asxpi/datacenterbingo
asxpi/datacenterbingo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

deps: update rack to 3.2.8
All checks were successful
Build and Deploy to Production / test (push) Successful in 35s
Details
Build and Deploy to Production / build (push) Successful in 51s
Details
Build and Deploy to Production / deploy (push) Successful in 37s
Details

Browse source 
rack 3.2.6 has a denial of service in the multipart parser
(CVE-2026-125111, GHSA-5v64-555j-wjxm): parsed data stays in the scan
buffer, so a crafted request body makes memory grow without bound.
The site is read-only but reachable from the internet, so take the
fix along with asxpio.

Only the lock changes; the Gemfile already allows ~> 3.2.

Assisted-by: Claude:fable-5-2
This commit is contained in:
Sergei Poljanski 2026-11-12 06:07:55 +04:00
commit 50eeced68a
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Gemfile.lock
View file

@ -53,7 +53,7 @@ GEM
pg (1.6.3-x86_64-linux-musl)
puma (6.6.1)
nio4r (~> 2.0)
rack (3.2.6)
rack (3.2.8)
rack-protection (4.2.1)
base64 (>= 0.1.0)
logger (>= 1.6.0)