alphagov/gds-sso — pull request #2 by tomafro (2012-06-15 13:23:52+00:00)
Title: Rack does not need to be an explicit dependency.

The previous gemspec tied gds-sso to a particular version of rack. This forces any app using gds-sso to use versions of rails that use this version of rack. This prevents the use of versions that include serious security patches such as this: http://seclists.org/oss-sec/2012/q2/504. There are other reasons to tie apps to a specific version of rack (passenger oddness) but I don't think this is the right place.

Note, as the gemspec still includes a dependency on rails, there is still an implicit rack dependency, which will change as the version of rails used changes.