[SECURITY]
- Fix memory leak of every request env in Plack::Middleware::Recursive (CVE-2026-110333)
- Plack::Request::Upload->basename never returns '', '.' or '..' (CVE-2026-110332)
- Plack::App::URLMap matches SERVER_PORT literally when stripping it from Host (CVE-2026-110335)
[BUG FIXES]
- Plack::Middleware::ErrorDocument restores the env after a subrequest, so outer
middleware such as AccessLog sees the original request (CVE-2026-110334)
[DOCUMENTATION]
- Document that Plack::Handler::FCGI and Apache2 keep dot segments in PATH_INFO and
warn against relying on front-server path-based access control (CVE-2026-110336)