Bump puma from 3.8.2 to 4.3.4 in /examples/todo-vuejs

[dependabot]

Bumps puma from 3.8.2 to 4.3.4.

Release notes

Sourced from puma's releases.

v4.3.0 - Mysterious Traveller

Mysterious Traveller

• Features

  • Strip whitespace at end of HTTP headers (#2010)
  • Optimize HTTP parser for JRuby (#2012)
  • Add SSL support for the control app and cli (#2046, #2052)

• Bugfixes

  • Fix Errno::EINVAL when SSL is enabled and browser rejects cert (#1564)
  • Fix pumactl defaulting puma to development if an environment was not specified (#2035)
  • Fix closing file stream when reading pid from pidfile (#2048)
  • Fix a typo in configuration option --extra_runtime_dependencies (#2050)

4.2.1

• 3 bugfixes
  • Fix socket activation of systemd (pre-existing) unix binder files (#1842, #1988)
  • Deal with multiple calls to bind correctly (#1986, #1994, #2006)
  • Accepts symbols for verify_mode (#1222)

4.2.0 - Distant Airhorns

• 6 features
  • Pumactl has a new -e environment option and reads config/puma/.rb config files (#1885)
  • Semicolons are now allowed in URL paths (MRI only), useful for Angular or Redmine (#1934)
  • Allow extra dependencies to be defined when using prune_bundler (#1105)
  • Puma now reports the correct port when binding to port 0, also reports other listeners when binding to localhost (#1786)
  • Sending SIGINFO to any Puma worker now prints currently active threads and their backtraces (#1320)
  • Puma threads all now have their name set on Ruby 2.3+ (#1968)
• 4 bugfixes
  • Fix some misbehavior with phased restart and externally SIGTERMed workers (#1908, #1952)
  • Fix socket closing on error (#1941)
  • Removed unnecessary SIGINT trap for JRuby that caused some race conditions (#1961)
  • Fix socket files being left around after process stopped (#1970)
• Absolutely thousands of lines of test improvements and fixes thanks to @MSP-Greg

4.1.1

3 bugfixes

• Revert our attempt to not dup STDOUT/STDERR (#1946)
• Fix socket close on error (#1941)
• Fix workers not shutting down correctly (#1908)

4.1.0 - Fourth and One

• 4 features
  • Add REQUEST_PATH on parse error message (#1831)
  • You can now easily add custom log formatters with the log_formatter config option (#1816)

... (truncated)

Changelog

Sourced from puma's changelog.

5.0.0

• Features

  • EXPERIMENTAL: Add fork_worker option and refork command for reduced memory usage by forking from a worker process instead of the master process. (#2099)
  • EXPERIMENTAL: Added wait_for_less_busy_worker config. This may reduce latency on MRI through inserting a small delay before re-listening on the socket if worker is busy (#2079).
  • EXPERIMENTAL: Added nakayoshi_fork option. Reduce memory usage in preloaded cluster-mode apps by GCing before fork and compacting, where available. (#2093, #2256)
  • Added pumactl thread-backtraces command to print thread backtraces (#2054)
  • Added incrementing requests_count to Puma.stats. (#2106)
  • Increased maximum URI path length from 2048 to 8196 bytes (#2167)
  • lowlevel_error_handler is now called during a forced threadpool shutdown, and if a callable with 3 arguments is set, we now also pass the status code (#2203)
  • Faster phased restart and worker timeout (#2220)
  • Added state_permission to config DSL to set state file permissions (#2238)
  • Added Puma.stats_hash, which returns a stats in Hash instead of a JSON string (#2086, #2253)

• Deprecations, Removals and Breaking API Changes

  • --control has been removed. Use --control-url (#1487)
  • worker_directory has been removed. Use directory.
  • min_threads now set by environment variables PUMA_MIN_THREADS and MIN_THREADS. (#2143)
  • max_threads now set by environment variables PUMA_MAX_THREADS and MAX_THREADS. (#2143)
  • max_threads default to 5 in MRI or 16 for all other interpreters. (#2143)
  • preload by default if workers > 1 (#2143)
  • Puma::Plugin.workers_supported? has been removed. Use Puma.forkable? instead. (#2143)
  • tcp_mode has been removed without replacement. (#2169)
  • Daemonization has been removed without replacement. (#2170)
  • Changed #connected_port to #connected_ports (#2076)
  • Configuration: environment is read from RAILS_ENV, if RACK_ENV can't be found (#2022)

• Bugfixes

  • Close client http connections made to an ssl server with TLSv1.3 (#2116)
  • Do not set user_config to quiet by default to allow for file config (#2074)
  • Always close SSL connection in Puma::ControlCLI (#2211)
  • Windows update extconf.rb for use with ssp and varied Ruby/MSYS2 combinations (#2069)
  • Ensure control server Unix socket is closed on shutdown (#2112)
  • Preserve BUNDLE_GEMFILE env var when using prune_bundler (#1893)
  • Send 408 request timeout even when queue requests is disabled (#2119)
  • Rescue IO::WaitReadable instead of EAGAIN for blocking read (#2121)
  • Ensure BUNDLE_GEMFILE is unspecified in workers if unspecified in master when using prune_bundler (#2154)
  • Rescue and log exceptions in hooks defined by users (on_worker_boot, after_worker_fork etc) (#1551)
  • Read directly from the socket in #read_and_drop to avoid raising further SSL errors (#2198)
  • Set Connection: closed header when queue requests is disabled (#2216)
  • Pass queued requests to thread pool on server shutdown (#2122)
  • Fixed a few minor concurrency bugs in ThreadPool that may have affected non-GVL Rubies (#2220)
  • Fix out_of_band hook never executed if the number of worker threads is > 1 (#2177)
  • Fix ThreadPool#shutdown timeout accuracy (#2221)
  • Fix UserFileDefaultOptions#fetch to properly use default (#2233)
  • Improvements to out_of_band hook (#2234)
  • Prefer the rackup file specified by the CLI (#2225)

• Refactor

  • Remove unused loader argument from Plugin initializer (#2095)

... (truncated)

Commits

• 3846a4e Bump version
• f24d552 Better handle client input
• 7a65937 4.3.3
• 45b4cc9 HTTP Injection - fix bug + 1 more vector (#2136)
• 040a5bf 4.3.2
• ae98b54 4.3.2 and 3.12.3 release notes
• 694feaf Merge pull request from GHSA-84j7-475p-hp8v
• 2986bc4 4.3.1
• 285c3f9 4.3.1 and 4.2.1 release notes
• 98a1f03 Merge pull request from GHSA-7xx3-m584-x994
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Superseded by #32.