Grape security PR changes error middleware and auth surface, verify instrumentation compatibility

[sarahg423]

Background

Grape PR #2789 addresses two security issues:

1. HTML escaping bypass in Grape::Middleware::Error#rack_response. The existing code only escaped when content-type was exactly text/html, but text/html; charset=utf-8 skipped escaping. The fix compares the media type only.

2. Auth bypass on mounted bare Rack apps. Bare Rack apps mounted with mount bypass the endpoint middleware stack. The fix adds a compile-time warning.

Impact

Scout instruments Grape's middleware stack. The change to rack_response modifies how error responses are constructed. If Scout hooks into this method, the new media-type comparison could change observed behavior.

Suggested Action

• Test Scout Grape instrumentation against a Grape version with PR #2789
• Check if Scout hooks into Grape::Middleware::Error#rack_response
• Confirm Scout's middleware insertion point is not affected by the mounted-app warning logic

References

• ruby-grape/grape#2789

Filed by marketing pipeline.