Update Thruster to 0.1.27

[namespaceMarcello]

Campfire's lockfile has Thruster at 0.1.23. Two advisories in Thruster's HTTP cache have been published and fixed since:

• GHSA-m592-hhcw-jh6f (high), fixed in 0.1.24: "Thruster cache-key collisions allow cross-request response substitution, including GET-to-POST origin bypass".
• GHSA-g74j-pv38-jj8g (medium), fixed in 0.1.27: "Thruster HTTP cache ignores later Vary field lines and repeated request header values".

Campfire's public responses go through that cache: avatars, the account logo, Active Storage files and what is in public/. Whether either advisory can be reached in Campfire wasn't looked into here. This moves the lockfile to the fixed release and nothing else: bundle lock --update thruster --conservative, four lines.

bundler-audit doesn't point at this: it finds nothing in either lockfile, since ruby-advisory-db (at a6847b0, 2026-10-10) doesn't list the two advisories.

What else comes with 0.1.24 to 0.1.27, from Thruster's changelog: requests that can't be cached bypass the cache altogether (0.1.25), an X-Request-ID on requests, responses and logs (0.1.26), Go 1.27.1 and updated dependencies, golang.org/x/crypto 0.56.0 among them (0.1.27).

What someone running Campfire could notice, as seen on the production image:

• Thruster's request log line gains a request_id: the id Rails tags its own log lines with and returns as X-Request-Id.
• Responses for the files in public/ (assets, robots.txt) carry an X-Request-Id too. They had none.

Checks

On our machine (a laptop, Docker), with the production image built from main at edbc779 and from this branch, over plain HTTP:

• 36 requests through Thruster, for every kind of file: an attachment whole and asked for twice, ranges it can and can't satisfy, the way a <video> asks, HEAD, conditional requests, with and without compression accepted, a thumbnail, an avatar, the logo, a bot's default avatar, a file of no bytes, a PDF, a stylesheet and a script, robots.txt, an asset that isn't there. The same status and the same decoded bytes in all 36.
• Headless Chrome 155 opening a room with a picture, a file and avatars: the same 160 resources, all 200, the same pictures drawn, the same style rules, no console errors.
• 20 WebSocket clients, each with a room page's eight subscriptions: all connected, and every message posted reached every one of them.
• A 3 MB file posted to a room: 200, stored whole.
• The same four with Have Thruster send whole files from disk again #359 on top of this: the same results as Have Thruster send whole files from disk again #359 alone.

Not tried: TLS (TLS_DOMAIN and Let's Encrypt), and so not HTTP/2 either.

Validation in the container: bin/brakeman, bin/rails herb:check, bin/rails test (580 runs) and bin/rails test:system (27 runs) pass with no failures. They run in the test environment, where there is no Thruster: they say the lockfile resolves and the suite passes, and the checks above say the rest.

Written by Claude Code (AI assistant) on behalf of @namespaceMarcello, who directs this work.

🤖 Generated with Claude Code

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.