Release 6.1.2

• [Ruby] logger is now a “bundled” but not “default” gem, so it must be added to gemspec. Closes GH-2642.
• [Ruby] Fix Ruby < 2.3 support. Closes GH-2641.
• Updated various library versions used in precompiled binaries (used for e.g. gem installs):
  • cmake: 4.2.1 -> 4.2.2
  • curl: 8.17.0 -> 8.18.0
  • gnupg: 2.4.8 -> 2.5.16
  • rubygems: 4.0.2 -> 4.0.4
  • rubys:
    • 3.2.9 -> 3.2.10
    • added 4.0.1

Release 6.1.1

• [Ruby] Improve support for Ruby 4 and Frozen String Literals. Closes GH-2619.
• [Ubuntu] Add packages for Ubuntu 25.10 "questing", remove packages for Ubuntu 25.04 "plucky".
• Upgrade Boost from 1.87 -> 1.90.
• [Nginx] Fixes bug with unbuffered uploads. Closes GH-2575.
• [Nginx] Upgrades preferred Nginx to 1.28.0 from 1.26.3.
• [Nginx] The preferred PCRE2 version is now 10.46 (previously 10.45).
• Updated various library versions used in precompiled binaries (used for e.g. gem installs):
  • ccache: 4.11.2 -> 4.12.2
  • cmake: 4.0.0 -> 4.2.1
  • curl: 8.12.1 -> 8.17.0
  • git: 2.49.0 -> 2.52.0
  • gnupg:2.4.7 -> 2.4.8
  • libffi:3.4.7 -> 3.5.2
  • libgcrypt:1.11.0 -> 1.11.2
  • libgpg_error:1.51 -> 1.58
  • libreadline:8.2 -> 8.3
  • openssl:3.4.1 -> 3.6.0
  • pcre2:10.45 -> 10.47
  • pinentry:1.3.1 -> 1.3.2
  • rubygems: 3.6.6 -> 4.0.2
  • rubys:
    • dropped 3.1.7
    • 3.2.8 -> 3.2.9
    • 3.3.7 -> 3.3.10
    • 3.4.2 -> 3.4.8

Release 6.1.0

• [Ruby] Fix compatibility with Rackup while maintaining compatibility with Rack 3. Closes GH-2602.
• A C++14 compiler is now required to compile Passenger.
• Add rpm packages for EL10 (RHEL, Rocky, Alma).
• [Standalone] Fixes security update checker with builtin engine.
• [Debian] Add Debian 13 Trixie packages. Closes GH-2622.

Release 6.0.27

Release 6.0.27 (Not yet released)

• Upgrade Boost from 1.86 → 1.87.
• Remove Passenger admin panel (Fuse).
• Fix compilation on FreeBSD.
• [Ruby] Fix compatibility with Rack 2 While maintaining compatibility with Rack 3. Closes GH-2595.
• [Ruby] Use non-deprecated functions in native extensions.
• Fix an issue where Passenger could freeze while connecting to application processes (event loop blocking).
• Updated various library versions used in precompiled binaries (used for e.g. gem installs):
  • ccache: 4.10.2 -> 4.11.2
  • cmake: 3.31.3 -> 4.0.0
  • curl: 8.11.1 -> 8.12.1
  • git: 2.47.1 -> 2.49.0
  • libassuan: 3.0.1 -> 3.0.2
  • libffi: 3.4.6 -> 3.4.7
  • openssl: 3.4.0 -> 3.4.1
  • pcre2: 10.44 -> 10.45
  • rubies
    • 3.1.6 -> 3.1.7
    • 3.2.6 -> 3.2.8
    • 3.3.6 -> 3.3.7
    • 3.4.1 -> 3.4.2
  • rubygems: 3.6.2 -> 3.6.6
  • zstd: 1.5.6 -> 1.5.7
• [Nginx] Upgrades preferred Nginx to 1.26.3 from 1.26.2.
• [Nginx] The preferred PCRE2 version is now 10.45 (previously 10.39).

Release 6.0.26

• [CVE-2025-26803] The http parser (from Passenger 6.0.21-6.0.25) was susceptible to a denial of service attack when parsing a request with an invalid HTTP method.

Release 6.0.25

• Fixes compilation with clang 19 (latest Fedora update) by dropping a buggy stddev function from the moving average header. Closes GH-2580.
• [Standalone] Adds a config option to specify the stop timeout for Passenger: --stop-timeout 120 or PASSENGER_STOP_TIMEOUT=120.
• [Standalone] Changes Passenger's (not apps') start timeout to 25s (from 15s), stop timeouts default to 60s.
• [Ruby] Fixes an issue where Bundler would try to re-exec the process name instead of the script. Closes GH-2567 and GH-2577.
• [Enterprise] Adds a temporary flag to allow reverting to previous routing behaviour, in order to mitigate possible performance regressions, this flag will become a no-op and eventually removed once the routing issues have been fixed. Closes GH-2579.
  • Apache: PassengerOldRouting on
  • Nginx: passenger_old_routing on;
  • Standalone: --old-routing
• Updated various library versions used in precompiled binaries (used for e.g. gem installs):
  • cmake: 3.31.2 -> 3.31.3
  • curl: 8.11.0 -> 8.11.1
  • libiconv: 1.17 -> 1.18
  • rubygems: 3.5.23 -> 3.6.2
  • rubies:
    • added 3.4.1

Release 6.0.24

• [Nginx] Upgrades preferred Nginx to 1.26.2 from 1.26.1.
• [Enterprise] Smarter rolling restarts for better performance and reliability. We changed the way we route requests. Instead of picking the least-busy process, we now first prioritize new processes first. During a rolling restart, this new behavior leads to more efficient utilization of application caches, faster validation of new rollouts, and faster recovery from problematic deployments. Closes GH-2551.
• Fix a regression from 6.0.10 where running passenger-config system-properties would throw an error. Closes GH-2565.
• [Enterprise] Fix a memory corruption-related crash that could occur during rolling restarting.
• [Ubuntu] Add packages for Ubuntu 24.10 "oracular".
• [Ruby] Specify rackup version to avoid broken 1.0 gem. Closes GH-2559.
• Fixes compatibility with Ruby apps whose Gemfile.lock depends on base64.
• Upgrades Boost from 1.85 -> 1.86.
• Updated various library versions used in precompiled binaries (used for e.g. gem installs):
  • ccache 4.10.1 -> 4.10.2
  • cmake 3.30.1 -> 3.31.2
  • curl 8.8.0 -> 8.11.0
  • git 2.45.2 -> 2.47.1
  • gnupg 2.4.5 -> 2.4.7
  • libgpg_error 1.50 -> 1.51
  • npth 1.7 -> 1.8
  • openssl 3.3.1 -> 3.4.0
  • rubygems 3.5.16 -> 3.5.23
  • rubies:
    • 3.2.4 -> 3.2.6
    • 3.3.4 -> 3.3.6

Release 6.0.23

• [Enterprise] The rolling restart feature now replaces app processes in newest-to-oldest order, to make more efficient use of alive processes during the rolling-restart's duration. Closes GH-2551.
• [Ruby] Improve Rack 3 compatibility.
• [Nginx] Upgrades preferred Nginx to 1.26.1 from 1.26.0.
• [Debian] Remove packages for Debian 10 Buster. (EOL 2024-07).
• [Ubuntu] Add packages for Ubuntu 24.04 "noble".
• [RPMs] Remove EL7 RPMs, CentOS7 is EOL.
• Fixes compatibility with Ruby apps whose Gemfile.lock depends on strscan.
• Adds option to render a custom error page when app fails to launch. Closes GH-2515.
  • Apache: PassengerCustomErrorPage "public/error.html"
  • Nginx: passenger_custom_error_page public/error.html;
  • Standalone: --custom-error-page public/error.html
• Updated various library versions used in precompiled binaries (used for e.g. gem installs):
  • glibc 2.17 -> 2.28
  • ccache 4.9.1 -> 4.10.1
  • cmake 3.29.3 -> 3.30.1
  • curl 8.7.1 -> 8.8.0
  • git 2.45.0 -> 2.45.2
  • openssl 3.3.0 -> 3.3.1
  • pcre2 10.43 -> 10.44
  • libassuan 2.5.7 -> 3.0.1
  • libgcrypt 1.10.3 -> 1.11.0
  • libgpg_error 1.49 -> 1.50
  • libksba 1.6.6 -> 1.6.7
  • pinentry 1.3.0 -> 1.3.1
  • rubygems 3.5.10 -> 3.5.16
  • rubies:
    • dropped 3.0.7
    • 3.1.5 -> 3.1.6
    • 3.3.1 -> 3.3.4

Release 6.0.22

• [RPM] Fix dependency on selinux-policy. Closes GH-2545.
• Fix Amazon Linux detection. Closes GH-3296.

Release 6.0.21

• [Python] Fix version of Python when imp module is replaced with importlib. Contributed by Grigory Ponomarenko.
• [Ubuntu] Remove packages for Ubuntu 23.10 "mantic".
• [Nginx] Upgrades preferred Nginx to 1.26.0 from 1.24.0.
• [Nginx] Switch to using PCRE2 instead of PCRE.
• [RPM] The Passenger Nginx module rpm package for EL9 (RHEL, Rocky, Alma) will now require Nginx 1.24.0 as per the policy of supporting the newest Nginx module stream available.
• [Standalone] Fixes security update checker with builtin engine.
• [Enterprise] Ability to enforce hard memory limits on application processes (PassengerHardMemoryLimit/passenger_hard_memory_limit/`--hard-memory-limit``). Unlike the soft memory limit, the hard memory limit doesn't wait for the request to finish. Useful for preventing high memory usage from taking down the entire machine or container.
• [Enterprise] Ability to throttle memory metrics collection (PassengerAnalyticsCollectionRate/passenger_analytics_collection_rate). This allows you to control the frequency that Passenger Enterpprise measures the app memory use at.
• Swaps http-parser for llhttp.
• Fixes crash-watch hanging when lldb is used as backend.
• Fixes Apache module unload crash due to not properly cleaning up all threads.
• Workaround compilation error on clang on x86_64.
• Upgrades Boost from 1.83 -> 1.85.
• Updated various library versions used in precompiled binaries (used for e.g. gem installs):
  • ccache: 4.6.3 -> 4.9.1
  • cmake: 3.28.1 -> 3.29.3
  • curl: 8.5.0 -> 8.7.1
  • git: 2.43.0 -> 2.45.0
  • gnupg: 2.4.3 -> 2.4.5
  • libassuan: 2.5.6 -> 2.5.7
  • libffi: 3.4.4 -> 3.4.6
  • libgpg_error: 1.47 -> 1.49
  • libksba: 1.6.5 -> 1.6.6
  • libpsl: 0.21.5
  • npth: 1.6 -> 1.7
  • openssl: 3.2.0 -> 3.3.0
  • pcre2: 10.42 -> 10.43
  • pinentry: 1.2.1 -> 1.3.0
  • rubygems: 3.5.4 -> 3.5.10
  • zlib: 1.3 -> 1.3.1
  • zstd: 1.5.5 -> 1.5.6
  • rubies:
    • 3.0.6 -> 3.0.7
    • 3.1.4 -> 3.1.5
    • 3.2.3 -> 3.2.4
    • 3.3.0 -> 3.3.1