Skip to content

Upgrading sinatra 3 to 4

Breaking3.2.0 → 4.2.1Breaking4Security3Platform1New3Changed3Fixed12

Full comparisonBack to sinatra
BreakingUpgrade verdict

4 breaking changes and a platform requirement change and 2 security fixes.

In plain terms
  • Sinatra no longer works with Rack 2, and if you use Sinatra to start the web server you must install the rackup gem.
  • Code that created an IndifferentHash with an initializer no longer works.
  • The protection against session hijacking is now off unless you turn it on.
  • The EncryptedCookie protection class is gone, but session cookies remain encrypted through Rack's session cookie support.
Must act Top 5 of 7 that need code or config changes

Ruby requirement changed in 4.0.0: >= 2.6.0 → >= 2.7.8.

What you must change

Breaking4
Drops support for Rack 2; starting the web server now requires the rackup gem.
rackup
4.0.0CHANGELOG.mdSummarizedView source
Removes the IndifferentHash initializer.
IndifferentHash
4.0.0CHANGELOG.mdSummarizedView source
Disables session_hijacking protection by default.
session_hijacking
4.0.0CHANGELOG.mdSummarizedView source
Removes Rack::Protection::EncryptedCookie; cookies are still encrypted by Rack::Session::Cookie.
Rack::Protection::EncryptedCookieRack::Session::Cookie
4.0.0CHANGELOG.mdSummarizedView source
Security2
Sinatra is vulnerable to ReDoS through ETag header value generation
etag_matches?Low
4.2.0GitHub AdvisoryOriginalView source
The host_authorization setting addresses CVE-2024-21510.
Moderate · CVSS 5.4
4.1.0CHANGELOG.mdSummarizedView source
Platform1
Requires Ruby 2.7.8 as the minimum Ruby version.
4.0.0CHANGELOG.mdSummarizedView source