Bump rack from 2.2.22 to 2.2.23

[dependabot]

Bumps rack from 2.2.22 to 2.2.23.

Changelog

Sourced from rack's changelog.

[2.2.23] - 2026-04-01

Security

• CVE-2026-34763 Root directory disclosure via unescaped regex interpolation in Rack::Directory.
• CVE-2026-34230 Avoid O(n^2) algorithm in Rack::Utils.select_best_encoding which could lead to denial of service.
• CVE-2026-26961 Raise error for multipart requests with multiple boundary parameters.
• CVE-2026-34786 Rack::Static header_rules bypass via URL-encoded path mismatch.
• CVE-2026-34831 Content-Length mismatch in Rack::Files error responses.
• CVE-2026-34826 Multipart byte range processing allows denial of service via excessive overlapping ranges.
• CVE-2026-34830 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect.
• CVE-2026-34785 Rack::Static prefix matching can expose unintended files under the static root.
• CVE-2026-34829 Multipart parsing without Content-Length header allows unbounded chunked file uploads.

Commits

• f2af0c8 Bump patch version.
• 345b744 Fix tests for old Rubies.
• e2d8e30 Add version guard around non-default gems.
• add1a80 Fix handling of Errno::EPIPE in multipart tests.
• 54261ec Fix typo in test.
• a36f48b Add ostruct to Gemfile.
• 8883f0d Fix test expectation.
• 2287a3b Add logger to gemfile.
• e6540e5 Add Ruby v4.0 to the test matrix.
• c42e357 Add Content-Length size check in Rack::Multipart::Parser
• Additional commits viewable in compare view