[LostWarrior]

What

• que.gemspec: rack floor >= 2 -> >= 3.2.8 (upper bound < 4 unchanged)
• Gemfile: RACK_VERSION default 3.2.7 -> 3.2.8
• .github/workflows/tests.yml: smoke_test matrix ["2.2.5", "3.1"] -> ["3.2.8"]
• CHANGELOG entry

Why

The gemspec floor of >= 2 permitted rack versions carrying a large number of open advisories, and the smoke_test matrix actively built two of them:

rack	advisories	high
2.2.5	33	14
3.1.0	29	12
3.2.7 (Gemfile default)	4	1

Among the high ones: CVE-2025-27610 (LFI in Rack::Static), CVE-2026-22860 (directory traversal), CVE-2025-46727 (unbounded-parameter DoS in Rack::QueryParser), CVE-2026-34230 (quadratic select_best_encoding). The last two need only a GET, so they are reachable through the metrics server in bin/que, which binds 0.0.0.0 with no auth.

Why these versions

Every known consumer already resolves the same stack:

	rack	rackup
payments-service	3.2.8	2.3.1
que-ui (gocardless)	3.2.8	2.3.1
que-ui (upstream)	3.2.8	2.3.1

So the rack 2 leg was testing a configuration no consumer has.

How the pins got stale

All three date from Nov 2024. The matrix started as ["~> 2", "~> 3"] (5fcf274), which floated to the newest patch of each line, was tightened to ["2.2", "3.1"] then ["2.2.5", "3.1"] the same day, and never moved again. The Gemfile default was separately bumped 3.1 -> 3.2.7 on 2026-10-14 in a commit that left the matrix untouched.

If we would rather keep dual-major support than match the consumers, ["~> 2.2", "~> 3.2"] restores the float so the pins self-maintain. Happy to switch to that instead.

Verification

bundle lock resolves rack 3.2.8 / rackup 2.3.1. bundle audit and OSV.dev both report zero advisories against that resolution. Rubocop clean on Gemfile and que.gemspec.

Note for reviewers

This raises the gem's declared minimum, so it is a breaking change for compatibility even though no current consumer notices.

Follow-up (not in this PR)

With rack 2 unsupported, these become dead code:

• USE_RACKUP and the Rack::Handler::Puma branch, bin/que:16,175
• the rackup "~> 1.0" arm, Gemfile:27-31

Left out to keep this PR to dependency constraints only, since those touch the metrics server's runtime path.