From 03fa883f98db9a208996afd3413b5563168ef8e4 Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Tue, 9 Jun 2026 12:20:14 -0400
Subject: [PATCH] =?UTF-8?q?dep:=20update=20puma=206.6.1=20=E2=86=92=207.2.?=
 =?UTF-8?q?1=20(major)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Security bump for CVE-2026-47736 (PROXY Protocol v1 parser memory
exhaustion) and CVE-2026-47737 (PROXY v1 repeated headers). Not exposed:
PROXY protocol is opt-in via set_remote_address proxy_protocol:, which
campfire never calls — default remote_address :socket leaves the parser
unreachable. Thruster/kamal-proxy front campfire over HTTP X-Forwarded-*,
not PROXY protocol.

No 6.x fix exists, so this is a major v6→v7 bump:
  - Gemfile pin "~> 6.6" → "~> 7.2", ">= 7.2.1"
  - config/puma.rb needs NO changes — every DSL method used (threads,
    worker_timeout, bind, environment, pidfile, workers, plugin
    :tmp_restart) is unchanged in v7; tmp_restart.rb is byte-identical.

Behavior notes (no action): preload_app effectively defaults on for
clustered mode (safe — Rails eager-loaded in master, Membership.
disconnect_all handles pre-fork conns); persistent_timeout default
20→65s (internal keep-alive). Min Ruby 3.0; campfire runs 3.4.5.

Direct gem. 137 commits triaged, 0 mitigations. Verified green via full
unit + system suites (system tests boot Puma 7.2.1).

https://github.com/basecamp/37signals-hq/blob/main/upgrade-analysis/campfire-20260609-puma_v6.6.1..v7.2.1.md

🤖 Assisted by Claude
---
 Gemfile      | 2 +-
 Gemfile.lock | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Gemfile b/Gemfile
index b60dbe0..1077c90 100644
--- a/Gemfile
+++ b/Gemfile
@@ -12,7 +12,7 @@ gem "sqlite3"
 gem "redis", "~> 5.4"
 
 # Deployment
-gem "puma", "~> 6.6"
+gem "puma", "~> 7.2", ">= 7.2.1"
 
 # Jobs
 gem "resque", "~> 2.7.0"
diff --git a/Gemfile.lock b/Gemfile.lock
index bbd10a9..f563cd2 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -259,7 +259,7 @@ GEM
       date
       stringio
     public_suffix (6.0.2)
-    puma (6.6.1)
+    puma (7.2.1)
       nio4r (~> 2.0)
     racc (1.8.1)
     rack (3.2.6)
@@ -429,7 +429,7 @@ DEPENDENCIES
   ostruct
   platform_agent
   propshaft!
-  puma (~> 6.6)
+  puma (~> 7.2, >= 7.2.1)
   rails!
   rails_autolink
   redis (~> 5.4)