Bump rack-contrib from 1.1.0 to 2.5.0

[dependabot]

Bumps rack-contrib from 1.1.0 to 2.5.0.

Release notes

Sourced from rack-contrib's releases.

Omnibus release of dooooooooom

The list of changes in this release is long, and should serve as a warning to me to make releases more often, as it cuts down on typing. Thanks to everyone who made PRs, checked PRs, merged PRs, and... renewed PRs. Special thanks to Andrew Konchin (@​andrykonchin) who is responsible for over half the changes in this monster release, and who has come on board as a maintainer.

This release removes the Rack::Runtime and Rack::Config middleware. This may seem like a foolhardy thing to do in a minor release, but rack itself ships with functionally identical versions. Compatibility has been maintained by having require "rack/contrib/<thing>" still work, but that should be changed to require "rack/<thing>" instead.

• A #close method was added to the body that is returned by Rack::Signals.

• A stub CHANGELOG.md, pointing to the canonical source of release notes, has been added.

• Thread safety issues in Rack::Access, Rack::CommonCookies, and Rack::Deflect have been fixed. Additionally, the need for a thread-safe external cache object in Rack::LazyConditionalGet has been documented.

• A SPEC violation in Rack::CSSHTTPRequest has been fixed.

• Case-sensitive header problems in a whole bunch of middlewares have been fixed.

• Rack::JSONBodyParser now only rescues JSON::ParserError if it is raised within the middleware's own code. Exceptions raised by the application itself will now be left alone to be handled elsewhere.

• All string literals are now frozen.

• Residual ye olde Ruby compatibility checks were removed from Rack::Backstage, Rack::MailExceptions and Rack::NestedParams.

• The length calculation in Rack::JSONP has been made simpler.

Stuck at home? Why not release your favourite collection of Rack contributions!

A healthy crop of fixes and new features in this release. Thanks to everyone who contributed, and welcome to Andrew Konchin, as the newest recipient of a commit bit.

• New middleware Rack::JSONBodyParser: a better-designed replacement for Rack::PostBodyContentTypeParser, with a more appropriate name (given that they both only handle JSON natively, having JSON in the name seems like a good idea), and with a better set of default behaviours and knobs. It is also significantly faster than PostBodyContentTypeParser.

• Rack::PostBodyContentTypeParser: this middleware's interface is a bit of a mess, which makes it nearly impossible to improve in a backwards-compatible manner. As a result, its use has been deprecated, in favour of Rack::JSONBodyParser.

• Several middlewares that set Content-Length headers were fixed to use

... (truncated)

Commits

• d5265bc Bump minor version.
• 0eec2a9 Specify a maximum number of runs to limit the request params -> DoS. (#191)
• ddd96e9 Allow Rack::Locale to match languages with variants (#190)
• 70930e0 Add security reporting contact
• 6afd9ad Don't bother testing on Ruby 2.2 as it's failing and way EOL.
• 64735ac Bump minor version.
• f3a2799 Prefer to use version constant for release management.
• 599f768 Rack::JSONBodyParser: rescue all parser exceptions (#184)
• a9cd089 Support Rack 3 (#187)
• b97c5e7 Remove another crazy spec
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.