[Security] Bump puma from 4.3.3 to 4.3.5

[dependabot-preview]

Bumps puma from 4.3.3 to 4.3.5.

Changelog

Sourced from puma's changelog.

5.0.0

• Features

  • EXPERIMENTAL: Add fork_worker option and refork command for reduced memory usage by forking from a worker process instead of the master process. (#2099)
  • EXPERIMENTAL: Added wait_for_less_busy_worker config. This may reduce latency on MRI through inserting a small delay before re-listening on the socket if worker is busy (#2079).
  • EXPERIMENTAL: Added nakayoshi_fork option. Reduce memory usage in preloaded cluster-mode apps by GCing before fork and compacting, where available. (#2093, #2256)
  • Added pumactl thread-backtraces command to print thread backtraces (#2054)
  • Added incrementing requests_count to Puma.stats. (#2106)
  • Increased maximum URI path length from 2048 to 8196 bytes (#2167)
  • lowlevel_error_handler is now called during a forced threadpool shutdown, and if a callable with 3 arguments is set, we now also pass the status code (#2203)
  • Faster phased restart and worker timeout (#2220)
  • Added state_permission to config DSL to set state file permissions (#2238)
  • Added Puma.stats_hash, which returns a stats in Hash instead of a JSON string (#2086, #2253)

• Deprecations, Removals and Breaking API Changes

  • --control has been removed. Use --control-url (#1487)
  • worker_directory has been removed. Use directory.
  • min_threads now set by environment variables PUMA_MIN_THREADS and MIN_THREADS. (#2143)
  • max_threads now set by environment variables PUMA_MAX_THREADS and MAX_THREADS. (#2143)
  • max_threads default to 5 in MRI or 16 for all other interpreters. (#2143)
  • preload by default if workers > 1 (#2143)
  • Puma::Plugin.workers_supported? has been removed. Use Puma.forkable? instead. (#2143)
  • tcp_mode has been removed without replacement. (#2169)
  • Daemonization has been removed without replacement. (#2170)
  • Changed #connected_port to #connected_ports (#2076)
  • Configuration: environment is read from RAILS_ENV, if RACK_ENV can't be found (#2022)

• Bugfixes

  • Close client http connections made to an ssl server with TLSv1.3 (#2116)
  • Do not set user_config to quiet by default to allow for file config (#2074)
  • Always close SSL connection in Puma::ControlCLI (#2211)
  • Windows update extconf.rb for use with ssp and varied Ruby/MSYS2 combinations (#2069)
  • Ensure control server Unix socket is closed on shutdown (#2112)
  • Preserve BUNDLE_GEMFILE env var when using prune_bundler (#1893)
  • Send 408 request timeout even when queue requests is disabled (#2119)
  • Rescue IO::WaitReadable instead of EAGAIN for blocking read (#2121)
  • Ensure BUNDLE_GEMFILE is unspecified in workers if unspecified in master when using prune_bundler (#2154)
  • Rescue and log exceptions in hooks defined by users (on_worker_boot, after_worker_fork etc) (#1551)
  • Read directly from the socket in #read_and_drop to avoid raising further SSL errors (#2198)
  • Set Connection: closed header when queue requests is disabled (#2216)
  • Pass queued requests to thread pool on server shutdown (#2122)
  • Fixed a few minor concurrency bugs in ThreadPool that may have affected non-GVL Rubies (#2220)
  • Fix out_of_band hook never executed if the number of worker threads is > 1 (#2177)
  • Fix ThreadPool#shutdown timeout accuracy (#2221)
  • Fix UserFileDefaultOptions#fetch to properly use default (#2233)
  • Improvements to out_of_band hook (#2234)
  • Prefer the rackup file specified by the CLI (#2225)
  • Fix for spawning subprocesses with fork_worker option (#2267)

• Refactor

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

[pgwillia]

I left a comment on the previous puma PR about a deprecation we should address
#1654 (review)

[dependabot-preview]

We've just been alerted that this update fixes a security vulnerability:

Sourced from The GitHub Security Advisory Database.

HTTP Smuggling via Transfer-Encoding Header in Puma

Impact

By using an invalid transfer-encoding header, an attacker could smuggle an HTTP response.

Originally reported by @ZeddYu, who has our thanks for the detailed report.

Patches

The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

... (truncated)

Affected versions: [">= 4.0.0, < 4.3.4"]

[murny]

@pgwillia I looked at your comment here #1654 (review)

But I didn't see any indication of RAILS_MAX_THREADS/RAILS_MIN_THREADS being deprecated from Puma or Rails project (I searched the changelog/issues/commits/etc of both projects without much luck)?

Do you have more context here? If not then we can probably go ahead and merge this

[pgwillia]

It's in the CHANGELOG provided by Puma. There were a bunch listed but this is the only one that stuck out to me that affected us.

Deprecations, Removals and Breaking API Changes

• --control has been removed. Use --control-url (1487)
• worker_directory has been removed. Use directory.
• min_threads now set by environment variables PUMA_MIN_THREADS and MIN_THREADS. (2143)
• max_threads now set by environment variables PUMA_MAX_THREADS and MAX_THREADS. (2143)
• max_threads default to 5 in MRI or 16 for all other interpreters. (2143)
• preload by default if workers > 1 (2143)
• Puma::Plugin.workers_supported? has been removed. Use Puma.forkable? instead. (2143)
• tcp_mode has been removed without replacement. (2169)
• Daemonization has been removed without replacement. (2170)
• Changed #connected_port to #connected_ports (2076)
• Configuration: environment is read from RAILS_ENV, if RACK_ENV can't be found (2022)

[pgwillia]

I see how that is confusing. The deprecation is to min and max threads. We could be fine if we changed from RAILS_MAX_THREADS and RAILS_MIN_THREADS to PUMA_MAX_THREADS and PUMA_MAX_THREADS but maybe the defaults are fine.

[murny]

I saw that but it makes no mention that RAILS_MAX_THREADS/RAILS_MIN_THREADS was deprecated. Just mentions you can now use PUMA_MAX_THREADS or MAX_THREADS (also?). So I assume RAILS_MAX_THREADS version still seems valid and works?

But something weird going on. They added RAILS_MAX_THREADS version here puma/puma@0593668#diff-e1bbd4f15e3b63427b4261e05b948ea8

Then seem to reverse it in this PR: puma/puma#2143

(interesting enough you can read about some of the history about RAILS_MAX_THREADS here: rails/rails#23057 (comment))

I guess to play it safe and keep everything consistent we can rename to PUMA_MAX_THREADS 👍