Adversarial sweep: eleven longstanding fixes - #2850

Open

ericproulx wants to merge 11 commits into

fix/adversarial-sweep-2026-08

Commits on Aug 1, 2026

Reject params nested deeper than the array scope declares

ericproulx
and
claude
committed
Tag path params as UTF-8 instead of leaving them binary

ericproulx
and
claude
committed
Answer 500 when an error response cannot be rendered

ericproulx
and
claude
committed
Give point-in-time copies their own stackable and rescue-handler stores

ericproulx
and
claude
committed
Warn when a rescue_from handler can never run

ericproulx
and
claude
committed
Let rescue_from :grape_exceptions outrank a catch-all class handler

ericproulx
and
claude
committed
Look up an entity by the object's own class before its element's

ericproulx
and
claude
committed
Render a redirect message as the plain text it claims to be

ericproulx
and
claude
committed
Keep a :version path capture when the API declares no version

ericproulx
and
claude
committed
Match Accept media types case-insensitively

ericproulx
and
claude
committed
Remove http_digest

ericproulx
and
claude
committed