From db8a9e207db545686a139ac28584f2d9d98ae551 Mon Sep 17 00:00:00 2001
From: Sergei Poljanski <me@asxp.io>
Date: Thu, 12 Nov 2026 06:07:54 +0400
Subject: [PATCH] deps: update rack to 3.2.8

rack 3.2.6 has a denial of service in the multipart parser
(CVE-2026-125111, GHSA-5v64-555j-wjxm): parsed data stays in the scan
buffer, so a crafted upload makes memory grow without bound. The app
is reachable from the internet and accepts multipart forms.

Only the lock changes; the Gemfile already allows ~> 3.2.

Assisted-by: Claude:fable-5-2
---
 Gemfile.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index e6b3057..9b42fbe 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -80,7 +80,7 @@ GEM
       prawn (>= 1.3.0, < 3.0.0)
     puma (6.6.1)
       nio4r (~> 2.0)
-    rack (3.2.6)
+    rack (3.2.8)
     rack-protection (4.2.1)
       base64 (>= 0.1.0)
       logger (>= 1.6.0)