5.5.2

Re-allows UTF-8 in HTTP header values

5.5.1

GHSA-48w2-rm65-62xx

4.3.10

Re-allows UTF-8 in HTTP header values

4.3.9

GHSA-48w2-rm65-62xx

5.5.0 - Zawgyi

5.5.0 / 2021-09-19

Zawgyi (Burmese: ဇော်ဂျီ) is a semi-immortal human alchemist and mystic with supernatural powers and often seen with a magic stick and a red hat. Zawgyi is one of the supernatural figures in Burmese mythology and folklore. Name chosen by new (Myanma!) contributor @ye-lin-aung.

The headline feature of this release is a new integration with the localhost gem. Localhost takes care of creating a self-signed SSL certificate for you in development. Require it in your config.ru:

# Sinatra
require './app'
require 'localhost/authority'
run Sinatra::Application

# Rails 
require 'localhost/authority' if Rails.env.development?
run MyRailsApp::Application

... and in the development environment, Puma will use a self-signed SSL cert generated by Localhost if no other cert is provided.
Note: Make sure you set up Puma to run on an SSL socket: puma -b 'ssl://localhost:9292' config.ru

• Features

  • Automatic SSL certificate provisioning for localhost, via localhost gem ([#2610], [#2257])
  • add support for the PROXY protocol (v1 only) ([#2654], [#2651])
  • Add a semantic CLI option for no config file ([#2689])

• Bugfixes

  • More elaborate exception handling - lets some dead pumas die. ([#2700], [#2699])
  • allow multiple after_worker_fork hooks ([#2690])
  • Preserve BUNDLE_APP_CONFIG on worker fork ([#2688], [#2687])

• Performance

  • Fix performance of server-side SSL connection close. ([#2675])

5.4.0 - Super Flight

• Features

  • Better/expanded names for threadpool threads ([#2657])
  • Allow pkg_config for OpenSSL ([#2648], [#1412])
  • Add rack_url_scheme to Puma::DSL, allows setting of rack.url_scheme header ([#2586], [#2569])

• Bugfixes

  • Binder#parse - allow for symlinked unix path, add create_activated_fds debug ENV ([#2643], [#2638])
  • Fix deprecation warning: minissl.c - Use Random.bytes if available ([#2642])
  • Client certificates: set session id context while creating SSLContext ([#2633])

• Refactor

  • Replace IO.select with IO#wait_* when checking a single IO ([#2666])

5.3.2

• Bugfixes
  • Gracefully handle Rack not accepting CLI options (#2630, #2626)
  • Fix sigterm misbehavior (#2629)
  • Improvements to keepalive-connection shedding (#2628)

This version was released 2021-05-21.

5.3.1

• Security
  • Close keepalive connections after the maximum number of fast inlined requests (#2625)

v4.3.8

• Security
  • Close keepalive connections after the maximum number of fast inlined requests (#2625)

5.3.0 - Sweetnighter

5.3.0 / 2021-05-07

Contributor @MSP-Greg codenamed this release "Sweetnighter".

• Features

  • Add support for Linux's abstract sockets ([#2564], [#2526])
  • Add debug to worker timeout and startup ([#2559], [#2528])
  • Print warning when running one-worker cluster ([#2565], [#2534])
  • Don't close systemd activated socket on pumactl restart ([#2563], [#2504])

• Bugfixes

  • systemd - fix event firing ([#2591], [#2572])
  • Immediately unlink temporary files ([#2613])
  • Improve parsing of HTTP_HOST header ([#2605], [#2584])
  • Handle fatal error that has no backtrace ([#2607], [#2552])
  • Fix timing out requests too early ([#2606], [#2574])
  • Handle segfault in Ruby 2.6.6 on thread-locals ([#2567], [#2566])
  • Server#closed_socket? - parameter may be a MiniSSL::Socket ([#2596])
  • Define UNPACK_TCP_STATE_FROM_TCP_INFO in the right place ([#2588], [#2556])
  • request.rb - fix chunked assembly for ascii incompatible encodings, add test ([#2585], [#2583])

• Performance

  • Reset peerip only if remote_addr_header is set ([#2609])
  • Reduce puma_parser struct size ([#2590])

• Refactor

  • Refactor drain on shutdown ([#2600])
  • Micro optimisations in wait_for_less_busy_worker feature ([#2579])
  • Lots of test fixes