From 50eeced68a213510af0c2c6c0dede9eafb7cead9 Mon Sep 17 00:00:00 2001
From: Sergei Poljanski <me@asxp.io>
Date: Thu, 12 Nov 2026 06:07:55 +0400
Subject: [PATCH] deps: update rack to 3.2.8

rack 3.2.6 has a denial of service in the multipart parser
(CVE-2026-125111, GHSA-5v64-555j-wjxm): parsed data stays in the scan
buffer, so a crafted request body makes memory grow without bound.
The site is read-only but reachable from the internet, so take the
fix along with asxpio.

Only the lock changes; the Gemfile already allows ~> 3.2.

Assisted-by: Claude:fable-5-2
---
 Gemfile.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 79cd3ff..12a931e 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -53,7 +53,7 @@ GEM
     pg (1.6.3-x86_64-linux-musl)
     puma (6.6.1)
       nio4r (~> 2.0)
-    rack (3.2.6)
+    rack (3.2.8)
     rack-protection (4.2.1)
       base64 (>= 0.1.0)
       logger (>= 1.6.0)