mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-07-09 01:20:23 +09:00
Mike Dalessio
03fa883f98
Security bump for CVE-2026-47736 (PROXY Protocol v1 parser memory
exhaustion) and CVE-2026-47737 (PROXY v1 repeated headers). Not exposed:
PROXY protocol is opt-in via set_remote_address proxy_protocol:, which
campfire never calls — default remote_address :socket leaves the parser
unreachable. Thruster/kamal-proxy front campfire over HTTP X-Forwarded-*,
not PROXY protocol.
No 6.x fix exists, so this is a major v6→v7 bump:
- Gemfile pin "~> 6.6" → "~> 7.2", ">= 7.2.1"
- config/puma.rb needs NO changes — every DSL method used (threads,
worker_timeout, bind, environment, pidfile, workers, plugin
:tmp_restart) is unchanged in v7; tmp_restart.rb is byte-identical.
Behavior notes (no action): preload_app effectively defaults on for
clustered mode (safe — Rails eager-loaded in master, Membership.
disconnect_all handles pre-fork conns); persistent_timeout default
20→65s (internal keep-alive). Min Ruby 3.0; campfire runs 3.4.5.
Direct gem. 137 commits triaged, 0 mitigations. Verified green via full
unit + system suites (system tests boot Puma 7.2.1).
https://github.com/basecamp/37signals-hq/blob/main/upgrade-analysis/campfire-20260609-puma_v6.6.1..v7.2.1.md
🤖 Assisted by Claude
62 lines
1.1 KiB
Ruby
62 lines
1.1 KiB
Ruby
source "https://rubygems.org"
|
|
|
|
git_source(:github) { |repo| "https://github.com/#{repo}.git" }
|
|
|
|
# Rails
|
|
gem "rails", github: "rails/rails", branch: "main"
|
|
gem "ostruct"
|
|
gem "benchmark"
|
|
|
|
# Drivers
|
|
gem "sqlite3"
|
|
gem "redis", "~> 5.4"
|
|
|
|
# Deployment
|
|
gem "puma", "~> 7.2", ">= 7.2.1"
|
|
|
|
# Jobs
|
|
gem "resque", "~> 2.7.0"
|
|
gem "resque-pool", "~> 0.7.1"
|
|
|
|
# Assets
|
|
gem "propshaft", github: "rails/propshaft"
|
|
gem "importmap-rails", github: "rails/importmap-rails"
|
|
|
|
# Hotwire
|
|
gem "turbo-rails", github: "hotwired/turbo-rails"
|
|
gem "stimulus-rails"
|
|
|
|
# Media handling
|
|
gem "image_processing", ">= 1.2"
|
|
|
|
# Telemetry
|
|
gem "sentry-ruby"
|
|
gem "sentry-rails"
|
|
|
|
# Other
|
|
gem "bcrypt"
|
|
gem "web-push"
|
|
gem "rqrcode"
|
|
gem "rails_autolink"
|
|
gem "geared_pagination"
|
|
gem "jbuilder"
|
|
gem "net-http-persistent"
|
|
gem "kredis"
|
|
gem "platform_agent"
|
|
gem "thruster"
|
|
|
|
group :development, :test do
|
|
gem "debug"
|
|
gem "rubocop-rails-omakase", require: false
|
|
gem "bundler-audit", require: false
|
|
gem "faker", require: false
|
|
gem "brakeman", require: false
|
|
end
|
|
|
|
group :test do
|
|
gem "capybara"
|
|
gem "mocha"
|
|
gem "selenium-webdriver"
|
|
gem "webmock", require: false
|
|
end
|