Bump rack from 1.4.1 to 1.4.7

[dependabot]

Bumps rack from 1.4.1 to 1.4.7.

Changelog

Sourced from rack's changelog.

Changelog

All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference Keep A Changelog.

Unreleased

SPEC Changes

• rack.session request environment entry must respond to to_hash and return unfrozen Hash. (@​jeremyevans)
• Request environment cannot be frozen. (@​jeremyevans)
• CGI values in the request environment with non-ASCII characters must use ASCII-8BIT encoding. (@​jeremyevans)

Added

• rackup supports multiple -r options and will require all arguments. (@​jeremyevans)
• Server supports an array of paths to require for the :require option. (@​khotta)
• Files supports multipart range requests. (@​fatkodima)
• Multipart::UploadedFile supports an IO-like object instead of using the filesystem, using :filename and :io options. (@​jeremyevans)
• Multipart::UploadedFile supports keyword arguments :path, :content_type, and :binary in addition to positional arguments. (@​jeremyevans)
• Static supports a :cascade option for calling the app if there is no matching file. (@​jeremyevans)
• Session::Abstract::SessionHash#dig. (@​jeremyevans)
• Response.[] and MockResponse.[] for creating instances using status, headers, and body. (@​ioquatix)

Changed

• Etag will continue sending ETag even if the response should not be cached. (@​henm)
• Request#host_with_port no longer includes a colon for a missing or empty port. (@​AlexWayfer)
• All handlers uses keywords arguments instead of an options hash argument. (@​ioquatix)
• Files handling of range requests no longer return a body that supports to_path, to ensure range requests are handled correctly. (@​jeremyevans)
• Multipart::Generator only includes Content-Length for files with paths, and Content-Disposition filename if the UploadedFile instance has one. (@​jeremyevans)
• Request#ssl? is true for the wss scheme (secure websockets). (@​jeremyevans)

Removed

• Session::Abstract::SessionHash#transform_keys, no longer needed. (pavel)
• URLMap::INFINITY and URLMap::NEGATIVE_INFINITY, in favor of Float::INFINITY. (@​ch1c0t)
• Deprecation of Rack::File. It will be deprecated again in rack 2.2 or 3.0. (@​rafaelfranca)
• Support for Ruby 2.2 as it is well past EOL. (@​ioquatix)

Fixed

• CommonLogger includes SCRIPT_NAME when logging. (@​Erol)
• Utils.parse_nested_query correctly handles empty queries, using an empty instance of the params class instead of a hash. (@​jeremyevans)
• Directory correctly escapes paths in links. (@​yous)
• Request#delete_cookie and related Utils methods handle :domain and :path options in same call. (@​jeremyevans)
• Request#delete_cookie and related Utils methods do an exact match on :domain and :path options. (@​jeremyevans)
• Static no longer adds headers when a gzipped file request has a 304 response. (@​chooh)
• ContentLength sets Content-Length response header even for bodies not responding to to_ary. (@​jeremyevans)
• Multipart::Parser uses a slightly modified parser to avoid denial of service when parsing MIME boundaries. (@​aiomaster)
• Thin handler supports options passed directly to Thin::Controllers::Controller. (@​jeremyevans)

... (truncated)

Commits

• f5c0968 bumping version
• bf5bd20 Merge pull request #814 from johnnaegle/only_increment_open_file_count_for_fi...
• e4f4df5 Explicitly fail when hitting the multipart limit
• 1ae52c1 bumping the release
• 88b067e raise an exception if the parameters are too deep
• 688516a Prevent signals from being sent to pid 0
• 9939d40 Bump version number
• 56374f2 Update README for todays releases
• 5c9b0de Prevent symlink path traversals
• 6c39dfc Use secure_compare for hmac comparison
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.