ignore this minor version

will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) •

@dependabot ignore this dependency

will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the Security Alerts page. pact-foundation/pact-ruby-standalone