Shiny Server Pro Release History

1.5.18 (2022-04-20)

• Upgrade Node.js to 16.14.0.
• Drop support for Ubuntu 16.04.

1.5.17 (2021-10-19)

• app_dir config directives pointing to missing or unreadable directories on disk were causing errors during routing, even for requests intended for unrelated apps.
• Fix an issue where entire R processes would leak if: 1) they ever called reticulate::source_python(), and 2) were running at the time that Shiny Server stopped (or restarted). Both conditions were required to trigger the leak.
• Fix a bug that resulted in the log message "MaxListenersExceededWarning: Possible EventEmitter memory leak detected."
• Upgrade Node.js to 12.22.6.
• Major upgrade to SockJS client (from 0.3.4 to 1.5.0). Technically, this adds two new SockJS protocols, eventsource and htmlfile, but the vast majority of admins shouldn't need to think about this. (The new protocols will be used automatically if necessary, unless either they or the older SockJS protocols iframe-eventsource and iframe-htmlfile are disabled in shiny-server.conf using the disable_protocols directive.)
• Drop support for Ubuntu 14.04. The oldest supported Ubuntu version is now 16.04.

1.5.16 (2021-01-11)

• Fix a security vulnerability that could allow the download of published application source code directly from the server.
• Fix an issue where a failure in a certain phase of R process launching would result in a broken process being treated as a normal process, and repeatedly used to (unsuccessfully) serve new clients.
• Upgrade Node.js to 12.20.0.
• Drop support for RedHat/CentOS 6.

1.5.15 (2020-11-10)

• Fixed a bug where unreliable LDAP server could crash Shiny Server Pro.
• Fixed a bug where utilization_scheduler was not respecting load factor of exactly 0.
• Upgrade Node.js to 12.19.0.

1.5.14 (2020-06-18)

• Support for Ubuntu 14.04 has been dropped, and support for Ubuntu 20.04 has been added. (Ubuntu 16.04 and 18.04 continue to be supported.)
• Added support for SameSite=None cookie attribute. Without this support, when Shiny apps are displayed within iframes and require authentication, newer browsers that implement the "Incrementally Better Cookies" IETF draft proposal (at the time of this writing, only Google Chrome 80, though Firefox and Edge also intend to) will not be able to login. See the "Displaying Shiny apps inside iframes" section of the Shiny Server Pro Admin Guide.
• iframe based SockJS protocols were using a CDN copy of a JS library that no longer exists, causing breakage. Now an internal copy is used. (The iframe SockJS protocols should not be needed for browsers that are supported by Shiny Server these days; if you ran into this problem, please revisit the value you're using for disable_protocols, and especially try removing xhr-polling from the disabled list.)
• Upgrade Node.js to 12.18.0.
• Upgrade dependencies to latest versions.

1.5.13 (2020-03-12)

• BREAKING CHANGE: By default, Shiny Server Pro now requires TLSv1.2 or higher when establishing TLS connections. This applies to serving HTTP using the built-in SSL support, and to connecting as an LDAP client to authentication servers. If you have web browsers or LDAP servers that do not support TLSv1.2+ you will need to upgrade them; or, if you must, you can use ssl_min_version to try to re-enable obsolete versions of TLS.
• Upgrade Node.js to 12.15.0.
• Upgrade dependencies to latest versions.
• The disable_protocols directive now has streaming and polling options for easily disabling families of protocols.
• Now able to redirect R logs to the main shiny-server process's stderr, which is useful for containerized deployments and other scenarios where log files on disk are inconvenient to access. Enable this functionality by setting the environment variable SHINY_LOG_STDERR to a non-empty value.
• The auth_duration directive now detects values less than 10 (minutes), and logs a warning that a value of 10 minutes will be used instead. This is to prevent seemingly-spontaneous logouts of active sessions, which only refresh their auth cookies every 5 minutes or so.
• Local app configuration files (.shiny_app.conf) now respect the r_path directive.
• Fixes benign XML parsing error message in Firefox JS console.

1.5.12 (2019-09-24)

• Upgrade Node.js to 10.15.3.
• Upgrade lodash dependency (CVE-2019-10744).
• Support Red Hat 8 and SLES 15.
• Admin dashboard now works properly when accessed via a raw IPv6 address.

1.5.11 (2019-01-31)

• Modify Google OAuth 2.0 implementation to stop using soon-to-be deprecated Google API endpoints. Some of these endpoints appeared to be causing login attempts to "hang" at the Google consent step.
• Added base_url directive, which should be used under server and admin nodes when Shiny Server is being fronted by a reverse proxy like Nginx or Apache, to tell Shiny Server what URL the browser sees. This URL is used for forming absolute redirect URLs, such as those needed to support Google OAuth authentication.

1.5.10 (2018-09-20)

• Fix bug with listening on port 443.

1.5.9 (2018-09-12)

• Fix bug with listening on port 80.

1.5.8 (2018-08-30)

• Upgrade to Node v8.11.3.
• Added support for listening on IPv6 addresses.
• X-Powered-By response header now reports "Shiny Server" instead of "Express".
• For LDAP double-bind authentication, use the base_bind account to iterate the user's groups (rather than the user's own LDAP account, which sometimes does not have permissions to see its own groups).
• Resolve permissions issues when log directory is on an NFS mount with root squash. The log_as_user directive was intended to work for these situations, but would fail in common configurations. It should now work.
• log_file_mode no longer respects the process umask, and the default has been changed from 0660 to 0640.
• Exit code of shiny-server process was always 0, regardless of the reason the process exited. Now a non-zero exit code is used if the process was terminated by a signal, or an unhandled error crashed the process, or loading of the shiny-server.conf config file failed during startup.
• Added auth_ignore_case directive, which can be used to treat required_user and required_group directives as case-insensitive. Disabled by default, as it's only safe to use on systems that prevent the creation of users/groups whose names vary from existing users/groups only by case.
• For SSL/TLS configurations, remove support for TLSv1 by default (SSLv2 and v3
  were already not supported). If a stricter or looser policy is desired, this can be achieved by adding ssl_min_version as a child directive of ssl; valid values for ssl_min_version are tlsv1, tlsv11, and tlsv12.

1.5.7 (2018-04-11)

• Upgrade to Node v8.10.0.
• Dropped support for Ubuntu 12.04 and SLES 11.
• Rename CSRF token cookie from XSRF-TOKEN to SSP-CSRF, so as not to conflict with other Angular apps being served from the same host.
• Fix bug where dashboard could show incorrect or even negative values from RAM usage.
• Fix bugs retrieving LDAP/Active Directory groups when group_filter contains an extensible match operator (which is the default for auth_active_dir).
• Support gzip/deflate compression for HTTP responses. You can disable this if necessary with the directive http_allow_compression no; at the top level of shiny-server.conf.
• Fix bug where server could crash with "render is not defined".
• Don't color log output if stdout is not a terminal.
• Add secure_cookies always; directive, which adds the HTTP cookie flag "secure" to our session cookies. Note that this should only be used if all authenticated apps and the admin dashboard are ONLY accessible via https, either through Shiny Server Pro's built-in TLS support or via a proxy.

1.5.6 (2017-12-08)

• Dropped support for RedHat/CentOS 5.
• Added floating license support through the new license_type configuration directive. The floating licensing model makes it easier for multiple instances of Shiny Server to share a license, such as in cloud environments.

1.5.5 (2017-09-26)

• Fix a rare crash that can occur when a logged out user has a second browser
  tab open with an app that's trying to reconnect.
• Fix several bugs in license-manager

1.5.4 (2017-08-31)

• Upgrade to Node.js v6.10.3.
• Upgrade to pandoc 1.19.2.1.
• Refactor scheduler code to make enforcement of connection limits more robust.
• Utilization scheduler behavior is more intuitive, especially around connection limits and load factor.
• Add `log_file_mode` directive; set this to 0644 to allow application log files to be globally readable.
• When using `auth_pam`, login can be slow if the user is part of many groups and/or those groups have many users. This release does not speed up the login process, but it does prevent slow logins from tying up other requests, by performing the group retrieval on a worker thread.
• Fix bug where LDAP returns no groups when username contains a backslash.

1.5.3 (2017-03-13)

• Fix bug where using `frame_options` directive would cause a crash.
• Upgrade to Node.js v6.10.0

1.5.2 (2016-11-18)

• Fix bug where network connectivity issues with LDAP servers could cause a crash. Also, eagerly close connection between LDAP client and server when no longer needed.

1.5.1 (2016-11-04)

• Improve robustness with unfriendly proxy configurations. This had regressed some time between 1.4.3 and 1.4.7.

1.5.0 (2016-11-02)

• Upgrade to Node.js v6.9.1, and upgrade all npm dependencies. While no distinct features or significant bug fixes result from this upgrade, catching up to the current Node.js release is critical for the long-term health of our codebase.
• SSL/TLS connections now support forward secrecy.
• Fix bug where R processes would not be cleaned up if an HTTP request was prematurely closed.
• Fix bug introduced in 1.4.7 where user could be logged out spontaneously, especially in interactive Rmd documents that contain many embedded sub-apps.
• Fix bug where low-level network errors communicating with LDAP servers could cause a crash.

1.4.7 (2016-10-12)

• Add auto-reconnect capabilities. Can be disabled via `reconnect false;` config option (replaces `disable_reconnect true;`).
• Upgrade to Node.js v0.10.47 (security patches).
• Fix bug where running the admin dashboard behind a reverse proxy would cause problems with "Kill Process" and "Kill Connection" buttons, requiring ugly proxy rules to workaround. These should no longer be required.
• The bookmarkable state feature in Shiny v0.14 is now officially supported. Use the `bookmark_state_dir` directive to store bookmarked sessions in a specific location (default is /var/lib/shiny-server/bookmarks).

1.4.6 (2016-09-22)

Bug fix release.

• Fix a bug where a 404 response on some URLs could cause the server to exit with an unhandled exception.

1.4.5 (2016-09-09)

Security release to fix minor issues raised in penetration test results.

• Add `disable_login_autocomplete` directive that can be used to instruct browsers not to attempt to autocomplete on the login screen. Note that servers can only suggest this behavior to browsers (and in particular, Google Chrome chooses not to comply, as its developers argue that disabling autocomplete decreases security rather than increasing it).
• Add opt-in clickjacking protection via `frame_options` directive. Login and /admin URLs now served with `X-Frame-Options: DENY` (the former can be opted out with an `auth_frame_options allow;` directive).
• Fix open redirection on __login__. Previously, a URL created with malicious intent could cause you to go to an arbitrary URL after successful login. Now, it is only possible to be redirected to a path on Shiny Server.
• Add Cross-Site Request Forgery (CSRF) protection to login and other POST operations.

1.4.4 (2016-08-01)

• Fix fatal EBADF error that could cause server crashes.
• Updated PAM integration to resolve bug with asynchronous PAM modules like pam_ldap, pam_vas, and nss_ldap.
• Upgrade to Node.js v0.10.46 (security patches).

1.4.3 (2016-03-09)

• Added proxied authentication mechanism via the `auth_proxy` option.
• Upgrade to Node.js v0.10.45 (primarily for updated OpenSSL).

1.4.2 (2016-02-26)

• Bug fix: Updates to license manager to increase stability
• Update the list of preferred SSL ciphers to be in line with current best practices.
• Add `set_header` option to allow the setting of an arbitrary HTTP header.
• Add `metrics_user` config to allow control over which user spawns the metrics process.
• Improve disconnected UI by adding modal with description.
• Capture killing of sessions and workers from admin dashboard in server log.
• Bug fix: URL query arguments are preserved through the login attempts.
• Added experimental support for reconnecting disconnected sessions. Set `disable_reconnect false;` to enable the feature.

1.4.1 (2015-11-06)

• Update to NodeJS v0.10.40 for security fixes
• Add preserve_logs option to retain logs for R processes that didn't error.
• Bug fix: No more instability when reloading after removing the auth strategy.

1.4.0 (2015-07-10)

• Added support for RHEL/CentOS 7 and Ubuntu 15.04.
• Added disabled_protocols to allow administrators to disable arbitrary SockJS protocols.
• Include supplemental groups when switching users.
• Support multiple CA certificates for LDAP over SSL.
• Log successful login attemps (at the DEBUG level) and unsuccessful login attempts (at the INFO level).
• Capture Upstart failures to start Shiny Server successfully.
• Bug fix: Load fonts over HTTPS.
• Bug fix: Fix installer locale issue for Ubuntu 14.04.
• Bug fix: RH6 uses a statically linked Pandoc.
• Support appidletimeout of 0.

1.3.0 (2015-01-15)

• Added support for SUSE Linux Enterprise Server 11.

1.2.3 (2014-10-10)

• Bug fix: Ensured proper LDAP filter query escaping for special characters.

1.2.2 (2014-10-01)

• Added support for single-file app.R deployment released in Shiny 0.10.2.
• Logging performance improvements.
• Bug fix: Check for undefined target in link handler, will resolve the browser error: "Uncaught TypeError: Cannot read property 'replace' of undefined."
• Bug fix: Properly target all HTTP traffic to the original worker in IE8 and 9.

1.2.0 (2014-06-30)

• Added experimental support for Interactive Documents (Shiny + Rmd) via the rmarkdown package.
• Leverage sitedir when hosting in userdirs mode; userdirs will now respect the directoryindex setting and host static assets other than Shiny applications.
• Provide a more sane handling of LANG by ensuring it's passed through in all spawning modes and set an environment variable in the startup script on Ubuntu.
• Bug fix: Restored functionality of sspasswd's -v switch.

1.1.0 (2014-04-18)

• Added Google Authentication (OAuth2) as a new authentication strategy.
• Added support for custom page templates -- exposing the ability to customize the static pages generated by Shiny Server for directory listings or errors.
• Support PAM for auth (auth-pam) and session creation (pam-sessions-profile).
• Leverage bash when spawning Shiny processes on behalf of other users, as in 'user_apps' mode.
• Support custom locations for the R executable in the configuration file.
• Added the '' and '*' special-cases to the 'required_user' setting.
• Added the 'exec_supervisor' setting to allow administrators to prefix the R process with a command, such as 'nice'.
• Bug fix: Restored compatibility with IE8 Standards Mode
• Added a health check endpoint at /health-check (two underscores on either side) which makes various statistics about the server available.
• DEPRECATED: No longer offering a health-check endpoint '/ping'.
• Created 'userdirs' mode and the special ':HOMEUSER:' runas user to replace 'userapps'.
• Leverage bash when spawning Shiny processes on behalf of other users, as in 'user_dirs' mode.
• Bug fix: Make compatible with loading content from Shiny Server in an iframe with third-party cookies blocked.
• Bug fix: Restored compatibility with IE8 Standards Mode

1.0.0 (2014-02-04)

• Added various quick-start configurations as described at: http://rstudio.github.io/shiny-server/latest/#quick-start
• Added ability to disable metrics using --no-metrics.

0.5.0

• Drop root privileges and run as another user when appropriate.
• Don't uninstall Upstart script when upgrading rpm package.
• Refactor admin: Added username, protocol, SSL icon, and IP address to connections table.

0.4.2

• BREAKING CHANGE: Deprecated application setting in favor of nested `location blocks.
• Allow client to configure which network techniques should be used to connect to the server using the keyboard shortcut 'ctrl+shift+A'.
• Properly set working directory of spawned Shiny Processes to the associated application's directory to honor local .Renviron and family.
• Provide a logrotate configuration for /var/log/shiny-server.log where logrotate is available.
• Various memory leak and stability improvements.

0.4.1

• Added LDAP and AD Auth schemes
• Support SSL on Admin
• Patch Admin on Safari
• Ability to proxy headers

0.4.0

• Use UNIX domain sockets for data transfer instead of TCP/IP for enhanced security.
• Added scheduler and traffic direction which require shiny >= 0.6.0.99 to be compatible.

0.3.6

• Support for node-webkit-agent (https://github.com/c4milo/node-webkit-agent). Use by setting DEBUG_PORT environment variable to a port number, then follow the instructions on the node-webkit-agent GitHub page under "Connecting to the agent". (At the time of this writing, node-webkit-agent only supports Node v0.8.x, not v0.10.x.)
• Fix slow memory leak when checking for restart.txt that doesn't exist.

0.3.5

• Fix crash on Node 0.10.x when serving static files.
• Fix slow memory leak and log file descriptor leak.

0.3.4

• You can now force an app to restart by calling "touch restart.txt" in the app directory root. Existing sessions will not be terminated, but the next session to be initiated will cause a new R process to be launched.
• shiny-server now passes its version number to R processes it launches.

0.3.3

• Remove pausing which is causing corruption in proxied HTTP request bodies.

0.3.2

• Make shiny-server compatible with httpuv package which we are introducing to Shiny.

0.3.1

• Fix crashing bug when "req" object has no address.

0.3.0

• Initial release.