Release 6.0.27 (Not yet released) * Upgrade Boost from 1.86 → 1.87. * Remove Passenger admin panel (Fuse). * Fix compilation on FreeBSD. * [Ruby] Fix compatibility with Rack 2 While maintaining compatibility with Rack 3. Closes [GH-2595](https://github.com/phusion/passenger/issues/2595). * [Ruby] Use non-deprecated functions in native extensions. * Fix an issue where Passenger could freeze while connecting to application processes (event loop blocking). * Updated various library versions used in precompiled binaries (used for e.g. gem installs): - ccache: 4.10.2 -> 4.11.2 - cmake: 3.31.3 -> 4.0.0 - curl: 8.11.1 -> 8.12.1 - git: 2.47.1 -> 2.49.0 - libassuan: 3.0.1 -> 3.0.2 - libffi: 3.4.6 -> 3.4.7 - openssl: 3.4.0 -> 3.4.1 - pcre2: 10.44 -> 10.45 - rubies - 3.1.6 -> 3.1.7 - 3.2.6 -> 3.2.8 - 3.3.6 -> 3.3.7 - 3.4.1 -> 3.4.2 - rubygems: 3.6.2 -> 3.6.6 - zstd: 1.5.6 -> 1.5.7 * [Nginx] Upgrades preferred Nginx to 1.26.3 from 1.26.2. * [Nginx] The preferred PCRE2 version is now 10.45 (previously 10.39).

* [CVE-2025-26803] The http parser (from Passenger 6.0.21-6.0.25) was susceptible to a denial of service attack when parsing a request with an invalid HTTP method.

* Fixes compilation with clang 19 (latest Fedora update) by dropping a buggy stddev function from the moving average header. Closes [GH-2580](https://github.com/phusion/passenger/issues/2580). * [Standalone] Adds a config option to specify the stop timeout for Passenger: `--stop-timeout 120` or `PASSENGER_STOP_TIMEOUT=120`. * [Standalone] Changes Passenger's (not apps') start timeout to 25s (from 15s), stop timeouts default to 60s. * [Ruby] Fixes an issue where Bundler would try to re-exec the process name instead of the script. Closes [GH-2567](https://github.com/phusion/passenger/issues/2567) and [GH-2577](https://github.com/phusion/passenger/issues/2577). * [Enterprise] Adds a temporary flag to allow reverting to previous routing behaviour, in order to mitigate possible performance regressions, this flag will become a no-op and eventually removed once the routing issues have been fixed. Closes [GH-2579](https://github.com/phusion/passenger/issues/2579). - Apache: PassengerOldRouting on - Nginx: passenger_old_routing on; - Standalone: --old-routing * Updated various library versions used in precompiled binaries (used for e.g. gem installs): - cmake: 3.31.2 -> 3.31.3 - curl: 8.11.0 -> 8.11.1 - libiconv: 1.17 -> 1.18 - rubygems: 3.5.23 -> 3.6.2 - rubies: - added 3.4.1

* [Nginx] Upgrades preferred Nginx to 1.26.2 from 1.26.1. * [Enterprise] Smarter rolling restarts for better performance and reliability. We changed the way we route requests. Instead of picking the least-busy process, we now first prioritize new processes first. During a rolling restart, this new behavior leads to more efficient utilization of application caches, faster validation of new rollouts, and faster recovery from problematic deployments. Closes [GH-2551](https://github.com/phusion/passenger/issues/2551). * Fix a regression from 6.0.10 where running `passenger-config system-properties` would throw an error. Closes [GH-2565](https://github.com/phusion/passenger/issues/2565). * [Enterprise] Fix a memory corruption-related crash that could occur during rolling restarting. * [Ubuntu] Add packages for Ubuntu 24.10 "oracular". * [Ruby] Specify rackup version to avoid broken 1.0 gem. Closes [GH-2559](https://github.com/phusion/passenger/issues/2559). * Fixes compatibility with Ruby apps whose Gemfile.lock depends on base64. * Upgrades Boost from 1.85 -> 1.86. * Updated various library versions used in precompiled binaries (used for e.g. gem installs): - ccache 4.10.1 -> 4.10.2 - cmake 3.30.1 -> 3.31.2 - curl 8.8.0 -> 8.11.0 - git 2.45.2 -> 2.47.1 - gnupg 2.4.5 -> 2.4.7 - libgpg_error 1.50 -> 1.51 - npth 1.7 -> 1.8 - openssl 3.3.1 -> 3.4.0 - rubygems 3.5.16 -> 3.5.23 - rubies: - 3.2.4 -> 3.2.6 - 3.3.4 -> 3.3.6

* [Enterprise] The rolling restart feature now replaces app processes in newest-to-oldest order, to make more efficient use of alive processes during the rolling-restart's duration. Closes [GH-2551](https://github.com/phusion/passenger/issues/2551). * [Ruby] Improve Rack 3 compatibility. * [Nginx] Upgrades preferred Nginx to 1.26.1 from 1.26.0. * [Debian] Remove packages for Debian 10 Buster. (EOL 2024-07). * [Ubuntu] Add packages for Ubuntu 24.04 "noble". * [RPMs] Remove EL7 RPMs, CentOS7 is EOL. * Fixes compatibility with Ruby apps whose Gemfile.lock depends on strscan. * Adds option to render a custom error page when app fails to launch. Closes [GH-2515](https://github.com/phusion/passenger/issues/2515). - Apache: PassengerCustomErrorPage "public/error.html" - Nginx: passenger_custom_error_page public/error.html; - Standalone: --custom-error-page public/error.html * Updated various library versions used in precompiled binaries (used for e.g. gem installs): - glibc 2.17 -> 2.28 - ccache 4.9.1 -> 4.10.1 - cmake 3.29.3 -> 3.30.1 - curl 8.7.1 -> 8.8.0 - git 2.45.0 -> 2.45.2 - openssl 3.3.0 -> 3.3.1 - pcre2 10.43 -> 10.44 - libassuan 2.5.7 -> 3.0.1 - libgcrypt 1.10.3 -> 1.11.0 - libgpg_error 1.49 -> 1.50 - libksba 1.6.6 -> 1.6.7 - pinentry 1.3.0 -> 1.3.1 - rubygems 3.5.10 -> 3.5.16 - rubies: - dropped 3.0.7 - 3.1.5 -> 3.1.6 - 3.3.1 -> 3.3.4

* [RPM] Fix dependency on selinux-policy. Closes [GH-2545](https://github.com/phusion/passenger/issues/2545). * Fix Amazon Linux detection. Closes [GH-3296](https://github.com/phusion/passenger/issues/3296).

* [Python] Fix version of Python when imp module is replaced with importlib. Contributed by Grigory Ponomarenko. * [Ubuntu] Remove packages for Ubuntu 23.10 "mantic". * [Nginx] Upgrades preferred Nginx to 1.26.0 from 1.24.0. * [Nginx] Switch to using PCRE2 instead of PCRE. * [RPM] The Passenger Nginx module rpm package for EL9 (RHEL, Rocky, Alma) will now require Nginx 1.24.0 as per the policy of supporting the newest Nginx module stream available. * [Standalone] Fixes security update checker with builtin engine. * [Enterprise] Ability to enforce hard memory limits on application processes (`PassengerHardMemoryLimit`/`passenger_hard_memory_limit`/`--hard-memory-limit``). Unlike the soft memory limit, the hard memory limit doesn't wait for the request to finish. Useful for preventing high memory usage from taking down the entire machine or container. * [Enterprise] Ability to throttle memory metrics collection (`PassengerAnalyticsCollectionRate`/`passenger_analytics_collection_rate`). This allows you to control the frequency that Passenger Enterpprise measures the app memory use at. * Swaps http-parser for llhttp. * Fixes crash-watch hanging when lldb is used as backend. * Fixes Apache module unload crash due to not properly cleaning up all threads. * Workaround compilation error on clang on x86_64. * Upgrades Boost from 1.83 -> 1.85. * Updated various library versions used in precompiled binaries (used for e.g. gem installs): - ccache: 4.6.3 -> 4.9.1 - cmake: 3.28.1 -> 3.29.3 - curl: 8.5.0 -> 8.7.1 - git: 2.43.0 -> 2.45.0 - gnupg: 2.4.3 -> 2.4.5 - libassuan: 2.5.6 -> 2.5.7 - libffi: 3.4.4 -> 3.4.6 - libgpg_error: 1.47 -> 1.49 - libksba: 1.6.5 -> 1.6.6 - libpsl: 0.21.5 - npth: 1.6 -> 1.7 - openssl: 3.2.0 -> 3.3.0 - pcre2: 10.42 -> 10.43 - pinentry: 1.2.1 -> 1.3.0 - rubygems: 3.5.4 -> 3.5.10 - zlib: 1.3 -> 1.3.1 - zstd: 1.5.5 -> 1.5.6 - rubies: - 3.0.6 -> 3.0.7 - 3.1.4 -> 3.1.5 - 3.2.3 -> 3.2.4 - 3.3.0 -> 3.3.1

* Upgrades Boost from 1.81 -> 1.83. * Upgrades http-parser from 2.3.0 -> 2.9.4. * [Ubuntu] Adds packages for Ubuntu 23.10 "mantic". * [Python] Address use of binary strings and file reads in python3. * [Ruby] Address use of deprecated ActiveRecord method. Closes [GH-2516](https://github.com/phusion/passenger/issues/2516). * [ARM] fix arch for apache module on Arm Macs. * Updated various library versions used in precompiled binaries (used for e.g. gem installs): - cmake: 3.27.7 -> 3.28.1 - curl: 8.4.0 -> 8.5.0 - git: 2.42.0 -> 2.43.0 - libgcrypt: 1.10.2 -> 1.10.3 - libksba: 1.6.4 -> 1.6.5 - ntbtls: 0.3.1 -> 0.3.2 - openssl: 3.1.4 -> 3.2.0 - rubygems: 3.4.21 -> 3.5.4 - s3cmd: 2.3.0 -> 2.4.0 - rubies: - 3.2.2 -> 3.2.3 - 3.3.0