Version 6.2.2 of the Passenger application server has been released. This release is mostly focused on bug-fixes and security hardening.

Other Improvements

  • Harden against symlink attacks on improperly secured instance directories. This is a mitigation, and not intended to replace the use of proper filesystem permissions.
  • Harden against secure headers containing header delimiters.
  • [Enterprise] Fix the hard memory limit not being enforced on a process that already exceeded the soft memory limit and is still finishing its requests.
  • [Standalone] Fix Passengerfile.json strings that contain \uXXXX escapes for non-ASCII characters being garbled or making Passenger crash.

Upgraded libraries

  • Upgrade llhttp from 9.2.1 -> 9.4.3.
  • Upgrade Boost from 1.90 -> 1.92.
  • Upgrade jsoncpp from 1.8.1 -> 1.9.8.
  • Updated various library versions used in precompiled binaries (used for e.g. gem installs):
    • ccache: 4.14.1 -> 4.14.2
    • cmake: 4.4.4 -> 4.4.5
    • gnupg: 2.5.21 -> 2.5.24
    • libgcrypt: 1.12.2 -> 1.12.4
    • libksba: 1.8.0 -> 1.8.1
    • rubies:
      • 3.3.12 -> 3.3.13
      • 3.4.11 -> 3.4.12
      • 4.0.7 -> 4.0.9

Installing 6.2.2

Please see the installation guide for advice on getting started with Passenger. Coming from a language other than Ruby, Python, Meteor or Node? Even if we didn't write a specific tutorial for your language, we made a generic guide that shows you the steps.

Upgrading to 6.2.2

We strongly advise staying up to date with the latest version.

Check out our upgrade guides for the different platforms:

Please be aware that you can enjoy enterprise features and sponsor the open source development directly by buying Phusion Passenger Enterprise.