Roadmap for Thin removal

[stephanme]

Puma is the default web server since capi-release v1.196.0 released on 7th Nov 24.

This issue is to discuss the timeline for removing the Thin webserver from ccng.

Steps:

1. remove the configuration flags related to Thin
   • cc.temporary_enable_deprecated_thin_webserver
   • cc.experimental.use_puma_webserver
   • cc.experimental.thin_server.thread_pool_size
2. build a CAPI release
3. remove Thin from documentation (e.g. Scaling Cloud Controller
4. remove Thin from ccng codebase

My proposal for steps 1 and 2 is Jan 25. Step 4 could happen 4..8 weeks after step 2 (allows an easy revert in case of severe problems).

[sethboyles]

I think, at the earliest, we'd like to wait until October to remove Thin support entirely. To be transparent, it would be simplest for us to wait until even 2026 (or later) to keep Thin.

But I know that Thin prevents us from upgrading Sinatra, which is on a version that is not maintained. That could be a liability. (It could be blocking us on upgrading other gems as well). I'm hoping we can come up with a plan to move off of Thin completely by October so we don't have to block this any longer than necessary.

[stephanme]

Blackduck Scan findings that would be resolved when Thin gets removed:

Sinatra 3.2.0

• BDSA-2024-7996, medium (6.3) = https://nvd.nist.gov/vuln/detail/CVE-2024-21510
• BDSA-2025-13798, medium (4.6) = https://nvd.nist.gov/vuln/detail/CVE-2025-61921
• outdated dependency violation - nearly 2y old

[sethboyles]

@stephanme Removing Thin works for us.

[sethboyles]

Is this a significant enough breaking change to finally bump the release version to CAPI 2.0? 😅