• Harden against symlink attacks on improperly secured instance directories. This is a mitigation, and not intended to replace the use of proper filesystem permissions.
• Upgrade llhttp from 9.2.1 -> 9.4.3.
• Harden against secure headers containing header delimiters.
• Upgrade Boost from 1.90 -> 1.92.
• Upgrade jsoncpp from 1.8.1 -> 1.9.8.
• [Enterprise] Fix the hard memory limit not being enforced on a process that already exceeded the soft memory limit and is still finishing its requests.
• [Standalone] Fix Passengerfile.json strings that contain \uXXXX escapes for non-ASCII characters being garbled or making Passenger crash.
• Updated various library versions used in precompiled binaries (used for e.g. gem installs):
  • ccache: 4.14.1 -> 4.14.2
  • cmake: 4.4.4 -> 4.4.5
  • gnupg: 2.5.21 -> 2.5.24
  • libgcrypt: 1.12.2 -> 1.12.4
  • libksba: 1.8.0 -> 1.8.1
  • rubies:
    • 3.3.12 -> 3.3.13
    • 3.4.11 -> 3.4.12
    • 4.0.7 -> 4.0.9