Sourced from rack's changelog.

[3.2.0] - 2025-07-31

This release continues Rack's evolution toward a cleaner, more efficient foundation while maintaining backward compatibility for most applications. The breaking changes primarily affect deprecated functionality, so most users should experience a smooth upgrade with improved performance and standards compliance.

SPEC Changes

• Request environment keys must now be strings. (#2310, [@​jeremyevans])
• Add nil as a valid return from a Response body.to_path (#2318, [@​MSP-Greg])
• Rack::Lint#check_header_value is relaxed, only disallowing CR/LF/NUL characters. (#2354, [@​ioquatix])

Added

• Introduce Rack::VERSION constant. (#2199, [@​ioquatix])
• ISO-2022-JP encoded parts within MIME Multipart sections of an HTTP request body will now be converted to UTF-8. (#2245, @​nappa)
• Add Rack::Request#query_parser= to allow setting the query parser to use. (#2349, [@​jeremyevans])
• Add Rack::Request#form_pairs to access form data as raw key-value pairs, preserving duplicate keys. (#2351, [@​matthewd])

Changed

• Invalid cookie keys will now raise an error. (#2193, [@​ioquatix])
• Rack::MediaType#params now handles empty strings. (#2229, [@​jeremyevans])
• Avoid unnecessary calls to the ip_filter lambda to evaluate Request#ip (#2287, [@​willbryant])
• Only calculate Request#ip once per request (#2292, [@​willbryant])
• Rack::Builder #use, #map, and #run methods now return nil. (#2355, [@​ioquatix])
• Directly close the body in Rack::ConditionalGet when the response is 304 Not Modified. (#2353, [@​ioquatix])
• Directly close the body in Rack::Head when the request method is HEAD(#2360, @​skipkayhil)

Deprecated

• Rack::Auth::AbstractRequest#request is deprecated without replacement. (#2229, [@​jeremyevans])
• Rack::Request#parse_multipart (private method designed to be overridden in subclasses) is deprecated without replacement. (#2229, [@​jeremyevans])

Removed

• Rack::Request#values_at is removed. (#2200, [@​ioquatix])
• Rack::Logger is removed with no replacement. (#2196, [@​ioquatix])
• Automatic cache invalidation in Rack::Request#{GET,POST} has been removed. (#2230, [@​jeremyevans])
• Support for CGI::Cookie has been removed. (#2332, [@​ioquatix])

Fixed

• Rack::RewindableInput::Middleware no longer wraps a nil input. (#2259, @​tt)
• Fix NoMethodError in Rack::Request#wrap_ipv6 when x-forwarded-host is empty. (#2270, @​oieioi)
• Fix the specification for SERVER_PORT which was incorrectly documented as required to be an Integer if present - it must be a String containing digits only. (#2296, [@​ioquatix])
• SERVER_NAME and HTTP_HOST are now more strictly validated according to the relevant specifications. (#2298, [@​ioquatix])
• Rack::Lint now disallows PATH_INFO="" SCRIPT_NAME="". (#2298, [@​jeremyevans])

• b68251c Bump minor version.
• a6ba717 Minor updates to README and CHANGELOG.
• 9e10390 Directly close the body in Rack::Head. (#2360)
• 36156aa Ensure truthy is used consistently in the context of hijacking support in R...
• 7d09de4 Tidy up checks for script_name, path_info. (#2357)
• 5ce04c1 lint.rb consistency improvements. (#2352)
• 5f06728 Regenerate SPEC.rdoc.
• 9453930 Make Rack::Lint disallow PATH_INFO="" SCRIPT_NAME="" (#2316)
• 6828a17 Directly close the body. (#2353)
• f01e2b5 Relax check_header_value. (#2354)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)