passenger 6.0.18 → 6.0.20

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 9631f47cd869b2262addb53a779923f101ebb5ee
-  data.tar.gz: 7dbcdde76c535a7bd78e39fca3ce19a524b3733c
+SHA256:
+  metadata.gz: 31a05868dd215b1999d12f6b03d72af3ea92674ee44ad6b8c4ac04656ee3e45f
+  data.tar.gz: 7b827c29786d69c42544e9ffd1be1a9a22bb7a7c5c290c4f58a9a4c092352034
 SHA512:
-  metadata.gz: f55d2c8ee306af93f2c83042de2ff89a296059594b471796fe8d945ed759a8623703b38a154dad95fe46d6d602fe75a18b6db2da06749a353c34fbb1f8fc866d
-  data.tar.gz: 0a13b5e2e888dce47a980b62485a6ccca71f01c4d0db98934d0cd61f44a8ca69c4b70bdeddd540ed17fada52df588a775524807616314e9430ec488d9f6d96cc
+  metadata.gz: 0bfbb6358658b39082ddd04c56f6d9dcd8e3a1a8ea4309146d3c9fd0706fd936f60eb2cbedd4b4264e9a81a1723e3335ad4da746486eca41453ac5401e8bd5d7
+  data.tar.gz: ca7752ab7ddce1209e99f6e1a1c408d5c4363b821b3eb97c68cba9481ae8575ddebd46ab9e69f2e2fad182b4f4976f997ebdd17776280aaaa5ef2f0b04486c2e

data/CHANGELOG

@@ -1,6 +1,52 @@
-Release 6.0.18 (Not yet released)
+Release 6.0.20 (Not yet released)
+-------------
+ * Upgrades Boost from 1.81 -> 1.83.
+ * Upgrades http-parser from 2.3.0 -> 2.9.4.
+ * [Ubuntu] Adds packages for Ubuntu 23.10 "mantic".
+ * [Python] Address use of binary strings and file reads in python3.
+ * [Ruby] Address use of deprecated ActiveRecord method. Closes GH-2516.
+ * [ARM] fix arch for apache module on Arm Macs.
+ * Updated various library versions used in precompiled binaries (used for e.g. gem installs):
+   - cmake: 3.27.7 -> 3.28.1
+   - curl: 8.4.0 -> 8.5.0
+   - git: 2.42.0 -> 2.43.0
+   - libgcrypt: 1.10.2 -> 1.10.3
+   - libksba: 1.6.4 -> 1.6.5
+   - ntbtls: 0.3.1 -> 0.3.2
+   - openssl: 3.1.4 -> 3.2.0
+   - rubygems: 3.4.21 -> 3.5.4
+   - s3cmd: 2.3.0 -> 2.4.0
+   - rubies:
+     - 3.2.2 -> 3.2.3
+     - 3.3.0
+
+
+Release 6.0.19
+-------------
+ * [Ruby] Fix compatibility with Rack 3 header array. Closes GH-2503.
+ * [Ruby] Preserve `SIGPROF` signal handlers. Contributed by Ivo Anjo. Closes GH-2489.
+ * [Python] Replaces use of imp module with importlib in Python 3. Contributed by Rongxin Liu. Closes GH-2399 and GH-2501.
+ * [Ubuntu] Removes packages for Ubuntu 18.04 "Bionic" (EOL June 2023).
+ * Fixed a memory allocation bug in the security update checker.
+ * [Debian] Add Debian 12 Bookworm packages. Closes GH-2488.
+ * [RPM] Published arm64/aarch64 rpms for EL8 & EL9 (RHEL, Rocky, Alma). Closes GH-2452.
+ * [ARM] Publishes prebuilt arm64/aarch64 binaries for Passenger gem installs. Closes GH-2288.
+ * [ARM] Fixes a regression in Passenger 6.0.7 where strict-aliasing archs (notably: aarch64 aka ARM64) builds of Passenger were always building for big-endian archs. Closes GH-2451 and GH-2419.
+ * Updated various library versions used in precompiled binaries (used for e.g. gem installs):
+   - ccache: 4.6.3 -> 4.8.3
+   - cmake: 3.26.4 -> 3.27.7
+   - curl: 8.1.2 -> 8.4.0
+   - git: 2.41.0 -> 2.42.0
+   - gnupg: 2.4.2 -> 2.4.3
+   - libassuan: 2.5.5 -> 2.5.6
+   - libksba: 1.6.3 -> 1.6.4
+   - openssl: 3.1.1 -> 3.1.4
+   - rubygems: 3.4.13 -> 3.4.21
+   - zlib: 1.2.13 -> 1.3
+
+
+Release 6.0.18
 -------------
- * Adds support for arm (aarch64) rpm packages.
  * Adds Ubuntu 23.04 "Lunar" packages, removes Ubuntu 22.10 "Kinetic" packages.
  * Removes packages for Debian 9 "Stretch" (EOL June 2022).
  * [RPM] Changes to building Nginx module packages for the latest supported Nginx module stream instead of the default.

data/CONTRIBUTORS

@@ -48,6 +48,7 @@ Ian Kottman
 Igor Vuk
 isaac
 Isaac Reuben
+Ivo Anjo
 J Smith
 J.W. Koelewijn
 Jacob Elder
@@ -105,6 +106,7 @@ Rob Paisley
 Robin Bowes
 Romain Tartière
 ROMB
+Rongxin Liu
 Ruslan Ermilov (NGINX Inc)
 Ryan Schwartz
 Ryo Onodera

data/build/integration_tests.rb

@@ -105,8 +105,9 @@ task 'test:integration:native_packaging' do
     # The tests put /usr/bin and /usr/sbin first in PATH, causing /usr/bin/ruby to be used.
     # We should run the tests in /usr/bin/ruby too, so that native_support is compiled for
     # the same Ruby.
+    brew_prefix = `env -P /usr/local/bin:/opt/homebrew/bin brew --prefix`
     prefix = "env NATIVE_PACKAGING_METHOD=homebrew " +
-      "LOCATIONS_INI=/usr/local/Cellar/passenger/#{PhusionPassenger::VERSION_STRING}/libexec/src/ruby_supportlib/phusion_passenger/locations.ini"
+      "LOCATIONS_INI=#{brew_prefix}/Cellar/passenger/#{PhusionPassenger::VERSION_STRING}/libexec/src/ruby_supportlib/phusion_passenger/locations.ini"
     if PlatformInfo.in_rvm?
       prefix << " rvm-exec system /usr/bin/ruby -S"
     end

data/build/test_basics.rb

@@ -62,9 +62,13 @@ task 'test:install_deps' do
   end
 
   if install_base_deps
-    sh "bundle install #{bundle_args} --without="
+    if Gem::Version.new(RUBY_VERSION) >= Gem::Version.new('3.0.0') || RUBY_PLATFORM =~ /darwin/
+      sh "bundle install #{bundle_args} --without="
+    else
+      sh "bundle install #{bundle_args} --without future"
+    end
   else
-    sh "bundle install #{bundle_args} --without base"
+    sh "bundle install #{bundle_args} --without base future"
   end
 
   if boolean_option('NODE_MODULES', default)

data/dev/copy_boost_headers

@@ -24,56 +24,56 @@
 #  THE SOFTWARE.
 
 ESSENTIALS = [
-  "boost/detail/{limits,endian}.hpp",
-  "boost/config*",
-  "boost/mpl",
-  "boost/preprocessor/stringize.hpp",
-  "boost/smart_ptr/detail/sp_counted_*",
-  "boost/smart_ptr/detail/atomic_count*",
-  "boost/smart_ptr/detail/spinlock*",
+  "boost/*regex*",
+  "boost/algorithm/string",
+  "boost/asio*",
   "boost/atomic",
-  "boost/pool",
-  "boost/unordered*",
-  "boost/thread",
-  "boost/intrusive",
+  "boost/bind",
+  "boost/chrono*",
+  "boost/config*",
   "boost/container",
-  "boost/predef",
-  "boost/move",
   "boost/core",
-  "boost/bind",
+  "boost/cstdint.hpp",
+  "boost/date_time",
+  "boost/date_time/date_formatting_limited.hpp",
+  "boost/date_time/gregorian/formatters_limited.hpp",
+  "boost/detail/fenv.hpp",
+  "boost/detail/reference_content.hpp",
+  "boost/foreach.hpp",
   "boost/function",
-  "boost/ratio*",
   "boost/integer*",
-  "boost/chrono*",
-  "boost/random*",
-  "boost/asio*",
-  "boost/optional.hpp",
+  "boost/intrusive",
+  "boost/move",
+  "boost/mpl",
+  "boost/non_type.hpp",
+  "boost/none*",
   "boost/optional",
-  "boost/utility",
-  "libs/thread/src",
-  "libs/system/src",
-  "libs/regex/src",
-  "libs/chrono/src",
-  "libs/random/src",
-  "boost/preprocessor",
+  "boost/optional.hpp",
   "boost/parameter",
-  "boost/date_time/gregorian/formatters_limited.hpp",
-  "boost/date_time/date_formatting_limited.hpp",
-  "boost/type_traits/make_signed.hpp",
+  "boost/pool",
+  "boost/predef",
+  "boost/predef/other/endian.h",
+  "boost/preprocessor",
+  "boost/preprocessor/stringize.hpp",
+  "boost/random*",
+  "boost/ratio*",
+  "boost/smart_ptr/detail/atomic_count*",
+  "boost/smart_ptr/detail/sp_counted_*",
+  "boost/smart_ptr/detail/spinlock*",
+  "boost/system/config.hpp",
+  "boost/system/detail/error_code.ipp",
+  "boost/thread",
+  "boost/type_traits",
   "boost/type_traits/detail/*",
+  "boost/type_traits/make_signed.hpp",
   "boost/typeof",
-  "boost/date_time",
-  "boost/type_traits",
-  "boost/cstdint.hpp",
-  "boost/*regex*",
-  "boost/non_type.hpp",
-  "boost/detail/fenv.hpp",
-  "boost/foreach.hpp",
-  "boost/none*",
-  "boost/system/detail/error_code.ipp",
-  "boost/system/config.hpp",
-  "boost/detail/reference_content.hpp",
-  "boost/algorithm/string"
+  "boost/unordered*",
+  "boost/utility",
+  "libs/chrono/src",
+  "libs/random/src",
+  "libs/regex/src",
+  "libs/system/src",
+  "libs/thread/src",
 ]
 EXCLUDE = [
   "libs/thread/src/win32/*",
@@ -87,43 +87,59 @@ EXCLUDE = [
   "boost/asio/detail/impl/win*"
 ]
 PROGRAM_SOURCE = %q{
-  #include <boost/shared_ptr.hpp>
-  #include <boost/shared_array.hpp>
-  #include <boost/weak_ptr.hpp>
-  #include <boost/make_shared.hpp>
-  #include <boost/enable_shared_from_this.hpp>
-  #include <boost/intrusive_ptr.hpp>
-  #include <boost/smart_ptr/intrusive_ref_counter.hpp>
-  #include <boost/thread.hpp>
-  #include <boost/noncopyable.hpp>
-  #include <boost/function.hpp>
-  #include <boost/bind/bind.hpp>
-  #include <boost/container/vector.hpp>
-  #include <boost/date_time/posix_time/posix_time.hpp>
-  #include <boost/foreach.hpp>
-  #include <boost/unordered_map.hpp>
-  #include <boost/regex.hpp>
-  #include <boost/pool/object_pool.hpp>
-  #include <boost/move/core.hpp>
-  #include <boost/move/utility.hpp>
+  #include <boost/aligned_storage.hpp>
+  #include <boost/asio.hpp>
+  #include <boost/asio/ssl.hpp>
+  #include <boost/asio/steady_timer.hpp>
   #include <boost/atomic.hpp>
-  #include <boost/typeof/typeof.hpp>
+  #include <boost/bind/bind.hpp>
+  #include <boost/chrono.hpp>
   #include <boost/circular_buffer.hpp>
   #include <boost/config.hpp>
   #include <boost/container/small_vector.hpp>
+  #include <boost/container/vector.hpp>
   #include <boost/core/noncopyable.hpp>
   #include <boost/cstdint.hpp>
   #include <boost/current_function.hpp>
+  #include <boost/date_time/posix_time/posix_time.hpp>
   #include <boost/date_time/posix_time/posix_time_types.hpp>
+  #include <boost/enable_shared_from_this.hpp>
+  #include <boost/foreach.hpp>
+  #include <boost/function.hpp>
+  #include <boost/intrusive_ptr.hpp>
+  #include <boost/make_shared.hpp>
+  #include <boost/move/core.hpp>
   #include <boost/move/move.hpp>
+  #include <boost/move/utility.hpp>
+  #include <boost/noncopyable.hpp>
+  #include <boost/nondet_random.hpp>
+  #include <boost/pointer_cast.hpp>
+  #include <boost/pool/object_pool.hpp>
   #include <boost/predef.h>
+  #include <boost/predef/other/endian.h>
+  #include <boost/random/random_device.hpp>
+  #include <boost/random/uniform_int_distribution.hpp>
   #include <boost/ref.hpp>
+  #include <boost/regex.hpp>
   #include <boost/scoped_array.hpp>
   #include <boost/scoped_ptr.hpp>
+  #include <boost/shared_array.hpp>
+  #include <boost/shared_ptr.hpp>
+  #include <boost/smart_ptr/intrusive_ref_counter.hpp>
   #include <boost/static_assert.hpp>
+  #include <boost/system/error_code.hpp>
+  #include <boost/system/system_error.hpp>
+  #include <boost/thread.hpp>
+  #include <boost/thread/condition_variable.hpp>
   #include <boost/thread/mutex.hpp>
+  #include <boost/thread/once.hpp>
   #include <boost/thread/tss.hpp>
+  #include <boost/typeof/typeof.hpp>
+  #include <boost/unordered_map.hpp>
+  #include <boost/version.hpp>
+  #include <boost/weak_ptr.hpp>
 // Included despite not used in Passenger
+  #include <boost/thread/thread_time.hpp>
   #include <boost/cregex.hpp>
   #include <boost/pointer_cast.hpp>
   #include <boost/asio.hpp>

data/package.json

@@ -4,25 +4,25 @@
   "description": "A fast and robust web server and application server for Ruby, Python and Node.js",
   "main": "index.js",
   "devDependencies": {
-    "@babel/core": "^7.17.9",
-    "@babel/preset-env": "^7.16.11",
-    "@babel/preset-react": "^7.16.7",
-    "babel-loader": "^8.2.5",
-    "body-parser": "^1.20.0",
-    "css-loader": "^6.7.1",
+    "@babel/core": "^7.23.5",
+    "@babel/preset-env": "^7.23.5",
+    "@babel/preset-react": "^7.23.3",
+    "babel-loader": "^8.3.0",
+    "body-parser": "^1.20.2",
+    "css-loader": "^6.8.1",
     "css-minimizer-webpack-plugin": "^3.4.1",
-    "express": "^4.17.3",
-    "jquery": "^3.6.0",
-    "mini-css-extract-plugin": "^2.6.0",
-    "mocha": "^6.2.3",
-    "multer": "^1.4.4",
+    "express": "^4.18.2",
+    "jquery": "^3.7.1",
+    "mini-css-extract-plugin": "^2.7.6",
+    "mocha": "^9.2.2",
+    "multer": "^1.4.4-lts.1",
     "preact": "^8.5.3",
     "should": "^2.1.1",
     "sinon": "^1.17.7",
-    "style-loader": "^3.3.1",
-    "terser-webpack-plugin": "^5.3.1",
-    "webpack": "^5.72.0",
-    "webpack-cli": "^4.9.2"
+    "style-loader": "^3.3.3",
+    "terser-webpack-plugin": "^5.3.9",
+    "webpack": "^5.89.0",
+    "webpack-cli": "^4.10.0"
   },
   "scripts": {
     "test": "rake test:node"

data/src/agent/Core/Config.h

@@ -165,7 +165,7 @@ using namespace std;
  *   security_update_checker_interval                                unsigned integer   -          default(86400)
  *   security_update_checker_proxy_url                               string             -          -
  *   security_update_checker_url                                     string             -          default("https://securitycheck.phusionpassenger.com/v1/check.json")
- *   server_software                                                 string             -          default("Phusion_Passenger/6.0.18")
+ *   server_software                                                 string             -          default("Phusion_Passenger/6.0.20")
  *   show_version_in_header                                          boolean            -          default(true)
  *   single_app_mode_app_root                                        string             -          default,read_only
  *   single_app_mode_app_start_command                               string             -          read_only

data/src/agent/Core/Controller/Config.h

@@ -116,7 +116,7 @@ parseControllerBenchmarkMode(const StaticString &mode) {
  *   multi_app                                           boolean            -          default(true),read_only
  *   request_freelist_limit                              unsigned integer   -          default(1024)
  *   response_buffer_high_watermark                      unsigned integer   -          default(134217728)
- *   server_software                                     string             -          default("Phusion_Passenger/6.0.18")
+ *   server_software                                     string             -          default("Phusion_Passenger/6.0.20")
  *   show_version_in_header                              boolean            -          default(true)
  *   start_reading_after_accept                          boolean            -          default(true)
  *   stat_throttle_rate                                  unsigned integer   -          default(10)

data/src/agent/Core/SecurityUpdateChecker.h

@@ -322,7 +322,7 @@ private:
 				error.append("url not found: " + sessionState.configRlz.url + " " POSSIBLE_MITM_RESOLUTION);
 				break;
 			case 403:
-				error.append("connection denied by server " POSSIBLE_MITM_RESOLUTION);
+				error.append("request forbidden by server " POSSIBLE_MITM_RESOLUTION);
 				break;
 			case 503:
 				error.append("server temporarily unavailable, try again later");
@@ -646,7 +646,7 @@ public:
 			string data64 = responseJson["data"].asString();
 
 			signatureChars = (char *)malloc(modp_b64_decode_len(signature64.length()));
-			dataChars = (char *)malloc(modp_b64_decode_len(data64.length()));
+			dataChars = (char *)malloc(modp_b64_decode_len(data64.length()) + 1);
 			if (signatureChars == NULL || dataChars == NULL) {
 				logUpdateFailResponse("out of memory", responseData);
 				break;
@@ -667,14 +667,14 @@ public:
 			int dataLen;
 			dataLen = modp_b64_decode(dataChars, data64.c_str(), data64.length());
 			if (dataLen <= 0) {
-				logUpdateFailResponse("corrupted data", responseData);
+				logUpdateFailResponse("corrupted data", data64.c_str());
 				break;
 			}
 			dataChars[dataLen] = '\0';
 
 			Json::Value responseDataJson;
 			if (!reader.parse(dataChars, responseDataJson, false)) {
-				logUpdateFailResponse("unparseable data", responseData);
+				logUpdateFailResponse("unparseable data", dataChars);
 				break;
 			}
 			P_DEBUG("data content (signature OK): " << responseDataJson.toStyledString());

data/src/agent/Watchdog/Config.h

@@ -154,7 +154,7 @@ using namespace std;
  *   security_update_checker_interval                                         unsigned integer   -          default(86400)
  *   security_update_checker_proxy_url                                        string             -          -
  *   security_update_checker_url                                              string             -          default("https://securitycheck.phusionpassenger.com/v1/check.json")
- *   server_software                                                          string             -          default("Phusion_Passenger/6.0.18")
+ *   server_software                                                          string             -          default("Phusion_Passenger/6.0.20")
  *   setsid                                                                   boolean            -          default(false)
  *   show_version_in_header                                                   boolean            -          default(true)
  *   single_app_mode_app_root                                                 string             -          default,read_only

data/src/cxx_supportlib/Constants.h

@@ -83,7 +83,7 @@
 #define PASSENGER_API_VERSION_MAJOR 0
 #define PASSENGER_API_VERSION_MINOR 3
 #define PASSENGER_DEFAULT_USER "nobody"
-#define PASSENGER_VERSION "6.0.18"
+#define PASSENGER_VERSION "6.0.20"
 #define POOL_HELPER_THREAD_STACK_SIZE 262144
 #define PROCESS_SHUTDOWN_TIMEOUT 60
 #define PROCESS_SHUTDOWN_TIMEOUT_DISPLAY "1 minute"

data/src/cxx_supportlib/ServerKit/HttpHeaderParser.h

@@ -489,6 +489,9 @@ public:
 					goto default_error;
 				}
 				break;
+			case HPE_UNEXPECTED_CONTENT_LENGTH:
+				message->aux.parseError = REQUEST_CONTAINS_CONTENT_LENGTH_AND_TRANSFER_ENCODING;
+				break;
 			default:
 				default_error:
 				message->aux.parseError = HTTP_PARSER_ERRNO_BEGIN - HTTP_PARSER_ERRNO(&state->parser);