Skip to content
This repository has been archived by the owner on Sep 28, 2023. It is now read-only.

Update dependency rails to v7 #14

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update dependency rails to v7 #14

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link

@renovate renovate bot commented Nov 20, 2022 •
edited
Loading

Mend Renovate

This PR contains the following updates:

Package Update Change
rails (source, changelog) major '>= 5.0.0', '< 5.1' -> '>= 5.0.0', '< 7.0.9'

Release Notes

rails/rails (rails)

v7.0.8: 7.0.8

Compare Source

Active Support

  • Fix TimeWithZone still using deprecated #to_s when ENV or config to
    disable it are set.

    Hartley McGuire

  • Fix CacheStore#write_multi when using a distributed Redis cache with a connection pool.

    Fixes #​48938.

    Jonathan del Strother

Active Model

  • No changes.

Active Record

  • Fix change_column not setting precision: 6 on datetime columns when
    using 7.0+ Migrations and SQLite.

    Hartley McGuire

  • Fix unscope is not working in specific case

    Before:

    Post.where(id: 1...3).unscope(where: :id).to_sql # "SELECT `posts`.* FROM `posts` WHERE `posts`.`id` >= 1 AND `posts`.`id` < 3"

    After:

    Post.where(id: 1...3).unscope(where: :id).to_sql # "SELECT `posts`.* FROM `posts`"

    Fixes #​48094.

    Kazuya Hatanaka

  • Fix associations to a STI model including a class_name parameter

    class Product < ApplicationRecord
  has_many :requests, as: :requestable, class_name: "ProductRequest", dependent: :destroy
end

STI tables

class Request < ApplicationRecord
  belongs_to :requestable, polymorphic: true

  validate :request_type, presence: true
end

class ProductRequest < Request
  belongs_to :user
end
```

Accessing such association would lead to:

```
table_metadata.rb:22:in `has_column?': undefined method `key?' for nil:NilClass (NoMethodError)
```

*Romain Filinto*

  • Fix change_table setting datetime precision for 6.1 Migrations

    Hartley McGuire

  • Fix change_column setting datetime precision for 6.1 Migrations

    Hartley McGuire

Action View

  • Fix form_for missing the hidden _method input for models with a
    namespaced route.

    Hartley McGuire

  • Fix render collection: @&#8203;records, cache: true inside jbuilder templates

    The previous fix that shipped in 7.0.7 assumed template fragments are always strings,
    this isn't true with jbuilder.

    Jean Boussier

Action Pack

  • Fix HostAuthorization potentially displaying the value of the
    X_FORWARDED_HOST header when the HTTP_HOST header is being blocked.

    Hartley McGuire, Daniel Schlosser

Active Job

  • Fix Active Job log message to correctly report a job failed to enqueue
    when the adapter raises an ActiveJob::EnqueueError.

    Ben Sheldon

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • No changes.

Action Mailbox

  • No changes.

Action Text

  • No changes.

Railties

  • Omit webdrivers gem dependency from Gemfile template

    Sean Doyle

v7.0.7.2: 7.0.7.2

Compare Source

No changes between this and 7.0.7.2. This release was just to fix file permissions in the previous release.

v7.0.7.1: 7.0.7.1

Compare Source

Active Support

  • Use a temporary file for storing unencrypted files while editing

    [CVE-2023-38037]

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • No changes.

Action Mailbox

  • No changes.

Action Text

  • No changes.

Railties

  • No changes.

v7.0.7: 7.0.7

Compare Source

Active Support

  • Fix Cache::NullStore with local caching for repeated reads.

    fatkodima

  • Fix to_s with no arguments not respecting custom :default formats

    Hartley McGuire

  • Fix ActiveSupport::Inflector.humanize(nil) raising NoMethodError: undefined method `end_with?' for nil:NilClass.

    James Robinson

  • Fix Enumerable#sum for Enumerator#lazy.

    fatkodima, Matthew Draper, Jonathan Hefner

  • Improve error message when EventedFileUpdateChecker is used without a
    compatible version of the Listen gem

    Hartley McGuire

Active Model

  • Error.full_message now strips ":base" from the message.

    zzak

  • Add a load hook for ActiveModel::Model (named active_model) to match the load hook for
    ActiveRecord::Base and allow for overriding aspects of the ActiveModel::Model class.

Active Record

  • Restores functionality to the missing method when using enums and fixes.

    paulreece

  • Fix StatementCache::Substitute with serialized type.

    ywenc

  • Fix :db_runtime on notification payload when application have multiple databases.

    Eileen M. Uchitelle

  • Correctly dump check constraints for MySQL 8.0.16+.

    Steve Hill

  • Fix ActiveRecord::QueryMethods#in_order_of to include nils, to match the
    behavior of Enumerable#in_order_of.

    For example, Post.in_order_of(:title, [nil, "foo"]) will now include posts
    with nil titles, the same as Post.all.to_a.in_order_of(:title, [nil, "foo"]).

    fatkodima

  • Revert "Fix autosave associations with validations added on :base of the associated objects."

    This change intended to remove the :base attribute from the message,
    but broke many assumptions which key these errors were stored.

    zzak

  • Fix #previously_new_record? to return true for destroyed records.

    Before, if a record was created and then destroyed, #previously_new_record? would return true.
    Now, any UPDATE or DELETE to a record is considered a change, and will result in #previously_new_record?
    returning false.

    Adrianna Chang

  • Revert breaking changes to has_one relationship deleting the old record before the new one is validated.

    zzak

  • Fix support for Active Record instances being uses in queries.

    As of 7.0.5, query arguments were deep duped to avoid mutations impacting
    the query cache, but this had the adverse effect to clearing the primary key when
    the query argument contained an ActiveRecord::Base instance.

    This broke the noticed gem.

    Jean Boussier

Action View

  • Fix render collection: @&#8203;records, cache: true to cache fragments as bare strings

    Previously it would incorrectly cache them as Action View buffers.

    Jean Boussier

  • Don't double-encode nested field_id and field_name index values

    Pass index: @&#8203;options as a default keyword argument to field_id and
    field_name view helper methods.

    Sean Doyle

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • No changes.

Action Mailbox

  • No changes.

Action Text

  • No changes.

Railties

  • Update default scaffold templates to set 303 (See Other) as status code
    on redirect for the update action for XHR requests other than GET or POST
    to avoid issues (e.g browsers trying to follow the redirect using the
    original request method resulting in double PATCH/PUT)

    Guillermo Iguaran

v7.0.6: 7.0.6

Compare Source

Active Support

  • Fix EncryptedConfiguration returning incorrect values for some Hash
    methods

    Hartley McGuire

  • Fix arguments being destructed Enumerable#many? with block.

    Andrew Novoselac

  • Fix humanize for strings ending with id.

    fatkodima

Active Model

  • No changes.

Active Record

  • Fix autosave associations with validations added on :base of the associated objects.

    fatkodima

  • Fix result with anonymous PostgreSQL columns of different type from json.

    Oleksandr Avoiants

  • Preserve timestamp when setting an ActiveSupport::TimeWithZone value to timestamptz attribute.

    fatkodima

  • Fix where on association with has_one/has_many polymorphic relations.

    Before:

    Treasure.where(price_estimates: PriceEstimate.all)
#=> SELECT (...) WHERE "treasures"."id" IN (SELECT "price_estimates"."estimate_of_id" FROM "price_estimates")

    Later:

    Treasure.where(price_estimates: PriceEstimate.all)
#=> SELECT (...) WHERE "treasures"."id" IN (SELECT "price_estimates"."estimate_of_id" FROM "price_estimates" WHERE "price_estimates"."estimate_of_type" = 'Treasure')

    Lázaro Nixon

  • Fix decrementing counter caches on optimistically locked record deletion

    fatkodima

  • Ensure binary-destined values have binary encoding during type cast.

    Matthew Draper

  • Preserve existing column default functions when altering table in SQLite.

    fatkodima

  • Remove table alias added when using where.missing or where.associated.

    fatkodima

  • Fix Enumerable#in_order_of to only flatten first level to preserve nesting.

    Miha Rekar

Action View

  • No changes.

Action Pack

  • No changes.

Active Job

  • Fix error Active Job passed class with permitted?.

    Alex Baldwin

Action Mailer

  • No changes.

Action Cable

  • Fix Action Cable Redis configuration with sentinels.

    Dmitriy Ivliev

Active Storage

  • Fix retrieving rotation value from FFmpeg on version 5.0+.

    In FFmpeg version 5.0+ the rotation value has been removed from tags.
    Instead the value can be found in side_data_list. Along with
    this update it's possible to have values of -90, -270 to denote the video
    has been rotated.

    Haroon Ahmed

Action Mailbox

  • No changes.

Action Text

  • No changes.

Railties

  • Avoid escaping paths when editing credentials.

    Jonathan Hefner

v7.0.5.1

Compare Source

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • Raise an exception if illegal characters are provide to redirect_to
    [CVE-2023-28362]

    Zack Deveau

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • No changes.

Action Mailbox

  • No changes.

Action Text

  • No changes.

Railties

  • No changes.

v7.0.5

Compare Source

Active Support

  • Fixes TimeWithZone ArgumentError.

    Niklas Häusele

Active Model
  • No changes.
Active Record

  • Type cast #attribute_changed? :from and :to options.

    Andrew Novoselac

  • Fix index_exists? when column is an array.

    Eileen M. Uchitelle

  • Handle Date objects for PostgreSQL timestamptz columns.

    Alex Ghiculescu

  • Fix collation for changing column to non-string.

    Hartley McGuire

  • Map through subtype in PostgreSQL::OID::Array.

    Jonathan Hefner

  • Store correct environment in internal_metadata when run rails db:prepare.

    fatkodima

  • Make sure ActiveRecord::Relation#sum works with objects that implement #coerce without deprecation.

    Alex Ghiculescu

  • Fix retrieving foreign keys referencing tables named like keywords in PostgreSQL and MySQL.

    fatkodima

  • Support UUIDs in Disable Joins.

    Samuel Cochran

  • Fix Active Record's explain for queries starting with comments.

    fatkodima

  • Fix incorrectly preloading through association records when middle association has been loaded.

    Joshua Young

  • Fix where.missing and where.associated for parent/child associations.

    fatkodima

  • Fix Enumerable#in_order_of to preserve duplicates.

    fatkodima

  • Fix autoincrement on primary key for mysql.

    Eileen M. Uchitelle

  • Restore ability to redefine column in create_table for Rails 5.2 migrations.

    fatkodima

  • Fix schema cache dumping of virtual columns.

    fatkodima

  • Fix Active Record grouped calculations on joined tables on column present in both tables.

    fatkodima

  • Fix mutation detection for serialized attributes backed by binary columns.

    Jean Boussier

  • Fix a bug where using groups and counts with long table names would return incorrect results.

    Shota Toguchi, Yusaku Ono

  • Fix erroneous nil default precision on virtual datetime columns.

    Prior to this change, virtual datetime columns did not have the same
    default precision as regular datetime columns, resulting in the following
    being erroneously equivalent:

    t.virtual :name, type: datetime,                 as: "expression"
t.virtual :name, type: datetime, precision: nil, as: "expression"

    This change fixes the default precision lookup, so virtual and regular
    datetime column default precisions match.

    Sam Bostock

  • Fix a case where the query cache can return wrong values. See #​46044

    Aaron Patterson

Action View

  • FormBuilder#id finds id set by form_for and form_with.

    Matt Polito

  • Allow all available locales for template lookups.

    Ben Dilley

  • Choices of select can optionally contain html attributes as the last element
    of the child arrays when using grouped/nested collections

    <%= form.select :foo, [["North America", [["United States","US"],["Canada","CA"]], { disabled: "disabled" }]] %>
=> United StatesCanada
```

*Chris Gunther*
Action Pack

  • Do not return CSP headers for 304 Not Modified responses.

    Tobias Kraze

  • Fix EtagWithFlash when there is no Flash middleware available.

    fatkodima

  • Fix content-type header with send_stream.

    Elliot Crosby-McCullough

  • Address Selenium :capabilities deprecation warning.

    Ron Shinall

  • Fix cookie domain for domain: all on two letter single level TLD.

    John Hawthorn

  • Don't double log the controller, action, or namespaced_controller when using ActiveRecord::QueryLog

    Previously if you set config.active_record.query_log_tags to an array that included
    :controller, :namespaced_controller, or :action, that item would get logged twice.
    This bug has been fixed.

    Alex Ghiculescu

  • Rescue EOFError exception from rack on a multipart request.

    Nikita Vasilevsky

  • Rescue JSON::ParserError in Cookies json deserializer to discards marshal dumps:

    Without this change, if action_dispatch.cookies_serializer is set to :json and
    the app tries to read a :marshal serialized cookie, it would error out which wouldn't
    clear the cookie and force app users to manually clear it in their browser.

    (See #​45127 for original bug discussion)

    Nathan Bardoux

Active Job

  • Make delayed job display_name failsafe.

    codez

  • Don't double log the job when using ActiveRecord::QueryLog

    Previously if you set config.active_record.query_log_tags to an array that included
    :job, the job name would get logged twice. This bug has been fixed.

    Alex Ghiculescu

Action Mailer
  • No changes.
Action Cable

  • Restore Action Cable Redis pub/sub listener on connection failure.

    Vladimir Dementyev

Active Storage
  • No changes.
Action Mailbox
  • No changes.
Action Text

  • Fix ActionText::Attachable#as_json.

    Alexandre Ruban

Railties

  • Add puma app server to Gemfile in order to start test/dummy.

    Donapieppo

  • Rails console now disables IRB's autocompletion feature in production by default.

    Setting IRB_USE_AUTOCOMPLETE=true can override this default.

    Stan Lo

  • Send 303 See Other status code back for the destroy action on newly generated
    scaffold controllers.

    Tony Drake

v7.0.4.3

Compare Source

Active Support

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • Ignore certain data-* attributes in rails-ujs when element is contenteditable

    [CVE-2023-23913]

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • No changes.

Action Mailbox

  • No changes.

Action Text

  • No changes.

Railties

  • No changes.

v7.0.4.2

Compare Source

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • Fix domain: :all for two letter TLD

    This fixes a compatibility issue introduced in our previous security
    release when using domain: :all with a two letter but single level top
    level domain domain (like .ca, rather than .co.uk).

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • No changes.

Action Mailbox

  • No changes.

Action Text

  • No changes.

Railties

  • No changes.

v7.0.4.1

Compare Source

This is a security release. More information is available in our security announcements forum: https://discuss.rubyonrails.org/c/security-announcements/9

Active Support

Active Model

  • No changes.

Active Record

  • Make sanitize_as_sql_comment more strict

    Though this method was likely never meant to take user input, it was
    attempting sanitization. That sanitization could be bypassed with
    carefully crafted input.

    This commit makes the sanitization more robust by replacing any
    occurrances of "/" or "/" with "/ " or " /". It also performs a
    first pass to remove one surrounding comment to avoid compatibility
    issues for users relying on the existing removal.

    This also clarifies in the documentation of annotate that it should not
    be provided user input.

    [CVE-2023-22794]

  • Added integer width check to PostgreSQL::Quoting

    Given a value outside the range for a 64bit signed integer type
    PostgreSQL will treat the column type as numeric. Comparing
    integer values against numeric values can result in a slow
    sequential scan.

    This behavior is configurable via
    ActiveRecord::Base.raise_int_wider_than_64bit which defaults to true.

    [CVE-2022-44566]

Action View

  • No changes.

Action Pack

  • Fix sec issue with _url_host_allowed?

    Disallow certain strings from _url_host_allowed? to avoid a redirect
    to malicious sites.

    [CVE-2023-22797]

  • Avoid regex backtracking on If-None-Match header

    [CVE-2023-22795]

  • Use string#split instead of regex for domain parts

    [CVE-2023-22792]

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • No changes.

Action Mailbox

  • No changes.

Action Text

  • No changes.

Railties

  • No changes.

v7.0.4

Compare Source

Active Support

  • Redis cache store is now compatible with redis-rb 5.0.

    Jean Boussier

  • Fix NoMethodError on custom ActiveSupport::Deprecation behavior.

    ActiveSupport::Deprecation.behavior= was supposed to accept any object
    that responds to call, but in fact its internal implementation assumed that
    this object could respond to arity, so it was restricted to only Proc objects.

    This change removes this arity restriction of custom behaviors.

    Ryo Nakamura

Active Model

  • Handle name clashes in attribute methods code generation cache.

    When two distinct attribute methods would generate similar names,
    the first implementation would be incorrectly re-used.

    class A
  attribute_method_suffix "_changed?"
  define_attribute_methods :x
end

class B
  attribute_method_suffix "?"
  define_attribute_methods :x_changed
end

    Jean Boussier

Active Record

  • Symbol is allowed by default for YAML columns

    Étienne Barrié

  • Fix ActiveRecord::Store to serialize as a regular Hash

    Previously it would serialize as an ActiveSupport::HashWithIndifferentAccess
    which is wasteful and cause problem with YAML safe_load.

    Jean Boussier

  • Add timestamptz as a time zone aware type for PostgreSQL

    This is required for correctly parsing timestamp with time zone values in your database.

    If you don't want this, you can opt out by adding this initializer:

    ActiveRecord::Base.time_zone_aware_types -= [:timestamptz]

    Alex Ghiculescu

  • Fix supporting timezone awareness for tsrange and tstzrange array columns.

    

    • 



In database migrations


add_column :shops, :open_hours, :tsrange, array: true



In app config


ActiveRecord::Base.time_zone_aware_types += [:tsrange]



In the code times are properly converted to app time zone


Shop.create!(open_hours: [Time.current..8.hour.from_now])
```

*Wojciech Wnętrzak*



    

  • 

    Resolve issue where a relation cache_version could be left stale.
    

    Previously, when reset was called on a relation object it did not reset the cache_versions
    
ivar. This led to a confusing situation where despite having the correct data the relation
    
still reported a stale cache_version.
    

    Usage:
    

    developers = Developer.all
developers.cache_version

Developer.update_all(updated_at: Time.now.utc + 1.second)

developers.cache_version # Stale cache_version
developers.reset
developers.cache_version # Returns the current correct cache_version
    

    Fixes #​45341.
    

    Austen Madden
    

    • 

  • 

    Fix load_async when called on an association proxy.
    

    Calling load_async directly an association would schedule
    
a query but never use it.
    

    comments = post.comments.load_async # schedule a query
comments.to_a # perform an entirely new sync query
    

    Now it does use the async query, however note that it doesn't
    
cause the association to be loaded.
    

    Jean Boussier
    

    • 

  • 

    Fix eager loading for models without primary keys.
    

    Anmol Chopra, Matt Lawrence, and Jonathan Hefner
    

    • 

  • 

    rails db:schema:{dump,load} now checks ENV["SCHEMA_FORMAT"] before config
    

    Since rails db:structure:{dump,load} was deprecated there wasn't a simple
    
way to dump a schema to both SQL and Ruby formats. You can now do this with
    
an environment variable. For example:
    

    SCHEMA_FORMAT=sql rake db:schema:dump

    

    Alex Ghiculescu
    

    • 

  • 

    Fix Hstore deserialize regression.
    

    edsharp
    

    • 



Action View


    

  • 

    Guard against ActionView::Helpers::FormTagHelper#field_name calls with nil
    
object_name arguments. For example:
    

    <%= fields do |f| %>
  <%= f.field_name :body %>
<% end %>
    

    Sean Doyle
    

    • 

  • 

    Strings returned from strip_tags are correctly tagged html_safe?
    

    Because these strings contain no HTML elements and the basic entities are escaped, they are safe
    
to be included as-is as PCDATA in HTML content. Tagging them as html-safe avoids double-escaping
    
entities when being concatenated to a SafeBuffer during rendering.
    

    Fixes rails/rails-html-sanitizer#124
    

    Mike Dalessio
    

    • 



Action Pack


    

  • 

    Prevent ActionDispatch::ServerTiming from overwriting existing values in Server-Timing.
    

    Previously, if another middleware down the chain set Server-Timing header,
    
it would overwritten by ActionDispatch::ServerTiming.
    

    Jakub Malinowski
    

    • 



Active Job


    

  • 

    Update ActiveJob::QueueAdapters::QueAdapter to remove deprecation warning.
    

    Remove a deprecation warning introduced in que 1.2 to prepare for changes in
    
que 2.0 necessary for Ruby 3 compatibility.
    

    Damir Zekic and Adis Hasovic
    

    • 



Action Mailer


    

  • No changes.
    • 



Action Cable


    

  • 

    The Redis adapter is now compatible with redis-rb 5.0
    

    Compatibility with redis-rb 3.x was dropped.
    

    Jean Boussier
    

    • 

  • 

    The Action Cable server is now mounted with anchor: true.
    

    This means that routes that also start with /cable will no longer clash with Action Cable.
    

    Alex Ghiculescu
    

    • 



Active Storage


    

  • 

    Fixes proxy downloads of files over 5MiB
    

    Previously, trying to view and/or download files larger than 5mb stored in
    
services like S3 via proxy mode could return corrupted files at around
    
5.2mb or cause random halts in the download. Now,
    
ActiveStorage::Blobs::ProxyController correctly handles streaming these
    
larger files from the service to the client without any issues.
    

    Fixes #​44679
    

    Felipe Raul
    

    • 



Action Mailbox


    

  • No changes.
    • 



Action Text


    

  • No changes.
    • 



Railties


    

  • 

    config.allow_concurrency = false now use a Monitor instead of a Mutex
    

    This allows to enable config.active_support.executor_around_test_case even
    
when config.allow_concurrency is disabled.
    

    Jean Boussier
    

    • 

  • 

    Skip Active Storage and Action Mailer if Active Job is skipped.
    

    Étienne Barrié
    

    • 

  • 

    Correctly check if frameworks are disabled when running app:update.
    

    Étienne Barrié and Paulo Barros
    

    • 

  • 

    Fixed config.active_support.cache_format_version never being applied.
    

    Rails 7.0 shipped with a new serializer for Rails.cache, but the associated config
    
wasn't working properly. Note that even after this fix, it can only be applied from
    
the application.rb file.
    

    Alex Ghiculescu
    

    • 



v7.0.3.1: 7.0.3.1


Compare Source


Active Support


    

  • No changes.
    • 



Active Model


    

  • No changes.
    • 



Active Record


    

  • 

    Change ActiveRecord::Coders::YAMLColumn default to safe_load
    

    This adds two new configuration options The configuration options are as
    
follows:
    

      

    • config.active_storage.use_yaml_unsafe_load
      • 

    

    When set to true, this configuration option tells Rails to use the old
    
"unsafe" YAML loading strategy, maintaining the existing behavior but leaving
    
the possible escalation vulnerability in place.  Setting this option to true
    
is not recommended, but can aid in upgrading.
    

      

    • config.active_record.yaml_column_permitted_classes
      • 

    

    The "safe YAML" loading method does not allow all classes to be deserialized
    
by default.  This option allows you to specify classes deemed "safe" in your
    
application.  For example, if your application uses Symbol and Time in
    
serialized data, you can add Symbol and Time to the allowed list as follows:
    

    config.active_record.yaml_column_permitted_classes = [Symbol, Date, Time]

    

    [CVE-2022-32224]
    

    • 



Action View


    

  • No changes.
    • 



Action Pack


    

  • No changes.
    • 



Active Job


    

  • No changes.
    • 



Action Mailer


    

  • No changes.
    • 



Action Cable


    

  • No changes.
    • 



Active Storage


    

  • No changes.
    • 



Action Mailbox


    

  • No changes.
    • 



Action Text


    

  • No changes.
    • 



Railties


    

  • No changes.
    • 



v7.0.3: 7.0.3


Compare Source


Active Support


    

  • No changes.
    • 



Active Model


    

  • No changes.
    • 



Active Record


    

  • 

    Some internal housekeeping on reloads could break custom respond_to?
    
methods in class objects that referenced reloadable constants. See
    
#​44125 for details.
    

    Xavier Noria
    

    • 

  • 

    Fixed MariaDB default function support.
    

    Defaults would be written wrong in "db/schema.rb" and not work correctly
    
if using db:schema:load. Further more the function name would be
    
added as string content when saving new records.
    

    kaspernj
    

    • 

  • 

    Fix remove_foreign_key with :if_exists option when foreign key actually exists.
    

    fatkodima
    

    • 

  • 

    Remove --no-comments flag in structure dumps for PostgreSQL
    

    This broke some apps that used custom schema comments. If you don't want
    
comments in your structure dump, you can use:
    

    ActiveRecord::Tasks::DatabaseTasks.structure_dump_flags = ['--no-comments']
    

    Alex Ghiculescu
    

    • 

  • 

    Use the model name as a prefix when filtering encrypted attributes from logs.
    

    For example, when encrypting Person#name it will add person.name as a filter
    
parameter, instead of just name. This prevents unintended filtering of parameters
    
with a matching name in other models.
    

    Jorge Manrubia
    

    • 

  • 

    Fix quoting of ActiveSupport::Duration and Rational numbers in the MySQL adapter.
    

    Kevin McPhillips
    

    • 

  • 

    Fix change_column_comment to preserve column's AUTO_INCREMENT in the MySQL adapter
    

    fatkodima
    

    • 



Action View


    

  • 

    Ensure models passed to form_for attempt to call to_model.
    

    Sean Doyle
    

    • 



Action Pack


    

  • 

    Allow relative redirects when raise_on_open_redirects is enabled.
    

    Tom Hughes
    

    • 

  • 

    Fix authenticate_with_http_basic to allow for missing password.
    

    Before Rails 7.0 it was possible to handle basic authentication with only a username.
    

    authenticate_with_http_basic do |token, _|
  ApiClient.authenticate(token)
end
    

    This ability is restored.
    

    Jean Boussier
    

    • 

  • 

    Fix content_security_policy returning invalid directives.
    

    Directives such as self, unsafe-eval and few others were not
    
single quoted when the directive was the result of calling a lambda
    
returning an array.
    

    content_security_policy do |policy|
  policy.frame_ancestors lambda { [:self, "https://example.com"] }
end
    

    With this fix the policy generated from above will now be valid.
    

    Edouard Chin
    

    • 

  • 

    Fix skip_forgery_protection to run without raising an error if forgery
    
protection has not been enabled / verify_authenticity_token is not a
    
defined callback.
    

    This fix prevents the Rails 7.0 Welcome Page (/) from raising an
    
ArgumentError if default_protect_from_forgery is false.
    

    Brad Trick
    

    • 

  • 

    Fix ActionController::Live to copy the IsolatedExecutionState in the ephemeral thread.
    

    Since its inception ActionController::Live has been copying thread local variables
    
to keep things such as CurrentAttributes set from middlewares working in the controller action.
    

    With the introduction of IsolatedExecutionState in 7.0, some of that global state was lost in
    
ActionController::Live controllers.
    

    Jean Boussier
    

    • 

  • 

    Fix setting trailing_slash: true in route definition.
    

    get '/test' => "test#index", as: :test, trailing_slash: true

test_path() # => "/test/"
    

    Jean Boussier
    

    • 



Active Job


    

  • 

    Add missing bigdecimal require in ActiveJob::Arguments
    

    Could cause uninitialized constant ActiveJob::Arguments::BigDecimal (NameError)
    
when loading Active Job in isolation.
    

    Jean Boussier
    

    • 



Action Mailer


    

  • No changes.
    • 



Action Cable


    

  • No changes.
    • 



Active Storage


    

  • 

    Don't stream responses in redirect mode
    

    Previously, both redirect mode and proxy mode streamed their
    
responses which caused a new thread to be created, and could end
    
up leaking connections in the connection pool. But since redirect
    
mode doesn't actually send any data, it doesn't need to be
    
streamed.
    

    Luke Lau
    

    • 



Action Mailbox


    

  • No changes.
    • 



Action Text


    

  • No changes.
    • 



Railties


    

  • 

    If reloading and eager loading are both enabled, after a reload Rails eager loads again the application code.
    

    Xavier Noria
    

    • 

  • 

    Use controller_class_path in Rails::Generators::NamedBase#route_url
    

    The route_url method now returns the correct path when generating
    
a namespaced controller with a top-level model using --model-name.
    

    Previously, when running this command:
    

    bin/rails generate scaffold_controller Admin/Post --model-name Post
    

    the comments above the controller action would look like:
    

    

    • 



GET /posts


def index
  @&#8203;posts = Post.all
end
```

afterwards, they now look like this:

``` ruby



GET /admin/posts


def index
  @&#8203;posts = Post.all
end
```

Fixes #&#8203;44662.

*Andrew White*



v7.0.2.4


Compare Source


Active Support


    

  • 

    Fix and add protections for XSS in ActionView::Helpers and ERB::Util.
    

    Add the method ERB::Util.xml_name_escape to escape dangerous characters
    
in names of tags and names of attributes, following the specification of XML.
    

    Álvaro Martín Fraguas
    

    • 



Active Model


    

  • No changes.
    • 



Active Record


    

  • No changes.
    • 



Action View


    

  • 

    Fix and add protections for XSS in ActionView::Helpers and ERB::Util.
    

    Escape dangerous characters in names of tags and names of attributes in the
    
tag helpers, following the XML specification. Rename the option
    
:escape_attributes to :escape, to simplify by applying the option to the
    
whole tag.
    

    Álvaro Martín Fraguas
    

    • 



Action Pack


    

  • 

    Allow Content Security Policy DSL to generate for API responses.
    

    Tim Wade
    

    • 



Active Job


    

  • No changes.
    • 



Action Mailer


    

  • No changes.
    • 



Action Cable


    

  • No changes.
    • 



Active Storage


    

  • No changes.
    • 



Railties


    

  • No changes.
    • 



v7.0.2.3: 7.0.2.3


Compare Source


Active Support


    

  • No changes.
    • 



Active Model


    

  • No changes.
    • 



Active Record


    

  • No changes.
    • 



Action View


    

  • No changes.
    • 



Action Pack


    

  • No changes.
    • 



Active Job


    

  • No changes.
    • 



Action Mailer


    

  • No changes.
    • 



Action Cable


    

  • No changes.
    • 



Active Storage


    

  • 

    Added image transformation validation via configurable allow-list.
    

    Variant now offers a configurable allow-list for
    
transformation methods in addition to a configurable deny-list for arguments.
    

    [CVE-2022-21831]
    

    • 



Action Mailbox


    

  • No changes.
    • 



Action Text


    

  • No changes.
    • 



Railties


    

  • No changes.
    • 



v7.0.2.2: 7.0.2.2


Compare Source


Active Support


    

  • No changes.
    • 



Active Model


    

  • No changes.
    • 



Active Record


    

  • No changes.
    • 



Action View


    

  • No changes.
    • 



Action Pack


    

  • Fix Reloader method signature to work with the new Executor signature
    • 



Active Job


    

  • No changes.
    • 



Action Mailer


    

  • No changes.
    • 



Action Cable


    

  • No changes.
    • 



Active Storage


    

  • No changes.
    • 



Action Mailbox


    

  • No changes.
    • 



Action Text


    

  • No changes.
    • 



Railties


    

  • No changes.
    • 



v7.0.2.1: 7.0.2.1


Compare Source


Active Support


    

  • No changes.
    • 



Active Model


    

  • No changes.
    • 



Active Record


    

  • No changes.
    • 



Action View


    

  • No changes.
    • 



Action Pack


    

  • 

    Under certain circumstances, the middleware isn't informed that the
    
response body has been fully closed which result in request state not
    
being fully reset before the next request
    

    [CVE-2022-23633]
    

    • 



Active Job


    

  • No changes.
    • 



Action Mailer


    

  • No changes.
    • 



Action Cable


    

  • No changes.
    • 



Active Storage


    

  • No changes.
    • 



Action Mailbox


    

  • No changes.
    • 



Action Text


    

  • No changes.
    • 



Railties


    

  • No changes.
    • 



v7.0.2: 7.0.2


Compare Source


Active Support


    

  • 

    Fix ActiveSupport::EncryptedConfiguration to be compatible with Psych 4
    

    Stephen Sugden
    

    • 

  • 

    Improve File.atomic_write error handling.
    

    Daniel Pepper
    

    • 



Active Model


    

  • 

    Use different cache namespace for proxy calls
    

    Models can currently have different attribute bodies for the same method
    
names, leading to conflicts. Adding a new namespace :active_model_proxy
    
fixes the issue.
    

    Chris Salzberg
    

    • 



Active Record


    

  • 

    Fix PG.connect keyword arguments deprecation warning on ruby 2.7.
    

    Nikita Vasilevsky
    

    • 

  • 

    Fix the ability to exclude encryption params from being autofiltered.
    

    Mark Gangl
    

    • 

  • 

    Dump the precision for datetime columns following the new defaults.
    

    Rafael Mendonça França
    

    • 

  • 

    Make sure encrypted attributes are not being filtered twice.
    

    Nikita Vasilevsky
    

    • 

  • 

    Dump the database schema containing the current Rails version.
    

    Since https://github.com/rails/rails/pull/42297, Rails now generate datetime columns
    
with a default precision of 6. This means that users upgrading to Rails 7.0 from 6.1,
    
when loading the database schema, would get the new precision value, which would not match
    
the production schema.
    

    To avoid this the schema dumper will generate the new format which will include the Rails
    
version and will look like this:
    

    ActiveRecord::Schema[7.0].define

    

    When upgrading from Rails 6.1 to Rails 7.0, you can run the rails app:update task that will
    
set the current schema version to 6.1.
    

    Rafael Mendonça França
    

    • 

  • 

    Fix parsing expression for PostgreSQL generated column.
    

    fatkodima
    

    • 

  • 

    Fix Mysql2::Error: Commands out of sync; you can't run this command now
    
when bulk-inserting fixtures that exceed max_allowed_packet configuration.
    

    Nikita Vasilevsky
    

    • 

  • 

    Fix error when saving an association with a relation named record.
    

    Dorian Marié
    

    • 

  • 

    Fix MySQL::SchemaDumper behavior about datetime precision value.
    

    y0t4
    

    • 

  • 

    Improve associated with no reflection error.
    

    Nikolai
    

    • 

  • 

    Fix PG.connect keyword arguments deprecation warning on ruby 2.7.
    

    Fixes #​44307.
    

    Nikita Vasilevsky
    

    • 

  • 

    Fix passing options to check_constraint from change_table.
    

    Frederick Cheung
    

    • 



Action View


    

  • 

    Ensure preload_link_tag preloads JavaScript modules correctly.
    

    Máximo Mussini
    

    • 

  • 

    Fix stylesheet_link_tag and similar helpers are being used to work in objects with
    
a response method.
    

    dark-panda
    

    • 



Action Pack


    

  • No changes.
    • 



Active Job


    

  • No changes.
    • 



Action Mailer


    

  • No changes.
    • 



Action Cable


    

  • No changes.
    • 



Active Storage


    

  • 

    Revert the ability to pass service_name param to DirectUploadsController which was introduced
    
in 7.0.0.
    

    That change caused a lot of problems to upgrade Rails applications so we decided to remove it
    
while in work in a more backwards compatible implementation.
    

    Gannon McGibbon
    

    • 

  • 

    Allow applications to opt out of precompiling Active Storage JavaScript assets.
    

    jlestavel
    

    • 



Action Mailbox


    

  • No changes.
    • 



Action Text


    

  • No changes.
    • 



Railties


    

  • No changes.
    • 



v7.0.1: 7.0.1


Compare Source


Active Support



Active Model


    

  • No changes.
    • 



Active Record


    

  • 

    Change QueryMethods#in_order_of to drop records not listed in values.
    

    in_order_of now filters down to the values provided, to match the behavior of the Enumerable version.
    

    Kevin Newton
    

    • 

  • 

    Allow named expression indexes to be revertible.
    

    Previously, the following code would raise an error in a reversible migration executed while rolling back, due to the index name not being used in the index removal.
    

    add_index(:settings, "(data->'property')", using: :gin, name: :index_settings_data_property)
    

    Fixes #​43331.
    

    Oliver Günther
    

    • 

  • 

    Better error messages when association name is invalid in the argument of ActiveRecord::QueryMethods::WhereChain#missing.
    

    ykpythemind
    

    • 

  • 

    Fix ordered migrations for single db in multi db environment.
    

    Himanshu
    

    • 

  • 

    Extract on update CURRENT_TIMESTAMP for mysql2 adapter.
    

    Kazuhiro Masuda
    

    • 

  • 

    Fix incorrect argument in PostgreSQL structure dump tasks.
    

    Updating the --no-comment argument added in Rails 7 to the correct --no-comments argument.
    

    Alex Dent
    

    • 

  • 

    Fix schema dumping column default SQL values for sqlite3.
    

    fatkodima
    

    • 

  • 

    Correctly parse complex check constraint expressions for PostgreSQL.
    

    fatkodima
    

    • 

  • 

    Fix timestamptz attributes on PostgreSQL handle blank inputs.
    

    Alex Ghiculescu
    

    • 

  • 

    Fix migration compatibility to create SQLite references/belongs_to column as integer when migration version is 6.0.
    

    Reference/belongs_to in migrations with version 6.0 were creating columns as
    
bigint instead of integer for the SQLite Adapter.
    

    Marcelo Lauxen
    

    • 

  • 

    Fix joining through a polymorphic association.
    

    Alexandre Ruban
    

    • 

  • 

    Fix QueryMethods#in_order_of to handle empty order list.
    

    Post.in_order_of(:id, []).to_a
    

    Also more explicitly set the column as secondary order, so that any other
    
value is still ordered.
    

    Jean Boussier
    

    • 

  • 

    Fix rails dbconsole for 3-tier config.
    

    Eileen M. Uchitelle
    

    • 

  • 

    Fix quoting of column aliases generated by calculation methods.
    

    Since the alias is derived from the table name, we can't assume the result
    
is a valid identifier.
    

    class Test < ActiveRecord::Base
  self.table_name = '1abc'
end
Test.group(:id).count
    

    • 



syntax error at or near "1" (ActiveRecord::StatementInvalid)


LINE 1: SELECT COUNT(*) AS count_all, "1abc"."id" AS 1abc_id FROM "1...


```

*Jean Boussier*



Action View


    

  • 

    Fix button_to to work with a hash parameter as URL.
    

    MingyuanQin
    

    • 

  • 

    Fix link_to with a model passed as an argument twice.
    

    Alex Ghiculescu
    

    • 



Action Pack


    

  • 

    Fix ActionController::Parameters methods to keep the original logger context when creating a new copy
    
of the original object.
    

    Yutaka Kamei
    

    • 



Active Job


    

  • 

    Allow testing discard_on/retry_on ActiveJob::DeserializationError
    

    Previously in perform_enqueued_jobs, deserialize_arguments_if_needed
    
was called before calling perform_now. When a record no longer exists
    
and is serialized using GlobalID this led to raising
    
an ActiveJob::DeserializationError before reaching perform_now call.
    
This behaviour makes difficult testing the job discard_on/retry_on logic.
    

    Now deserialize_arguments_if_needed call is postponed to when perform_now
    
is called.
    

    Example:
    

    class UpdateUserJob < ActiveJob::Base
  discard_on ActiveJob::DeserializationError

  def perform(user)
    

    • 



...


  end
end



In the test


User.destroy_all
assert_nothing_raised do
  perform_enqueued_jobs only: UpdateUserJob
end
```

*Jacopo Beschi*



Action Mailer


    

  • 

    Keep configuration of smtp_settings consistent between 6.1 and 7.0.
    

    André Luis Leal Cardoso Junior
    

    • 



Action Cable


    

  • No changes.
    • 



Active Storage


    

  • No changes.
    • 



Action Mailbox


    

  • No changes.
    • 



Action Text


    

  • No changes.
    • 



Railties


    

  • 

    Prevent duplicate entries in plugin Gemfile.
    

    Jonathan Hefner
    

    • 

  • 

    Fix asset pipeline errors for plugin dummy apps.
    

    Jonathan Hefner
    

    • 

  • 

    Fix generated route revocation.
    

    Jonathan Hefner
    

    • 

  • 

    Addresses an issue in which Sidekiq jobs could not reload certain
    
namespaces.
    

    See fxn/zeitwerk#198 for
    
details.
    

    Xavier Noria
    

    • 

  • 

    Fix plugin generator to a plugin that pass all the tests.
    

    Rafael Mendonça França
    

    • 



v7.0.0: 7.0.0


Compare Source


Action Cable


    

  • 

    The Action Cable client now ensures successful channel subscriptions:
    

      

    • The client maintains a set of pending subscriptions until either
      
the server confirms the subscription or the channel is torn down.
      • 

    • Rectifies the race condition where an unsubscribe is rapidly followed
      
by a subscribe (on the same channel identifier) and the requests are
      
handled out of order by the ActionCable server, thereby ignoring the
      
subscribe command.
      • 

    

    Daniel Spinosa
    

    • 

  • 

    Compile ESM package that can be used directly in the browser as actioncable.esm.js.
    

    DHH
    

    • 

  • 

    Move action_cable.js to actioncable.js to match naming convention used for other Rails frameworks, and use JS console to communicate the deprecation.
    

    DHH
    

    • 

  • 

    Stop transpiling the UMD package generated as actioncable.js and drop the IE11 testing that relied on that.
    

    DHH
    

    • 

  • 

    Truncate broadcast logging messages.
    

    J Smith
    

    • 

  • 

    OpenSSL constants are now used for Digest computations.
    

    Dirkjan Bussink
    

    • 

  • 

    The Action Cable client now includes safeguards to prevent a "thundering
    
herd" of client reconnects after server connectivity loss:
    

      

    • The client will wait a random amount between 1x and 3x of the stale
      
threshold after the server's last ping before making the first
      
reconnection attempt.
      • 

    • Subsequent reconnection attempts now use exponential backoff instead of
      
logarithmic backoff.  To allow the delay between reconnection attempts to
      
increase slowly at first, the default exponentiation base is < 2.
      • 

    • Random jitter is applied to each delay between reconnection attempts.
      • 

    

    Jonathan Hefner
    

    • 



Action Mailbox


    

  • 

    Removed deprecated environment variable MAILGUN_INGRESS_API_KEY.
    

    Rafael Mendonça França
    

    • 

  • 

    Removed deprecated Rails.application.credentials.action_mailbox.mailgun_api_key.
    

    Rafael Mendonça França
    

    • 

  • 

    Add attachments to the list of permitted parameters for inbound emails conductor.
    

    When using the conductor to test inbound emails with attachments, this prevents an
    
unpermitted parameter warning in default configurations, and prevents errors for
    
applications that set:
    

    config.action_controller.action_on_unpermitted_parameters = :raise
    

    David Jones, Dana Henke
    

    • 

  • 

    Add ability to configure ActiveStorage service
    
for storing email raw source.
    

    

    • 



config/storage.yml


incoming_emails:
  service: Disk
  root: /secure/dir/for/emails/only
```

```ruby
config.action_mailbox.storage_service = :incoming_emails
```

*Yurii Rashkovskii*



    

  • 

    Add ability to incinerate an inbound message through the conductor interface.
    

    Santiago Bartesaghi
    

    • 

  • 

    OpenSSL constants are now used for Digest computations.
    

    Dirkjan Bussink
    

    • 



Action Mailer


    

  • 

    Remove deprecated ActionMailer::DeliveryJob and ActionMailer::Parameterized::DeliveryJob
    
in favor of ActionMailer::MailDeliveryJob.
    

    Rafael Mendonça França
    

    • 

  • 

    email_address_with_name returns just the address if name is blank.
    

    Thomas Hutterer
    

    • 

  • 

    Configures a default of 5 for both open_timeout and read_timeout for SMTP Settings.
    

    André Luis Leal Cardoso Junior
    

    • 



Action Pack


    

  • 

    Deprecate Rails.application.config.action_controller.urlsafe_csrf_tokens. This config is now always enabled.
    

    Étienne Barrié
    

    • 

  • 

    Instance variables set in requests in a ActionController::TestCase are now cleared before the next request
    

    This means if you make multiple requests in the same test, instance variables set in the first request will
    
not persist into the second one. (It's not recommended to make multiple requests in the same test.)
    

    Alex Ghiculescu
    

    • 

  • 

    Rails.application.executor hooks can now be called around every request in a ActionController::TestCase
    

    This helps to better simulate request or job local state being reset between requests and prevent state
    
leaking from one request to another.
    

    To enable this, set config.active_support.executor_around_test_case = true (this is the default in Rails 7).
    

    Alex Ghiculescu
    

    • 

  • 

    Consider onion services secure for cookies.
    

    Justin Tracey
    

    • 

  • 

    Remove deprecated Rails.config.action_view.raise_on_missing_translations.
    

    Rafael Mendonça França
    

    • 

  • 

    Remove deprecated support to passing a path to fixture_file_upload relative to fixture_path.
    

    Rafael Mendonça França
    

    • 

  • 

    Remove deprecated ActionDispatch::SystemTestCase#host!.
    

    Rafael Mendonça França
    

    • 

  • 

    Remove deprecated Rails.config.action_dispatch.hosts_response_app.
    

    Rafael Mendonça França
    

    • 

  • 

    Remove deprecated ActionDispatch::Response.return_only_media_type_on_content_type.
    

    Rafael Mendonça França
    

    • 

  • 

    Raise ActionController::Redirecting::UnsafeRedirectError for unsafe redirect_to redirects.
    

    This allows rescue_from to be used to add a default fallback route:
    

    rescue_from ActionController::Redirecting::UnsafeRedirectError do
  redirect_to root_url
end
    

    Kasper Timm Hansen, Chris Oliver
    

    • 

  • 

    Add url_from to verify a redirect location is internal.
    

    Takes the open redirect protection from redirect_to so users can wrap a
    
param, and fall back to an alternate redirect URL when the param provided
    
one is unsafe.
    

    def create
  redirect_to url_from(params[:redirect_url]) || root_url
end
    

    dmcge, Kasper Timm Hansen
    

    • 

  • 

    Allow Capybara driver name overrides in SystemTestCase::driven_by
    

    Allow users to prevent conflicts among drivers that use the same driver
    
type (selenium, poltergeist, webkit, rack test).
    

    Fixes #​42502
    

    Chris LaRose
    

    • 

  • 

    Allow multiline to be passed in routes when using wildcard segments.
    

    Previously routes with newlines weren't detected when using wildcard segments, returning
    
a No route matches error.
    
After this change, routes with newlines are detected on wildcard segments. Example
    

      draw do
    get "/wildcard/*wildcard_segment", to: SimpleApp.new("foo#index"), as: :wildcard
  end
    

    • 



After the change, the path matches.


  assert_equal "/wildcard/a%0Anewline", url_helpers.wildcard_path(wildcard_segment: "a\nnewline")
```

Fixes #&#8203;39103

*Ignacio Chiazzo*



    

  • 

    Treat html suffix in controller translation.
    

    Rui Onodera, Gavin Miller
    

    • 

  • 

    Allow permitting numeric params.
    

    Previously it was impossible to permit different fields on numeric parameters.
    
After this change you can specify different fields for each numbered parameter.
    
For example params like,
    

    book: {
        authors_attributes: {
          '0': { name: "William Shakespeare", age_of_death: "52" },
          '1': { name: "Unattributed Assistant" },
          '2': "Not a hash",
          'new_record': { name: "Some name" }
        }
      }
    

    Before you could permit name on each author with,
    
permit book: { authors_attributes: [ :name ] }
    

    After this change you can permit different keys on each numbered element,
    
permit book: { authors_attributes: { '1': [ :name ], '0': [ :name, :age_of_death ] } }
    

    Fixes #​41625
    

    Adam Hess
    

    • 

  • 

    Update HostAuthorization middleware to render debug info only
    
when config.consider_all_requests_local is set to true.
    

    Also, blocked host info is always logged with level error.
    

    Fixes #​42813
    

    Nikita Vyrko
    

    • 

  • 

    Add Server-Timing middleware
    

    Server-Timing specification defines how the server can communicate to browsers performance metrics
    
about the request it is responding to.
    

    The ServerTiming middleware is enabled by default on development environment by default using the
    
config.server_timing setting and set the relevant duration metrics in the Server-Timing header
    

    The full specification for Server-Timing header can be found in: https://www.w3.org/TR/server-timing/#dfn-server-timing-header-field
    

    Sebastian Sogamoso, Guillermo Iguaran
    

    • 

  • 

    Use a static error message when raising ActionDispatch::Http::Parameters::ParseError
    
to avoid inadvertently logging the HTTP request body at the fatal level when it contains
    
malformed JSON.
    

    Fixes #​41145
    

    Aaron Lahey
    

    • 

  • 

    Add Middleware#delete! to delete middleware or raise if not found.
    

    Middleware#delete! works just like Middleware#delete but will
    
raise an error if the middleware isn't found.
    

    Alex Ghiculescu, Petrik de Heus, Junichi Sato
    

    • 

  • 

    Raise error on unpermitted open redirects.
    

    Add allow_other_host options to redirect_to.
    
Opt in to this behaviour with ActionController::Base.raise_on_open_redirects = true.
    

    Gannon McGibbon
    

    • 

  • 

    Deprecate poltergeist and webkit (capybara-webkit) driver registration for system testing (they will be removed in Rails 7.1). Add cuprite instead.
    

    Poltergeist and capybara-webkit are already not maintained. These usage in Rails are removed for avoiding confusing users.
    

    Cuprite is a good alternative to Poltergeist. Some guide descriptions are replaced from Poltergeist to Cuprite.
    

    Yusuke Iwaki
    

    • 

  • 

    Exclude additional flash types from ActionController::Base.action_methods.
    

    Ensures that additional flash types defined on ActionController::Base subclasses
    
are not listed as actions on that controller.
    

    class MyController < ApplicationController
  add_flash_types :hype
end

MyController.action_methods.include?('hype') # => false

    

    Gavin Morrice
    

    • 

  • 

    OpenSSL constants are now used for Digest computations.
    

    Dirkjan Bussink
    

    • 

  • 

    Remove IE6-7-8 file download related hack/fix from ActionController::DataStreaming module.
    

    Due to the age of those versions of IE this fix is no longer relevant, more importantly it creates an edge-case for unexpected Cache-Control headers.
    

    Tadas Sasnauskas
    

    • 

  • 

    Configuration setting to skip logging an uncaught exception backtrace when the exception is
    
present in rescued_responses.
    

    It may be too noisy to get all backtraces logged for applications that manage uncaught
    
exceptions via rescued_responses and exceptions_app.
    
config.action_dispatch.log_rescued_responses (defaults to true) can be set to false in
    
this case, so that only exceptions not found in rescued_responses will be logged.
    

    Alexander Azarov, Mike Dalessio
    

    • 

  • 

    Ignore file fixtures on db:fixtures:load.
    

    Kevin Sjöberg
    

    • 

  • 

    Fix ActionController::Live controller test deadlocks by removing the body buffer size limit for tests.
    

    Dylan Thacker-Smith
    

    • 

  • 

    New ActionController::ConditionalGet#no_store method to set HTTP cache control no-store directive.
    

    Tadas Sasnauskas
    

    • 

  • 

    Drop support for the SERVER_ADDR header.
    

    Following up https://github.com/rack/rack/pull/1573 and https://github.com/rails/rails/pull/42349.
    

    Ricardo Díaz
    

    • 

  • 

    Set session options when initializing a basic session.
    

    Gannon McGibbon
    

    • 

  • 

    Add cache_control: {} option to fresh_when and stale?.
    

    Works as a shortcut to set response.cache_control with the above methods.
    

    Jacopo Beschi
    

    • 

  • 

    Writing into a disabled session will now raise an error.
    

    Previously when no session store was set, writing into the session would silently fail.
    

    Jean Boussier
    

    • 

  • 

    Add support for 'require-trusted-types-for' and 'trusted-types' headers.
    

    Fixes #​42034.
    

    lfalcao
    

    • 

  • 

    Remove inline styles and address basic accessibility issues on rescue templates.
    

    Jacob Herrington
    

    • 

  • 

    Add support fo
    

    • 







Configuration


📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).


🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.


♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.


🔕 Ignore: Close this PR and you won't be reminded about this update again.




    

  •  If you want to rebase/retry this PR, check this box
    • 





This PR has been generated by Mend Renovate. View repository job log here.


    

  
  



      


          

          
  

    
  
    
    

  

  




          

        
      




  





                  



      

  
          

  
  

  
      @renovate
  renovate
bot

        force-pushed
    the
        
      
  renovate/major-ruby-on-rails-packages


    
 branch
    from
    de1f01a    to
    cf0133d      
    Compare
  



    March 16, 2023 07:45    
    




  

  
  

  
      @renovate
  renovate
bot

        force-pushed
    the
        
      
  renovate/major-ruby-on-rails-packages


    
 branch
    from
    cf0133d    to
    b61a976      
    Compare
  



    May 28, 2023 19:54    
    




  

  
  

  
      @renovate
  renovate
bot

        force-pushed
    the
        
      
  renovate/major-ruby-on-rails-packages


    
 branch
    from
    b61a976    to
    90efaf3      
    Compare
  



    June 30, 2023 02:36    
    




  

  
  

  
      @renovate
  renovate
bot

        force-pushed
    the
        
      
  renovate/major-ruby-on-rails-packages


    
 branch
    from
    90efaf3    to
    9276cad      
    Compare
  



    August 10, 2023 05:29    
    









      

  
        





      

  
          

  
  

  
      @renovate
  renovate
bot

        force-pushed
    the
        
      
  renovate/major-ruby-on-rails-packages


    
 branch
    from
    9276cad    to
    d4bdd96      
    Compare
  



    September 13, 2023 02:46    
    













  
  

    

      

  




    


    

      

             

  
      Sign up for free
      to subscribe to this conversation on GitHub.
      Already have an account?
      Sign in.


  


      

    

  




  
    




      

  

    
    

    
  

    Reviewers
  


    

    No reviews






    

  


      
  

    Assignees
  



        

    No one assigned







      


  


  

    Labels
  



    

    None yet







      

  

    

        

    Projects
  


        




    None yet




  



      


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    
      

        
    

    Development
  



          


Successfully merging this pull request may close these issues.



  


    
  




      

    

  
      

  

    

      0 participants