build(deps): bump rack from 2.2.6.4 to 2.2.23 in /docs/multiple-tests/multi-patterns/src

[dependabot]

Bumps rack from 2.2.6.4 to 2.2.23.

Release notes

Sourced from rack's releases.

v2.2.8.1

What's Changed

• Fixed ReDoS in Accept header parsing [CVE-2024-26146]
• Fixed ReDoS in Content Type header parsing [CVE-2024-25126]
• Reject Range headers which are too large [CVE-2024-26141]

Full Changelog: rack/rack@v2.2.8...v2.2.8.1

v2.2.8

What's Changed

• Limit file extension length of multipart tempfiles (2.2 backport) by @​dentarg in rack/rack#2075
• CHANGELOG: Add missing 2.2.7 by @​tisba in rack/rack#2081
• Update cookie.rb by @​dchandekstark in rack/rack#2092
• Prefer ubuntu-latest for testing. by @​ioquatix in rack/rack#2095
• Fix inefficient assert pattern in Rack::Lint [2-2-stable] by @​skipkayhil in rack/rack#2101
• Regenerate SPEC [2-2-stable] by @​skipkayhil in rack/rack#2102

New Contributors

• @​tisba made their first contribution in rack/rack#2081
• @​dchandekstark made their first contribution in rack/rack#2092

Full Changelog: rack/rack@v2.2.7...v2.2.8

v2.2.7

What's Changed

• Correct the year number in the changelog by @​kimulab in rack/rack#2015
• Support underscore in host names for Rack 2.2 (Fixes #2070) by @​jeremyevans in rack/rack#2071

New Contributors

• @​kimulab made their first contribution in rack/rack#2015

Full Changelog: rack/rack@v2.2.6.4...v2.2.7

Changelog

Sourced from rack's changelog.

[2.2.23] - 2026-04-01

Security

• CVE-2026-34763 Root directory disclosure via unescaped regex interpolation in Rack::Directory.
• CVE-2026-34230 Avoid O(n^2) algorithm in Rack::Utils.select_best_encoding which could lead to denial of service.
• CVE-2026-26961 Raise error for multipart requests with multiple boundary parameters.
• CVE-2026-34786 Rack::Static header_rules bypass via URL-encoded path mismatch.
• CVE-2026-34831 Content-Length mismatch in Rack::Files error responses.
• CVE-2026-34826 Multipart byte range processing allows denial of service via excessive overlapping ranges.
• CVE-2026-34830 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect.
• CVE-2026-34785 Rack::Static prefix matching can expose unintended files under the static root.
• CVE-2026-34829 Multipart parsing without Content-Length header allows unbounded chunked file uploads.

[2.2.22] - 2026-02-16

Security

• CVE-2026-25500 XSS injection via malicious filename in Rack::Directory.
• CVE-2026-22860 Directory traversal via root prefix bypass in Rack::Directory.

[2.2.21] - 2025-11-03

Fixed

• Multipart parser: limit MIME header size check to the unread buffer region to avoid false multipart mime part header too large errors when previously read data accumulates in the scan buffer. (#2392, @​alpaca-tc, @​willnet, @​krororo)

[2.2.20] - 2025-10-10

Security

• CVE-2025-61780 Improper handling of headers in Rack::Sendfile may allow proxy bypass.
• CVE-2025-61919 Unbounded read in Rack::Request form parsing can lead to memory exhaustion.

[2.2.19] - 2025-10-07

Security

• CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
• CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
• CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)

[2.2.18] - 2025-09-25

Security

• CVE-2025-59830 Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion via semicolon-separated parameters.

[2.2.17] - 2025-06-03

... (truncated)

Commits

• f2af0c8 Bump patch version.
• 345b744 Fix tests for old Rubies.
• e2d8e30 Add version guard around non-default gems.
• add1a80 Fix handling of Errno::EPIPE in multipart tests.
• 54261ec Fix typo in test.
• a36f48b Add ostruct to Gemfile.
• 8883f0d Fix test expectation.
• 2287a3b Add logger to gemfile.
• e6540e5 Add Ruby v4.0 to the test matrix.
• c42e357 Add Content-Length size check in Rack::Multipart::Parser
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[codacy-production]

Not up to standards ⛔

🔴 Issues 1 critical · 4 high · 3 medium · 3 minor

Alerts:
⚠ 8 issues (≤ 1 issue of at least medium severity)
⚠ 11 issues (≤ 0 issues of at least minor severity)

Results:
11 new issues

Category	Results
Security	3 minor 4 high 1 critical 3 medium

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

This PR updates the 'rack' dependency to address security vulnerabilities (ReDoS, DoS, and directory disclosure). However, the overall quality is currently not up to standards according to Codacy. While patching 'rack' is necessary, the 'Gemfile.lock' still contains critical vulnerabilities in 'nokogiri' (libxml2 risk) and 'activesupport' (RCE risk) that should be addressed to ensure a secure environment.

Furthermore, there is a lack of automated test scenarios to verify that this upgrade does not regress multipart form parsing or static file serving, which were specifically touched by the security patches in 'rack' 2.2.23.

About this PR

• The PR lacks automated tests to verify compatibility with rack 2.2.23 or to ensure that the security fixes do not cause regressions in multipart parsing and static file serving. Additionally, ensure the Gemfile.lock actually reflects the version update as the diff was not fully verifiable in the review context.

2 comments outside of the diff

docs/multiple-tests/multi-patterns/src/Gemfile.lock

_{line 43 🔴 HIGH RISK}
Nokogiri 1.15.3 contains multiple security vulnerabilities, including a critical risk (GHSA-353f-x4gh-cqq8) in the packaged libxml2. While this PR updates rack, it leaves this critical dependency unpatched. Consider updating nokogiri in docs/multiple-tests/multi-patterns/src/Gemfile.lock to version 1.18.9 or higher.

_{line 26 🔴 HIGH RISK}
ActiveSupport 5.0.0.rc2 is an obsolete version containing a critical vulnerability (CVE-2020-8165) that allows potential remote code execution. Consider updating activesupport, actionpack, and actionview to at least 5.2.4.3 or a modern 7.x version.

Test suggestions

• Verify that the application boots and handles basic requests with rack 2.2.23.
• Verify that multipart form parsing and static file serving function correctly with the security patches applied.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that the application boots and handles basic requests with rack 2.2.23.
2. Verify that multipart form parsing and static file serving function correctly with the security patches applied.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}