Bump rack-proxy from 0.8.3 to 1.0.2

[dependabot]

Bumps rack-proxy from 0.8.3 to 1.0.2.

Release notes

Sourced from rack-proxy's releases.

v1.0.2 — dev-dependency security bump (json), housekeeping

Housekeeping — no library behavior changes. No action is needed by users: the shipped gem does not depend on json and was never affected by the advisory below.

Security

• Development dependency json bumped 2.21.1 → 2.21.2 to clear CVE-2026-71847 / GHSA-9hj4-r449-hfvc (JSON::ResumableParser#partial_value dereferences a freed input buffer on truncated duplicate-key streams). json reaches this repo only transitively (standard → rubocop → json) and lives solely in the development Gemfile.lock; the bump keeps the CI bundler-audit gate green. (#143)

Changed

• Release workflow: the laggy rubygems full-index await was replaced with a versions-API check, so a successful publish no longer fails the run. (#142)

Full diff: ncr/rack-proxy@v1.0.1...v1.0.2

v1.0.1 — docs modernization + housekeeping

Docs and housekeeping — no library behavior changes.

Changed

• README modernized: badges, quick start, a "How it works" pipeline overview, grouped options, and tightened recipes.
• Removed the internal modernization roadmap document, completed by 1.0.0.
• Development dependencies refreshed (rake 13.4.2, test-unit 3.7.8, rack-test 2.2.0) and CI bumped to actions/checkout@v7. (#136–#139)

Full diff: ncr/rack-proxy@v1.0.0...v1.0.1

v1.0.0 — the modernization + security-hardening release

The 2026 modernization + security-hardening release. From 1.0.0 on this project follows SemVer strictly: breaking changes only in majors.

Breaking changes

Read this list before upgrading from 0.8.x; everything else below is additive or a compatible fix. See the README's "Upgrading" section for migration steps.

• Host-derived (dynamic) backends are refused by default. With no :backend and no env["rack.backend"], requests now get 502 unless you pass allow_dynamic_backend: true. A bare Rack::Proxy.new is no longer an open proxy. Combine the opt-in with a backend_allowed? allowlist.

... (truncated)

Changelog

Sourced from rack-proxy's changelog.

[1.0.2] - 2026-09-01

Housekeeping — no library behavior changes. No action is needed by users: the shipped gem does not depend on json and was never affected by the advisory below.

Security

• Development dependency json bumped 2.21.1 → 2.21.2 to clear CVE-2026-71847 / GHSA-9hj4-r449-hfvc (JSON::ResumableParser#partial_value dereferences a freed input buffer on truncated duplicate-key streams). json reaches this repo only transitively (standard → rubocop → json) and lives solely in the development Gemfile.lock; the bump keeps the CI bundler-audit gate green.

Changed

• Release workflow: the laggy rubygems full-index await was replaced with a versions-API check, so a successful publish no longer fails the run. (#142)

[1.0.1] - 2026-07-23

Docs and housekeeping — no library behavior changes.

Changed

• README modernized: badges, quick start, a "How it works" pipeline overview, grouped options, and tightened recipes.
• Removed the internal modernization roadmap document, completed by 1.0.0.
• Development dependencies refreshed (rake 13.4.2, test-unit 3.7.8, rack-test 2.2.0) and CI bumped to actions/checkout@v7. (#136–#139)

[1.0.0] - 2026-07-18

The 2026 modernization + security-hardening release. From 1.0.0 on this project follows SemVer strictly: breaking changes only in majors.

Breaking changes

Read this list before upgrading from 0.8.x; everything else below is additive or a compatible fix. See the README's "Upgrading" section for migration steps.

• Host-derived (dynamic) backends are refused by default. With no :backend and no env["rack.backend"], requests now get 502 unless you pass allow_dynamic_backend: true. A bare Rack::Proxy.new is no longer an open proxy. Combine the opt-in with a backend_allowed? allowlist.
• net_http_hacked is gone — the file, require "net_http_hacked", and the begin_request_hacked/end_request_hacked methods (see Removed).
• The bundled examples left the gem — require "rack_proxy_examples/..." raises LoadError; copy the snippets from examples/ instead (see Removed).

... (truncated)

Commits

• dbb0d26 Merge pull request #143 from ncr/release-1.0.2
• 4b4f3c1 Bump version to 1.0.2
• d1aac9b Bump dev dependency json to 2.21.2 (CVE-2026-71847 / GHSA-9hj4-r449-hfvc)
• 36ed90b Merge pull request #142 from ncr/fix-release-await
• b208316 Release workflow: replace the laggy full-index await with a versions-API check
• 48002cc Merge pull request #141 from ncr/release-1.0.1
• bc5e54d Bump version to 1.0.1
• f043a7a Merge pull request #139 from ncr/dependabot/bundler/rack-test-2.2.0
• 47d4117 Merge pull request #138 from ncr/dependabot/bundler/test-unit-3.7.8
• 87dba09 Merge pull request #137 from ncr/dependabot/bundler/rake-13.4.2
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

MAIN-####
(populate the link above to make sure your PR is linked to the Jira ticket)

⚠️ This repo is Continuously Deployed: make sure you follow the guidance ⚠️