🚨 [security] Update puma 6.1.0 → 6.4.2 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ puma (6.1.0 → 6.4.2) · Repo · Changelog

Security Advisories 🚨

🚨 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in puma

Impact

Prior to version 6.3.1, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling.

The following vulnerabilities are addressed by this advisory:

• Incorrect parsing of trailing fields in chunked transfer encoding bodies
• Parsing of blank/zero-length Content-Length headers\r\n

Patches

The vulnerability has been fixed in 6.3.1 and 5.6.7.

Workarounds

No known workarounds.

References

HTTP Request Smuggling

🚨 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in puma

Impact

Prior to version 6.3.1, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling.

The following vulnerabilities are addressed by this advisory:

• Incorrect parsing of trailing fields in chunked transfer encoding bodies
• Parsing of blank/zero-length Content-Length headers\r\n

Patches

The vulnerability has been fixed in 6.3.1 and 5.6.7.

Workarounds

No known workarounds.

References

HTTP Request Smuggling

Release Notes

6.4.2 (from changelog)

• Security
  • Limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. (GHSA-c2f4-cvqm-65w2)

6.4.1

• Bugfixes

  • DSL#warn_if_in_single_mode - fixup when workers set via CLI ([#3256])
  • Fix idle-timeout not working in cluster mode ([#3235], [#3228], [#3282], [#3283])
  • Fix worker 0 timing out during phased restart ([#3225], [#2786])
  • context_builder.rb - require openssl if verify_mode != 'none' ([#3179])
  • Make puma cluster process suitable as PID 1 ([#3255])
  • Improve Puma::NullIO consistency with real IO ([#3276])
  • extconf.rb - fixup to detect openssl info in Ruby build ([#3271], [#3266])
  • MiniSSL.java - set serialVersionUID, fix RaiseException deprecation ([#3270])
  • dsl.rb - fix warn_if_in_single_mode when WEB_CONCURRENCY is set ([#3265], [#3264])

• Maintenance

  • LOTS of test refactoring to make tests more stable and easier to write - thanks to @MSP-Greg!
  • Fix bug in tests re: TestPuma::HOST4 ([#3254])
  • Dockerfile for minimal repros: use Ruby 3.2, expect bundler installed ([#3245])
  • fix define_method calls, use Symbol parameter instead of String ([#3293])

• Docs

  • README.md - add the puma-acme plugin ([#3301])
  • Remove --keep-file-descriptors flag from systemd docs ([#3248])
  • Note symlink mechanism in restart documentation for hot restart ([#3298])

6.4.0

America is #1 in professional cycling, baby!

• Features

  • on_thread_exit hook ([#2920])
  • on_thread_start_hook ([#3195])
  • Shutdown on idle ([#3209], [#2580])
  • New error message when control server port taken ([#3204])

• Refactor

  • Remove Forwardable dependency ([#3191], #3190)
  • Update URLMap Regexp usage for Ruby v3.3 ([#3165])

• Bugfixes

  • Bring the cert_pem: parameter into parity with the cert: parameter to ssl_bind. ([#3174])
  • Fix using control server with IPv6 host ([#3181])
  • control_cli.rb - add require_relative 'log_writer' ([#3187])
  • Fix cases where fallback Rack response wasn't sent to the client ([#3094])

6.3.1

• Security
  • Address HTTP request smuggling vulnerabilities with zero-length Content Length header and trailer fields (GHSA-68xg-gqqm-vgj8)

6.3.0

Japan has 72 traditional microseasons. May 31 is the first day of 麦秋至, which means the time of the wheat/barley harvest.

• Features

  • Add dsl method supported_http_methods ([#3106], [#3014])
  • Puma error responses no longer have any fingerprints to indicate Puma ([#3161], [#3037])
  • Support decryption of SSL key ([#3133], [#3132])

• Bugfixes

  • Don't send 103 early hints response when only invalid headers are used ([#3163])
  • Handle malformed request path ([#3155], [#3148])
  • Misc lib file fixes - trapping additional errors, CI helper ([#3129])
  • Fixup req form data file upload with "r\n" line endings ([#3137])
  • Restore rack 1.6 compatibility ([#3156])

• Refactor

  • const.rb - Update Puma::HTTP_STATUS_CODES ([#3162])
  • Clarify Reactor#initialize ([#3151])

New Contributors

• @severin made their first contribution in #3156

Full Changelog: v6.2.2...v6.3.0

6.2.2

• Bugfixes
  • Fix Rack-related NameError by adding :: operator ([#3118], [#3117])

6.2.1

6.2.1 / 2023-03-31

• Bugfixes
  • Fix java 8 compatibility ([#3109], [#3108])
  • Always write io_buffer when in "enum bodies" branch. ([#3113], [#3112])
  • Fix warn_if_in_single_mode incorrect message ([#3111])

6.2.0

Pat Metheny Group - Speaking of Now

• Features

  • Ability to supply a custom logger ([#2770], [#2511])
  • Warn when clustered-only hooks are defined in single mode ([#3089])
  • Adds the on_booted event ([#2709])

• Bugfixes

  • Loggers - internal_write - catch Errno::EINVAL ([#3091])
  • commonlogger.rb - fix HIJACK time format, use constants, not strings ([#3074])
  • Fixed some edge cases regarding request hijacking ([#3072])

6.1.1

• Bugfixes
  • We no longer try to use the systemd plugin for JRuby ([#3079])
  • Allow ::Rack::Handler::Puma.run to work regardless of whether Rack/Rackup are loaded ([#3080])

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ nio4r (indirect, 2.5.8 → 2.7.0) · Repo · Changelog

Release Notes

2.7.0

What's Changed

• Fix changelog_uri in gemspec metadata by @MaximeD in #303
• Fix license by @voxik in #309
• Convert NIO objects to TypedData API by @casperisfine in #310

New Contributors

• @MaximeD made their first contribution in #303
• @voxik made their first contribution in #309
• @casperisfine made their first contribution in #310

Full Changelog: v2.6.1...v2.7.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 29 commits:

• Bump minor version.
• For some reason, I had to add `bake` as a direct dependency.
• Update changes.
• Convert NIO objects to TypedData API (#310)
• Fix license (#309)
• Fix changelog_uri in gemspec metadata (#303)
• Disable `bake-modernize` as it's not supported on Ruby v2.4.
• Bump patch version.
• Update copyrights/license & funding URI.
• Add bake-gem and bake-modernize for maintenance tasks.
• Don't update `io` which is subsequently stored. Retain the original. (#306)
• Resolve issue loading both nio and nio4r gems (#302)
• Avoid direct access to IO internals. (#301)
• Update changes.
• Remove codeql as it seems tricky to use without extra research.
• Prefer lower case.
• Create codeql.yml
• Fix conversion loses int precision using SIZET2NUM. (#297)
• Add more notes for building jruby package.
• Bump patch version.
• Fix order of OpenSSL require.
• Remove coveralls.
• Rework (VALUE* args) -> (VALUE arg) invalid function type. Fixes #287.
• Fix java 8 compatibility. (#292)
• Fix test workflow.
• Actions - remove Ubuntu-16.04, macOS to 11, add Ubuntu-22.04, Win 2022
• Add license file. Fixes #228, #282.
• allow missing `devkit`
• Add missing changelogs for v2.5.6 v2.5.7 v2.5.8

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)