-
Notifications
You must be signed in to change notification settings - Fork 3
/
Copy pathfile.History.html
3194 lines (2570 loc) · 176 KB
/
file.History.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html>
<html>
<head>
<meta charset='UTF-8'>
<meta name='viewport' content='width=device-width, initial-scale=1.0, user-scalable=no'>
<meta name='apple-touch-fullscreen' content='yes'>
<meta name='apple-mobile-web-app-capable' content='yes'>
<meta name='apple-mobile-web-app-status-bar-style' content='rgba(228,228,228,1.0)'>
<title>File: History — Puma master</title>
<link rel='stylesheet' type='text/css' href='../css/y_fonts.css' />
<link rel='stylesheet' type='text/css' href='../css/highlight.github.css' />
<link rel='stylesheet' type='text/css' href='../css/y_style.css' />
<link rel='stylesheet' type='text/css' href='../css/y_list.css' />
<link rel='stylesheet' type='text/css' href='../css/y_color.css' />
<script type='text/javascript'>
var pathId = "History",
relpath = '';
var t2Info = {
CSEP: '.',
ISEP: '#',
NSEP: '::'
};
</script>
<script type='text/javascript' charset='utf-8' src='../js/highlight.pack.js'></script>
<script type='text/javascript' charset='utf-8' src='../js/y_app.js'></script>
</head>
<body>
<svg id='y_wait' class viewBox='0 0 90 90'></svg>
<div id='settings' class='hidden'></div>
<div id='y_list' class='d h'>
<header id='list_header'></header>
<nav id= 'list_nav' class='y_nav l_nav'>
<ul id='list_items'></ul>
</nav>
</div>
<div id='y_toc' class='f h'>
<header id='toc_header'></header>
<nav id= 'toc_nav' class='y_nav t_nav'>
<ol id='toc_items'></ol>
</nav>
</div>
<div id='y_main' tabindex='-1'>
<header id='y_header'>
<div id='y_menu'>
<a id='home_no_xhr' href='/'>Home</a> »
<a href='.'>Puma master</a> »
<a href='_index.html'>Index</a> »
<span class='title'><a id='t2_doc_top' href='#'>File: History ▲</a></span>
</div>
<a id='list_href' href="class_list.html"></a>
<div id='y_measure_em' class='y_measure'></div>
<div id='y_measure_vh' class='y_measure'></div>
<span id='y_measure_50pre' class='y_measure'><code>123456789_123456789_123456789_123456789_123456789_</code></span>
</header>
<div id='content' class='file'>
<h2>6.4.3 / 2024-09-19</h2>
<ul>
<li>Security
<ul>
<li>Discards any headers using underscores if the non-underscore version also exists. Without this, an attacker could overwrite values set by intermediate proxies (e.g. X-Forwarded-For). (<a href="https://github.com/puma/puma/security/advisories/GHSA-9hf4-67fc-4vf4">CVE-2024-45614</a>/GHSA-9hf4-67fc-4vf4)</li>
</ul></li>
</ul>
<h2>6.4.2 / 2024-01-08</h2>
<ul>
<li>Security
<ul>
<li>Limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. (<a href="https://github.com/puma/puma/security/advisories/GHSA-c2f4-cvqm-65w2">GHSA-c2f4-cvqm-65w2</a>)</li>
</ul></li>
</ul>
<h2>6.4.1 / 2024-01-03</h2>
<ul>
<li><p>Bugfixes</p>
<ul>
<li>DSL#warn_if_in_single_mode - fixup when workers set via CLI (<a href="https://github.com/puma/puma/pull/3256" title="PR by @MSP-Greg, merged 2023-10-16">#3256</a>)</li>
<li>Fix <code>idle-timeout</code> not working in cluster mode (<a href="https://github.com/puma/puma/pull/3235" title="PR by @joshuay03, merged 2023-10-03">#3235</a>, <a href="https://github.com/puma/puma/issues/3228" title="Issue by @davidalejandroaguilar, closed 2023-10-03">#3228</a>, <a href="https://github.com/puma/puma/issues/3282" title="Issue by @bensheldon, closed 2024-01-02">#3282</a>, <a href="https://github.com/puma/puma/pull/3283" title="PR by @joshuay03, merged 2024-01-02">#3283</a>)</li>
<li>Fix worker 0 timing out during phased restart (<a href="https://github.com/puma/puma/pull/3225" title="PR by @joshuay03, merged 2023-09-27">#3225</a>, <a href="https://github.com/puma/puma/issues/2786" title="Issue by @vitiokss, closed 2023-09-27">#2786</a>)</li>
<li>context_builder.rb - require openssl if verify_mode != 'none' (<a href="https://github.com/puma/puma/pull/3179" title="PR by @MSP-Greg, merged 2023-09-26">#3179</a>)</li>
<li>Make puma cluster process suitable as PID 1 (<a href="https://github.com/puma/puma/pull/3255" title="PR by @casperisfine, merged 2023-10-19">#3255</a>)</li>
<li>Improve Puma::NullIO consistency with real IO (<a href="https://github.com/puma/puma/pull/3276" title="PR by @casperisfine, merged 2023-11-16">#3276</a>)</li>
<li>extconf.rb - fixup to detect openssl info in Ruby build (<a href="https://github.com/puma/puma/pull/3271" title="PR by @MSP-Greg, merged 2023-10-30">#3271</a>, <a href="https://github.com/puma/puma/issues/3266" title="Issue by @Dragonicity, closed 2023-10-30">#3266</a>)</li>
<li>MiniSSL.java - set serialVersionUID, fix RaiseException deprecation (<a href="https://github.com/puma/puma/pull/3270" title="PR by @MSP-Greg, merged 2023-10-30">#3270</a>)</li>
<li>dsl.rb - fix warn_if_in_single_mode when WEB_CONCURRENCY is set (<a href="https://github.com/puma/puma/pull/3265" title="PR by @MSP-Greg, merged 2023-10-25">#3265</a>, <a href="https://github.com/puma/puma/issues/3264" title="Issue by @dentarg, closed 2023-10-25">#3264</a>)</li>
</ul></li>
<li><p>Maintenance</p>
<ul>
<li>LOTS of test refactoring to make tests more stable and easier to write - thanks to @MSP-Greg!</li>
<li>Fix bug in tests re: TestPuma::HOST4 (<a href="https://github.com/puma/puma/pull/3254" title="PR by @casperisfine, merged 2023-10-11">#3254</a>)</li>
<li>Dockerfile for minimal repros: use Ruby 3.2, expect bundler installed (<a href="https://github.com/puma/puma/pull/3245" title="PR by @olleolleolle, merged 2023-10-02">#3245</a>)</li>
<li>fix define_method calls, use Symbol parameter instead of String (<a href="https://github.com/puma/puma/pull/3293" title="PR by @MSP-Greg, merged 2023-12-21">#3293</a>)</li>
</ul></li>
<li><p>Docs</p>
<ul>
<li>README.md - add the puma-acme plugin (<a href="https://github.com/puma/puma/pull/3301" title="PR by @benburkert, merged 2023-12-29">#3301</a>)</li>
<li>Remove <code>--keep-file-descriptors</code> flag from systemd docs (<a href="https://github.com/puma/puma/pull/3248" title="PR by @dentarg, merged 2023-10-04">#3248</a>)</li>
<li>Note symlink mechanism in restart documentation for hot restart (<a href="https://github.com/puma/puma/pull/3298" title="PR by @til, merged 2023-12-26">#3298</a>)</li>
</ul></li>
</ul>
<h2>6.4.0 / 2023-09-21</h2>
<ul>
<li><p>Features</p>
<ul>
<li>on_thread_exit hook (<a href="https://github.com/puma/puma/pull/2920" title="PR by @biinari, merged 2023-07-11">#2920</a>)</li>
<li>on_thread_start_hook (<a href="https://github.com/puma/puma/pull/3195" title="PR by @binarygit, merged 2023-08-15">#3195</a>)</li>
<li>Shutdown on idle (<a href="https://github.com/puma/puma/pull/3209" title="PR by @joshuay03, merged 2023-09-04">#3209</a>, <a href="https://github.com/puma/puma/issues/2580" title="Issue by @schuetzm, closed 2023-09-04">#2580</a>)</li>
<li>New error message when control server port taken (<a href="https://github.com/puma/puma/pull/3204" title="PR by @dhavalsingh, merged 2023-08-25">#3204</a>)</li>
</ul></li>
<li><p>Refactor</p>
<ul>
<li>Remove <code>Forwardable</code> dependency (<a href="https://github.com/puma/puma/pull/3191" title="PR by @MSP-Greg, merged 2023-08-31">#3191</a>, #3190)</li>
<li>Update URLMap Regexp usage for Ruby v3.3 (<a href="https://github.com/puma/puma/pull/3165" title="PR by @fallwith, merged 2023-06-06">#3165</a>)</li>
</ul></li>
<li><p>Bugfixes</p>
<ul>
<li>Bring the cert_pem: parameter into parity with the cert: parameter to ssl_bind. (<a href="https://github.com/puma/puma/pull/3174" title="PR by @copiousfreetime, merged 2023-06-11">#3174</a>)</li>
<li>Fix using control server with IPv6 host (<a href="https://github.com/puma/puma/pull/3181" title="PR by @MSP-Greg, merged 2023-06-23">#3181</a>)</li>
<li>control_cli.rb - add require_relative 'log_writer' (<a href="https://github.com/puma/puma/pull/3187" title="PR by @MSP-Greg, merged 2023-06-30">#3187</a>)</li>
<li>Fix cases where fallback Rack response wasn't sent to the client (<a href="https://github.com/puma/puma/pull/3094" title="PR by @Vuta, merged 2023-07-23">#3094</a>)</li>
</ul></li>
</ul>
<h2>6.3.1 / 2023-08-18</h2>
<ul>
<li>Security
<ul>
<li>Address HTTP request smuggling vulnerabilities with zero-length Content Length header and trailer fields (<a href="https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8">GHSA-68xg-gqqm-vgj8</a>)</li>
</ul></li>
</ul>
<h2>6.3.0 / 2023-05-31</h2>
<ul>
<li><p>Features</p>
<ul>
<li>Add dsl method <code>supported_http_methods</code> (<a href="https://github.com/puma/puma/pull/3106" title="PR by @MSP-Greg, merged 2023-05-29">#3106</a>, <a href="https://github.com/puma/puma/issues/3014" title="Issue by @kyledrake, closed 2023-05-29">#3014</a>)</li>
<li>Puma error responses no longer have any fingerprints to indicate Puma (<a href="https://github.com/puma/puma/pull/3161" title="PR by @MSP-Greg, merged 2023-05-27">#3161</a>, <a href="https://github.com/puma/puma/issues/3037" title="Issue by @daisy1754, closed 2023-05-27">#3037</a>)</li>
<li>Support decryption of SSL key (<a href="https://github.com/puma/puma/pull/3133" title="PR by @stanhu, merged 2023-04-30">#3133</a>, <a href="https://github.com/puma/puma/issues/3132" title="Issue by @stanhu, closed 2023-04-30">#3132</a>)</li>
</ul></li>
<li><p>Bugfixes</p>
<ul>
<li>Don't send 103 early hints response when only invalid headers are used (<a href="https://github.com/puma/puma/pull/3163" title="PR by @MSP-Greg, merged 2023-05-27">#3163</a>)</li>
<li>Handle malformed request path (<a href="https://github.com/puma/puma/pull/3155" title="PR by @dentarg, merged 2023-05-14">#3155</a>, <a href="https://github.com/puma/puma/issues/3148" title="Issue by @dentarg, closed 2023-05-14">#3148</a>)</li>
<li>Misc lib file fixes - trapping additional errors, CI helper (<a href="https://github.com/puma/puma/pull/3129" title="PR by @MSP-Greg, merged 2023-05-02">#3129</a>)</li>
<li>Fixup req form data file upload with "r\n" line endings (<a href="https://github.com/puma/puma/pull/3137" title="PR by @MSP-Greg, merged 2023-04-30">#3137</a>)</li>
<li>Restore rack 1.6 compatibility (<a href="https://github.com/puma/puma/pull/3156" title="PR by @severin, merged 2023-05-16">#3156</a>)</li>
</ul></li>
<li><p>Refactor</p>
<ul>
<li>const.rb - Update Puma::HTTP_STATUS_CODES (<a href="https://github.com/puma/puma/pull/3162" title="PR by @MSP-Greg, merged 2023-05-23">#3162</a>)</li>
<li>Clarify Reactor#initialize (<a href="https://github.com/puma/puma/pull/3151" title="PR by @nateberkopec, merged 2023-05-12">#3151</a>)</li>
</ul></li>
</ul>
<h2>6.2.2 / 2023-04-17</h2>
<ul>
<li>Bugfixes
<ul>
<li>Fix Rack-related NameError by adding :: operator (<a href="https://github.com/puma/puma/pull/3118" title="PR by @ninoseki, merged 2023-04-01">#3118</a>, <a href="https://github.com/puma/puma/issues/3117" title="Issue by @ninoseki, closed 2023-04-01">#3117</a>)</li>
</ul></li>
</ul>
<h2>6.2.1 / 2023-03-31</h2>
<ul>
<li>Bugfixes
<ul>
<li>Fix java 8 compatibility (<a href="https://github.com/puma/puma/pull/3109" title="PR by @ahorek, merged 2023-03-31">#3109</a>, <a href="https://github.com/puma/puma/issues/3108" title="Issue by @treviateo, closed 2023-03-31">#3108</a>)</li>
<li>Always write io_buffer when in "enum bodies" branch. (<a href="https://github.com/puma/puma/pull/3113" title="PR by @collinsauve, merged 2023-03-31">#3113</a>, <a href="https://github.com/puma/puma/issues/3112" title="Issue by @dmke, closed 2023-03-31">#3112</a>)</li>
<li>Fix warn_if_in_single_mode incorrect message (<a href="https://github.com/puma/puma/pull/3111" title="PR by @adzap, merged 2023-03-30">#3111</a>)</li>
</ul></li>
</ul>
<h2>6.2.0 / 2023-03-29</h2>
<ul>
<li><p>Features</p>
<ul>
<li>Ability to supply a custom logger (<a href="https://github.com/puma/puma/pull/2770" title="PR by @vzajkov, merged 2023-03-29">#2770</a>, <a href="https://github.com/puma/puma/issues/2511" title="Issue by @jchristie55332, closed 2021-12-12">#2511</a>)</li>
<li>Warn when clustered-only hooks are defined in single mode (<a href="https://github.com/puma/puma/pull/3089" title="PR by @Vuta, merged 2023-03-06">#3089</a>)</li>
<li>Adds the on_booted event (<a href="https://github.com/puma/puma/pull/2709" title="PR by @rodzyn, merged 2023-02-20">#2709</a>)</li>
</ul></li>
<li><p>Bugfixes</p>
<ul>
<li>Loggers - internal_write - catch Errno::EINVAL (<a href="https://github.com/puma/puma/pull/3091" title="PR by @MSP-Greg, merged 2023-03-28">#3091</a>)</li>
<li>commonlogger.rb - fix HIJACK time format, use constants, not strings (<a href="https://github.com/puma/puma/pull/3074" title="PR by @MSP-Greg, merged 2023-03-14">#3074</a>)</li>
<li>Fixed some edge cases regarding request hijacking (<a href="https://github.com/puma/puma/pull/3072" title="PR by @MSP-Greg, merged 2023-02-17">#3072</a>)</li>
</ul></li>
</ul>
<h2>6.1.1 / 2023-02-28</h2>
<ul>
<li>Bugfixes
<ul>
<li>We no longer try to use the systemd plugin for JRuby (<a href="https://github.com/puma/puma/pull/3079" title="PR by @mohamedhafez, merged 2023-02-24">#3079</a>)</li>
<li>Allow ::Rack::Handler::Puma.run to work regardless of whether Rack/Rackup are loaded (<a href="https://github.com/puma/puma/pull/3080" title="PR by @MSP-Greg, merged 2023-02-16">#3080</a>)</li>
</ul></li>
</ul>
<h2>6.1.0 / 2023-02-12</h2>
<ul>
<li><p>Features</p>
<ul>
<li>WebSocket support via partial hijack (<a href="https://github.com/puma/puma/pull/3058" title="PR by @dentarg, merged 2023-01-29">#3058</a>, <a href="https://github.com/puma/puma/issues/3007" title="Issue by @MSP-Greg, closed 2023-01-29">#3007</a>)</li>
<li>Add built-in systemd notify support (<a href="https://github.com/puma/puma/pull/3011" title="PR by @joaomarcos96, merged 2023-01-03">#3011</a>)</li>
<li>Periodically send status to systemd (<a href="https://github.com/puma/puma/pull/3006" title="PR by @QWYNG, merged 2023-02-09">#3006</a>, <a href="https://github.com/puma/puma/issues/2604" title="Issue by @dgoetz, closed 2023-02-09">#2604</a>)</li>
<li>Introduce the ability to return 413: payload too large for requests (<a href="https://github.com/puma/puma/pull/3040" title="PR by @shayonj, merged 2023-01-02">#3040</a>)</li>
<li>Log loaded extensions when <code>PUMA_DEBUG</code> is set (<a href="https://github.com/puma/puma/pull/3036" title="PR by @MSP-Greg, merged 2023-01-13">#3036</a>, <a href="https://github.com/puma/puma/issues/3020" title="Issue by @dentarg, closed 2023-01-13">#3020</a>)</li>
</ul></li>
<li><p>Bugfixes</p>
<ul>
<li>Fix issue with rack 3 compatibility re: rackup (<a href="https://github.com/puma/puma/pull/3061" title="PR by @MSP-Greg, merged 2023-02-12">#3061</a>, <a href="https://github.com/puma/puma/issues/3057" title="Issue by @mmarvb8h, closed 2023-02-12">#3057</a>)</li>
<li>Allow setting TCP low_latency with SSL listener (<a href="https://github.com/puma/puma/pull/3065" title="PR by @MSP-Greg, merged 2023-02-11">#3065</a>)</li>
</ul></li>
<li><p>Performance</p>
<ul>
<li>Reduce memory usage for large file uploads (<a href="https://github.com/puma/puma/pull/3062" title="PR by @willkoehler, merged 2023-01-29">#3062</a>)</li>
</ul></li>
</ul>
<h2>6.0.2 / 2023-01-01</h2>
<ul>
<li>Refactor
<ul>
<li>Remove use of etc and time gems in Puma (<a href="https://github.com/puma/puma/pull/3035" title="PR by @MSP-Greg, merged 2022-12-24">#3035</a>, <a href="https://github.com/puma/puma/issues/3033" title="Issue by @jules-w2, closed 2022-12-24">#3033</a>)</li>
<li>Refactor const.rb - freeze (<a href="https://github.com/puma/puma/pull/3016" title="PR by @MSP-Greg, merged 2022-12-24">#3016</a>)</li>
</ul></li>
</ul>
<h2>6.0.1 / 2022-12-20</h2>
<ul>
<li>Bugfixes
<ul>
<li>Handle waking up a closed selector in Reactor#add (<a href="https://github.com/puma/puma/pull/3005" title="PR by @JuanitoFatas, merged 2022-11-04">#3005</a>)</li>
<li>Fixup response processing, enumerable bodies (<a href="https://github.com/puma/puma/pull/3004" title="PR by @MSP-Greg, merged 2022-11-24">#3004</a>, <a href="https://github.com/puma/puma/issues/3000" title="Issue by @dentarg, closed 2022-11-24">#3000</a>)</li>
<li>Correctly close app body for all code paths (<a href="https://github.com/puma/puma/pull/3002" title="PR by @MSP-Greg, merged 2022-11-03">#3002</a>, <a href="https://github.com/puma/puma/issues/2999" title="Issue by @aymeric-ledorze, closed 2022-11-03">#2999</a>)</li>
</ul></li>
<li>Refactor
<ul>
<li>Add IOBuffer to Client, remove from ThreadPool thread instances (<a href="https://github.com/puma/puma/pull/3013" title="PR by @MSP-Greg, merged 2022-11-13">#3013</a>)</li>
</ul></li>
</ul>
<h2>6.0.0 / 2022-10-14</h2>
<ul>
<li><p>Breaking Changes</p>
<ul>
<li>Dropping Ruby 2.2 and 2.3 support (now 2.4+) (<a href="https://github.com/puma/puma/pull/2919" title="PR by @MSP-Greg, merged 2022-08-30">#2919</a>)</li>
<li>Remote_addr functionality has changed (<a href="https://github.com/puma/puma/issues/2652" title="Issue by @Roguelazer, closed 2022-09-04">#2652</a>, <a href="https://github.com/puma/puma/pull/2653" title="PR by @Roguelazer, closed 2022-03-07">#2653</a>)</li>
<li>No longer supporting Java 1.7 or below (JRuby 9.1 was the last release to support this) (<a href="https://github.com/puma/puma/pull/2849" title="PR by @kares, merged 2022-04-09">#2849</a>)</li>
<li>Remove nakayoshi GC (<a href="https://github.com/puma/puma/pull/2933" title="PR by @cafedomancer, merged 2022-09-09">#2933</a>, <a href="https://github.com/puma/puma/issues/2925" title="Issue by @nateberkopec, closed 2022-09-09">#2925</a>)</li>
<li>wait_for_less_busy_worker is now default on (<a href="https://github.com/puma/puma/pull/2940" title="PR by @cafedomancer, merged 2022-09-10">#2940</a>)</li>
<li>Prefix all environment variables with <code>PUMA_</code> (<a href="https://github.com/puma/puma/pull/2924" title="PR by @cafedomancer, merged 2022-09-07">#2924</a>, <a href="https://github.com/puma/puma/issues/2853" title="Issue by @nateberkopec, closed 2022-09-07">#2853</a>)</li>
<li>Removed some constants (<a href="https://github.com/puma/puma/pull/2957" title="PR by @JuanitoFatas, merged 2022-09-16">#2957</a>, <a href="https://github.com/puma/puma/pull/2958" title="PR by @JuanitoFatas, merged 2022-09-16">#2958</a>, <a href="https://github.com/puma/puma/pull/2959" title="PR by @JuanitoFatas, merged 2022-09-16">#2959</a>, <a href="https://github.com/puma/puma/pull/2960" title="PR by @JuanitoFatas, merged 2022-09-16">#2960</a>)</li>
<li>The following classes are now part of Puma's private API: <a href="Puma/Client.html" title="Puma::Client (class)"><code>Client</code></a>, <a href="Puma/Cluster/Worker.html" title="Puma::Cluster::Worker (class)"><code>Cluster::Worker</code></a>, <a href="Puma/Cluster/Worker.html" title="Puma::Cluster::Worker (class)"><code>Cluster::Worker</code></a>, <code>HandleRequest</code>. (<a href="https://github.com/puma/puma/pull/2988" title="PR by @MSP-Greg, merged 2022-10-12">#2988</a>)</li>
<li>Configuration constants like <code>DefaultRackup</code> removed (<a href="https://github.com/puma/puma/pull/2928" title="PR by @nateberkopec, merged 2022-09-10">#2928</a>)</li>
<li>Extracted <a href="Puma/LogWriter.html" title="Puma::LogWriter (class)"><code>LogWriter</code></a> from <a href="Puma/Events.html" title="Puma::Events (class)"><code>Events</code></a> (<a href="https://github.com/puma/puma/pull/2798" title="PR by @johnnyshields, merged 2022-02-05">#2798</a>)</li>
<li>Only accept the standard 8 HTTP methods, others rejected with 501. (<a href="https://github.com/puma/puma/pull/2932" title="PR by @mrzasa, merged 2022-09-12">#2932</a>)</li>
</ul></li>
<li><p>Features</p>
<ul>
<li>Increase throughput on large (100kb+) response bodies by 3-10x (<a href="https://github.com/puma/puma/pull/2896" title="PR by @MSP-Greg, merged 2022-09-13">#2896</a>, <a href="https://github.com/puma/puma/pull/2892" title="PR by @guilleiguaran, closed 2022-09-13">#2892</a>)</li>
<li>Increase throughput on file responses (<a href="https://github.com/puma/puma/pull/2923" title="PR by @nateberkopec, merged 2022-09-09">#2923</a>)</li>
<li>Add support for streaming bodies in Rack. (<a href="https://github.com/puma/puma/pull/2740" title="PR by @ioquatix, merged 2022-01-29">#2740</a>)</li>
<li>Allow OpenSSL session reuse via a 'reuse' ssl_bind method or bind string query parameter (<a href="https://github.com/puma/puma/issues/2845" title="Issue by @donv, closed 2022-03-22">#2845</a>)</li>
<li>Allow <code>run_hooks</code> to pass a hash to blocks for use later (<a href="https://github.com/puma/puma/pull/2917" title="PR by @MSP-Greg, merged 2022-09-19">#2917</a>, <a href="https://github.com/puma/puma/issues/2915" title="Issue by @mperham, closed 2022-09-19">#2915</a>)</li>
<li>Allow using <code>preload_app!</code> with <code>fork_worker</code> (<a href="https://github.com/puma/puma/pull/2907" title="PR by @casperisfine, merged 2022-09-15">#2907</a>)</li>
<li>Support request_body_wait metric with higher precision (<a href="https://github.com/puma/puma/pull/2953" title="PR by @JuanitoFatas, merged 2022-09-14">#2953</a>)</li>
<li>Allow header values to be arrays (Rack 3) (<a href="https://github.com/puma/puma/pull/2936" title="PR by @MSP-Greg, merged 2022-09-09">#2936</a>, <a href="https://github.com/puma/puma/issues/2931" title="Issue by @dentarg, closed 2022-09-09">#2931</a>)</li>
<li>Export Puma/Ruby versions in /stats (<a href="https://github.com/puma/puma/pull/2875" title="PR by @ylecuyer, merged 2022-05-19">#2875</a>)</li>
<li>Allow configuring request uri max length & request path max length (<a href="https://github.com/puma/puma/pull/2840" title="PR by @LukaszMaslej, merged 2022-04-13">#2840</a>)</li>
<li>Add a couple of public accessors (<a href="https://github.com/puma/puma/pull/2774" title="PR by @ob-stripe, merged 2022-01-31">#2774</a>)</li>
<li>Log entire backtrace when worker start fails (<a href="https://github.com/puma/puma/pull/2891" title="PR by @gingerlime, merged 2022-06-02">#2891</a>)</li>
<li>[jruby] Enable TLSv1.3 support (<a href="https://github.com/puma/puma/pull/2886" title="PR by @kares, merged 2022-05-30">#2886</a>)</li>
<li>[jruby] support setting TLS protocols + rename ssl_cipher_list (<a href="https://github.com/puma/puma/pull/2899" title="PR by @kares, merged 2022-07-04">#2899</a>)</li>
<li>[jruby] Support a truststore option (<a href="https://github.com/puma/puma/pull/2849" title="PR by @kares, merged 2022-04-09">#2849</a>, <a href="https://github.com/puma/puma/pull/2904" title="PR by @kares, merged 2022-08-27">#2904</a>, <a href="https://github.com/puma/puma/pull/2884" title="PR by @kares, merged 2022-05-30">#2884</a>)</li>
</ul></li>
<li><p>Bugfixes</p>
<ul>
<li>Load the configuration before passing it to the binder (<a href="https://github.com/puma/puma/pull/2897" title="PR by @Edouard-chin, merged 2022-08-27">#2897</a>)</li>
<li>Do not raise error raised on HTTP methods we don't recognize or support, like CONNECT (<a href="https://github.com/puma/puma/pull/2932" title="PR by @mrzasa, merged 2022-09-12">#2932</a>, <a href="https://github.com/puma/puma/issues/1441" title="Issue by @nirvdrum, closed 2022-09-12">#1441</a>)</li>
<li>Fixed a memory leak when creating a new SSL listener (<a href="https://github.com/puma/puma/pull/2956" title="PR by @MSP-Greg, merged 2022-09-15">#2956</a>)</li>
</ul></li>
<li><p>Refactor</p>
<ul>
<li>log_writer.rb - add internal_write method (<a href="https://github.com/puma/puma/pull/2888" title="PR by @MSP-Greg, merged 2022-06-01">#2888</a>)</li>
<li>Extract prune_bundler code into it's own class. (<a href="https://github.com/puma/puma/pull/2797" title="PR by @johnnyshields, merged 2022-02-01">#2797</a>)</li>
<li>Refactor Launcher#run to increase readability (no logic change) (<a href="https://github.com/puma/puma/pull/2795" title="PR by @johnnyshields, merged 2022-01-31">#2795</a>)</li>
<li>Ruby 3.2 will have native IO#wait_* methods, don't require io/wait (<a href="https://github.com/puma/puma/pull/2903" title="PR by @MSP-Greg, merged 2022-08-27">#2903</a>)</li>
<li>Various internal API refactorings (<a href="https://github.com/puma/puma/pull/2942" title="PR by @nateberkopec, merged 2022-09-15">#2942</a>, <a href="https://github.com/puma/puma/issues/2921" title="Issue by @MSP-Greg, closed 2022-09-15">#2921</a>, <a href="https://github.com/puma/puma/issues/2922" title="Issue by @MSP-Greg, closed 2022-09-10">#2922</a>, <a href="https://github.com/puma/puma/pull/2955" title="PR by @cafedomancer, merged 2022-09-15">#2955</a>)</li>
</ul></li>
</ul>
<h2>5.6.9 / 2024-09-19</h2>
<ul>
<li>Security
<ul>
<li>Discards any headers using underscores if the non-underscore version also exists. Without this, an attacker could overwrite values set by intermediate proxies (e.g. X-Forwarded-For). (<a href="https://github.com/puma/puma/security/advisories/GHSA-9hf4-67fc-4vf4">CVE-2024-45614</a>/GHSA-9hf4-67fc-4vf4)</li>
</ul></li>
<li>JRuby
<ul>
<li>Must use at least Java >= 9 to compile. You can no longer build from source on Java 8.</li>
</ul></li>
</ul>
<h2>5.6.8 / 2024-01-08</h2>
<ul>
<li>Security
<ul>
<li>Limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. (<a href="https://github.com/puma/puma/security/advisories/GHSA-c2f4-cvqm-65w2">GHSA-c2f4-cvqm-65w2</a>)</li>
</ul></li>
</ul>
<h2>5.6.7 / 2023-08-18</h2>
<ul>
<li>Security
<ul>
<li>Address HTTP request smuggling vulnerabilities with zero-length Content Length header and trailer fields (<a href="https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8">GHSA-68xg-gqqm-vgj8</a>)</li>
</ul></li>
</ul>
<h2>5.6.6 / 2023-06-21</h2>
<ul>
<li>Bugfix
<ul>
<li>Prevent loading with rack 3 (<a href="https://github.com/puma/puma/pull/3166" title="PR by @JoeDupuis, merged 2023-06-08">#3166</a>)</li>
</ul></li>
</ul>
<h2>5.6.5 / 2022-08-23</h2>
<ul>
<li><p>Feature</p>
<ul>
<li>Puma::ControlCLI - allow refork command to be sent as a request (<a href="https://github.com/puma/puma/pull/2868" title="PR by @MSP-Greg, merged 2022-06-02">#2868</a>, <a href="https://github.com/puma/puma/issues/2866" title="Issue by @slondr, closed 2022-06-02">#2866</a>)</li>
</ul></li>
<li><p>Bugfixes</p>
<ul>
<li>NullIO#closed should return false (<a href="https://github.com/puma/puma/pull/2883" title="PR by @MSP-Greg, merged 2022-06-02">#2883</a>)</li>
<li>[jruby] Fix TLS verification hang (<a href="https://github.com/puma/puma/pull/2890" title="PR by @kares, merged 2022-06-01">#2890</a>, <a href="https://github.com/puma/puma/issues/2729" title="Issue by @kares, closed 2022-06-01">#2729</a>)</li>
<li>extconf.rb - don't use pkg_config('openssl') if '--with-openssl-dir' is used (<a href="https://github.com/puma/puma/pull/2885" title="PR by @MSP-Greg, merged 2022-05-30">#2885</a>, <a href="https://github.com/puma/puma/issues/2839" title="Issue by @wlipa, closed 2022-05-30">#2839</a>)</li>
<li>MiniSSL - detect SSL_CTX_set_dh_auto (<a href="https://github.com/puma/puma/pull/2864" title="PR by @MSP-Greg, merged 2022-04-26">#2864</a>, <a href="https://github.com/puma/puma/issues/2863" title="Issue by @eradman, closed 2022-04-26">#2863</a>)</li>
<li>Fix rack.after_reply exceptions breaking connections (<a href="https://github.com/puma/puma/pull/2861" title="PR by @BlakeWilliams, merged 2022-04-17">#2861</a>, <a href="https://github.com/puma/puma/issues/2856" title="Issue by @nateberkopec, closed 2022-04-17">#2856</a>)</li>
<li>Escape SSL cert and filenames (<a href="https://github.com/puma/puma/pull/2855" title="PR by @stanhu, merged 2022-04-09">#2855</a>)</li>
<li>Fail hard if SSL certs or keys are invalid (<a href="https://github.com/puma/puma/pull/2848" title="PR by @stanhu, merged 2022-04-02">#2848</a>)</li>
<li>Fail hard if SSL certs or keys cannot be read by user (<a href="https://github.com/puma/puma/pull/2847" title="PR by @stanhu, merged 2022-04-02">#2847</a>)</li>
<li>Fix build with Opaque DH in LibreSSL 3.5. (<a href="https://github.com/puma/puma/pull/2838" title="PR by @epsilon-0, merged 2022-03-03">#2838</a>)</li>
<li>Pre-existing socket file removed when TERM is issued after USR2 (if puma is running in cluster mode) (<a href="https://github.com/puma/puma/pull/2817" title="PR by @khustochka, merged 2022-02-20">#2817</a>)</li>
<li>Fix Puma::StateFile#load incompatibility (<a href="https://github.com/puma/puma/pull/2810" title="PR by @kzkn, merged 2022-01-27">#2810</a>)</li>
</ul></li>
</ul>
<h2>5.6.4 / 2022-03-30</h2>
<ul>
<li>Security
<ul>
<li>Close several HTTP Request Smuggling exploits (CVE-2022-24790)</li>
</ul></li>
</ul>
<h2>5.6.2 / 2022-02-11</h2>
<ul>
<li>Bugfix/Security
<ul>
<li>Response body will always be <code>close</code>d. (GHSA-rmj8-8hhh-gv5h, related to <a href="https://github.com/puma/puma/pull/2809" title="PR by @dentarg, merged 2022-01-26">#2809</a>)</li>
</ul></li>
</ul>
<h2>5.6.1 / 2022-01-26</h2>
<ul>
<li>Bugfixes
<ul>
<li>Reverted a commit which appeared to be causing occasional blank header values (<a href="https://github.com/puma/puma/pull/2809" title="PR by @dentarg, merged 2022-01-26">#2809</a>)</li>
</ul></li>
</ul>
<h2>5.6.0 / 2022-01-25</h2>
<ul>
<li><p>Features</p>
<ul>
<li>Support <code>localhost</code> integration in <code>ssl_bind</code> (<a href="https://github.com/puma/puma/pull/2764" title="PR by @dentarg, merged 2022-01-18">#2764</a>, <a href="https://github.com/puma/puma/issues/2708" title="Issue by @erikaxel, closed 2022-01-18">#2708</a>)</li>
<li>Allow backlog parameter to be set with ssl_bind DSL (<a href="https://github.com/puma/puma/pull/2780" title="PR by @dalibor, merged 2022-01-01">#2780</a>)</li>
<li>Remove yaml (psych) requirement in StateFile (<a href="https://github.com/puma/puma/pull/2784" title="PR by @MSP-Greg, merged 2022-01-01">#2784</a>)</li>
<li>Allow culling of oldest workers, previously was only youngest (<a href="https://github.com/puma/puma/pull/2773" title="PR by @ob-stripe, merged 2022-01-01">#2773</a>, <a href="https://github.com/puma/puma/pull/2794" title="PR by @johnnyshields, merged 2022-01-10">#2794</a>)</li>
<li>Add worker_check_interval configuration option (<a href="https://github.com/puma/puma/pull/2759" title="PR by @ob-stripe, merged 2021-12-11">#2759</a>)</li>
<li>Always send lowlevel_error response to client (<a href="https://github.com/puma/puma/pull/2731" title="PR by @baelter, merged 2021-11-02">#2731</a>, <a href="https://github.com/puma/puma/issues/2341" title="Issue by @cjlarose, closed 2023-07-23">#2341</a>)</li>
<li>Support for cert_pem and key_pem with ssl_bind DSL (<a href="https://github.com/puma/puma/pull/2728" title="PR by @dalibor, merged 2021-10-31">#2728</a>)</li>
</ul></li>
<li><p>Bugfixes</p>
<ul>
<li>Keep thread names under 15 characters, prevents breakage on some OSes (<a href="https://github.com/puma/puma/pull/2733" title="PR by @ob-stripe, merged 2021-12-12">#2733</a>)</li>
<li>Fix two 'old-style-definition' compile warning (<a href="https://github.com/puma/puma/pull/2807" title="PR by @MSP-Greg, merged 2022-01-25">#2807</a>, <a href="https://github.com/puma/puma/issues/2806" title="Issue by @olleolleolle, closed 2022-01-25">#2806</a>)</li>
<li>Log environment correctly using option value (<a href="https://github.com/puma/puma/pull/2799" title="PR by @ags, merged 2022-01-22">#2799</a>)</li>
<li>Fix warning from Ruby master (will be 3.2.0) (<a href="https://github.com/puma/puma/pull/2785" title="PR by @MSP-Greg, merged 2022-01-02">#2785</a>)</li>
<li>extconf.rb - fix openssl with old Windows builds (<a href="https://github.com/puma/puma/pull/2757" title="PR by @MSP-Greg, merged 2021-11-24">#2757</a>)</li>
<li>server.rb - rescue handling (<code>Errno::EBADF</code>) for <code>@notify.close</code> (<a href="https://github.com/puma/puma/pull/2745" title="PR by @MSP-Greg, merged 2021-11-03">#2745</a>)</li>
</ul></li>
<li><p>Refactor</p>
<ul>
<li>server.rb - refactor code using @options<a href="%5B#2742%5D">:remote_address</a></li>
<li>[jruby] a couple refactorings - avoid copy-ing bytes (<a href="https://github.com/puma/puma/pull/2730" title="PR by @kares, merged 2021-11-01">#2730</a>)</li>
</ul></li>
</ul>
<h2>5.5.2 / 2021-10-12</h2>
<ul>
<li>Bugfixes
<ul>
<li>Allow UTF-8 in HTTP header values</li>
</ul></li>
</ul>
<h2>5.5.1 / 2021-10-12</h2>
<ul>
<li><p>Feature (added as mistake - we don't normally do this on bugfix releases, sorry!)</p>
<ul>
<li>Allow setting APP_ENV in preference to RACK_ENV or RAILS_ENV (<a href="https://github.com/puma/puma/pull/2702" title="PR by @jacobherrington, merged 2021-09-21">#2702</a>)</li>
</ul></li>
<li><p>Security</p>
<ul>
<li>Do not allow LF as a line ending in a header (CVE-2021-41136)</li>
</ul></li>
</ul>
<h2>5.5.0 / 2021-09-19</h2>
<ul>
<li><p>Features</p>
<ul>
<li>Automatic SSL certificate provisioning for localhost, via localhost gem (<a href="https://github.com/puma/puma/pull/2610" title="PR by @ye-lin-aung, merged 2021-08-18">#2610</a>, <a href="https://github.com/puma/puma/issues/2257" title="Issue by @nateberkopec, closed 2021-08-18">#2257</a>)</li>
<li>add support for the PROXY protocol (v1 only) (<a href="https://github.com/puma/puma/pull/2654" title="PR by @Roguelazer, merged 2021-09-07">#2654</a>, <a href="https://github.com/puma/puma/issues/2651" title="Issue by @Roguelazer, closed 2021-09-07">#2651</a>)</li>
<li>Add a semantic CLI option for no config file (<a href="https://github.com/puma/puma/pull/2689" title="PR by @jacobherrington, merged 2021-09-05">#2689</a>)</li>
</ul></li>
<li><p>Bugfixes</p>
<ul>
<li>More elaborate exception handling - lets some dead pumas die. (<a href="https://github.com/puma/puma/pull/2700" title="PR by @ioquatix, merged 2021-09-16">#2700</a>, <a href="https://github.com/puma/puma/issues/2699" title="Issue by @ioquatix, closed 2021-09-16">#2699</a>)</li>
<li>allow multiple after_worker_fork hooks (<a href="https://github.com/puma/puma/pull/2690" title="PR by @doits, merged 2021-09-06">#2690</a>)</li>
<li>Preserve BUNDLE_APP_CONFIG on worker fork (<a href="https://github.com/puma/puma/pull/2688" title="PR by @jdelStrother, merged 2021-09-03">#2688</a>, <a href="https://github.com/puma/puma/issues/2687" title="Issue by @jdelStrother, closed 2021-09-03">#2687</a>)</li>
</ul></li>
<li><p>Performance</p>
<ul>
<li>Fix performance of server-side SSL connection close. (<a href="https://github.com/puma/puma/pull/2675" title="PR by @devwout, merged 2021-09-08">#2675</a>)</li>
</ul></li>
</ul>
<h2>5.4.0 / 2021-07-28</h2>
<ul>
<li><p>Features</p>
<ul>
<li>Better/expanded names for threadpool threads (<a href="https://github.com/puma/puma/pull/2657" title="PR by @olivierbellone, merged 2021-07-13">#2657</a>)</li>
<li>Allow pkg_config for OpenSSL (<a href="https://github.com/puma/puma/pull/2648" title="PR by @MSP-Greg, merged 2021-06-27">#2648</a>, <a href="https://github.com/puma/puma/issues/1412" title="Issue by @x-yuri, closed 2021-06-27">#1412</a>)</li>
<li>Add <code>rack_url_scheme</code> to Puma::DSL, allows setting of <code>rack.url_scheme</code> header (<a href="https://github.com/puma/puma/pull/2586" title="PR by @MSP-Greg, merged 2021-05-26">#2586</a>, <a href="https://github.com/puma/puma/issues/2569" title="Issue by @tarragon, closed 2021-05-26">#2569</a>)</li>
</ul></li>
<li><p>Bugfixes</p>
<ul>
<li><a href="Puma/Binder.html#parse-instance_method" title="Puma::Binder#parse (method)">Puma::Binder#parse</a> - allow for symlinked unix path, add create_activated_fds debug ENV (<a href="https://github.com/puma/puma/pull/2643" title="PR by @MSP-Greg, merged 2021-06-27">#2643</a>, <a href="https://github.com/puma/puma/issues/2638" title="Issue by @gingerlime, closed 2021-06-27">#2638</a>)</li>
<li>Fix deprecation warning: minissl.c - Use Random.bytes if available (<a href="https://github.com/puma/puma/pull/2642" title="PR by @MSP-Greg, merged 2021-06-16">#2642</a>)</li>
<li>Client certificates: set session id context while creating SSLContext (<a href="https://github.com/puma/puma/pull/2633" title="PR by @onlined, merged 2021-06-04">#2633</a>)</li>
<li>Fix deadlock issue in thread pool (<a href="https://github.com/puma/puma/pull/2656" title="PR by @olivierbellone, merged 2021-07-07">#2656</a>)</li>
</ul></li>
<li><p>Refactor</p>
<ul>
<li>Replace <code>IO.select</code> with <code>IO#wait_*</code> when checking a single IO (<a href="https://github.com/puma/puma/pull/2666" title="PR by @MSP-Greg, merged 2021-07-25">#2666</a>)</li>
</ul></li>
</ul>
<h2>5.3.2 / 2021-05-21</h2>
<ul>
<li>Bugfixes
<ul>
<li>Gracefully handle Rack not accepting CLI options (<a href="https://github.com/puma/puma/pull/2630" title="PR by @seangoedecke, merged 2021-05-20">#2630</a>, <a href="https://github.com/puma/puma/issues/2626" title="Issue by @rorymckinley, closed 2021-05-20">#2626</a>)</li>
<li>Fix sigterm misbehavior (<a href="https://github.com/puma/puma/pull/2629" title="PR by @ye-lin-aung, merged 2021-05-20">#2629</a>)</li>
<li>Improvements to keepalive-connection shedding (<a href="https://github.com/puma/puma/pull/2628" title="PR by @wjordan, merged 2021-05-20">#2628</a>)</li>
</ul></li>
</ul>
<h2>5.3.1 / 2021-05-11</h2>
<ul>
<li>Security
<ul>
<li>Close keepalive connections after the maximum number of fast inlined requests (CVE-2021-29509) (<a href="https://github.com/puma/puma/issues/2625" title="Issue by @jarthod, closed 2021-05-11">#2625</a>)</li>
</ul></li>
</ul>
<h2>5.3.0 / 2021-05-07</h2>
<ul>
<li><p>Features</p>
<ul>
<li>Add support for Linux's abstract sockets (<a href="https://github.com/puma/puma/pull/2564" title="PR by @MSP-Greg, merged 2021-04-24">#2564</a>, <a href="https://github.com/puma/puma/issues/2526" title="Issue by @nerdrew, closed 2021-04-24">#2526</a>)</li>
<li>Add debug to worker timeout and startup (<a href="https://github.com/puma/puma/pull/2559" title="PR by @ylecuyer, merged 2021-03-11">#2559</a>, <a href="https://github.com/puma/puma/issues/2528" title="Issue by @cjlarose, closed 2021-03-11">#2528</a>)</li>
<li>Print warning when running one-worker cluster (<a href="https://github.com/puma/puma/pull/2565" title="PR by @CGA1123, merged 2021-03-09">#2565</a>, <a href="https://github.com/puma/puma/issues/2534" title="Issue by @nateberkopec, closed 2021-03-09">#2534</a>)</li>
<li>Don't close systemd activated socket on pumactl restart (<a href="https://github.com/puma/puma/pull/2563" title="PR by @MSP-Greg, merged 2021-03-06">#2563</a>, <a href="https://github.com/puma/puma/issues/2504" title="Issue by @fsateler, closed 2021-03-06">#2504</a>)</li>
</ul></li>
<li><p>Bugfixes</p>
<ul>
<li>systemd - fix event firing (<a href="https://github.com/puma/puma/pull/2591" title="PR by @MSP-Greg, merged 2021-05-05">#2591</a>, <a href="https://github.com/puma/puma/issues/2572" title="Issue by @josef-krabath, closed 2021-05-05">#2572</a>)</li>
<li>Immediately unlink temporary files (<a href="https://github.com/puma/puma/pull/2613" title="PR by @smcgivern, merged 2021-04-27">#2613</a>)</li>
<li>Improve parsing of HTTP_HOST header (<a href="https://github.com/puma/puma/pull/2605" title="PR by @pascalbetz, merged 2021-04-26">#2605</a>, <a href="https://github.com/puma/puma/issues/2584" title="Issue by @kaorihinata, closed 2021-04-26">#2584</a>)</li>
<li>Handle fatal error that has no backtrace (<a href="https://github.com/puma/puma/pull/2607" title="PR by @calvinxiao, merged 2021-04-23">#2607</a>, <a href="https://github.com/puma/puma/issues/2552" title="Issue by @feliperaul, closed 2021-05-24">#2552</a>)</li>
<li>Fix timing out requests too early (<a href="https://github.com/puma/puma/pull/2606" title="PR by @wjordan, merged 2021-04-20">#2606</a>, <a href="https://github.com/puma/puma/issues/2574" title="Issue by @darkhelmet, closed 2021-04-20">#2574</a>)</li>
<li>Handle segfault in Ruby 2.6.6 on thread-locals (<a href="https://github.com/puma/puma/pull/2567" title="PR by @kddnewton, merged 2021-04-19">#2567</a>, <a href="https://github.com/puma/puma/issues/2566" title="Issue by @kddnewton, closed 2021-04-19">#2566</a>)</li>
<li>Server#closed_socket? - parameter may be a MiniSSL::Socket (<a href="https://github.com/puma/puma/pull/2596" title="PR by @MSP-Greg, merged 2021-04-18">#2596</a>)</li>
<li>Define UNPACK_TCP_STATE_FROM_TCP_INFO in the right place (<a href="https://github.com/puma/puma/pull/2588" title="PR by @dentarg, merged 2021-04-02">#2588</a>, <a href="https://github.com/puma/puma/issues/2556" title="Issue by @gamecreature, closed 2021-04-02">#2556</a>)</li>
<li>request.rb - fix chunked assembly for ascii incompatible encodings, add test (<a href="https://github.com/puma/puma/pull/2585" title="PR by @MSP-Greg, merged 2021-03-26">#2585</a>, <a href="https://github.com/puma/puma/issues/2583" title="Issue by @jboler, closed 2021-03-26">#2583</a>)</li>
</ul></li>
<li><p>Performance</p>
<ul>
<li>Reset peerip only if remote_addr_header is set (<a href="https://github.com/puma/puma/pull/2609" title="PR by @calvinxiao, merged 2021-04-26">#2609</a>)</li>
<li>Reduce puma_parser struct size (<a href="https://github.com/puma/puma/pull/2590" title="PR by @calvinxiao, merged 2021-04-05">#2590</a>)</li>
</ul></li>
<li><p>Refactor</p>
<ul>
<li>Refactor drain on shutdown (<a href="https://github.com/puma/puma/pull/2600" title="PR by @wjordan, merged 2021-04-30">#2600</a>)</li>
<li>Micro optimisations in <code>wait_for_less_busy_worker</code> feature (<a href="https://github.com/puma/puma/pull/2579" title="PR by @ghiculescu, merged 2021-03-17">#2579</a>)</li>
<li>Lots of test fixes</li>
</ul></li>
</ul>
<h2>5.2.2 / 2021-02-22</h2>
<ul>
<li>Bugfixes
<ul>
<li>Add <code>#flush</code> and <code>#sync</code> methods to <a href="Puma/NullIO.html" title="Puma::NullIO (class)"><code>NullIO</code></a> (<a href="https://github.com/puma/puma/pull/2553" title="PR by @olivierbellone, merged 2021-02-10">#2553</a>)</li>
<li>Restore <code>sync=true</code> on <code>STDOUT</code> and <code>STDERR</code> streams (<a href="https://github.com/puma/puma/pull/2557" title="PR by @cjlarose, merged 2021-02-22">#2557</a>)</li>
</ul></li>
</ul>
<h2>5.2.1 / 2021-02-05</h2>
<ul>
<li>Bugfixes
<ul>
<li>Fix TCP cork/uncork operations to work with ssl clients (<a href="https://github.com/puma/puma/pull/2550" title="PR by @MSP-Greg, merged 2021-02-05">#2550</a>)</li>
<li>Require rack/common_logger explicitly if :verbose is true (<a href="https://github.com/puma/puma/pull/2547" title="PR by @wildmaples, merged 2021-02-03">#2547</a>)</li>
<li>MiniSSL::Socket#write - use data.byteslice(wrote..-1) (<a href="https://github.com/puma/puma/pull/2543" title="PR by @MSP-Greg, merged 2021-02-01">#2543</a>)</li>
<li>Set <code>@env[CONTENT_LENGTH]</code> value as string. (<a href="https://github.com/puma/puma/pull/2549" title="PR by @nmb, merged 2021-02-04">#2549</a>)</li>
</ul></li>
</ul>
<h2>5.2.0 / 2021-01-27</h2>
<ul>
<li><p>Features</p>
<ul>
<li>10x latency improvement for MRI on ssl connections by reducing overhead (<a href="https://github.com/puma/puma/pull/2519" title="PR by @MSP-Greg, merged 2021-01-26">#2519</a>)</li>
<li>Add option to specify the desired IO selector backend for libev (<a href="https://github.com/puma/puma/pull/2522" title="PR by @jcmfernandes, merged 2021-01-12">#2522</a>)</li>
<li>Add ability to set OpenSSL verification flags (MRI only) (<a href="https://github.com/puma/puma/pull/2490" title="PR by @Bonias, merged 2020-12-07">#2490</a>)</li>
<li>Uses <code>flush</code> after writing messages to avoid mutating $stdout and $stderr using <code>sync=true</code> (<a href="https://github.com/puma/puma/pull/2486" title="PR by @karloscodes, merged 2020-12-02">#2486</a>)</li>
</ul></li>
<li><p>Bugfixes</p>
<ul>
<li>MiniSSL - Update dhparam to 2048 bit for use with SSL_CTX_set_tmp_dh (<a href="https://github.com/puma/puma/pull/2535" title="PR by @MSP-Greg, merged 2021-01-27">#2535</a>)</li>
<li>Change 'Goodbye!' message to be output after listeners are closed (<a href="https://github.com/puma/puma/pull/2529" title="PR by @MSP-Greg, merged 2021-01-24">#2529</a>)</li>
<li>Fix ssl bind logging with 0.0.0.0 and localhost (<a href="https://github.com/puma/puma/pull/2533" title="PR by @MSP-Greg, merged 2021-01-24">#2533</a>)</li>
<li>Fix compiler warnings, but skipped warnings related to ragel state machine generated code (<a href="https://github.com/puma/puma/issues/1953" title="Issue by @nateberkopec, closed 2020-12-01">#1953</a>)</li>
<li>Fix phased restart errors related to nio4r gem when using the Puma control server (<a href="https://github.com/puma/puma/pull/2516" title="PR by @cjlarose, merged 2020-12-17">#2516</a>)</li>
<li>Add <code>#string</code> method to <a href="Puma/NullIO.html" title="Puma::NullIO (class)"><code>NullIO</code></a> (<a href="https://github.com/puma/puma/pull/2520" title="PR by @dentarg, merged 2021-01-04">#2520</a>)</li>
<li>Fix binding via Rack handler to IPv6 addresses (<a href="https://github.com/puma/puma/pull/2521" title="PR by @ojab, merged 2021-01-04">#2521</a>)</li>
</ul></li>
<li><p>Refactor</p>
<ul>
<li>Refactor MiniSSL::Context on MRI, fix MiniSSL::Socket#write (<a href="https://github.com/puma/puma/pull/2519" title="PR by @MSP-Greg, merged 2021-01-26">#2519</a>)</li>
<li>Remove <code>Server#read_body</code> (<a href="https://github.com/puma/puma/pull/2531" title="PR by @wjordan, merged 2021-01-19">#2531</a>)</li>
<li>Fail build if compiling extensions raises warnings on GH Actions, configurable via <code>MAKE_WARNINGS_INTO_ERRORS</code> (<a href="https://github.com/puma/puma/issues/1953" title="Issue by @nateberkopec, closed 2020-12-01">#1953</a>)</li>
</ul></li>
</ul>
<h2>5.1.1 / 2020-12-10</h2>
<ul>
<li>Bugfixes
<ul>
<li>Fix over eager matching against banned header names (<a href="https://github.com/puma/puma/pull/2510" title="PR by @micke, merged 2020-12-10">#2510</a>)</li>
</ul></li>
</ul>
<h2>5.1.0 / 2020-11-30</h2>
<ul>
<li><p>Features</p>
<ul>
<li>Phased restart availability is now always logged, even if it is not available.</li>
<li>Prints the loaded configuration if the environment variable <code>PUMA_LOG_CONFIG</code> is present (<a href="https://github.com/puma/puma/pull/2472" title="PR by @karloscodes, merged 2020-11-02">#2472</a>)</li>
<li>Integrate with systemd's watchdog and notification features (<a href="https://github.com/puma/puma/pull/2438" title="PR by @ekohl, merged 2020-10-26">#2438</a>)</li>
<li>Adds max_fast_inline as a configuration option for the Server object (<a href="https://github.com/puma/puma/pull/2406" title="PR by @fdel15, merged 2020-10-19">#2406</a>)</li>
<li>You can now fork workers from worker 0 using SIGURG w/o fork_worker enabled <a href="https://github.com/puma/puma/pull/2449" title="PR by @MSP-Greg, merged 2020-10-28">#2449</a></li>
<li>Add option to bind to systemd activated sockets (<a href="https://github.com/puma/puma/pull/2362" title="PR by @ekohl, merged 2020-11-10">#2362</a>)</li>
<li>Add compile option to change the <code>QUERY_STRING</code> max length (<a href="https://github.com/puma/puma/pull/2485" title="PR by @elct9620, merged 2020-11-18">#2485</a>)</li>
</ul></li>
<li><p>Bugfixes</p>
<ul>
<li>Fix JRuby handling in Puma::DSL#ssl_bind (<a href="https://github.com/puma/puma/pull/2489" title="PR by @MSP-Greg, merged 2020-11-27">#2489</a>)</li>
<li>control_cli.rb - all normal output should be to @stdout (<a href="https://github.com/puma/puma/pull/2487" title="PR by @MSP-Greg, merged 2020-11-17">#2487</a>)</li>
<li>Catch 'Error in reactor loop escaped: mode not supported for this object: r' (<a href="https://github.com/puma/puma/pull/2477" title="PR by @MSP-Greg, merged 2020-11-16">#2477</a>)</li>
<li>Ignore Rails' reaper thread (and any thread marked forksafe) for warning (<a href="https://github.com/puma/puma/pull/2475" title="PR by @nateberkopec, merged 2020-11-02">#2475</a>)</li>
<li>Ignore illegal (by Rack spec) response header (<a href="https://github.com/puma/puma/pull/2439" title="PR by @kuei0221, merged 2020-10-26">#2439</a>)</li>
<li>Close idle connections immediately on shutdown (<a href="https://github.com/puma/puma/pull/2460" title="PR by @cjlarose, merged 2020-10-27">#2460</a>)</li>
<li>Fix some instances of phased restart errors related to the <code>json</code> gem (<a href="https://github.com/puma/puma/pull/2473" title="PR by @cjlarose, merged 2020-11-01">#2473</a>)</li>
<li>Remove use of <code>json</code> gem to fix phased restart errors (<a href="https://github.com/puma/puma/pull/2479" title="PR by @cjlarose, merged 2020-11-10">#2479</a>)</li>
<li>Fix grouping regexp of ILLEGAL_HEADER_KEY_REGEX (<a href="https://github.com/puma/puma/pull/2495" title="PR by @JuanitoFatas, merged 2020-11-27">#2495</a>)</li>
</ul></li>
</ul>
<h2>5.0.4 / 2020-10-27</h2>
<ul>
<li>Bugfixes
<ul>
<li>Pass preloaded application into new workers if available when using <code>preload_app</code> (<a href="https://github.com/puma/puma/pull/2461" title="PR by @cjlarose, merged 2020-10-27">#2461</a>, <a href="https://github.com/puma/puma/issues/2454" title="Issue by @majksner, closed 2020-10-27">#2454</a>)</li>
</ul></li>
</ul>
<h2>5.0.3 / 2020-10-26</h2>
<ul>
<li><p>Bugfixes</p>
<ul>
<li>Add Client#io_ok?, check before Reactor#register (<a href="https://github.com/puma/puma/pull/2432" title="PR by @MSP-Greg, merged 2020-10-25">#2432</a>)</li>
<li>Fix hang on shutdown in refork (<a href="https://github.com/puma/puma/pull/2442" title="PR by @wjordan, merged 2020-10-22">#2442</a>)</li>
<li>Fix <code>Bundler::GemNotFound</code> errors for <code>nio4r</code> gem during phased restarts (<a href="https://github.com/puma/puma/pull/2427" title="PR by @cjlarose, merged 2020-10-20">#2427</a>, <a href="https://github.com/puma/puma/issues/2018" title="Issue by @gingerlime, closed 2020-10-20">#2018</a>)</li>
<li>Server run thread safety fix (<a href="https://github.com/puma/puma/pull/2435" title="PR by @wjordan, merged 2020-10-20">#2435</a>)</li>
<li>Fire <code>on_booted</code> after server starts (<a href="https://github.com/puma/puma/pull/2431" title="PR by @wjordan, merged 2020-10-16">#2431</a>, <a href="https://github.com/puma/puma/issues/2212" title="Issue by @junaruga, closed 2020-10-16">#2212</a>)</li>
<li>Cleanup daemonization in rc.d script (<a href="https://github.com/puma/puma/pull/2409" title="PR by @fliiiix, merged 2020-10-03">#2409</a>)</li>
</ul></li>
<li><p>Refactor</p>
<ul>
<li>Remove accept_nonblock.rb, add test_integration_ssl.rb (<a href="https://github.com/puma/puma/pull/2448" title="PR by @MSP-Greg, merged 2020-10-25">#2448</a>)</li>
<li>Refactor status.rb - dry it up a bit (<a href="https://github.com/puma/puma/pull/2450" title="PR by @MSP-Greg, merged 2020-10-25">#2450</a>)</li>
<li>Extract req/resp methods to new request.rb from server.rb (<a href="https://github.com/puma/puma/pull/2419" title="PR by @MSP-Greg, merged 2020-10-09">#2419</a>)</li>
<li>Refactor Reactor and Client request buffering (<a href="https://github.com/puma/puma/pull/2279" title="PR by @wjordan, merged 2020-10-06">#2279</a>)</li>
<li>client.rb - remove JRuby specific 'finish' code (<a href="https://github.com/puma/puma/pull/2412" title="PR by @MSP-Greg, merged 2020-10-06">#2412</a>)</li>
<li>Consolidate fast_write calls in Server, extract early_hints assembly (<a href="https://github.com/puma/puma/pull/2405" title="PR by @MSP-Greg, merged 2020-10-05">#2405</a>)</li>
<li>Remove upstart from docs (<a href="https://github.com/puma/puma/pull/2408" title="PR by @fliiiix, merged 2020-10-03">#2408</a>)</li>
<li>Extract worker process into separate class (<a href="https://github.com/puma/puma/pull/2374" title="PR by @cjlarose, merged 2020-09-29">#2374</a>)</li>
<li>Consolidate option handling in Server, Server small refactors, doc changes (<a href="https://github.com/puma/puma/pull/2389" title="PR by @MSP-Greg, merged 2020-09-29">#2389</a>)</li>
</ul></li>
</ul>
<h2>5.0.2 / 2020-09-28</h2>
<ul>
<li>Bugfixes
<ul>
<li>Reverted API changes to Server.</li>
</ul></li>
</ul>
<h2>5.0.1 / 2020-09-28</h2>
<ul>
<li><p>Bugfixes</p>
<ul>
<li>Fix LoadError in CentOS 8 (<a href="https://github.com/puma/puma/pull/2381" title="PR by @joergschray, merged 2020-09-24">#2381</a>)</li>
<li>Better error handling during force shutdown (<a href="https://github.com/puma/puma/pull/2271" title="PR by @wjordan, merged 2020-09-24">#2271</a>)</li>
<li>Prevent connections from entering Reactor after shutdown begins (<a href="https://github.com/puma/puma/pull/2377" title="PR by @cjlarose, merged 2020-09-23">#2377</a>)</li>
<li>Fix error backtrace debug logging && Do not log request dump if it is not parsed (<a href="https://github.com/puma/puma/pull/2376" title="PR by @alexeevit, merged 2020-09-22">#2376</a>)</li>
<li>Split TCP_CORK and TCP_INFO (<a href="https://github.com/puma/puma/pull/2372" title="PR by @ahorek, merged 2020-09-22">#2372</a>)</li>
<li>Do not log EOFError when a client connection is closed without write (<a href="https://github.com/puma/puma/pull/2384" title="PR by @schneems, merged 2020-09-27">#2384</a>)</li>
</ul></li>
<li><p>Refactor</p>
<ul>
<li>Change Events#ssl_error signature from (error, peeraddr, peercert) to (error, ssl_socket) (<a href="https://github.com/puma/puma/pull/2375" title="PR by @MSP-Greg, merged 2020-09-23">#2375</a>)</li>
<li>Consolidate option handling in Server, Server small refactors, doc chang (<a href="https://github.com/puma/puma/pull/2373" title="PR by @MSP-Greg, merged 2020-09-23">#2373</a>)</li>
</ul></li>
</ul>
<h2>5.0.0 / 2020-09-17</h2>
<ul>
<li><p>Features</p>
<ul>
<li>Allow compiling without OpenSSL and dynamically load files needed for SSL, add 'no ssl' CI (<a href="https://github.com/puma/puma/pull/2305" title="PR by @MSP-Greg, merged 2020-09-14">#2305</a>)</li>
<li>EXPERIMENTAL: Add <code>fork_worker</code> option and <code>refork</code> command for reduced memory usage by forking from a worker process instead of the master process. (<a href="https://github.com/puma/puma/pull/2099" title="PR by @wjordan, merged 2020-05-11">#2099</a>)</li>
<li>EXPERIMENTAL: Added <code>wait_for_less_busy_worker</code> config. This may reduce latency on MRI through inserting a small delay before re-listening on the socket if worker is busy (<a href="https://github.com/puma/puma/pull/2079" title="PR by @ayufan, merged 2020-05-11">#2079</a>).</li>
<li>EXPERIMENTAL: Added <code>nakayoshi_fork</code> option. Reduce memory usage in preloaded cluster-mode apps by GCing before fork and compacting, where available. (<a href="https://github.com/puma/puma/pull/2093" title="PR by @schneems, merged 2019-12-18">#2093</a>, <a href="https://github.com/puma/puma/pull/2256" title="PR by @nateberkopec, merged 2020-05-11">#2256</a>)</li>
<li>Added pumactl <code>thread-backtraces</code> command to print thread backtraces (<a href="https://github.com/puma/puma/pull/2054" title="PR by @composerinteralia, merged 2019-11-11">#2054</a>)</li>
<li>Added incrementing <code>requests_count</code> to <a href="Puma.html#stats-class_method" title="Puma.stats (method)">Puma.stats</a>. (<a href="https://github.com/puma/puma/pull/2106" title="PR by @ylecuyer, merged 2020-02-11">#2106</a>)</li>
<li>Increased maximum URI path length from 2048 to 8192 bytes (<a href="https://github.com/puma/puma/pull/2167" title="PR by @ChrisBr, closed 2020-07-06">#2167</a>, <a href="https://github.com/puma/puma/pull/2344" title="PR by @dentarg, merged 2020-08-26">#2344</a>)</li>
<li><code>lowlevel_error_handler</code> is now called during a forced threadpool shutdown, and if a callable with 3 arguments is set, we now also pass the status code (<a href="https://github.com/puma/puma/pull/2203" title="PR by @zanker-stripe, merged 2020-03-31">#2203</a>)</li>
<li>Faster phased restart and worker timeout (<a href="https://github.com/puma/puma/pull/2220" title="PR by @wjordan, merged 2020-04-14">#2220</a>)</li>
<li>Added <code>state_permission</code> to config DSL to set state file permissions (<a href="https://github.com/puma/puma/pull/2238" title="PR by @sthirugn, merged 2020-05-07">#2238</a>)</li>
<li>Added <a href="Puma.html#stats_hash-class_method" title="Puma.stats_hash (method)">Puma.stats_hash</a>, which returns a stats in Hash instead of a JSON string (<a href="https://github.com/puma/puma/pull/2086" title="PR by @bdewater, merged 2019-12-17">#2086</a>, <a href="https://github.com/puma/puma/pull/2253" title="PR by @schneems, merged 2020-05-11">#2253</a>)</li>
<li><code>rack.multithread</code> and <code>rack.multiprocess</code> now dynamically resolved by <code>max_thread</code> and <code>workers</code> respectively (<a href="https://github.com/puma/puma/pull/2288" title="PR by @FTLam11, merged 2020-06-02">#2288</a>)</li>
</ul></li>
<li><p>Deprecations, Removals and Breaking API Changes</p>
<ul>
<li><code>--control</code> has been removed. Use <code>--control-url</code> (<a href="https://github.com/puma/puma/pull/1487" title="PR by @jxa, merged 2018-05-09">#1487</a>)</li>
<li><code>worker_directory</code> has been removed. Use <code>directory</code>.</li>
<li>min_threads now set by environment variables PUMA_MIN_THREADS and MIN_THREADS. (<a href="https://github.com/puma/puma/pull/2143" title="PR by @jalevin, merged 2020-04-21">#2143</a>)</li>
<li>max_threads now set by environment variables PUMA_MAX_THREADS and MAX_THREADS. (<a href="https://github.com/puma/puma/pull/2143" title="PR by @jalevin, merged 2020-04-21">#2143</a>)</li>
<li>max_threads default to 5 in MRI or 16 for all other interpreters. (<a href="https://github.com/puma/puma/pull/2143" title="PR by @jalevin, merged 2020-04-21">#2143</a>)</li>
<li><code>preload_app!</code> is on by default if number of workers > 1 and set via <code>WEB_CONCURRENCY</code> (<a href="https://github.com/puma/puma/pull/2143" title="PR by @jalevin, merged 2020-04-21">#2143</a>)</li>
<li>Puma::Plugin.workers_supported? has been removed. Use Puma.forkable? instead. (<a href="https://github.com/puma/puma/pull/2143" title="PR by @jalevin, merged 2020-04-21">#2143</a>)</li>
<li><code>tcp_mode</code> has been removed without replacement. (<a href="https://github.com/puma/puma/pull/2169" title="PR by @nateberkopec, merged 2020-03-10">#2169</a>)</li>
<li>Daemonization has been removed without replacement. (<a href="https://github.com/puma/puma/pull/2170" title="PR by @nateberkopec, merged 2020-03-10">#2170</a>)</li>
<li>Changed #connected_port to #connected_ports (<a href="https://github.com/puma/puma/pull/2076" title="PR by @drews256, merged 2020-02-27">#2076</a>)</li>
<li>Configuration: <code>environment</code> is read from <code>RAILS_ENV</code>, if <code>RACK_ENV</code> can't be found (<a href="https://github.com/puma/puma/pull/2022" title="PR by @olleolleolle, merged 2019-11-11">#2022</a>)</li>
<li>Log binding on http:// for TCP bindings to make it clickable (<a href="https://github.com/puma/puma/pull/2300" title="PR by @alexeevit, merged 2020-07-06">#2300</a>)</li>
</ul></li>
<li><p>Bugfixes</p>
<ul>
<li>Fix JSON loading issues on phased-restarts (<a href="https://github.com/puma/puma/pull/2269" title="PR by @MSP-Greg, merged 2020-08-31">#2269</a>)</li>
<li>Improve shutdown reliability (<a href="https://github.com/puma/puma/pull/2312" title="PR by @MSP-Greg, merged 2020-07-20">#2312</a>, <a href="https://github.com/puma/puma/issues/2338" title="Issue by @micahhainlinestitchfix, closed 2020-08-18">#2338</a>)</li>
<li>Close client http connections made to an ssl server with TLSv1.3 (<a href="https://github.com/puma/puma/pull/2116" title="PR by @MSP-Greg, merged 2020-05-15">#2116</a>)</li>
<li>Do not set user_config to quiet by default to allow for file config (<a href="https://github.com/puma/puma/issues/2074" title="Issue by @jchristie55332, closed 2020-02-19">#2074</a>)</li>
<li>Always close SSL connection in Puma::ControlCLI (<a href="https://github.com/puma/puma/pull/2211" title="PR by @MSP-Greg, merged 2020-03-30">#2211</a>)</li>
<li>Windows update extconf.rb for use with ssp and varied Ruby/MSYS2 combinations (<a href="https://github.com/puma/puma/pull/2069" title="PR by @MSP-Greg, merged 2019-11-09">#2069</a>)</li>
<li>Ensure control server Unix socket is closed on shutdown (<a href="https://github.com/puma/puma/pull/2112" title="PR by @wjordan, merged 2020-03-03">#2112</a>)</li>
<li>Preserve <code>BUNDLE_GEMFILE</code> env var when using <code>prune_bundler</code> (<a href="https://github.com/puma/puma/pull/1893" title="PR by @seven1m, merged 2020-02-18">#1893</a>)</li>
<li>Send 408 request timeout even when queue requests is disabled (<a href="https://github.com/puma/puma/pull/2119" title="PR by @wjordan, merged 2020-02-20">#2119</a>)</li>
<li>Rescue IO::WaitReadable instead of EAGAIN for blocking read (<a href="https://github.com/puma/puma/pull/2121" title="PR by @wjordan, merged 2020-02-21">#2121</a>)</li>
<li>Ensure <code>BUNDLE_GEMFILE</code> is unspecified in workers if unspecified in master when using <code>prune_bundler</code> (<a href="https://github.com/puma/puma/pull/2154" title="PR by @cjlarose, merged 2020-03-10">#2154</a>)</li>
<li>Rescue and log exceptions in hooks defined by users (on_worker_boot, after_worker_fork etc) (<a href="https://github.com/puma/puma/issues/1551" title="Issue by @austinthecoder, closed 2020-03-10">#1551</a>)</li>
<li>Read directly from the socket in #read_and_drop to avoid raising further SSL errors (<a href="https://github.com/puma/puma/pull/2198" title="PR by @eregon, merged 2020-03-24">#2198</a>)</li>
<li>Set <code>Connection: closed</code> header when queue requests is disabled (<a href="https://github.com/puma/puma/pull/2216" title="PR by @praboud-stripe, merged 2020-04-06">#2216</a>)</li>
<li>Pass queued requests to thread pool on server shutdown (<a href="https://github.com/puma/puma/pull/2122" title="PR by @wjordan, merged 2020-04-10">#2122</a>)</li>
<li>Fixed a few minor concurrency bugs in ThreadPool that may have affected non-GVL Rubies (<a href="https://github.com/puma/puma/pull/2220" title="PR by @wjordan, merged 2020-04-14">#2220</a>)</li>
<li>Fix <code>out_of_band</code> hook never executed if the number of worker threads is > 1 (<a href="https://github.com/puma/puma/issues/2177" title="Issue by @GuiTeK, closed 2020-04-08">#2177</a>)</li>
<li>Fix ThreadPool#shutdown timeout accuracy (<a href="https://github.com/puma/puma/pull/2221" title="PR by @wjordan, merged 2020-04-17">#2221</a>)</li>
<li>Fix <a href="Puma/UserFileDefaultOptions.html#fetch-instance_method" title="Puma::UserFileDefaultOptions#fetch (method)">Puma::UserFileDefaultOptions#fetch</a> to properly use <code>default</code> (<a href="https://github.com/puma/puma/pull/2233" title="PR by @ayufan, merged 2020-04-25">#2233</a>)</li>
<li>Improvements to <code>out_of_band</code> hook (<a href="https://github.com/puma/puma/pull/2234" title="PR by @wjordan, merged 2020-04-30">#2234</a>)</li>
<li>Prefer the rackup file specified by the CLI (<a href="https://github.com/puma/puma/issues/2225" title="Issue by @nateberkopec, closed 2020-04-27">#2225</a>)</li>
<li>Fix for spawning subprocesses with fork_worker option (<a href="https://github.com/puma/puma/pull/2267" title="PR by @wjordan, merged 2020-05-20">#2267</a>)</li>
<li>Set <code>CONTENT_LENGTH</code> for chunked requests (<a href="https://github.com/puma/puma/pull/2287" title="PR by @eugeneius, merged 2020-05-31">#2287</a>)</li>
<li>JRuby - Add Puma::MiniSSL::Engine#init? and #teardown methods, run all SSL tests (<a href="https://github.com/puma/puma/pull/2317" title="PR by @MSP-Greg, merged 2020-09-01">#2317</a>)</li>
<li>Improve shutdown reliability (<a href="https://github.com/puma/puma/pull/2312" title="PR by @MSP-Greg, merged 2020-07-20">#2312</a>)</li>
<li>Resolve issue with threadpool waiting counter decrement when thread is killed</li>
<li>Constrain rake-compiler version to 0.9.4 to fix <code>ClassNotFound</code> exception when using MiniSSL with Java8.</li>
<li>Fix recursive <code>prune_bundler</code> (<a href="https://github.com/puma/puma/issues/2319" title="Issue by @AlexWayfer, closed 2020-09-03">#2319</a>).</li>
<li>Ensure that TCP_CORK is usable</li>
<li>Fix corner case when request body is chunked (<a href="https://github.com/puma/puma/pull/2326" title="PR by @rkistner, closed 2020-09-04">#2326</a>)</li>
<li>Fix filehandle leak in MiniSSL (<a href="https://github.com/puma/puma/issues/2299" title="Issue by @JohnPhillips31416, closed 2020-09-17">#2299</a>)</li>
</ul></li>
<li><p>Refactor</p>
<ul>
<li>Remove unused loader argument from Plugin initializer (<a href="https://github.com/puma/puma/pull/2095" title="PR by @bdewater, merged 2019-12-25">#2095</a>)</li>
<li>Simplify <a href="Puma/Configuration.html#random_token-class_method" title="Puma::Configuration.random_token (method)">Puma::Configuration.random_token</a> and remove insecure fallback (<a href="https://github.com/puma/puma/pull/2102" title="PR by @bdewater, merged 2020-02-07">#2102</a>)</li>
<li>Simplify <a href="Puma/Runner.html#start_control-instance_method" title="Puma::Runner#start_control (method)">Puma::Runner#start_control</a> URL parsing (<a href="https://github.com/puma/puma/pull/2111" title="PR by @wjordan, merged 2020-02-20">#2111</a>)</li>
<li>Removed the IOBuffer extension and replaced with Ruby (<a href="https://github.com/puma/puma/pull/1980" title="PR by @nateberkopec, merged 2020-02-27">#1980</a>)</li>
<li>Update <code>Rack::Handler::Puma.run</code> to use <code>**options</code> (<a href="https://github.com/puma/puma/pull/2189" title="PR by @jkowens, merged 2020-03-19">#2189</a>)</li>
<li>ThreadPool concurrency refactoring (<a href="https://github.com/puma/puma/pull/2220" title="PR by @wjordan, merged 2020-04-14">#2220</a>)</li>
<li>JSON parse cluster worker stats instead of regex (<a href="https://github.com/puma/puma/pull/2124" title="PR by @wjordan, merged 2020-04-14">#2124</a>)</li>
<li>Support parallel tests in verbose progress reporting (<a href="https://github.com/puma/puma/pull/2223" title="PR by @wjordan, merged 2020-04-20">#2223</a>)</li>
<li>Refactor error handling in server accept loop (<a href="https://github.com/puma/puma/pull/2239" title="PR by @wjordan, merged 2020-05-15">#2239</a>)</li>
</ul></li>
</ul>
<h2>4.3.12 / 2022-03-30</h2>
<ul>
<li>Security
<ul>
<li>Close several HTTP Request Smuggling exploits (CVE-2022-24790)</li>
</ul></li>
</ul>
<h2>4.3.11 / 2022-02-11</h2>
<ul>
<li>Security
<ul>
<li>Always close the response body (GHSA-rmj8-8hhh-gv5h)</li>
</ul></li>
</ul>
<h2>4.3.10 / 2021-10-12</h2>
<ul>
<li>Bugfixes
<ul>
<li>Allow UTF-8 in HTTP header values</li>
</ul></li>
</ul>
<h2>4.3.9 / 2021-10-12</h2>
<ul>
<li>Security
<ul>
<li>Do not allow LF as a line ending in a header (CVE-2021-41136)</li>
</ul></li>
</ul>
<h2>4.3.8 / 2021-05-11</h2>
<ul>
<li>Security
<ul>
<li>Close keepalive connections after the maximum number of fast inlined requests (CVE-2021-29509) (<a href="https://github.com/puma/puma/issues/2625" title="Issue by @jarthod, closed 2021-05-11">#2625</a>)</li>
</ul></li>
</ul>
<h2>4.3.7 / 2020-11-30</h2>
<ul>
<li>Bugfixes
<ul>
<li>Backport set CONTENT_LENGTH for chunked requests (Originally: <a href="https://github.com/puma/puma/pull/2287" title="PR by @eugeneius, merged 2020-05-31">#2287</a>, backport: <a href="https://github.com/puma/puma/pull/2496" title="PR by @TheRusskiy, merged 2020-11-30">#2496</a>)</li>
</ul></li>
</ul>
<h2>4.3.6 / 2020-09-05</h2>
<ul>
<li>Bugfixes
<ul>
<li>Explicitly include ctype.h to fix compilation warning and build error on macOS with Xcode 12 (<a href="https://github.com/puma/puma/issues/2304" title="Issue by @mpeltomaa, closed 2020-09-05">#2304</a>)</li>
<li>Don't require json at boot (<a href="https://github.com/puma/puma/pull/2269" title="PR by @MSP-Greg, merged 2020-08-31">#2269</a>)</li>
</ul></li>
</ul>
<h2>4.3.4/4.3.5 and 3.12.5/3.12.6 / 2020-05-22</h2>
<p>Each patchlevel release contains a separate security fix. We recommend simply upgrading to 4.3.5/3.12.6.</p>
<ul>
<li>Security
<ul>
<li>Fix: Fixed two separate HTTP smuggling vulnerabilities that used the Transfer-Encoding header. CVE-2020-11076 and CVE-2020-11077.</li>
</ul></li>
</ul>
<h2>4.3.3 and 3.12.4 / 2020-02-28</h2>
<ul>
<li>Bugfixes
<ul>
<li>Fix: Fixes a problem where we weren't splitting headers correctly on newlines (<a href="https://github.com/puma/puma/issues/2132" title="Issue by @bmclean, closed 2020-02-28">#2132</a>)</li>
</ul></li>
<li>Security
<ul>
<li>Fix: Prevent HTTP Response splitting via CR in early hints. CVE-2020-5249.</li>
</ul></li>
</ul>
<h2>4.3.2 and 3.12.3 / 2020-02-27 (YANKED)</h2>
<ul>
<li>Security
<ul>
<li>Fix: Prevent HTTP Response splitting via CR/LF in header values. CVE-2020-5247.</li>
</ul></li>
</ul>
<h2>4.3.1 and 3.12.2 / 2019-12-05</h2>
<ul>
<li>Security
<ul>
<li>Fix: a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. CVE-2019-16770.</li>
</ul></li>
</ul>
<h2>4.3.0 / 2019-11-07</h2>
<ul>
<li><p>Features</p>
<ul>
<li>Strip whitespace at end of HTTP headers (<a href="https://github.com/puma/puma/pull/2010" title="PR by @nateberkopec, merged 2019-10-07">#2010</a>)</li>
<li>Optimize HTTP parser for JRuby (<a href="https://github.com/puma/puma/pull/2012" title="PR by @headius, merged 2019-10-07">#2012</a>)</li>
<li>Add SSL support for the control app and cli (<a href="https://github.com/puma/puma/pull/2046" title="PR by @composerinteralia, merged 2019-10-21">#2046</a>, <a href="https://github.com/puma/puma/pull/2052" title="PR by @composerinteralia, merged 2019-11-02">#2052</a>)</li>
</ul></li>
<li><p>Bugfixes</p>
<ul>
<li>Fix Errno::EINVAL when SSL is enabled and browser rejects cert (<a href="https://github.com/puma/puma/issues/1564" title="Issue by @perlun, closed 2019-10-07">#1564</a>)</li>
<li>Fix pumactl defaulting puma to development if an environment was not specified (<a href="https://github.com/puma/puma/pull/2035" title="PR by @AndrewSpeed, merged 2019-10-18">#2035</a>)</li>
<li>Fix closing file stream when reading pid from pidfile (<a href="https://github.com/puma/puma/pull/2048" title="PR by @hahmed, merged 2019-10-21">#2048</a>)</li>
<li>Fix a typo in configuration option <code>--extra_runtime_dependencies</code> (<a href="https://github.com/puma/puma/pull/2050" title="PR by @olleolleolle, merged 2019-10-25">#2050</a>)</li>
</ul></li>
</ul>
<h2>4.2.1 / 2019-10-07</h2>
<ul>
<li>3 bugfixes
<ul>
<li>Fix socket activation of systemd (pre-existing) unix binder files (<a href="https://github.com/puma/puma/issues/1842" title="Issue by @nateberkopec, closed 2019-09-18">#1842</a>, <a href="https://github.com/puma/puma/issues/1988" title="Issue by @mcg, closed 2019-10-01">#1988</a>)</li>