Pull requests

• Add opt-in :deny_missing_origin to HttpOrigin, fix wrong docs

  #2195·horaciob opened Oct 17, 2026Contributor·

  ·

• Keep network-path references (//host/path) intact in uri/redirect

  #2194·januththedev opened Sep 28, 2026·

  ·

• Clarify that the catch-all error handler doesn't run under :after_handler

  #2193·hikmetba-bit opened Sep 19, 2026·

  ·
  1

• Allow token characters in Accept header parameters

  #2191·dylanpulver opened Sep 2, 2026·

  ·
  2

• Avoid bare raise for maintainability and compatibility

  #2190·udzura opened Aug 28, 2026Contributor·

  ·

• Keep keyword arguments as keywords in two middleware entry points

  #2189·SeanLF opened Jul 27, 2026·

  ·

• Forward keyword arguments explicitly instead of via ruby2_keywords

  #2186·SeanLF opened Jul 23, 2026·

  ·

  · v5.0
  1

  4

• Make Sinatra::TemplateCache thread-safe

  #2180·hexonal opened Jul 15, 2026Contributor·

  ·
  1

  7

• Roll back all response state on pass, not just content-type (#2177)

  #2179·SeanLF opened Jul 11, 2026·

  ·

  · v5.0
  1

• Add support for the QUERY HTTP method

  #2176·louismachin opened Jul 4, 2026·

  ·

  · v5.0
  3

• Production-safe Rack 3 callable-body streaming (5.0): server-aware disconnect reaping, finite TTL, concurrency cap, SSE helpers

  #2172·SeanLF opened Jun 2, 2026·

  ·

  · v5.0
  1

  4

• Add IndifferentHash#symbolize_keys for keyword-argument splatting

  #2171·SeanLF opened Jun 1, 2026·

  ·
  3

• Fix multi_json 1.21 deprecations in sinatra-contrib JSON helper (backward compatible)

  #2169·SeanLF opened May 27, 2026·

  ·
  1

  4

• Fixing issue when when ARGV has -v

  bug
  #2168·matobinder opened May 26, 2026·

  ·
  4

• feat: skip host_authorization when protection is disabled

  #2167·SAY-5 opened May 24, 2026·

  ·

  · v5.0
  1

  4

• Mustermann 4.0

  #2163·rkh opened Apr 22, 2026Member·2 of 3 tasks·

  ·

  · v5.0
  16

• test: enable valid empty PATH_INFO mounted scenarios

  #2157·wwenrr opened Apr 1, 2026Contributor·

  ·
  1

  3

• fix: raise BadRequest for null byte in uri/url helper

  #2156·wwenrr opened Apr 1, 2026Contributor·

  ·
  1

  2

• Add additionally-supported CSP directives not listed in Rack::Protection::ContentSecurityPolicy

  #2102·davetron5000 opened Apr 27, 2025Contributor·

  ·
  6

• Add code-example for using Sinatra with turbo-streams and server-side broadcasts

  #2100·adrians opened Apr 27, 2025·

  ·
  4

• Re-compute content length *only* if it makes sense to do so.

  #2031·ioquatix opened Jul 11, 2024Contributor·

  ·
  15

• Rack no longer unescapes cookie keys, so these tests no longer make sense.

  #2030·ioquatix opened Jul 11, 2024Contributor·

  ·
  1

  11