🚨 [security] Update puma: 3.9.1 → 3.12.2 (minor)

[depfu[bot]]

---

🚨 Your version of puma has known security vulnerabilities 🚨

Advisory: CVE-2019-16770 Disclosed: December 05, 2019 URL: https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994

Keepalive thread overload/DoS in puma

A poorly-behaved client could use keepalive requests to monopolize
Puma's reactor and create a denial of service attack.

If more keepalive connections to Puma are opened than there are
threads available, additional connections will wait permanently if
the attacker sends requests frequently enough.

🚨 We recommend to merge and deploy this update as soon as possible! 🚨

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ puma (3.9.1 → 3.12.2) · Repo · Changelog

Release Notes

3.12.1

v3.12.1

3.11.0

• 2 features:

  • HTTP 103 Early Hints (#1403)
  • 421/451 status codes now have correct status messages attached (#1435)

• 9 bugfixes:

  • Environment config files (/config/puma/.rb) load correctly (#1340)
  • Specify windows dependencies correctly (#1434, #1436)
  • puma/events required in test helper (#1418)
  • Correct control CLI's option help text (#1416)
  • Remove a warning for unused variable in mini_ssl (#1409)
  • Correct pumactl docs argument ordering (#1427)
  • Fix an uninitialized variable warning in server.rb (#1430)
  • Fix docs typo/error in Launcher init (#1429)
  • Deal with leading spaces in RUBYOPT (#1455)

• 2 other:

  • Add docs about internals (#1425, #1452)
  • Tons of test fixes from @MSP-Greg (#1439, #1442, #1464)

3.10.0

• 3 features:

  • The status server has a new /gc and /gc-status command. (#1384)
  • The persistent and first data timeouts are now configurable (#1111)
  • Implemented RFC 2324 (#1392)

• 12 bugfixes:

  • Not really a Puma bug, but @NickolasVashchenko created a gem to workaround a Ruby bug that some users of Puma may be experiencing. See README for more. (#1347)
  • Fix hangups with SSL and persistent connections. (#1334)
  • Fix Rails double-binding to a port (#1383)
  • Fix incorrect thread names (#1368)
  • Fix issues with /etc/hosts and JRuby where localhost addresses were not correct. (#1318)
  • Fix compatibility with RUBYOPT="--enable-frozen-string-literal" (#1376)
  • Fixed some compiler warnings (#1388)
  • We actually run the integration tests in CI now (#1390)
  • No longer shipping unnecessary directories in the gemfile (#1391)
  • If RUBYOPT is nil, we no longer blow up on restart. (#1385)
  • Correct response to SIGINT (#1377)
  • Proper exit code returned when we receive a TERM signal (#1337)

• 3 refactors:

  • Various test improvements from @grosser
  • Rubocop (#1325)
  • Hoe has been removed (#1395)

• 1 known issue:

  • Socket activation doesn't work in JRuby. Their fault, not ours. (#1367)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[depfu[bot]]

Closed in favor of #184.

[depfu[bot]]

Closed in favor of #184.