Log message:
Update Passenger to 5.0.6.
Remove libev linking, as building with external libev is no longer possible.
Upstream changelog follows:
Release 5.0.6
-------------
* The turbocache no longer caches responses for which the Cache-Control header
contains "no-cache". Please note that "no-cache" does not \
mean "do not
cache this response". Instead, it means "any caching servers may \
only serve
the cached response after validating it". Since the turbocache does not
support validation, we've chosen to skip caching instead.
* Fixes a number of memory leaks. Memory was leaked upon processing a request
with multiple headers, upon processing a response with multiple headers,
and upon processing a response with Set-Cookie headers. Every time such
a request or response was processed, 512 bytes of memory was leaked due
to improperly dereferencing relevant memory buffers. Closes GH-1455.
* Fixes various bugs related to Union Station data collection.
* Fixes a Union Station-related file descriptor leak. Closes GH-1439.
* Fixes some bugs w.r.t. use of uninitialized memory.
* More informative error message if a support binary is not found, including
a resolution hint. Closes GH-1395.
* [Apache] `SetEnv` variables are now passed as Rack/CGI/request variables.
This was also the case in Passenger 4, but not in Passenger 5.0.0-5.0.5.
We've restored the old behavior because the behavior in 5.0.0-5.0.5 breaks
certain Apache modules such as Shibboleth. Closes GH-1446.
* [Standalone] PID and log files now correctly created if user specifies
relative path.
Release 5.0.5
-------------
* Fixes various crashes due to use of uninitialized memory. One such crash
is documented in GH-1431.
* Fixes a connection stall in the Apache module. Closes GH-1425.
* Fixes a potential read-past-buffer bug in string-to-integer conversion
routines. Thanks to dcb314 for spotting this. Closes GH-1441.
* Fixes a compilation problem on Solaris. This problem was caused by the fact
that `tm_gmtoff` is not supported on that platform. Closes GH-1435.
* There is now an API endpoint for force disconnecting a client:
`passenger-config admin-command DELETE /server/<client name>.json`.
Closes GH-1246.
* Fixes some file descriptor leaks. These leaks were caused by the fact that
keep-alive connections with application processes were not being closed
properly. Closes GH-1439.
* In order to more easily debug future file descriptor leaks, we've introduced
the `PassengerFileDescriptorLogFile` (Apache) and
`passenger_file_descriptor_log_file` (Nginx) config options. This allows
Passenger to log all file descriptor open/close activity to a specific
log file.
* The `PassengerDebugLogFile` (Apache) and `passenger_debug_log_file` (Nginx)
configuration options have been renamed to `PassengerLogFile` and
`passenger_log_file`, respectively. The old name is support supported for
backward compatibility reasons.
* [Enterprise] Fixes a bug in Flying Passenger's `--instance-registry-dir`
command line parameter. This command line parameter didn't do anything.
* [Enterprise] The Flying Passenger daemon no longer supports the
`--max-preloader-idle-time` config option. This is because the config option
never worked. The correct way to set the max preloader idle time is through
the Nginx config option, but this was wrongly documented, so
the documentation has been fixed.
Release 5.0.4
-------------
* Fixes a compilation problem introduced in 5.0.3.
Release 5.0.3
-------------
* [Standalone] When using the builtin engine, `passenger start` may crash
during startup due to an initialization race condition. This has been fixed.
* [Enterprise] Fixes a bug in passenger-irb. Running passenger-irb without
a PID parameter worked, but running it with a PID parameter didn't.
* Fixes an integer overflow that resulted in a file descriptor leak and
stalled client connections. Closes GH-1412.
* Truncates Passenger source code paths in logs (to 3 chars) to reduce
redundant info. Closes GH-1383.
* Fixes invalid JSON output for non-finite double values (e.g. from the HTTP
JSON API). Closes GH-1408.
* All hooks now set the `PASSENGER_HOOK_NAME` environment variable. This
variable is set to the name of the hook that is being called.
* The Ruby handler no longer tries to call #force_encoding on response body
strings, which fixes an incompatibility with apps/libraries that return
frozen body strings. Closes GH-1414.
* If the Ruby handler crashes while processing a Rack response body, it will
now no longer stall the connection.
* Fixes env.SERVER_PORT containing 80 instead of 443 when using https on
default port. Closes GH-1421.
* We now handle errors in the `poll()` system call better. This might fix
some crashes during shutdown which manifest on FreeBSD.
Release 5.0.2
-------------
* Fixes a connection freeze that could occur when processing large responses.
This would manifest itself under the error message "This website is under
heavy load" or "Request queue is full, returning an error". \
Closes GH-1404.
* Debian and Ubuntu packages have been reintroduced.
* When `passenger-config restart-app` is run interactively, if Passenger is
not serving any applications, then the command now prints an error message
instead of showing a menu with only a "Cancel" option.
* Fixes a compilation problem on FreeBSD 10 (contributed by: clemensg).
Closes GH-1401.
* [Standalone] Fixes a crash that would occur if you use the `--ctl`
parameter.
* [Enterprise] The `--max-request-time` option has been added to Passenger
Standalone.
* [Enterprise] The `max_request_time_reached` hook has been introduced. This
hook allows you to run diagnostics on a process that that took too long
to respond to a request.
Release 5.0.1
-------------
* The `passenger-config restart-app` command is now more user friendly.
When run in a terminal, it will show an interactive menu, allowing you
to select the app to restart. Closes GH-1387.
* Fixed a crash bug in the handling of sticky session cookies.
* Log failed program in error message, not its command line (contributed
by: paisleyrob). Closes GH-1397.
* [Nginx] Fixes cases in which Passenger overrides the Nginx handler
function even when it shouldn't, for example when Passenger is disabled.
Closes GH-1393.
* [Enterprise] The `sticky_sessions` and `envvars` options in
Passengerfile.json is now also supported in mass deployment mode.
Release 5.0.0 release candidate 2
---------------------------------
* Fixes an installation problem with the Ruby gem due to incorrect Makefile
generation. Closes GH-1382.
* More helpful message when request queue is full. Closes GH-1375.
Release 5.0.0 release candidate 1
---------------------------------
* Fixed Date headers not being formatted in the GMT timezone. Closes GH-1367.
* Fixed Passengerfile.json/passenger-standalone.json not being properly
loaded in Passenger Standalone.
* Fixed support for sticky sessions.
* Fixed an infinite loop if the ApplicationPool garbage collector fails due
to an exception. Closes GH-1360.
* Fixed Passenger Standalone exiting prematurely when the HelperAgent crashes.
Exiting prematurely is not supposed to happen because the watchdog will
restart the HelperAgent. Closes GH-1339.
* Fixed a crash that occurs when using a non-standard startup file value.
Closes GH-1378.
* When dumping system metrics during error page generation, the
`passenger-config` command is now invoked under the same Ruby interpreter
as the app, instead of the one in PATH. Closes GH-1381.
* When a Ruby process crashes due to an uncaught exception, this fact is now
properly logged.
* Specifying 0 for the `max_pool_size` config option no longer results
in a crash. Closes GH-1334.
* The timeouts when downloading Passenger Standalone binaries and source
files are now customizable. Closes GH-1295.
* The `envvars` option is now supported in Passengerfile.json, for passing
environment variables to the application. Closes GH-1377.
* Introduced `hook_queue_full_error` for request queue overflows.
* [Ruby] Fixed handling of "transfer-encoding chunked" response bodies
which contain zero-sized chunks.
* [Nginx] It is no longer necessary to re-specify `passenger_enabled`
in `location` contexts. Closes GH-1338.
* [Enterprise] Fixed a bug in mass deployment reloading.
* [Enterprise] Fixed a bug in mass deployment daemonization.
* [Enterprise] The mass deployment mode now supports the `app_type`
and `startup_file` configuration options in
Passengerfile.json/passenger-standalone.json. Closes GH-1366.
Release 5.0.0 beta 3
--------------------
* The turbocache has received major updates and fixes based on excellent
feedback Chris Heald and the community. First, several bugs w.r.t.
the handling of caching headers have been fixed. Second, the turbocache
has become slightly more conservative for security reasons. In previous
versions, default cacheable responses (as defined by RFC 7234) were cached
unless caching headers tell us not to. Now, default cacheable responses
are only cached if caching headers explicitly tell us to. This change was
introduced because there are many applications that set incorrect caching
headers on private responses. This new behavior is currently not
configurable, but there are plans to make it configurable in 5.0.0
release candidate 1.
* Introduced a new configuration option,
`passenger_response_buffer_high_watermark` (Nginx) and
`PassengerResponseBufferHighWatermark` (Apache), for configuring
the behavior of the response buffering system. Closes GH-1300.
* Fixed more cookie handling issues. Closes GH-1310.
* Fixed various WebSocket issues. Closes GH-1306.
* Fixed some crashes caused by race conditions. Closes GH-1326.
* Fixed issues with handling POST data. Closes GH-1331.
* Fixed some issues on Heroku. Closes GH-1329.
* Fixed some integer overflows. Fix contributed by Go Maeda. Closes GH-1357.
* Fixed the `passenger-status --show=union_station` command. Closes GH-1336.
* Nginx versions earlier than 1.6 are no longer supported.
* Improved state introspection.
Release 5.0.0 beta 2
--------------------
* Fixed handling of multiple Set-Cookie headers. Closes GH-1296.
* `passenger-config system-metrics` now works properly if the agent is
installed in ~/.passenger. Closes GH-1304.
* Documentation enhancements by Igor Vuk. Closes GH-1318.
* Fixed some crasher bugs.
* [Standalone] User switching is now correctly disabled.
* [Standalone] Fixed the `--thread-count` parameter.
* [Apache] IPs set by mod_remoteip are now respected. Closes GH-1284.
* [Apache] Fixed support for gzipped chunked responses. Closes GH-1309.
Release 5.0.0 beta 1
--------------------
Version 5.0.0 beta 1 contains major changes. It's mostly compatible with
version 4, but there are a few minor breakages, which are described below.
Major changes and notable breakages are:
* Performance has been much improved. This is thanks to months of
optimization work. You can learn more at www.rubyraptor.org.
* Support for Rails 1.2 - 2.2 has been removed, for performance reasons.
Rails 2.3 is still supported.
* Phusion Passenger now supports integrated HTTP caching, which we call
turbocaching. If your app sets the right HTTP headers then Phusion Passenger
can tremendously accelerate your app. It is enabled by default, but you
can disable it with `--disable-turbocaching` (Standalone),
`PassengerTurbocaching off` (Apache), or 'passenger_turbocaching off' (Nginx).
* Touching restart.txt will no longer restart your app immediately. This is
because, for performance reasons, the stat throttle rate now defaults to 10.
You can still get back the old behavior by setting
`PassengerStatThrottleRate 0` (Apache) or `passenger_stat_throttle_rate 0`
(Nginx), but this is not encouraged. Instead, we encourage you to use
the `passenger-config restart-app` tool to initiate restarts, which has
immediate effect.
* Websockets are now properly disconnected on application restarts.
* The Phusion Passneger log levels have been completely revamped. If you
were setting a log level before (e.g. through `passenger_log_level`),
please read the latest documentation to learn about the new log levels.
* If you use out-of-band garbage collection, beware that the
`X-Passenger-Request-OOB-Work` header has now been renamed
to `!~Request-OOB-Work`.
* When using Rack's full socket hijacking, you must now output an HTTP
status line.
* [Nginx] The `passenger_set_cgi_param` option has been removed and replaced
by `passenger_set_header` and `passenger_env_var`.
* [Nginx] `passenger_show_version_in_header` is now only valid in
the `http` context.
* [Apache] The `PassengerStatThrottleRate` option is now global.
Minor changes:
* The minimum required Nginx version is now 1.6.0.
* The instance directory is now touched every hour instead of every 6 hours.
This should hopefully prevent more problems with /tmp cleaner daemons.
* Applications are not grouped not only on the application root path, but
also on the environment. For example, this allows you to run the same app
in both production and staging mode, with only a single directory, without
further configuration. Closes GH-664.
* The `passenger_temp_dir` option (Nginx) and the `PassengerTempDir` option
(Apache) have been replaced by two config options. On Nginx they are
`passenger_instance_registry_dir` and `passenger_data_buffer_dir`. On
Apache they are `PassengerInstanceRegistryDir` and `PassengerDataBufferDir`.
On Apache, `PassengerUploadBufferDir` has been replaced by \
`PassengerDataBufferDir`.
* Command line tools no longer respect the `PASSENGER_TEMP_DIR` environment
variable. Use `PASSENGER_INSTANCE_REGISTRY_DIR` instead.
* `passenger-status --show=requests` has been deprecated in favor
of `passenger-status --show=connections`.
* Using the SIGUSR1 signal to restart a Ruby app without dropping connections,
is no longer supported. Instead, use `passenger-config detach-process`.
* Introduced the `passenger-config reopen-logs` command, which instructs
all Phusion Passenger agent processes to reopen their log files. You
should call this after having rotated the web server logs.
* [Standalone] The Phusion Passenger Standalone config template has changed.
Users are encouraged to update it.
* [Standalone] `passenger-standalone.json` has been renamed to
`Passengerfile.json`.
* [Standalone] `passenger-standalone.json`/`Passengerfile.json` no longer
overrides command line options. Instead, command line options now have the \
highest priority.
Release 4.0.60
--------------
* Fixed the password protection of internal Phusion Passenger processes.
Release 4.0.59
--------------
* [Enterprise] Fixed support for free-style Node.js apps.
Release 4.0.58
--------------
* [Enterprise] Fixed a bug in the Debian packages which caused Flying
Passenger to break when used with non-system Rubies.
* The Debian packages no longer require Ruby 1.9. Closes GH-1353.
Release 4.0.57
--------------
* Fixed a native extension compatibility problem with Ruby 2.2. Closes
[ruby-core:67152](https://bugs.ruby-lang.org/issues/10656).
* Fixed compatibility with Nginx 1.7.9. Closes GH-1335.
Release 4.0.56
--------------
* Fixed a file descriptor leak that manifests when an error page is shown.
Contributed by Paul Bonaud, closes GH-1325.
* Improved Node.js request load balancing. Closes GH-1322. Thanks to Charles
Vallières for the analysis.
Release 4.0.55
--------------
* Supports Ruby 2.2. Closes GH-1314.
* Fixed Linux OS name detection.
Release 4.0.54
--------------
* Contains a licensing-related hot fix for Enterprise customers.
|
Log message:
Update Passenger to 4.0.53.
Remove vulnerability refences from TODO (none of which applied).
Changelog from 4.0.42 follows...
Release 4.0.53
--------------
* Upgraded the preferred Nginx version to 1.6.2.
* Improved RVM gemset autodetection.
* Fixed some Ruby 2.2 compatibility issues.
Release 4.0.52
--------------
* Fixed a null termination bug when autodetecting application types.
* Node.js apps can now also trigger the inverse port binding mechanism by
passing `'/passenger'` as argument. This was introduced in order to be able
to support the Hapi.js framework.
* It is now possible to abort Node.js WebSocket connections upon application
restart.
* Passenger Standalone no longer automatically resolves symlinks in its paths.
* `passenger-config system-metrics` no longer crashes when the system clock
is set to a time in the past.
* `passenger-status`, `passenger-memory-stats`,
`passenger-install-apache2-module` and `passenger-install-nginx-module`
no longer output ANSI color codes by default when STDOUT is not a TTY.
* `passenger-install-nginx-module --auto` is now all that's necessary
to make it fully non-interactive. It is no longer necessary to provide all
the answers through command line parameters.
* Minor contribution by Alessandro Lenzen.
Release 4.0.50
--------------
* Fixed a potential heap corruption bug.
* Added Union Station support for Rails 4.1.
Release 4.0.49
--------------
* Upgraded the preferred Nginx version to 1.6.1.
* Fixed a crash that may be triggered by the `passenger_max_requests`
feature.
* Introduced the `spawn_failed` hook, which is called when an application
process fails to spawn. You could use this hook to setup an error
notification system.
* Fonts, RSS and XML are now gzip-compressed by default in Phusion Passenger
Standalone. Thanks to Jacob Elder.
* Fixed some user and group information lookup issues.
* Fixed some request handling crashes.
* Fixed some compilation problems on Gentoo.
* Fixed some compilation problems on Solaris
Release 4.0.48
--------------
* Fixed a race condition while determining what user an application should
be executed as. This bug could lead to applications being run as the wrong
user.
* [Standalone] Improved autodetection of Rails asset pipeline files. This
prevents Standalone from incorrectly setting caching headers on non-asset
pipeline files.
* Fixed compilation problems on CentOS 5.
* Fixed compilation problems on OpenBSD.
* Fixed compatibility with Ruby 1.8.5.
Release 4.0.47
--------------
* [Enterprise] Fixed a bug in Flying Passenger's `--max-preloader-idle-time`
option.
Release 4.0.46
--------------
* Further improved Node.js and Socket.io compatibility.
* Sticky session cookies have been made more reliable.
* Fixed WebSocket upgrade issues on Firefox.
* The Python application loader now inserts the application root
into `sys.path`.
The fact that this was not done previously caused a lot of confusion amongst
Python users, who wondered why their `passenger_wsgi.py` could not import any
modules from the same directory.
* Fixed a compatibility problem with Django, which could cause Django apps to
freeze indefinitely.
* Logging of application spawning errors has been much improved. Full details
about the error, such as environment variables, are saved to a private
log file.
In the past, these details were only viewable in the browser. This change
also fixes a bug on Phusion Passenger Enterprise, where enabling Deployment
Error Resistance causes error messages to get lost.
* Fixed a regression in Node.js support. When a Node.js app is deployed on
a HTTPS host, the `X-Forwarded-Proto` header wasn't set in 4.0.45.
* Passenger Standalone no longer, by default, loads shell startup files
before loading the application. This is because Passenger Standalone is
often invoked from the shell anyway. Indeed, loading shell startup files
again can interfere with any environment variables already set in the
invoking shell. You can still tell Passenger Standalone to load shell
startup files by passing `--load-shell-envvars`. Passenger for Apache and
Passenger for Nginx still load shell startup files by default.
* Passenger Standalone now works properly when the HOME environment variable
isn't set.
* Passenger Standalone's `package-runtime` command has been removed. It has
been broken for a while and has nowadays been obsolete by our automatic
binary generation system.
* The `passenger_startup_file` option now also works on Python apps.
* If you are a Union Station customer, then Phusion Passenger will now also
log application spawning errors to Union Station. This data isn't shown in
the Union Station interface yet, but it will be implemented in the future.
* Fixed compilation problems on OmniOS and OpenIndiana.
* Fixed compilation problems when Nginx is configured with OpenResty.
Thanks to Yichun Zhang.
* Fixed Nginx HTTP POST failures on ARM platforms. Thanks to nocelic for
the fix.
* Documentation contributions by Tim Bishop and Tugdual de Kerviler.
* Minor Nginx bug fix by Feng Gu.
Release 4.0.45
--------------
* Major improvements in Node.js and Meteor compatibility. Older Phusion
Passenger versions implemented Node.js support by emulating Node.js' HTTP
library. This approach was found to be unsustainable, so we've abandoned
that approach and replaced it with a much simpler approach that does not
involve emulating the HTTP library.
* Introduced support for sticky sessions. Sticky sessions are useful -- or
even required -- for apps that store state inside process memory. Prominent
examples include SockJS, Socket.io, faye-websocket and Meteor. Sticky
sessions are required to make the aforementioned examples work in
multi-process scenarios. By introducing sticky sessions support, we've much
improved WebSocket support and support for the aforementioned libraries
and frameworks.
* Due to user demand, GET requests with request bodies are once again
supported. Support for these kinds of requests was removed in 4.0.42
in an attempt to increase the strictness and robustness of our request
handling code. It has been determined that GET requests with request bodies
can be adequately supported without degrading robustness in Phusion
Passenger. However, GET requests with both request bodies and WebSocket
upgrade headers are unsupported.
* Fixed some issues with RVM mixed mode support, issue #1121.
* Fixed Passenger Standalone complaining about not finding PassengerHelperAgent
during startup.
* Fixed various minor issues such as #1190 and #1197.
* The download timeout for passenger-install-nginx-module has been increased.
Release 4.0.44
--------------
* The issue tracker has now been moved from Google Code to Github.
Before version 4.0.44 (May 29 2014, commit 3dd0964c9f4), all
issue numbers referred to Google Code. From now on, all issue
numbers will refer to Github Issues.
* Fixed compilation problems on OS X Lion and OS X Mountain Lion.
* On Ruby, fixed `nil` being frozen on accident in some cases.
Release 4.0.43
--------------
* Introduced a new command `passenger-config list-instances`, which prints all
running Phusion Passenger instances.
* Introduced a new command `passenger-config system-metrics, which displays
metrics about the system such as the total CPU and memory usage.
* Fixed some compilation problems caused by the compiler capability
autodetector.
* System metrics such as total CPU usage and memory usage, are now sent to
[Union Station](https://www.unionstationapp.com) in preparation for future
features.
|