Bump rack from 3.1.20 to 3.1.21 in the bundler group across 1 directory

[dependabot]

Bumps the bundler group with 1 update in the / directory: rack.

Updates rack from 3.1.20 to 3.1.21

Changelog

Sourced from rack's changelog.

[3.1.21] - 2026-04-01

Security

• CVE-2026-34763 Root directory disclosure via unescaped regex interpolation in Rack::Directory.
• CVE-2026-34230 Avoid O(n^2) algorithm in Rack::Utils.select_best_encoding which could lead to denial of service.
• CVE-2026-32762 Forwarded header semicolon injection enables Host and Scheme spoofing.
• CVE-2026-26961 Raise error for multipart requests with multiple boundary parameters.
• CVE-2026-34786 Rack::Static header_rules bypass via URL-encoded path mismatch.
• CVE-2026-34831 Content-Length mismatch in Rack::Files error responses.
• CVE-2026-34826 Multipart byte range processing allows denial of service via excessive overlapping ranges.
• CVE-2026-34835 Rack::Request accepts invalid Host characters, enabling host allowlist bypass.
• CVE-2026-34830 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect.
• CVE-2026-34785 Rack::Static prefix matching can expose unintended files under the static root.
• CVE-2026-34829 Multipart parsing without Content-Length header allows unbounded chunked file uploads.
• CVE-2026-34827 Multipart header parsing allows denial of service via escape-heavy quoted parameters.

Commits

• ae84311 Bump patch version.
• 87961c3 Fix typo in test.
• fd1c23d Add logger to gemfile.
• c59d924 Fix test expectation.
• 176f468 Add Ruby v4.0 to the test matrix.
• 2856934 Drop EOL Rubies from external tests.
• 17ce783 Limit the number of quoted escapes during multipart parsing
• 367a2a0 Add Content-Length size check in Rack::Multipart::Parser
• a17cb99 Fix root prefix bug in Rack::Static
• 59a0966 Only do a simple substitution on the x-accel-mapping paths
• Additional commits viewable in compare view

[nobe4]

@dependabot recreate

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml