chore(deps): update marcel requirement from ~> 1.0 to >= 1, < 3

[dependabot]

Updates the requirements on marcel to permit the latest version.

Release notes

Sourced from marcel's releases.

v2.1.0

Marcel 2.1.0 refreshes the MIME database to the Apache Tika 4.0.0 release (#177). No API, Ruby requirement, canonical type, alias, or extension changes.

New detection

• Android binary XML (application/vnd.android.axml) — compiled AndroidManifest.xml and res/*.xml files from APKs, previously application/octet-stream.

Fixes

• application/timestamped-data (RFC 5544) content detection now recognizes definite-length DER encodings, not just the indefinite-length form.
• Sibling CMS content types in the 1.2.840.113549.1.9.16.1.* arc (compressedData, authData, …) are no longer misidentified as application/timestamped-data.

v2.0.0

Marcel 2.0.0 modernizes the toolchain, hardens the release pipeline, and teaches the content sniffer several new families of formats. It is a major release because it drops old Rubies and changes the canonical type returned for some inputs — details below so you can scan for the ones that affect you.

Breaking changes

• Ruby 3.3 or newer is required (was 2.3). (#170)
• Canonical type changes — the same bytes or filename may now return a different (more standard) type:
  • Aliased types now resolve to their canonical form on output (#171): audio/x-aac → audio/aac, audio/x-flac → audio/flac, audio/vnd.wave → audio/x-wav, text/x-yaml → application/yaml, application/x-debian-package → application/vnd.debian.binary-package, application/x-xliff+xml → application/xliff+xml. Lookups by any alias still work.
  • image/bmp;format=compressed is now plain image/bmp (#148).
  • .cr2 files are image/x-canon-cr2 instead of image/x-raw-canon (#172).
  • OpenXPS (.oxps) is split from XPS (#171).
  • The XML/HTML detection work below can relabel documents that previously fell back to application/xml, text/html, or application/octet-stream.

Security & hardening

A review of the detection pipeline landed as a series of PRs (#157–#164):

• MIME data is validated before table generation, and the generated tables are checked in CI (#157, rake tables:check).
• HTML and XHTML magic matches only bounded opening-tag patterns instead of unanchored scans (#158).
• IO edge cases — partial reads, unseekable and unrewindable IOs, non-string input — are handled explicitly while sniffing (#159).
• Declared MIME types are validated rather than trusted (#160).
• Marcel's detection boundary — what sniffing does and does not promise — is documented in the README (#161).
• CI runs with locked dependencies (#163), and the release workflow builds and publishes the same verified gem artifact with sha256 recorded and sigstore attestation (#164), with the gem's contents verified by script (#162, #173).

New detection

• OOXML documents (.docx/.xlsx/.pptx and their macro-enabled variants) are identified from the ZIP central directory, regardless of which application produced them (#169).
• XML vocabularies are identified by their root element, the way Apache Tika does: RSS, Atom, KML, Apple property lists, XSLT, ONIX, iWork flat XML, Office 2003 XML, and friends (#173 and #175, fixing #48).
• Canon CR2 raw images (#172).
• RAR archives (#155, @​tristan-f-r) and Google Sheets shortcuts (#156, @​tristan-f-r).
• AVIF image sequences (avis brand) (#151, @​mm12) and audio-only .m4a files (#147).
• HTML detection also checks the end of the document for closing tags (#146).

Performance

• The common-type fast path is restored with subtype-aware ordering, so common formats like JPEG are identified in ~25 IO reads instead of hundreds, without preempting subtype matchers (#172, #174).
• Sniffing uses IO#seek where possible instead of reading and discarding, including for regexp magic (#144, #145).

... (truncated)

Commits

• f1e0fec Marcel 2.1.0 (#178)
• fe45c80 Update Tika MIME data to the 4.0.0 release (#177)
• 9dccbfa Marcel 2.0.0 (#176)
• f6f5ce6 Accept valid XML documents the token scan wrongly rejected (#175)
• 71603ce Identify XML vocabularies by their root element (#173)
• 90855e0 Merge pull request #174 from rails/common-magic-fast-path
• ef1cbbd Restore the common-type magic fast path without preempting subtype matchers
• f71831d Probe common magic types within their priority band (#172)
• 56e5402 Respect MIME type aliases (#171)
• 097d677 Sniff ZIP central directories to identify OOXML documents (#169)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)