ruby-grape / grape / 42519225313

100%

push

github

Drop support for Rack 2.2 and 3.0 (#3063)

Rack's security policy covers its current release series and the one
before it, now 3.2 and 3.1. Rack 3.0 has had no release since 3.0.18
(2025-05-22) and is still affected by GHSA-2j8w-xcrc-x985, fixed only in
3.1.23 and 3.2.8. Grape now requires Rack >= 3.1 and stops testing
against 2.2 and 3.0: their gemfiles and CI matrix entries are removed.

With Rack::BadRequest and Rack::Headers always present, the version
branches in lib go. RACK_ERRORS is [EOFError, Rack::BadRequest], and
Grape::Util::Header, an alias that only existed to pick between
Rack::Headers and Rack::Utils::HeaderHash, is removed in favour of
Rack::Headers, now required explicitly next to the other rack requires.
Router#cascade? no longer falls back to X-Cascade, the Rack 2 spelling
#3064 still read from a mounted app's plain Hash. The specs lose their
Rack 2 and pre-3.1 branches, and the README's Rack::ETag note no longer
names 3.0.

Grape::Request::KNOWN_HEADERS no longer copies the 73 names of
Rack::Headers::KNOWN_HEADERS by hand: it takes them from Rack and adds
the 53 request headers Rack leaves out (Accept, Host, User-Agent, Cookie,
X-Forwarded-*, ...). Rack's table alone would make #headers build each
of those names, 45 allocations instead of 11 for a typical request.
The env keys are the same 126 as before. Names are now Rack's own frozen
lowercase Strings, which Rack::Headers#[]= stores without downcasing a
copy, so a typical request allocates 10 instead of 11.

The header names Grape writes are now spelled in lowercase, as the Rack
3 SPEC requires: allow, location, transfer-encoding and x-cascade. Each
went through a Rack::Headers or Rack::Response that lowercased it
already, so responses are unchanged; the code no longer relies on it.
The router's default 404 headers, an internal constant, are a plain
Hash rather than a Rack::Headers.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

1525 of 1525 branches covered (100.0%)

Branch coverage included in aggregate %.

16 of 16 new or added lines in 8 files covered. (100.0%)

4561 of 4561 relevant lines covered (100.0%)

19338.48 hits per line