Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build(deps): bump puma from 5.6.7 to 6.4.0 #214

Closed
wants to merge 87 commits into from

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Sep 21, 2023

Bumps puma from 5.6.7 to 6.4.0.

Release notes

Sourced from puma's releases.

6.4.0 - The Eagle of Durango

image

America is #1 in professional cycling, baby!

  • Features

    • on_thread_exit hook (#2920)
    • on_thread_start_hook (#3195)
    • Shutdown on idle (#3209, #2580)
    • New error message when control server port taken (#3204)
  • Refactor

    • Remove Forwardable dependency (#3191, #3190)
    • Update URLMap Regexp usage for Ruby v3.3 (#3165)
  • Bugfixes

    • Bring the cert_pem: parameter into parity with the cert: parameter to ssl_bind. (#3174)
    • Fix using control server with IPv6 host (#3181)
    • control_cli.rb - add require_relative 'log_writer' (#3187)
    • Fix cases where fallback Rack response wasn't sent to the client (#3094)

6.3.1

  • Security
    • Address HTTP request smuggling vulnerabilities with zero-length Content Length header and trailer fields (GHSA-68xg-gqqm-vgj8)

6.3.0 - Mugi No Toki Itaru

image

Japan has 72 traditional microseasons. May 31 is the first day of 麦秋至, which means the time of the wheat/barley harvest.

  • Features

    • Add dsl method supported_http_methods (#3106, #3014)
    • Puma error responses no longer have any fingerprints to indicate Puma (#3161, #3037)
    • Support decryption of SSL key (#3133, #3132)
  • Bugfixes

    • Don't send 103 early hints response when only invalid headers are used (#3163)
    • Handle malformed request path (#3155, #3148)
    • Misc lib file fixes - trapping additional errors, CI helper (#3129)
    • Fixup req form data file upload with "r\n" line endings (#3137)
    • Restore rack 1.6 compatibility (#3156)
  • Refactor

    • const.rb - Update Puma::HTTP_STATUS_CODES (#3162)
    • Clarify Reactor#initialize (#3151)

New Contributors

... (truncated)

Changelog

Sourced from puma's changelog.

6.4.0 / 2023-09-21

  • Features

    • on_thread_exit hook (#2920)
    • on_thread_start_hook (#3195)
    • Shutdown on idle (#3209, #2580)
    • New error message when control server port taken (#3204)
  • Refactor

    • Remove Forwardable dependency (#3191, #3190)
    • Update URLMap Regexp usage for Ruby v3.3 (#3165)
  • Bugfixes

    • Bring the cert_pem: parameter into parity with the cert: parameter to ssl_bind. (#3174)
    • Fix using control server with IPv6 host (#3181)
    • control_cli.rb - add require_relative 'log_writer' (#3187)
    • Fix cases where fallback Rack response wasn't sent to the client (#3094)

6.3.1 / 2023-08-18

  • Security
    • Address HTTP request smuggling vulnerabilities with zero-length Content Length header and trailer fields (GHSA-68xg-gqqm-vgj8)

6.3.0 / 2023-05-31

  • Features

    • Add dsl method supported_http_methods (#3106, #3014)
    • Puma error responses no longer have any fingerprints to indicate Puma (#3161, #3037)
    • Support decryption of SSL key (#3133, #3132)
  • Bugfixes

    • Don't send 103 early hints response when only invalid headers are used (#3163)
    • Handle malformed request path (#3155, #3148)
    • Misc lib file fixes - trapping additional errors, CI helper (#3129)
    • Fixup req form data file upload with "r\n" line endings (#3137)
    • Restore rack 1.6 compatibility (#3156)
  • Refactor

    • const.rb - Update Puma::HTTP_STATUS_CODES (#3162)
    • Clarify Reactor#initialize (#3151)

6.2.2 / 2023-04-17

  • Bugfixes
    • Fix Rack-related NameError by adding :: operator (#3118, #3117)

6.2.1 / 2023-03-31

  • Bugfixes

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

philippthun and others added 13 commits September 11, 2023 11:19
Bumps [rubocop](https://github.com/rubocop/rubocop) from 1.56.2 to 1.56.3.
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop@v1.56.2...v1.56.3)

---
updated-dependencies:
- dependency-name: rubocop
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
…dler/rubocop-1.56.3

build(deps-dev): bump rubocop from 1.56.2 to 1.56.3
…eletion-of-service-keys-by-space-supporters

Prevent deletion of service keys by space supporters
Bumps [newrelic_rpm](https://github.com/newrelic/newrelic-ruby-agent) from 9.4.2 to 9.5.0.
- [Release notes](https://github.com/newrelic/newrelic-ruby-agent/releases)
- [Changelog](https://github.com/newrelic/newrelic-ruby-agent/blob/dev/CHANGELOG.md)
- [Commits](newrelic/newrelic-ruby-agent@9.4.2...9.5.0)

---
updated-dependencies:
- dependency-name: newrelic_rpm
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
The endpoints for listing space and org users has a performance issue
when there is a large amount of roles in the roles tables and/or many
users exists in different role tables.

The query is constructed in a way that all role tables get unioned and
then a `select ... from users where user_id in (<RESULT OF UNION>)` is
executed. PSQL query planner took bad decitions when many duplicates
exist and the resulting union is large(observed at arount 1500 rows).
This changed the query times from around 10ms to 55seconds.

This change introduces a `select distinct` in the `in` clause so that no
duplicates exist which is beneficial in any case for this endpoint.
Now the query planner of PSQL query planner decides correctly.

Co-authored-by: Philipp Thun <[email protected]>
…users_endpoint_performance

Fix a performance regression in /v3/(space|organization)/:guid/users
…dler/newrelic_rpm-9.5.0

build(deps): bump newrelic_rpm from 9.4.2 to 9.5.0
The optimizations done in PR cloudfoundry#3068 [1] make the dedicated org and space
role classes superfluous.

[1] cloudfoundry#3068
Bumps [json-schema](https://github.com/voxpupuli/json-schema) from 4.0.0 to 4.1.1.
- [Changelog](https://github.com/voxpupuli/json-schema/blob/master/CHANGELOG.md)
- [Commits](voxpupuli/json-schema@v4.0.0...v4.1.1)

---
updated-dependencies:
- dependency-name: json-schema
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
If provided, the 'mode' field (resource match object) must be a string.
Without this fix a request to /v3/resource_matches with

  { .. "mode": 644 .. }

resulted in an UnknownError. Now the error message

  "array contains at least one resource with a non-string mode"

is returned instead.

Furthermore the format is checked and if the provided value is not a
POSIX mode string (*), the following error message is returned:

  "array contains at least one resource with an incorrect mode"

(*) A simple regex only allowing digits from 0 to 7 is used. At least 1
digit must be provided.

Co-authored-by: Florian Braun <[email protected]>
…dicated-org-and-space-role-classes

Remove dedicated org and space role classes
…-permission

Add validation for resource match mode
@dependabot dependabot bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Sep 21, 2023
kathap and others added 14 commits September 26, 2023 10:22
…-file-into-correct-folder

kpack_lifecycle_data_model_spec.rb was in the wrong folder, moving it to spec/...
…foundry#3378)

* Add instance_internal_ip field to ProcessStats endpoint

- Allows users to see the internal container IP address for a process

* Add docs for instance_internal_ip field

Authored-by: Tim Downey <[email protected]>
Previously a migration was only tested by reverting (running down
migrations) until being one migration before the one that shall be
tested, then executing the actual test in which all migrations run the
up part even of migrations that come after the migration one wants to
test.

This commit introduces the 'migration' shared context, a valuable
utility for Sequel migration testing. This new module reverts the
database schema to its version prior to a specific migration, provides a
directory with the migration file for running a given migration in a
test, and restores the schema to its full state after test completion to
avoid half-migrated database scenarios. Hereby only the up part of the
migration one wants to test is executed opposite to all available
migrations to construct a meaningful test case.

The accompanying updates to the documentation elaborate on the
distinctive operating nature of Sequel migration tests. Also extensive
documentation on Sequel migrations itself in the scope of the supported
dbs and cloud_controller_ng has been added to provide a good knowledge
base for writing highly sophisticated migrations that are resilient,
offer high level of consistency, are compatible with mysql and psql and
fast.

Constraints and restrictions on Sequel migrations and test writing have
also been detailed, stressing the need to exclude Cloud Controller code
in migrations and tests to maintain consistency in test outcomes and
behaviours.

Co-authored-by: Philipp Thun <[email protected]>
…est_framework

Introduce shared context for migrations and add documentation
Since we update to new rubocop versions we never activated new cops.
Rubocop by default will not apply newly introduced rules.
This PR enables the latest cops and add the autocorrections of rubocop.
Additionally a rubocop_todo.yml file will ignore present failures so
that they apply for new code and one has a comprehensive list of
findings on can one by one fix in the future.

Co-authored-by: Johannes Haass <[email protected]>
Add rubocop-sequel as this includes rules for the sequel library

Co-authored-by: Johannes Haass <[email protected]>
Rails cops have been moved out from default rubocop into an own gem.
This commit adds this gem and linting rules to make use of rails
specific cops.

Co-authored-by: Johannes Haass <[email protected]>
Bumps [fog-aws](https://github.com/fog/fog-aws) from 3.19.0 to 3.20.0.
- [Changelog](https://github.com/fog/fog-aws/blob/master/CHANGELOG.md)
- [Commits](fog/fog-aws@v3.19.0...v3.20.0)

---
updated-dependencies:
- dependency-name: fog-aws
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
…dler/fog-aws-3.20.0

build(deps): bump fog-aws from 3.19.0 to 3.20.0
Rubocop cops for rspecs are located in a different gem.
This commits adds this gem and corrects many findings.
Findings needing manual reworking are excluded in current
code by rules in .rubocop_todo.yml.

Co-authored-by: Johannes Haass <[email protected]>
philippthun and others added 26 commits October 11, 2023 14:47
…dler/rubocop-1.57.0

build(deps-dev): bump rubocop from 1.56.4 to 1.57.0
The ProcessStatsPresenter distinguishes between 'down' and 'found'
instances. For 'down' instances it expects the 'uptime' key in the given
hash itself, for 'found' instances, it is part of the 'stats' hash.
Although the ReporterMixin constructed 'down' instances as expected,
there were cases (e.g. placement errors) where a different hash was
created. This resulted in a JSON response containing "uptime":null.

With this change a consistent hash structure is used for all cases, i.e.
'uptime' is a key in 'stats'.
During the bosh update of diego-api/bbs or AZ failover the request from
CC might fail with 503 - Runner is unavailable. This PR aim to prevent
this bbs failover with exponential back-off.
Otherwise it's only executed after a relase has been created (capi and
cf-d) and errors cannot be fixed anymore.
Bumps [rubocop](https://github.com/rubocop/rubocop) from 1.57.0 to 1.57.1.
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop@v1.57.0...v1.57.1)

---
updated-dependencies:
- dependency-name: rubocop
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…#3478)

Bumps [honeycomb-beeline](https://github.com/honeycombio/beeline-ruby) from 3.0.0 to 3.0.1.
- [Release notes](https://github.com/honeycombio/beeline-ruby/releases)
- [Changelog](https://github.com/honeycombio/beeline-ruby/blob/main/CHANGELOG.md)
- [Commits](honeycombio/beeline-ruby@v3.0.0...v3.0.1)

---
updated-dependencies:
- dependency-name: honeycomb-beeline
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…e-migrations-are-current-task-in-spec

Run the ensure_migrations_are_current rake task in a spec
…t-stats-hash

Use consistent hash structure for process stats
Bumps [psych](https://github.com/ruby/psych) from 5.1.1 to 5.1.1.1.
- [Release notes](https://github.com/ruby/psych/releases)
- [Commits](ruby/psych@v5.1.1...v5.1.1.1)

---
updated-dependencies:
- dependency-name: psych
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps [cf-uaa-lib](https://github.com/cloudfoundry/cf-uaa-lib) from 4.0.3 to 4.0.4.
- [Release notes](https://github.com/cloudfoundry/cf-uaa-lib/releases)
- [Changelog](https://github.com/cloudfoundry/cf-uaa-lib/blob/master/CHANGELOG.md)
- [Commits](cloudfoundry/cf-uaa-lib@v4.0.3...v4.0.4)

---
updated-dependencies:
- dependency-name: cf-uaa-lib
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
…dler/psych-5.1.1.1

build(deps): bump psych from 5.1.1 to 5.1.1.1
…dler/cf-uaa-lib-4.0.4

build(deps): bump cf-uaa-lib from 4.0.3 to 4.0.4
- in cloudfoundry#2807 we manually set psych so we could resolve cloudfoundry#2193
- the newer psych is available as a default gem in [ruby 3.2](https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/)
- will remove deprecated warning when running `bundle exec rake`
…-rubocop-auto-correct

replace --auto-correct with --autocorrect
…d-explicit-psych-gem

Remove unneeded psych gem
Bumps [redis](https://github.com/redis/redis-rb) from 5.0.7 to 5.0.8.
- [Changelog](https://github.com/redis/redis-rb/blob/master/CHANGELOG.md)
- [Commits](redis/redis-rb@v5.0.7...v5.0.8)

---
updated-dependencies:
- dependency-name: redis
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
…dler/redis-5.0.8

build(deps): bump redis from 5.0.7 to 5.0.8
Bumps [puma](https://github.com/puma/puma) from 5.6.7 to 6.4.0.
- [Release notes](https://github.com/puma/puma/releases)
- [Changelog](https://github.com/puma/puma/blob/master/History.md)
- [Commits](puma/puma@v5.6.7...v6.4.0)

---
updated-dependencies:
- dependency-name: puma
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
- Use Events:on_booted instead of Configuration:after_worker_fork; the
  'periodic_updater' shall run in the main process only.
- Use Configuration:on_worker_shutdown instead of Events:on_stopped to
  log incomplete requests; this needs to run inside the worker
  processes.
- Don't try to write a log message from inside Events:on_stopped; this
  yields a 'can't be called from trap context' error.
Also default workers and max_threads to 1.
@philippthun philippthun force-pushed the dependabot/bundler/puma-6.4.0 branch from 41938b9 to 2a0e0d8 Compare November 13, 2023 15:49
@philippthun philippthun deleted the dependabot/bundler/puma-6.4.0 branch November 13, 2023 15:55
Copy link
Author

dependabot bot commented on behalf of github Nov 13, 2023

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

9 participants