🚨 [security] Update puma 6.1.0 → 6.4.2 (minor)

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ puma (6.1.0 → 6.4.2) · Repo · Changelog

Security Advisories 🚨

🚨 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in puma

Impact

Prior to version 6.3.1, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling.

The following vulnerabilities are addressed by this advisory:

Incorrect parsing of trailing fields in chunked transfer encoding bodies

Parsing of blank/zero-length Content-Length headers\r\n

Patches

The vulnerability has been fixed in 6.3.1 and 5.6.7.

Workarounds

No known workarounds.

References

HTTP Request Smuggling

🚨 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in puma

Impact

Prior to version 6.3.1, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling.

The following vulnerabilities are addressed by this advisory:

Incorrect parsing of trailing fields in chunked transfer encoding bodies

Parsing of blank/zero-length Content-Length headers\r\n

Patches

The vulnerability has been fixed in 6.3.1 and 5.6.7.

Workarounds

No known workarounds.

References

HTTP Request Smuggling

Release Notes

6.4.2 (from changelog)

Security

Limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. (GHSA-c2f4-cvqm-65w2)

6.4.1

Bugfixes

DSL#warn_if_in_single_mode - fixup when workers set via CLI ([#3256])

Fix idle-timeout not working in cluster mode ([#3235], [#3228], [#3282], [#3283])

Fix worker 0 timing out during phased restart ([#3225], [#2786])

context_builder.rb - require openssl if verify_mode != 'none' ([#3179])

Make puma cluster process suitable as PID 1 ([#3255])

Improve Puma::NullIO consistency with real IO ([#3276])

extconf.rb - fixup to detect openssl info in Ruby build ([#3271], [#3266])

MiniSSL.java - set serialVersionUID, fix RaiseException deprecation ([#3270])

dsl.rb - fix warn_if_in_single_mode when WEB_CONCURRENCY is set ([#3265], [#3264])

Maintenance

LOTS of test refactoring to make tests more stable and easier to write - thanks to @MSP-Greg!

Fix bug in tests re: TestPuma::HOST4 ([#3254])

Dockerfile for minimal repros: use Ruby 3.2, expect bundler installed ([#3245])

fix define_method calls, use Symbol parameter instead of String ([#3293])

Docs

README.md - add the puma-acme plugin ([#3301])

Remove --keep-file-descriptors flag from systemd docs ([#3248])

Note symlink mechanism in restart documentation for hot restart ([#3298])

6.4.0

America is #1 in professional cycling, baby!

Features

on_thread_exit hook ([#2920])

on_thread_start_hook ([#3195])

Shutdown on idle ([#3209], [#2580])

New error message when control server port taken ([#3204])

Refactor

Remove Forwardable dependency ([#3191], #3190)

Update URLMap Regexp usage for Ruby v3.3 ([#3165])

Bugfixes

Bring the cert_pem: parameter into parity with the cert: parameter to ssl_bind. ([#3174])

Fix using control server with IPv6 host ([#3181])

control_cli.rb - add require_relative 'log_writer' ([#3187])

Fix cases where fallback Rack response wasn't sent to the client ([#3094])

6.3.1

Security

Address HTTP request smuggling vulnerabilities with zero-length Content Length header and trailer fields (GHSA-68xg-gqqm-vgj8)

6.3.0

Japan has 72 traditional microseasons. May 31 is the first day of 麦秋至, which means the time of the wheat/barley harvest.

Features

Add dsl method supported_http_methods ([#3106], [#3014])

Puma error responses no longer have any fingerprints to indicate Puma ([#3161], [#3037])

Support decryption of SSL key ([#3133], [#3132])

Bugfixes

Don't send 103 early hints response when only invalid headers are used ([#3163])

Handle malformed request path ([#3155], [#3148])

Misc lib file fixes - trapping additional errors, CI helper ([#3129])

Fixup req form data file upload with "r\n" line endings ([#3137])

Restore rack 1.6 compatibility ([#3156])

Refactor

const.rb - Update Puma::HTTP_STATUS_CODES ([#3162])

Clarify Reactor#initialize ([#3151])

New Contributors

@severin made their first contribution in #3156

Full Changelog: v6.2.2...v6.3.0

6.2.2

Bugfixes

Fix Rack-related NameError by adding :: operator ([#3118], [#3117])

6.2.1

6.2.1 / 2023-03-31

Bugfixes

Fix java 8 compatibility ([#3109], [#3108])

Always write io_buffer when in "enum bodies" branch. ([#3113], [#3112])

Fix warn_if_in_single_mode incorrect message ([#3111])

6.2.0

Pat Metheny Group - Speaking of Now

Features

Ability to supply a custom logger ([#2770], [#2511])

Warn when clustered-only hooks are defined in single mode ([#3089])

Adds the on_booted event ([#2709])

Bugfixes

Loggers - internal_write - catch Errno::EINVAL ([#3091])

commonlogger.rb - fix HIJACK time format, use constants, not strings ([#3074])

Fixed some edge cases regarding request hijacking ([#3072])

6.1.1

Bugfixes

We no longer try to use the systemd plugin for JRuby ([#3079])

Allow ::Rack::Handler::Puma.run to work regardless of whether Rack/Rackup are loaded ([#3080])

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ nio4r (indirect, 2.5.8 → 2.7.0) · Repo · Changelog

Release Notes

2.7.0

What's Changed

Fix changelog_uri in gemspec metadata by @MaximeD in #303

Fix license by @voxik in #309

Convert NIO objects to TypedData API by @casperisfine in #310

New Contributors

@MaximeD made their first contribution in #303

@voxik made their first contribution in #309

@casperisfine made their first contribution in #310

Full Changelog: v2.6.1...v2.7.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 29 commits:

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update

@depfu recreate
Recreates this PR, overwriting any edits that you've made to it

@depfu merge
Merges this PR once your tests are passing and conflicts are resolved

@depfu cancel merge
Cancels automatic merging of this PR

@depfu close
Closes this PR and deletes the branch

@depfu reopen
Restores the branch and reopens this PR (if it's closed)

@depfu pause
Ignores all future updates for this dependency and closes this PR

@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR

@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

sanger / gatekeeper