[TRACKING] - Update to Rack 3

[YOU54F]

Scope

This ticket aims to documents the steps required to upgrade the Pact Broker Application to support Rack 3.

Rationale

The Ruby Rack gem has had a major bump to version 3.

https://github.com/rack/rack/blob/main/UPGRADE-GUIDE.md

The Pact Broker has dependencies on projects which use Rack, namely webmachine and Sinatra

pact_broker/pact_broker.gemspec

Line 58 in 476af02

gem.add_runtime_dependency "webmachine", ">= 2.0.0.beta", "< 3.0"

pact_broker/Gemfile

Line 11 in 476af02

gem "sinatra", "~> 3.0", require: false

Sinatra supports Rack 3, in version 4.x+ however Webmachine does not yet support Rack 3 which impedes our progress.

Affected Issues

1. Sinatra CVE cve-2024-21510 present in 3.x
   • The current image has vulnerabilities, so can we release new one with newer alpine updates pact-broker-docker#216

Work required

TBC

[github-actions]

🤖 Great news! We've labeled this issue as smartbear-supported and created a tracking ticket in PactFlow's Jira (PACT-2960). We'll keep work public and post updates here. Meanwhile, feel free to check out our docs. Thanks for your patience!

[rholshausen]

Webmachine does not yet support Rack 3 which impedes our progress

Just a note, Webmachine is not a Rack application, it is an independent server framework. There is a Rack adapter that is used to allowing mounting Webmachine resources in a Rack app. All we need to do is create a Rack 3 adapter, which I don't think will be very hard as the adapter is only about 50 lines of code.

[rholshausen]

Created branch chore/rack3

This won't take long.

[rholshausen]

Green build! https://github.com/pact-foundation/pact_broker/actions/runs/12921273536

[YOU54F]

This has now been released in https://github.com/pact-foundation/pact_broker/releases/tag/v2.113.1

However in trying to consume in the pact-broker-docker project, I am getting errors

pact-broker-1  | 2025-03-04 14:22:47 +0000 Rack app ("GET /diagnostic/status/heartbeat" - (172.18.0.4)): #<LoadError: cannot load such file -- webrick>

I also noted the example project was included in the repo fails when run, and invoked

https://github.com/pact-foundation/pact-broker-docker/actions/runs/13654993034/job/38171882397#step:9:779

it shows the same cannot load such file -- webrick error, if webrick (which has explicitly been added in the example project as part of the Rack 3 PR) is removed.

When the example project is run bundle exec rackup, it will return errors.

Rack::Lint::LintError: uppercase character in header name: Vary (Rack::Lint::LintError)

and for other headers.

[YOU54F]

This is now complete

https://github.com/pact-foundation/pact_broker/releases/tag/v2.113.2 contains a fix for the above.

Thanks @rholshausen