Upgrading puma 6 to 7
Breaking6.6.1 → 7.2.1Breaking8Security2Platform1New6Changed9Fixed22Other20
SecurityHigh · CVSS 7.5Limits and anchors PROXY protocol v1 parsing to prevent abuse via crafted inputs.GHSA-qpgp-93vx-g8v8 · CVE-2026-47736 ↗
BreakingUpgrade verdict
8 breaking changes and a platform requirement change and 2 security fixes.
In plain terms
- By default, a keep-alive connection now serves up to 999 requests before closing.
- Idle keep-alive connections now stay open for 65 seconds instead of the previous shorter default.
- The long-deprecated ruby_engine method is gone; code calling it will break.
- Default values that depend on other settings are now applied later, after command line options and config files are processed.
Must act Top 5 of 11 that need code or config changes
Ruby requirement changed in 7.0.0: >= 2.4 → >= 3.0.
What you must change
Breaking8
Sets the default
max_keep_alive to 999.max_keep_aliveIncreases the
persistent_timeout default to 65 seconds.persistent_timeoutRemoves the
ruby_engine method from Runner.rb, deprecated in Nov-2024.ruby_engineSets conditional config defaults after CLI options are parsed and config files are loaded.
Renames callback hooks, e.g. on_worker_boot to before_worker_boot and on_booted to after_booted.
on_worker_bootbefore_worker_booton_worker_shutdownbefore_worker_shutdownon_restartbefore_restarton_bootedafter_bootedRaises an ArgumentError when a hook is called without a block.
Stops setting env['HTTP_VERSION'] for Rack versions greater than 3.1.
env['HTTP_VERSION']Response headers are now set to lowercase.
Security2
Limits and anchors PROXY protocol v1 parsing to prevent abuse via crafted inputs.
High · CVSS 7.5Parses PROXY protocol only once per connection to prevent injection on keep-alive requests.
High · CVSS 7.5Platform1
Updates the minimum Ruby version to 3.0.