Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(deps): update dependency @rails/ujs to v7 #20

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Apr 27, 2022

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@rails/ujs (source) ^6.1.7 -> ^7.0.4 age adoption passing confidence

Release Notes

rails/rails

v7.0.4

Compare Source

Active Support

  • Redis cache store is now compatible with redis-rb 5.0.

    Jean Boussier

  • Fix NoMethodError on custom ActiveSupport::Deprecation behavior.

    ActiveSupport::Deprecation.behavior= was supposed to accept any object
    that responds to call, but in fact its internal implementation assumed that
    this object could respond to arity, so it was restricted to only Proc objects.

    This change removes this arity restriction of custom behaviors.

    Ryo Nakamura

Active Model

  • Handle name clashes in attribute methods code generation cache.

    When two distinct attribute methods would generate similar names,
    the first implementation would be incorrectly re-used.

    class A
      attribute_method_suffix "_changed?"
      define_attribute_methods :x
    end
    
    class B
      attribute_method_suffix "?"
      define_attribute_methods :x_changed
    end

    Jean Boussier

Active Record

  • Symbol is allowed by default for YAML columns

    Étienne Barrié

  • Fix ActiveRecord::Store to serialize as a regular Hash

    Previously it would serialize as an ActiveSupport::HashWithIndifferentAccess
    which is wasteful and cause problem with YAML safe_load.

    Jean Boussier

  • Add timestamptz as a time zone aware type for PostgreSQL

    This is required for correctly parsing timestamp with time zone values in your database.

    If you don't want this, you can opt out by adding this initializer:

    ActiveRecord::Base.time_zone_aware_types -= [:timestamptz]

    Alex Ghiculescu

  • Fix supporting timezone awareness for tsrange and tstzrange array columns.

In database migrations

add_column :shops, :open_hours, :tsrange, array: true

In app config

ActiveRecord::Base.time_zone_aware_types += [:tsrange]

In the code times are properly converted to app time zone

Shop.create!(open_hours: [Time.current..8.hour.from_now])
```

*Wojciech Wnętrzak*
  • Resolve issue where a relation cache_version could be left stale.

    Previously, when reset was called on a relation object it did not reset the cache_versions
    ivar. This led to a confusing situation where despite having the correct data the relation
    still reported a stale cache_version.

    Usage:

    developers = Developer.all
    developers.cache_version
    
    Developer.update_all(updated_at: Time.now.utc + 1.second)
    
    developers.cache_version # Stale cache_version
    developers.reset
    developers.cache_version # Returns the current correct cache_version

    Fixes #​45341.

    Austen Madden

  • Fix load_async when called on an association proxy.

    Calling load_async directly an association would schedule
    a query but never use it.

    comments = post.comments.load_async # schedule a query
    comments.to_a # perform an entirely new sync query

    Now it does use the async query, however note that it doesn't
    cause the association to be loaded.

    Jean Boussier

  • Fix eager loading for models without primary keys.

    Anmol Chopra, Matt Lawrence, and Jonathan Hefner

  • rails db:schema:{dump,load} now checks ENV["SCHEMA_FORMAT"] before config

    Since rails db:structure:{dump,load} was deprecated there wasn't a simple
    way to dump a schema to both SQL and Ruby formats. You can now do this with
    an environment variable. For example:

    SCHEMA_FORMAT=sql rake db:schema:dump
    

    Alex Ghiculescu

  • Fix Hstore deserialize regression.

    edsharp

Action View

  • Guard against ActionView::Helpers::FormTagHelper#field_name calls with nil
    object_name arguments. For example:

    <%= fields do |f| %>
      <%= f.field_name :body %>
    <% end %>

    Sean Doyle

  • Strings returned from strip_tags are correctly tagged html_safe?

    Because these strings contain no HTML elements and the basic entities are escaped, they are safe
    to be included as-is as PCDATA in HTML content. Tagging them as html-safe avoids double-escaping
    entities when being concatenated to a SafeBuffer during rendering.

    Fixes rails/rails-html-sanitizer#​124

    Mike Dalessio

Action Pack

  • Prevent ActionDispatch::ServerTiming from overwriting existing values in Server-Timing.

    Previously, if another middleware down the chain set Server-Timing header,
    it would overwritten by ActionDispatch::ServerTiming.

    Jakub Malinowski

Active Job

  • Update ActiveJob::QueueAdapters::QueAdapter to remove deprecation warning.

    Remove a deprecation warning introduced in que 1.2 to prepare for changes in
    que 2.0 necessary for Ruby 3 compatibility.

    Damir Zekic and Adis Hasovic

Action Mailer

  • No changes.

Action Cable

  • The Redis adapter is now compatible with redis-rb 5.0

    Compatibility with redis-rb 3.x was dropped.

    Jean Boussier

  • The Action Cable server is now mounted with anchor: true.

    This means that routes that also start with /cable will no longer clash with Action Cable.

    Alex Ghiculescu

Active Storage

  • Fixes proxy downloads of files over 5MiB

    Previously, trying to view and/or download files larger than 5mb stored in
    services like S3 via proxy mode could return corrupted files at around
    5.2mb or cause random halts in the download. Now,
    ActiveStorage::Blobs::ProxyController correctly handles streaming these
    larger files from the service to the client without any issues.

    Fixes #​44679

    Felipe Raul

Action Mailbox

  • No changes.

Action Text

  • No changes.

Railties

  • config.allow_concurrency = false now use a Monitor instead of a Mutex

    This allows to enable config.active_support.executor_around_test_case even
    when config.allow_concurrency is disabled.

    Jean Boussier

  • Skip Active Storage and Action Mailer if Active Job is skipped.

    Étienne Barrié

  • Correctly check if frameworks are disabled when running app:update.

    Étienne Barrié and Paulo Barros

  • Fixed config.active_support.cache_format_version never being applied.

    Rails 7.0 shipped with a new serializer for Rails.cache, but the associated config
    wasn't working properly. Note that even after this fix, it can only be applied from
    the application.rb file.

    Alex Ghiculescu

v7.0.3: 7.0.3

Compare Source

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • Some internal housekeeping on reloads could break custom respond_to?
    methods in class objects that referenced reloadable constants. See
    #​44125 for details.

    Xavier Noria

  • Fixed MariaDB default function support.

    Defaults would be written wrong in "db/schema.rb" and not work correctly
    if using db:schema:load. Further more the function name would be
    added as string content when saving new records.

    kaspernj

  • Fix remove_foreign_key with :if_exists option when foreign key actually exists.

    fatkodima

  • Remove --no-comments flag in structure dumps for PostgreSQL

    This broke some apps that used custom schema comments. If you don't want
    comments in your structure dump, you can use:

    ActiveRecord::Tasks::DatabaseTasks.structure_dump_flags = ['--no-comments']

    Alex Ghiculescu

  • Use the model name as a prefix when filtering encrypted attributes from logs.

    For example, when encrypting Person#name it will add person.name as a filter
    parameter, instead of just name. This prevents unintended filtering of parameters
    with a matching name in other models.

    Jorge Manrubia

  • Fix quoting of ActiveSupport::Duration and Rational numbers in the MySQL adapter.

    Kevin McPhillips

  • Fix change_column_comment to preserve column's AUTO_INCREMENT in the MySQL adapter

    fatkodima

Action View

  • Ensure models passed to form_for attempt to call to_model.

    Sean Doyle

Action Pack

  • Allow relative redirects when raise_on_open_redirects is enabled.

    Tom Hughes

  • Fix authenticate_with_http_basic to allow for missing password.

    Before Rails 7.0 it was possible to handle basic authentication with only a username.

    authenticate_with_http_basic do |token, _|
      ApiClient.authenticate(token)
    end

    This ability is restored.

    Jean Boussier

  • Fix content_security_policy returning invalid directives.

    Directives such as self, unsafe-eval and few others were not
    single quoted when the directive was the result of calling a lambda
    returning an array.

    content_security_policy do |policy|
      policy.frame_ancestors lambda { [:self, "https://example.com"] }
    end

    With this fix the policy generated from above will now be valid.

    Edouard Chin

  • Fix skip_forgery_protection to run without raising an error if forgery
    protection has not been enabled / verify_authenticity_token is not a
    defined callback.

    This fix prevents the Rails 7.0 Welcome Page (/) from raising an
    ArgumentError if default_protect_from_forgery is false.

    Brad Trick

  • Fix ActionController::Live to copy the IsolatedExecutionState in the ephemeral thread.

    Since its inception ActionController::Live has been copying thread local variables
    to keep things such as CurrentAttributes set from middlewares working in the controller action.

    With the introduction of IsolatedExecutionState in 7.0, some of that global state was lost in
    ActionController::Live controllers.

    Jean Boussier

  • Fix setting trailing_slash: true in route definition.

    get '/test' => "test#index", as: :test, trailing_slash: true
    
    test_path() # => "/test/"

    Jean Boussier

Active Job

  • Add missing bigdecimal require in ActiveJob::Arguments

    Could cause uninitialized constant ActiveJob::Arguments::BigDecimal (NameError)
    when loading Active Job in isolation.

    Jean Boussier

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • Don't stream responses in redirect mode

    Previously, both redirect mode and proxy mode streamed their
    responses which caused a new thread to be created, and could end
    up leaking connections in the connection pool. But since redirect
    mode doesn't actually send any data, it doesn't need to be
    streamed.

    Luke Lau

Action Mailbox

  • No changes.

Action Text

  • No changes.

Railties

  • If reloading and eager loading are both enabled, after a reload Rails eager loads again the application code.

    Xavier Noria

  • Use controller_class_path in Rails::Generators::NamedBase#route_url

    The route_url method now returns the correct path when generating
    a namespaced controller with a top-level model using --model-name.

    Previously, when running this command:

    bin/rails generate scaffold_controller Admin/Post --model-name Post

    the comments above the controller action would look like:

GET /posts

def index
  @&#8203;posts = Post.all
end
```

afterwards, they now look like this:

``` ruby

GET /admin/posts

def index
  @&#8203;posts = Post.all
end
```

Fixes #&#8203;44662.

*Andrew White*

v7.0.2: 7.0.2

Compare Source

Active Support

  • Fix ActiveSupport::EncryptedConfiguration to be compatible with Psych 4

    Stephen Sugden

  • Improve File.atomic_write error handling.

    Daniel Pepper

Active Model

  • Use different cache namespace for proxy calls

    Models can currently have different attribute bodies for the same method
    names, leading to conflicts. Adding a new namespace :active_model_proxy
    fixes the issue.

    Chris Salzberg

Active Record

  • Fix PG.connect keyword arguments deprecation warning on ruby 2.7.

    Nikita Vasilevsky

  • Fix the ability to exclude encryption params from being autofiltered.

    Mark Gangl

  • Dump the precision for datetime columns following the new defaults.

    Rafael Mendonça França

  • Make sure encrypted attributes are not being filtered twice.

    Nikita Vasilevsky

  • Dump the database schema containing the current Rails version.

    Since https://github.com/rails/rails/pull/42297, Rails now generate datetime columns
    with a default precision of 6. This means that users upgrading to Rails 7.0 from 6.1,
    when loading the database schema, would get the new precision value, which would not match
    the production schema.

    To avoid this the schema dumper will generate the new format which will include the Rails
    version and will look like this:

    ActiveRecord::Schema[7.0].define
    

    When upgrading from Rails 6.1 to Rails 7.0, you can run the rails app:update task that will
    set the current schema version to 6.1.

    Rafael Mendonça França

  • Fix parsing expression for PostgreSQL generated column.

    fatkodima

  • Fix Mysql2::Error: Commands out of sync; you can't run this command now
    when bulk-inserting fixtures that exceed max_allowed_packet configuration.

    Nikita Vasilevsky

  • Fix error when saving an association with a relation named record.

    Dorian Marié

  • Fix MySQL::SchemaDumper behavior about datetime precision value.

    y0t4

  • Improve associated with no reflection error.

    Nikolai

  • Fix PG.connect keyword arguments deprecation warning on ruby 2.7.

    Fixes #​44307.

    Nikita Vasilevsky

  • Fix passing options to check_constraint from change_table.

    Frederick Cheung

Action View

  • Ensure preload_link_tag preloads JavaScript modules correctly.

    Máximo Mussini

  • Fix stylesheet_link_tag and similar helpers are being used to work in objects with
    a response method.

    dark-panda

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • Revert the ability to pass service_name param to DirectUploadsController which was introduced
    in 7.0.0.

    That change caused a lot of problems to upgrade Rails applications so we decided to remove it
    while in work in a more backwards compatible implementation.

    Gannon McGibbon

  • Allow applications to opt out of precompiling Active Storage JavaScript assets.

    jlestavel

Action Mailbox

  • No changes.

Action Text

  • No changes.

Railties

  • No changes.

v7.0.1: 7.0.1

Compare Source

Active Support

Active Model

  • No changes.

Active Record

  • Change QueryMethods#in_order_of to drop records not listed in values.

    in_order_of now filters down to the values provided, to match the behavior of the Enumerable version.

    Kevin Newton

  • Allow named expression indexes to be revertible.

    Previously, the following code would raise an error in a reversible migration executed while rolling back, due to the index name not being used in the index removal.

    add_index(:settings, "(data->'property')", using: :gin, name: :index_settings_data_property)

    Fixes #​43331.

    Oliver Günther

  • Better error messages when association name is invalid in the argument of ActiveRecord::QueryMethods::WhereChain#missing.

    ykpythemind

  • Fix ordered migrations for single db in multi db environment.

    Himanshu

  • Extract on update CURRENT_TIMESTAMP for mysql2 adapter.

    Kazuhiro Masuda

  • Fix incorrect argument in PostgreSQL structure dump tasks.

    Updating the --no-comment argument added in Rails 7 to the correct --no-comments argument.

    Alex Dent

  • Fix schema dumping column default SQL values for sqlite3.

    fatkodima

  • Correctly parse complex check constraint expressions for PostgreSQL.

    fatkodima

  • Fix timestamptz attributes on PostgreSQL handle blank inputs.

    Alex Ghiculescu

  • Fix migration compatibility to create SQLite references/belongs_to column as integer when migration version is 6.0.

    Reference/belongs_to in migrations with version 6.0 were creating columns as
    bigint instead of integer for the SQLite Adapter.

    Marcelo Lauxen

  • Fix joining through a polymorphic association.

    Alexandre Ruban

  • Fix QueryMethods#in_order_of to handle empty order list.

    Post.in_order_of(:id, []).to_a

    Also more explicitly set the column as secondary order, so that any other
    value is still ordered.

    Jean Boussier

  • Fix rails dbconsole for 3-tier config.

    Eileen M. Uchitelle

  • Fix quoting of column aliases generated by calculation methods.

    Since the alias is derived from the table name, we can't assume the result
    is a valid identifier.

    class Test < ActiveRecord::Base
      self.table_name = '1abc'
    end
    Test.group(:id).count

syntax error at or near "1" (ActiveRecord::StatementInvalid)

LINE 1: SELECT COUNT(*) AS count_all, "1abc"."id" AS 1abc_id FROM "1...

```

*Jean Boussier*

Action View

  • Fix button_to to work with a hash parameter as URL.

    MingyuanQin

  • Fix link_to with a model passed as an argument twice.

    Alex Ghiculescu

Action Pack

  • Fix ActionController::Parameters methods to keep the original logger context when creating a new copy
    of the original object.

    Yutaka Kamei

Active Job

  • Allow testing discard_on/retry_on ActiveJob::DeserializationError

    Previously in perform_enqueued_jobs, deserialize_arguments_if_needed
    was called before calling perform_now. When a record no longer exists
    and is serialized using GlobalID this led to raising
    an ActiveJob::DeserializationError before reaching perform_now call.
    This behaviour makes difficult testing the job discard_on/retry_on logic.

    Now deserialize_arguments_if_needed call is postponed to when perform_now
    is called.

    Example:

    class UpdateUserJob < ActiveJob::Base
      discard_on ActiveJob::DeserializationError
    
      def perform(user)

...

  end
end

In the test

User.destroy_all
assert_nothing_raised do
  perform_enqueued_jobs only: UpdateUserJob
end
```

*Jacopo Beschi*

Action Mailer

  • Keep configuration of smtp_settings consistent between 6.1 and 7.0.

    André Luis Leal Cardoso Junior

Action Cable

  • No changes.

Active Storage

  • No changes.

Action Mailbox

  • No changes.

Action Text

  • No changes.

Railties

  • Prevent duplicate entries in plugin Gemfile.

    Jonathan Hefner

  • Fix asset pipeline errors for plugin dummy apps.

    Jonathan Hefner

  • Fix generated route revocation.

    Jonathan Hefner

  • Addresses an issue in which Sidekiq jobs could not reload certain
    namespaces.

    See fxn/zeitwerk#​198 for
    details.

    Xavier Noria

  • Fix plugin generator to a plugin that pass all the tests.

    Rafael Mendonça França

v7.0.0: 7.0.0

Compare Source

Action Cable

  • The Action Cable client now ensures successful channel subscriptions:

    • The client maintains a set of pending subscriptions until either
      the server confirms the subscription or the channel is torn down.
    • Rectifies the race condition where an unsubscribe is rapidly followed
      by a subscribe (on the same channel identifier) and the requests are
      handled out of order by the ActionCable server, thereby ignoring the
      subscribe command.

    Daniel Spinosa

  • Compile ESM package that can be used directly in the browser as actioncable.esm.js.

    DHH

  • Move action_cable.js to actioncable.js to match naming convention used for other Rails frameworks, and use JS console to communicate the deprecation.

    DHH

  • Stop transpiling the UMD package generated as actioncable.js and drop the IE11 testing that relied on that.

    DHH

  • Truncate broadcast logging messages.

    J Smith

  • OpenSSL constants are now used for Digest computations.

    Dirkjan Bussink

  • The Action Cable client now includes safeguards to prevent a "thundering
    herd" of client reconnects after server connectivity loss:

    • The client will wait a random amount between 1x and 3x of the stale
      threshold after the server's last ping before making the first
      reconnection attempt.
    • Subsequent reconnection attempts now use exponential backoff instead of
      logarithmic backoff. To allow the delay between reconnection attempts to
      increase slowly at first, the default exponentiation base is < 2.
    • Random jitter is applied to each delay between reconnection attempts.

    Jonathan Hefner

Action Mailbox

  • Removed deprecated environment variable MAILGUN_INGRESS_API_KEY.

    Rafael Mendonça França

  • Removed deprecated Rails.application.credentials.action_mailbox.mailgun_api_key.

    Rafael Mendonça França

  • Add attachments to the list of permitted parameters for inbound emails conductor.

    When using the conductor to test inbound emails with attachments, this prevents an
    unpermitted parameter warning in default configurations, and prevents errors for
    applications that set:

    config.action_controller.action_on_unpermitted_parameters = :raise

    David Jones, Dana Henke

  • Add ability to configure ActiveStorage service
    for storing email raw source.

config/storage.yml

incoming_emails:
  service: Disk
  root: /secure/dir/for/emails/only
```

```ruby
config.action_mailbox.storage_service = :incoming_emails
```

*Yurii Rashkovskii*
  • Add ability to incinerate an inbound message through the conductor interface.

    Santiago Bartesaghi

  • OpenSSL constants are now used for Digest computations.

    Dirkjan Bussink

Action Mailer

  • Remove deprecated ActionMailer::DeliveryJob and ActionMailer::Parameterized::DeliveryJob
    in favor of ActionMailer::MailDeliveryJob.

    Rafael Mendonça França

  • email_address_with_name returns just the address if name is blank.

    Thomas Hutterer

  • Configures a default of 5 for both open_timeout and read_timeout for SMTP Settings.

    André Luis Leal Cardoso Junior

Action Pack

  • Deprecate Rails.application.config.action_controller.urlsafe_csrf_tokens. This config is now always enabled.

    Étienne Barrié

  • Instance variables set in requests in a ActionController::TestCase are now cleared before the next request

    This means if you make multiple requests in the same test, instance variables set in the first request will
    not persist into the second one. (It's not recommended to make multiple requests in the same test.)

    Alex Ghiculescu

  • Rails.application.executor hooks can now be called around every request in a ActionController::TestCase

    This helps to better simulate request or job local state being reset between requests and prevent state
    leaking from one request to another.

    To enable this, set config.active_support.executor_around_test_case = true (this is the default in Rails 7).

    Alex Ghiculescu

  • Consider onion services secure for cookies.

    Justin Tracey

  • Remove deprecated Rails.config.action_view.raise_on_missing_translations.

    Rafael Mendonça França

  • Remove deprecated support to passing a path to fixture_file_upload relative to fixture_path.

    Rafael Mendonça França

  • Remove deprecated ActionDispatch::SystemTestCase#host!.

    Rafael Mendonça França

  • Remove deprecated Rails.config.action_dispatch.hosts_response_app.

    Rafael Mendonça França

  • Remove deprecated ActionDispatch::Response.return_only_media_type_on_content_type.

    Rafael Mendonça França

  • Raise ActionController::Redirecting::UnsafeRedirectError for unsafe redirect_to redirects.

    This allows rescue_from to be used to add a default fallback route:

    rescue_from ActionController::Redirecting::UnsafeRedirectError do
      redirect_to root_url
    end

    Kasper Timm Hansen, Chris Oliver

  • Add url_from to verify a redirect location is internal.

    Takes the open redirect protection from redirect_to so users can wrap a
    param, and fall back to an alternate redirect URL when the param provided
    one is unsafe.

    def create
      redirect_to url_from(params[:redirect_url]) || root_url
    end

    dmcge, Kasper Timm Hansen

  • Allow Capybara driver name overrides in SystemTestCase::driven_by

    Allow users to prevent conflicts among drivers that use the same driver
    type (selenium, poltergeist, webkit, rack test).

    Fixes #​42502

    Chris LaRose

  • Allow multiline to be passed in routes when using wildcard segments.

    Previously routes with newlines weren't detected when using wildcard segments, returning
    a No route matches error.
    After this change, routes with newlines are detected on wildcard segments. Example

      draw do
        get "/wildcard/*wildcard_segment", to: SimpleApp.new("foo#index"), as: :wildcard
      end

After the change, the path matches.

  assert_equal "/wildcard/a%0Anewline", url_helpers.wildcard_path(wildcard_segment: "a\nnewline")
```

Fixes #&#8203;39103

*Ignacio Chiazzo*
  • Treat html suffix in controller translation.

    Rui Onodera, Gavin Miller

  • Allow permitting numeric params.

    Previously it was impossible to permit different fields on numeric parameters.
    After this change you can specify different fields for each numbered parameter.
    For example params like,

    book: {
            authors_attributes: {
              '0': { name: "William Shakespeare", age_of_death: "52" },
              '1': { name: "Unattributed Assistant" },
              '2': "Not a hash",
              'new_record': { name: "Some name" }
            }
          }

    Before you could permit name on each author with,
    permit book: { authors_attributes: [ :name ] }

    After this change you can permit different keys on each numbered element,
    permit book: { authors_attributes: { '1': [ :name ], '0': [ :name, :age_of_death ] } }

    Fixes #​41625

    Adam Hess

  • Update HostAuthorization middleware to render debug info only
    when config.consider_all_requests_local is set to true.

    Also, blocked host info is always logged with level error.

    Fixes #​42813

    Nikita Vyrko

  • Add Server-Timing middleware

    Server-Timing specification defines how the server can communicate to browsers performance metrics
    about the request it is responding to.

    The ServerTiming middleware is enabled by default on development environment by default using the
    config.server_timing setting and set the relevant duration metrics in the Server-Timing header

    The full specification for Server-Timing header can be found in: https://www.w3.org/TR/server-timing/#dfn-server-timing-header-field

    Sebastian Sogamoso, Guillermo Iguaran

  • Use a static error message when raising ActionDispatch::Http::Parameters::ParseError
    to avoid inadvertently logging the HTTP request body at the fatal level when it contains
    malformed JSON.

    Fixes #​41145

    Aaron Lahey

  • Add Middleware#delete! to delete middleware or raise if not found.

    Middleware#delete! works just like Middleware#delete but will
    raise an error if the middleware isn't found.

    Alex Ghiculescu, Petrik de Heus, Junichi Sato

  • Raise error on unpermitted open redirects.

    Add allow_other_host options to redirect_to.
    Opt in to this behaviour with ActionController::Base.raise_on_open_redirects = true.

    Gannon McGibbon

  • Deprecate poltergeist and webkit (capybara-webkit) driver registration for system testing (they will be removed in Rails 7.1). Add cuprite instead.

    Poltergeist and capybara-webkit are already not maintained. These usage in Rails are removed for avoiding confusing users.

    Cuprite is a good alternative to Poltergeist. Some guide descriptions are replaced from Poltergeist to Cuprite.

    Yusuke Iwaki

  • Exclude additional flash types from ActionController::Base.action_methods.

    Ensures that additional flash types defined on ActionController::Base subclasses
    are not listed as actions on that controller.

    class MyController < ApplicationController
      add_flash_types :hype
    end
    
    MyController.action_methods.include?('hype') # => false
    

    Gavin Morrice

  • OpenSSL constants are now used for Digest computations.

    Dirkjan Bussink

  • Remove IE6-7-8 file download related hack/fix from ActionController::DataStreaming module.

    Due to the age of those versions of IE this fix is no longer relevant, more importantly it creates an edge-case for unexpected Cache-Control headers.

    Tadas Sasnauskas

  • Configuration setting to skip logging an uncaught exception backtrace when the exception is
    present in rescued_responses.

    It may be too noisy to get all backtraces logged for applications that manage uncaught
    exceptions via rescued_responses and exceptions_app.
    config.action_dispatch.log_rescued_responses (defaults to true) can be set to false in
    this case, so that only exceptions not found in rescued_responses will be logged.

    Alexander Azarov, Mike Dalessio

  • Ignore file fixtures on db:fixtures:load.

    Kevin Sjöberg

  • Fix ActionController::Live controller test deadlocks by removing the body buffer size limit for tests.

    Dylan Thacker-Smith

  • New ActionController::ConditionalGet#no_store method to set HTTP cache control no-store directive.

    Tadas Sasnauskas

  • Drop support for the SERVER_ADDR header.

    Following up https://github.com/rack/rack/pull/1573 and https://github.com/rails/rails/pull/42349.

    Ricardo Díaz

  • Set session options when initializing a basic session.

    Gannon McGibbon

  • Add cache_control: {} option to fresh_when and stale?.

    Works as a shortcut to set response.cache_control with the above methods.

    Jacopo Beschi

  • Writing into a disabled session will now raise an error.

    Previously when no session store was set, writing into the session would silently fail.

    Jean Boussier

  • Add support for 'require-trusted-types-for' and 'trusted-types' headers.

    Fixes #​42034.

    lfalcao

  • Remove inline styles and address basic accessibility issues on rescue templates.

    Jacob Herrington

  • Add support for 'private, no-store' Cache-Control headers.

    Previously, 'no-store' was exclusive; no other directives could be specified.

    Alex Smith

  • Expand payload of unpermitted_parameters.action_controller instrumentation to allow subscribers to
    know which controller action received unpermitted parameters.

    bbuchalter

  • Add ActionController::Live#send_stream that makes it more convenient to send generated streams:

    send_stream(filename: "subscribers.csv") do |stream|
      stream.writeln "email_address,updated_at"
    
      @&#8203;subscribers.find_each do |subscriber|
        stream.writeln [ subscriber.email_address, subscriber.updated_at ].join(",")
      end
    end

    DHH

  • Add ActionController::Live::Buffer#writeln to write a line to the stream with a newline included.

    DHH

  • ActionDispatch::Request#content_type now returned Content-Type header as it is.

    Previously, ActionDispatch::Request#content_type returned value does NOT contain charset part.
    This behavior changed to returned Content-Type header containing charset part as it is.

    If you want just MIME type, please use ActionDispatch::Request#media_type instead.

    Before:

    request = ActionDispatch::Request.new("CONTENT_TYPE" => "text/csv; header=present; charset=utf-16", "REQUEST_METHOD" => "GET")
    request.content_type #=> "text/csv"

    After:

    request = ActionDispatch::Request.new("Content-Type" => "text/csv; header=present; charset=utf-16", "REQUEST_METHOD" => "GET")
    request.content_type #=> "text/csv; header=present; charset=utf-16"
    request.media_type   #=> "text/csv"

    Rafael Mendonça França

  • Change ActionDispatch::Request#media_type to return nil when the request don't have a Content-Type header.

    Rafael Mendonça França

  • Fix error in ActionController::LogSubscriber that would happen when throwing inside a controller action.

    Janko Marohnić

  • Allow anything with #to_str (like Addressable::URI) as a redirect_to location.

    ojab

  • Change the request method to a GET when passing failed requests down to config.exceptions_app.

    Alex Robbin

  • Deprecate the ability to assign a single value to config.action_dispatch.trusted_proxies
    as RemoteIp middleware behaves inconsistently depending on whether this is configured
    with a single value or an enumerable.

    Fixes #​40772.

    Christian Sutter

  • Add redirect_back_or_to(fallback_location, **) as a more aesthetically pleasing version of redirect_back fallback_location:, **.
    The old method name is retained without explicit deprecation.

    DHH

Action Text

  • Fix an issue with how nested lists were displayed when converting to plain text

    Matt Swanson

  • Allow passing in a custom direct_upload_url or blob_url_template to rich_text_area_tag.

    Lucas Mansur

  • Make the Action Text + Trix JavaScript and CSS available through the asset pipeline.

    DHH

  • OpenSSL constants are now used for Digest computations.

    Dirkjan Bussink

  • Add support for passing form: option to rich_text_area_tag and
    rich_text_area helpers to specify the <input type="hidden" form="...">
    value.

    Sean Doyle

  • Add config.action_text.attachment_tag_name, to specify the HTML tag that contains attachments.

    Mark VanLandingham

  • Expose how we render the HTML surrounding rich text content as an
    extensible layouts/action_view/contents/_content.html.erb template to
    encourage user-land customizations, while retaining private API control over how
    the rich text itself is rendered by action_text/contents/_content.html.erb
    partial.

    Sean Doyle

  • Add with_all_rich_text method to eager load all rich text associations on a model at once.

    Matt Swanson, DHH

Action View

  • Support include_hidden: option in calls to
    ActionView::Helper::FormBuilder#file_field with multiple: true to
    support submitting an empty collection of files.

    form.file_field :attachments, multiple: true

=>

     <input type="file" multiple="multiple" id="post_attachments" name="post[attachments][]">

form.file_field :attachments, multiple: true, include_hidden: false

=>

```

*Sean Doyle*
  • Fix number_with_precision(raise: true) always raising even on valid numbers.

    Pedro Moreira

  • Support fields model: [@&#8203;nested, @&#8203;model] the same way as form_with model: [@&#8203;nested, @&#8203;model].

    Sean Doyle

  • Infer HTTP verb [method] from a model or Array with model as the first
    argument to button_to when combined with a block:

    button_to(Workshop.find(1)){ "Update" }
    #=> <form method="post" action="/workshops/1" class="button_to">
    #=>   <input type="hidden" name="_method" value="patch" autocomplete="off" />
    #=>   <button type="submit">Update</button>
    #=> </form>
    
    button_to([ Workshop.find(1), Session.find(1) ]) { "Update" }
    #=> <form method="post" action="/workshops/1/sessions/1" class="button_to">
    #=>   <input type="hidden" name="_method" value="patch" autocomplete="off" />
    #=>   <button type="submit">Update</button>
    #=> </form>

    Sean Doyle

  • Support passing a Symbol as the first argument to FormBuilder#button:

    form.button(:draft, value: true)

=> Create post

form.button(:draft, value: true) do
  content_tag(:strong, "Save as draft")
end

=>

Save as draft

```

*Sean Doyle*
  • Introduce the field_name view helper, along with the
    FormBuilder#field_name counterpart:

    form_for @&#8203;post do |f|
      f.field_tag :tag, name: f.field_name(:tag, multiple: true)

=>

end
```

*Sean Doyle*
  • Execute the ActionView::Base.field_error_proc within the context of the
    ActionView::Base instance:

    config.action_view.field_error_proc = proc { |html| content_tag(:div, html, class: "field_with_errors") }

    Sean Doyle

  • Add support for button_to ..., authenticity_token: false

    button_to "Create", Post.new, authenticity_token: false

=> Create

button_to "Create", Post.new, authenticity_token: true

=> Create

button_to "Create", Post.new, authenticity_token: "secret"

=> Create

```

*Sean Doyle*
  • Support rendering <form> elements without [action] attributes by:

    • form_with url: false or form_with ..., html: { action: false }
    • form_for ..., url: false or form_for ..., html: { action: false }
    • form_tag false or form_tag ..., action: false
    • button_to "...", false or button_to(false) { ... }

    Sean Doyle

  • Add :day_format option to date_select

    date_select("article", "written_on", day_format: ->(day) { day.ordinalize })
    

generates day options like 1st\n2nd...

*Shunichi Ikegami*
  • Allow link_to helper to infer link name from Model#to_s when it
    is used with a single argument:

    link_to @&#8203;profile
    #=> <a href="/profiles/1">Eileen</a>
    

    This assumes the model class implements a to_s method like this:

    class Profile < ApplicationRecord
    

...

      def to_s
        name
      end
    end

Previously you had to supply a second argument even if the `Profile`
model implemented a `#to_s` method that called the `name` method.

    link_to @&#8203;profile, @&#8203;profile.name
    #=> <a href="/profiles/1">Eileen</a>

*Olivier Lacan*
  • Support svg unpaired tags for tag helper.

    tag.svg { tag.use('href' => "#cool-icon") }
    

=>

*Oleksii Vasyliev*
  • Improves the performance of ActionView::Helpers::NumberHelper formatters by avoiding the use of
    exceptions as flow control.

    Mike Dalessio

  • preload_link_tag properly inserts as attributes for files with image MIME types, such as JPG or SVG.

    Nate Berkopec

  • Add weekday_options_for_select and weekday_select helper methods. Also adds weekday_select to FormBuilder.

    Drew Bragg, Dana Kashubeck, Kasper Timm Hansen

  • Add caching? helper that returns whether the current code path is being cached and uncacheable! to denote helper methods that can't participate in fragment caching.

    Ben Toews, John Hawthorn, Kasper Timm Hansen, Joel Hawksley

  • Add include_seconds option for time_field.

    <%= form.time_field :foo, include_seconds: false %>
    

=>

Default includes seconds:

    <%= form.time_field :foo %>

=>

This allows you to take advantage of [different rendering options](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/time#time_value_format) in some browsers.

*Alex Ghiculescu*
  • Improve error messages when template file does not exist at absolute filepath.

    Ted Whang

  • Add :country_code option to sms_to for consistency with phone_to.

    Jonathan Hefner

  • OpenSSL constants are now used for Digest computations.

    Dirkjan Bussink

  • The translate helper now passes default values that aren't
    translation keys through I18n.translate for interpolation.

    Jonathan Hefner

  • Adds option extname to stylesheet_link_tag to skip default
    .css extension appended to the stylesheet path.

    Before:

    stylesheet_link_tag "style.less"

```

After:

```ruby
stylesheet_link_tag "style.less", extname: false, skip_pipeline: true, rel: "stylesheet/less"

```

*Abhay Nikam*
  • Deprecate render locals to be assigned to instance variables.

    Petrik de Heus

  • Remove legacy default media=screen from stylesheet_link_tag.

    André Luis Leal Cardoso Junior

  • Change ActionView::Helpers::FormBuilder#button to transform formmethod
    attributes into _method="$VERB" Form Data to enable varied same-form actions:

    <%= form_with model: post, method: :put do %>
      <%= form.button "Update" %>
      <%= form.button "Delete", formmethod: :delete %>
    <% end %>
    <%# => <form action="posts/1">
        =>   <input type="hidden" name="_method" value="put">
        =>   <button type="submit">Update</button>
        =>   <button type="submit" formmethod="post" name="_method" value="delete">Delete</button>
        => </form>
    %>
    

    Sean Doyle

  • Change ActionView::Helpers::UrlHelper#button_to to always render a
    <button> element, regardless of whether or not the content is passed as
    the first argument or as a block.

    <%= button_to "Delete", post_path(@&#8203;post), method: :delete %>
    

=> Delete

    <%= button_to post_path(@&#8203;post), method: :delete do %>
      Delete
    <% end %>

=> Delete

*Sean Doyle*, *Dusan Orlovic*
  • Add config.action_view.preload_links_header to allow disabling of
    the Link header being added by default when using stylesheet_link_tag
    and javascript_include_tag.

    Andrew White

  • The translate helper now resolves default values when a nil key is
    specified, instead of always returning nil.

    Jonathan Hefner

  • Add config.action_view.image_loading to configure the default value of
    the image_tag :loading option.

    By setting config.action_view.image_loading = "lazy", an application can opt in to
    lazy loading images sitewide, without changing view code.

    Jonathan Hefner

  • ActionView::Helpers::FormBuilder#id returns the value
    of the <form> element's id attribute. With a method argument, returns
    the id attribute for a form field with that name.

    <%= form_for @&#8203;post do |f| %>
      <%# ... %>
    
      <% content_for :sticky_footer do %>
        <%= form.button(form: f.id) %>
      <% end %>
    <% end %>
    

    Sean Doyle

  • ActionView::Helpers::FormBuilder#field_id returns the value generated by
    the FormBuilder for the given attribute name.

    <%= form_for @&#8203;post do |f| %>
      <%= f.label :title %>
      <%= f.text_field :title, aria: { describedby: f.field_id(:title, :error) } %>
      <%= tag.span("is blank", id: f.field_id(:title, :error) %>
    <% end %>
    

    Sean Doyle

  • Add tag.attributes to transform a Hash into HTML Attributes, ready to be
    interpolated into ERB.

    <input <%= tag.attributes(type: :text, aria: { label: "Search" }) %> >
    

=>

*Sean Doyle*

Active Job

  • Remove deprecated :return_false_on_aborted_enqueue option.

    Rafael Mendonça França

  • Deprecated Rails.config.active_job.skip_after_callbacks_if_terminated.

    Rafael Mendonça França

  • Removed deprecated behavior that was not halting after_enqueue/after_perform callbacks when a
    previous callback was halted with throw :abort.

    Rafael Mendonça França

  • Raise an SerializationError in Serializer::ModuleSerializer
    if the module name is not present.

    Veerpal Brar

  • Allow a job to retry indefinitely

    The attempts parameter of the retry_on method now accepts the
    symbol reference :unlimited in addition to a specific number of retry
    attempts to allow a developer to specify that a job should retry
    forever until it succeeds.

    class MyJob < ActiveJob::Base
      retry_on(AlwaysRetryException, attempts: :unlimited)
    

the actual job code

    end

*Daniel Morton*
  • Added possibility to check on :priority in test helper methods
    assert_enqueued_with and assert_performed_with.

    Wojciech Wnętrzak

  • OpenSSL constants are now used for Digest computations.

    Dirkjan Bussink

  • Add a Serializer for the Range class.

    This should allow things like MyJob.perform_later(range: 1..100).

  • Communicate enqueue failures to callers of perform_later.

    perform_later can now optionally take a block which will execute after
    the adapter attempts to enqueue the job. The block will receive the job
    instance as an argument even if the enqueue was not successful.
    Additionally, ActiveJob adapters now have the ability to raise an
    ActiveJob::EnqueueError which will be caught and stored in the job
    instance so code attempting to enqueue jobs can inspect any raised
    EnqueueError using the block.

    MyJob.perform_later do |job|
      unless job.successfully_enqueued?
        if job.enqueue_error&.message == "Redis was unavailable"
    

invoke some code that will retry the job after a delay

        end
      end
    end

*Daniel Morton*
  • Don't log rescuable exceptions defined with rescue_from.

    Hu Hailin

  • Allow rescue_from to rescue all exceptions.

    Adrianna Chang, Étienne Barrié

Active Model

  • Remove support to Marshal load Rails 5.x ActiveModel::AttributeSet format.

    Rafael Mendonça França

  • Remove support to Marshal and YAML load Rails 5.x error format.

    Rafael Mendonça França

  • Remove deprecated support to use []= in ActiveModel::Errors#messages.

    Rafael Mendonça França

  • Remove deprecated support to delete errors from ActiveModel::Errors#messages.

    Rafael Mendonça França

  • Remove deprecated support to clear errors from ActiveModel::Errors#messages.

    Rafael Mendonça França

  • Remove deprecated support concat errors to ActiveModel::Errors#messages.

    Rafael Mendonça França

  • Remove deprecated ActiveModel::Errors#to_xml.

    Rafael Mendonça França

  • Remove deprecated ActiveModel::Errors#keys.

    Rafael Mendonça França

  • Remove deprecated ActiveModel::Errors#values.

    Rafael Mendonça França

  • Remove deprecated ActiveModel::Errors#slice!.

    Rafael Mendonça França

  • Remove deprecated ActiveModel::Errors#to_h.

    Rafael Mendonça França

  • Remove deprecated enumeration of ActiveModel::Errors instances as a Hash.

    Rafael Mendonça França

  • Clear secure password cache if password is set to nil

    Before:

    user.password = 'something'
    user.password = nil

    user.password # => 'something'

    Now:

    user.password = 'something'
    user.password = nil

    user.password # => nil

    Markus Doits

  • Introduce ActiveModel::API.

    Make ActiveModel::API the minimum API to talk with Action Pack and Action View.
    This will allow adding more functionality to ActiveModel::Model.

    Petrik de Heus, Nathaniel Watts

  • Fix dirty check for Float::NaN and BigDecimal::NaN.

    Float::NaN and BigDecimal::NaN in Ruby are special values
    and can't be compared with ==.

    Marcelo Lauxen

  • Fix to_json for ActiveModel::Dirty object.

    Exclude mutations_from_database attribute from json as it lead to recursion.

    Anil Maurya

  • Add ActiveModel::AttributeSet#values_for_database.

    Returns attributes with values for assignment to the database.

    Chris Salzberg

  • Fix delegation in ActiveModel::Type::Registry#lookup and ActiveModel::Type.lookup.

    Passing a last positional argument {} would be incorrectly considered as keyword argument.

    Benoit Daloze

  • Cache and re-use generated attribute methods.

    Generated methods with identical implementations will now share their instruction sequences
    leading to reduced memory retention, and slightly faster load time.

    Jean Boussier

  • Add in: range parameter to numericality validator.

    Michal Papis

  • Add locale argument to ActiveModel::Name#initialize to be used to generate the singular,
    plural, route_key and singular_route_key values.

    Lukas Pokorny

  • Make ActiveModel::Errors#inspect slimmer for readability

    lulalala

Active Record

  • Better handle SQL queries with invalid encoding.

    Post.create(name: "broken \xC8 UTF-8")

    Would cause all adapters to fail in a non controlled way in the code
    responsible to detect write queries.

    The query is now properly passed to the database connection, which might or might
    not be able to handle it, but will either succeed or failed in a more correct way.

    Jean Boussier

  • Move database and shard selection config options to a generator.

    Rather than generating the config options in production.rb when applications are created, applications can now run a generator to create an initializer and uncomment / update options as needed. All multi-db configuration can be implemented in this initializer.

    Eileen M. Uchitelle

  • Remove deprecated ActiveRecord::DatabaseConfigurations::DatabaseConfig#spec_name.

    Rafael Mendonça França

  • Remove deprecated ActiveRecord::Connection#in_clause_length.

    Rafael Mendonça França

  • Remove deprecated ActiveRecord::Connection#allowed_index_name_length.

    Rafael Mendonça França

  • Remove deprecated ActiveRecord::Base#remove_connection.

    Rafael Mendonça França

  • Load STI Models in fixtures

    Data from Fixtures now loads based on the specific class for models with
    Single Table Inheritance. This affects enums defined in subclasses, previously
    the value of these fields was not parsed and remained nil

    Andres Howard

  • #authenticate returns false when the password is blank instead of raising an error.

    Muhammad Muhammad Ibrahim

  • Fix ActiveRecord::QueryMethods#in_order_of behavior for integer enums.

    ActiveRecord::QueryMethods#in_order_of didn't work as expected for enums stored as integers in the database when passing an array of strings or symbols as the order argument. This unexpected behavior occurred because the string or symbol values were not casted to match the integers in the database.

    The following example now works as expected:

    class Book < ApplicationRecord
      enum status: [:proposed, :written, :published]
    end
    
    Book.in_order_of(:status, %w[written published proposed])

    Alexandre Ruban

  • Ignore persisted in-memory records when merging target lists.

    Kevin Sjöberg

  • Add a new option :update_only to upsert_all to configure the list of columns to update in case of conflict.

    Before, you could only customize the update SQL sentence via :on_duplicate. There is now a new option :update_only that lets you provide a list of columns to update in case of conflict:

    Commodity.upsert_all(
      [
        { id: 2, name: "Copper", price: 4.84 },
        { id: 4, name: "Gold", price: 1380.87 },
        { id: 6, name: "Aluminium", price: 0.35 }
      ],
      update_only: [:price] # Only prices will be updated
    )

    Jorge Manrubia

  • Remove deprecated ActiveRecord::Result#map! and ActiveRecord::Result#collect!.

    Rafael Mendonça França

  • Remove deprecated ActiveRecord::Base.configurations.to_h.

    Rafael Mendonça França

  • Remove deprecated ActiveRecord::Base.configurations.default_hash.

    Rafael Mendonça França

  • Remove deprecated ActiveRecord::Base.arel_attribute.

    Rafael Mendonça França

  • Remove deprecated ActiveRecord::Base.connection_config.

    Rafael Mendonça França

  • Filter attributes in SQL logs

    Previously, SQL queries in logs containing ActiveRecord::Base.filter_attributes were not filtered.

    Now, the filter attributes will be masked [FILTERED] in the logs when prepared_statement is enabled.

Before:

  Foo Load (0.2ms)  SELECT "foos".* FROM "foos" WHERE "foos"."passw" = ? LIMIT ?  [["passw", "hello"], ["LIMIT", 1]]

After:

  Foo Load (0.5ms)  SELECT "foos".* FROM "foos" WHERE "foos"."passw" = ? LIMIT ?  [["passw", "[FILTERED]"], ["LIMIT", 1]]
```

*Aishwarya Subramanian*
  • Remove deprecated Tasks::DatabaseTasks.spec.

    Rafael Mendonça França

  • Remove deprecated Tasks::DatabaseTasks.current_config.

    Rafael Mendonça França

  • Deprecate Tasks::DatabaseTasks.schema_file_type.

    Rafael Mendonça França

  • Remove deprecated Tasks::DatabaseTasks.dump_filename.

    Rafael Mendonça França

  • Remove deprecated Tasks::DatabaseTasks.schema_file.

    Rafael Mendonça França

  • Remove deprecated environment and name arguments from Tasks::DatabaseTasks.schema_up_to_date?.

    Rafael Mendonça França

  • Merging conditions on the same column no longer maintain both conditions,
    and will be consistently replaced by the latter condition.

Rails 6.1 (IN clause is replaced by merger side equality condition)

Author.where(id: [david.id, mary.id]).merge(Author.where(id: bob)) # => [bob]

Rails 6.1 (both conflict conditions exists, deprecated)

Author.where(id: david.id..mary.id).merge(Author.where(id: bob)) # => []

Rails 6.1 with rewhere to migrate to Rails 7.0's behavior

Author.where(id: david.id..mary.id).merge(Author.where(id: bob), rewhere: true) # => [bob]

Rails 7.0 (same behavior with IN clause, mergee side condition is consistently replaced)

Author.where(id: [david.id, mary.id]).merge(Author.where(id: bob)) # => [bob]
Author.where(i

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

0 participants