Version 5.0.22 of the Phusion Passenger application server for Ruby, Python, Node.js and Meteor has been released. This release contains a security fix (medium severity) as well as introducing Union Station logging support for Node.js, including a brand new custom logging API. It also has a number of improvements for Passenger Standalone and various minor bugfixes.

If you hadn't already, be sure to check out the many major improvements that the 5.x series of Passenger introduces. And please be aware that you can enjoy enterprise features and sponsor the open source development directly by buying Phusion Passenger Enterprise.

CVE-2015-7519

It was discovered by the SUSE security team that it was possible, in some cases, for clients to overwrite headers set by the server, resulting in a medium level security issue (CVE-2015-7519). See the detailed blog post for more information. If you are affected, you should upgrade or mitigate the issue as soon as possible.

Union Station Node.js logging support

With the release of Passenger version 5.0.22, Express/MongoDB operations are automatically logged if Union Station is enabled. We've also made it possible to write custom log entries from anywhere in your Node.js application and see those entries visualized in Union Station!

A blog post will be dedicated to this topic very soon, so stay tuned :).

Node.js/Meteor autoscaling option

There is a new configuration option called force_max_concurrent_requests_per_process that can be used to enable dynamic process scaling for Node.js and Meteor apps. By default, Passenger assumes that Node.js and Meteor based apps can handle a virtually unlimited amount of concurrent requests, and do not require automatically spawned extra instances (effectively disabling autoscaling).

With this option you can tell Passenger to automatically spawn a new instance if a certain maximum of concurrent requests is reached. While this makes autoscaling work, we do note the tradeoff that this limits the total amount of concurrent requests to (force_max_concurrent_requests_per_process * maximum number of app instances).

Passenger Standalone improvements

• Passenger Standalone now accepts configuration options from environment variables. This makes using Passenger Standalone significantly easier on Heroku or on systems that follow the 12-factor principle. Closes GH-1661.
• The Nginx configuration template has been cleaned up. It is now significantly easier to edit the Nginx configuration template without breaking compatibility with future versions.
• The passenger start command now performs a sanity check on the internally generated Nginx configuration file and advises you accordingly when there is a problem.
• passenger start now accepts the --debug-nginx-config configuration option. This option allows you to view the Nginx configuration file that Passenger Standalone generates internally.
• passenger start now accepts the --envvar command line option for passing environment variables to the application.
• passenger start now accepts the --memory-limit configuration option.
• passenger start now accepts the --max-request-queue-size configuration option.

Bug fixes

• [Apache] Fixes compatibility with Apache 2.4.17's mod_autoindex. Fix contributed by Eric Covener. Closes GH-1642.
• [Standalone] The passenger status and passenger stop commands now respect Passengerfile.json. Closes GH-1593.
• [Standalone] Passenger Standalone on Solaris now properly tails the application log file.
• [Standalone] Fixes a problem with Passenger Standalone's builtin engine exiting at startup when run on Solaris.
• Fixes Passenger erroneously adding a Content-Length or Transfer-Encoding header to Ruby HTTP 204 No Content responses. Closes GH-1595.
• Fixes Union Station logging of Rack response body actions.
• The Ruby Union Station hooks no longer abort with a fatal error when the application does not call the Union Station initializer method during startup. The error is now only logged.
• The passenger-config restart-app command, when given --ignore-app-not-running, now properly exits with a zero status when one or more applications are running, but none of them belonging to the invoking user. Closes GH-1655.
• The passenger-config validate-install command no longer prints false warnings about duplicate Passenger installs on systems that use RBenv. Closes GH-1627.
• Fixes race conditions in the automatic building of the Ruby native support extension. Closes GH-1570.
• [Enterprise] Fixes compatibility with byebug 7.0. Closes GH-1662.
• Various administration tools, such as passenger-status, no longer raise an flock EBADF error on Solaris. Closes GH-1643.
• The passenger-config reopen-logs command, when used in combination with Passenger Standalone and the Nginx engine, now also instructs Nginx to reopen its log files. Closes GH-1674.

Other improvements

• [Standalone, Nginx] Introduces a new configuration option: abort_websockets_on_process_shutdown. By default, when Passenger shuts down or restarts an application process, it will abort associated Websocket connections. This option allows you to disable that behavior. Closes GH-1686.
• In case of an error response (HTTP 5xx), Union Station logging will also contain request headers.
• The Union Station hooks are now more resilient against environment variable problems.

Installing 5.0.22

Please see the installation guide.

Upgrading to 5.0.22

Users affected by the security vulnerability should upgrade as soon as possible. This version is also recommended for other users, especially for those on version 5.0.17 or below.

See also the upgrade notes below!

OS X	Debian	Ubuntu	Heroku
Red Hat	CentOS	Ruby gem	Tarball
Docker

If you are upgrading from 4.x, please read the 5.0 upgrade notes to learn about potential upgrade caveats.

Special notes about RPMs on CentOS

Update: we've tested the installation to work on CentOS 6 and 7 without any special settings. If you experience any problems, please try to install updates before installing Passenger:
yum clean all && yum update

Special notes about capistrano-passenger

If you are using Capistrano and [capistrano-passenger], then it may fail with this error:

SSHKit::Runner::ExecuteError: Exception while executing as user@99.99.99.99: undefined method `[]' for nil:NilClass

NoMethodError: undefined method `[]' for nil:NilClass

Tasks: TOP => passenger:restart

This is due to an incompatibility in capistrano-passenger with Passenger 5.0.22. We have submitted a pull request to capistrano-passenger. Please update capistrano-passenger as soon as it has been updated, or use our pull request.