Security release.
Fixes a denial of service: a crafted search key (a very long q[...] condition key or q[s] sort value) was parsed in quadratic time, letting an unauthenticated request exhaust CPU. Ransack now rejects an over-long key as invalid. Applies to any endpoint calling ransack; not mitigated by attribute allowlisting.
GHSA-j3f8-w227-4hh8. Also released as 5.0.2 (and fixed in 6.0.0).