* 3-0-sec: (24 commits)
  bump version
  Update changelog
  Fix ReDoS vulnerability in multipart parser
  Fix ReDoS in Rack::Utils.get_byte_ranges
  Forbid control characters in attributes
  Bump patch version.
  `Rack::Request#POST` should consistently raise errors. (#2010)
  Fix Rack::Lint error message for HTTP_CONTENT_TYPE and HTTP_CONTENT_LENGTH (#2007)
  Rack::MethodOverride handle QueryParser::ParamsTooDeepError (#2006)
  Bump patch version.
  Fix Regexp deprecated third argument with Regexp::NOENCODING (#1998)
  Update tests to work on latest Rubies. (#1999)
  Bump patch version.
  Allow passing through streaming bodies. (#1993)
  Remove unnecessary executable bit from test files (#1992)
  Fix Utils.build_nested_query to URL-encode all query string fields (#1989)
  Trim trailing white space throughout the project (#1990)
  Fix some typos (#1991)
  Remove leading dot to fix compatibility with latest cgi gem. (#1988)
  Fix outdated Rack::Builder rdocs and remove Lobster references (#1986)
  ...