actionpack 7.2.3.1 → 8.0.0.beta1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0f632afaf7276803c12ae1982dea2f181773d3cd0c8aece77746c30ab2fea034
-  data.tar.gz: '0850461c63c8f120819bd46ee69a293174ebd6eaa24d04553a02114978055c9c'
+  metadata.gz: 4392b60cf6c4af7ed943daf2c4e438440689b8f869a859510b1e0e5808204cf2
+  data.tar.gz: ee9993b25b397af527f1730dc439a0425a81d4b03afb148e310dac8862003261
 SHA512:
-  metadata.gz: 5bde81c0c852642c34f6b00e34b9d405c005cab6999939530204e015ac3c2c2f0dcecffc6318aa96278f0431f4e9ab9d680058c7276067404aea028a538298a6
-  data.tar.gz: c0dad94620adb34c30bb106d188bbb5a4b22883b05fc677f7d6ece653579cf8c92e15d42f8b4b9ef15f63512be0af30a22ee941ba600a0e68cc78265f9e48f45
+  metadata.gz: 2063ad6ca3243b066226af6a1d1ad616d808c48a18f80df374d02b064ad4839a971e4eff804321621d910111829b0c1130b5a05f5a44afabb380ec9f7d5985b7
+  data.tar.gz: f3f1e1ce84c47654f69cf3f3ada2afa48e412dac1b7a5abd10c4d0fc34b66b7574f2454410c323cfa26a000005da585815db8a27dc3f1e9c2a71a504b0f3021d

data/CHANGELOG.md

@@ -1,244 +1,135 @@
-## Rails 7.2.3.1 (March 23, 2026) ##
+## Rails 8.0.0.beta1 (September 26, 2024) ##
 
-*   No changes.
+*   Fix non-GET requests not updating cookies in `ActionController::TestCase`.
 
+    *Jon Moss*, *Hartley McGuire*
 
-## Rails 7.2.3 (October 28, 2025) ##
+*   Update `ActionController::Live` to use a thread-pool to reuse threads across requests.
 
-*   Submit test requests using `as: :html` with `Content-Type: x-www-form-urlencoded`
+    *Adam Renberg Tamm*
 
-    *Sean Doyle*
+*   Introduce safer, more explicit params handling method with `params#expect` such that
+    `params.expect(table: [ :attr ])` replaces `params.require(:table).permit(:attr)`
 
-*   Address `rack 3.2` deprecations warnings.
+    Ensures params are filtered with consideration for the expected
+    types of values, improving handling of params and avoiding ignorable
+    errors caused by params tampering.
 
+    ```ruby
+    # If the url is altered to ?person=hacked
+    # Before
+    params.require(:person).permit(:name, :age, pets: [:name])
+    # raises NoMethodError, causing a 500 and potential error reporting
+
+    # After
+    params.expect(person: [ :name, :age, pets: [[:name]] ])
+    # raises ActionController::ParameterMissing, correctly returning a 400 error
     ```
-    warning: Status code :unprocessable_entity is deprecated and will be removed in a future version of Rack.
-    Please use :unprocessable_content instead.
-    ```
-
-    Rails API will transparently convert one into the other for the forseable future.
 
-    *Earlopain*, *Jean Boussier*
+    You may also notice the new double array `[[:name]]`. In order to
+    declare when a param is expected to be an array of parameter hashes,
+    this new double array syntax is used to explicitly declare an array.
+    `expect` requires you to declare expected arrays in this way, and will
+    ignore arrays that are passed when, for example, `pet: [:name]` is used.
 
-*   Always return empty body for HEAD requests in `PublicExceptions` and
-    `DebugExceptions`.
+    In order to preserve compatibility, `permit` does not adopt the new
+    double array syntax and is therefore more permissive about unexpected
+    types. Using `expect` everywhere is recommended.
 
-    This is required by `Rack::Lint` (per RFC9110).
+    We suggest replacing `params.require(:person).permit(:name, :age)`
+    with the direct replacement `params.expect(person: [:name, :age])`
+    to prevent external users from manipulating params to trigger 500
+    errors. A 400 error will be returned instead, using public/400.html
 
-    *Hartley McGuire*
+    Usage of `params.require(:id)` should likewise be replaced with
+    `params.expect(:id)` which is designed to ensure that `params[:id]`
+    is a scalar and not an array or hash, also requiring the param.
 
-*   Fix `url_for` to handle `:path_params` gracefully when it's not a `Hash`.
+    ```ruby
+    # Before
+    User.find(params.require(:id)) # allows an array, altering behavior
 
-    Prevents various security scanners from causing exceptions.
+    # After
+    User.find(params.expect(:id)) # expect only returns non-blank permitted scalars (excludes Hash, Array, nil, "", etc)
+    ```
 
     *Martin Emde*
 
-*   Fix `ActionDispatch::Executor` to unwrap exceptions like other error reporting middlewares.
-
-    *Jean Boussier*
-
-*   Fix NoMethodError when a non-string CSRF token is passed through headers.
-
-    *Ryan Heneise*
+*   System Testing: Disable Chrome's search engine choice by default in system tests.
 
-*   Fix invalid response when rescuing `ActionController::Redirecting::UnsafeRedirectError` in a controller.
+    *glaszig*
 
-    *Alex Ghiculescu*
-
-
-## Rails 7.2.2.2 (August 13, 2025) ##
-
-*   No changes.
-
-
-## Rails 7.2.2.1 (December 10, 2024) ##
+*   Fix `Request#raw_post` raising `NoMethodError` when `rack.input` is `nil`.
 
-*   Add validation to content security policies to disallow spaces and semicolons.
-    Developers should use multiple arguments, and different directive methods instead.
+    *Hartley McGuire*
 
-    [CVE-2024-54133]
+*   Remove `racc` dependency by manually writing `ActionDispatch::Journey::Scanner`.
 
     *Gannon McGibbon*
 
+*   Speed up `ActionDispatch::Routing::Mapper::Scope#[]` by merging frame hashes.
 
-## Rails 7.2.2 (October 30, 2024) ##
-
-*   Fix non-GET requests not updating cookies in `ActionController::TestCase`.
-
-    *Jon Moss*, *Hartley McGuire*
-
-
-## Rails 7.2.1.2 (October 23, 2024) ##
-
-*   No changes.
-
-
-## Rails 7.2.1.1 (October 15, 2024) ##
-
-*   Avoid regex backtracking in HTTP Token authentication
-
-    [CVE-2024-47887]
-
-    *John Hawthorn*
-
-*   Avoid regex backtracking in query parameter filtering
-
-    [CVE-2024-41128]
-
-    *John Hawthorn*
-
-
-## Rails 7.2.1 (August 22, 2024) ##
-
-*   Fix `Request#raw_post` raising `NoMethodError` when `rack.input` is `nil`.
-
-    *Hartley McGuire*
-
-
-## Rails 7.2.0 (August 09, 2024) ##
+    *Gannon McGibbon*
 
 *   Allow bots to ignore `allow_browser`.
 
     *Matthew Nguyen*
 
-*   Include the HTTP Permissions-Policy on non-HTML Content-Types
-    [CVE-2024-28103]
-
-    *Aaron Patterson*, *Zack Deveau*
-
-*   Fix `Mime::Type.parse` handling type parameters for HTTP Accept headers.
-
-    *Taylor Chaparro*
-
-*   Fix the error page that is displayed when a view template is missing to account for nested controller paths in the
-    suggested correct location for the missing template.
-
-    *Joshua Young*
-
-*   Add `save_and_open_page` helper to `IntegrationTest`.
-
-    `save_and_open_page` is a helpful helper to keep a short feedback loop when working on system tests.
-    A similar helper with matching signature has been added to integration tests.
-
-    *Joé Dupuis*
-
-*   Fix a regression in 7.1.3 passing a `to:` option without a controller when the controller is already defined by a scope.
+*   Deprecate drawing routes with multiple paths to make routing faster.
+    You may use `with_options` or a loop to make drawing multiple paths easier.
 
     ```ruby
-    Rails.application.routes.draw do
-      controller :home do
-        get "recent", to: "recent_posts"
-      end
-    end
-    ```
+    # Before
+    get "/users", "/other_path", to: "users#index"
 
-    *Étienne Barrié*
-
-*   Request Forgery takes relative paths into account.
-
-    *Stefan Wienert*
-
-*   Add ".test" as a default allowed host in development to ensure smooth golden-path setup with puma.dev.
-
-    *DHH*
-
-*   Add `allow_browser` to set minimum browser versions for the application.
-
-    A browser that's blocked will by default be served the file in `public/406-unsupported-browser.html` with a HTTP status code of "406 Not Acceptable".
-
-    ```ruby
-    class ApplicationController < ActionController::Base
-      # Allow only browsers natively supporting webp images, web push, badges, import maps, CSS nesting + :has
-      allow_browser versions: :modern
-    end
-
-    class ApplicationController < ActionController::Base
-      # All versions of Chrome and Opera will be allowed, but no versions of "internet explorer" (ie). Safari needs to be 16.4+ and Firefox 121+.
-      allow_browser versions: { safari: 16.4, firefox: 121, ie: false }
-    end
-
-    class MessagesController < ApplicationController
-      # In addition to the browsers blocked by ApplicationController, also block Opera below 104 and Chrome below 119 for the show action.
-      allow_browser versions: { opera: 104, chrome: 119 }, only: :show
-    end
+    # After
+    get "/users", to: "users#index"
+    get "/other_path", to: "users#index"
     ```
 
-    *DHH*
-
-*   Add rate limiting API.
-
-    ```ruby
-    class SessionsController < ApplicationController
-      rate_limit to: 10, within: 3.minutes, only: :create
-    end
-
-    class SignupsController < ApplicationController
-      rate_limit to: 1000, within: 10.seconds,
-        by: -> { request.domain }, with: -> { redirect_to busy_controller_url, alert: "Too many signups!" }, only: :new
-    end
-    ```
-
-    *DHH*, *Jean Boussier*
-
-*   Add `image/svg+xml` to the compressible content types of `ActionDispatch::Static`.
-
-    *Georg Ledermann*
-
-*   Add instrumentation for `ActionController::Live#send_stream`.
-
-    Allows subscribing to `send_stream` events. The event payload contains the filename, disposition, and type.
-
-    *Hannah Ramadan*
-
-*   Add support for `with_routing` test helper in `ActionDispatch::IntegrationTest`.
-
     *Gannon McGibbon*
 
-*   Remove deprecated support to set `Rails.application.config.action_dispatch.show_exceptions` to `true` and `false`.
+*   Make `http_cache_forever` use `immutable: true`
 
-    *Rafael Mendonça França*
+    *Nate Matykiewicz*
 
-*   Remove deprecated `speaker`, `vibrate`, and `vr` permissions policy directives.
+*   Add `config.action_dispatch.strict_freshness`.
 
-    *Rafael Mendonça França*
+    When set to `true`, the `ETag` header takes precedence over the `Last-Modified` header when both are present,
+    as specified by RFC 7232, Section 6.
 
-*   Remove deprecated `Rails.application.config.action_dispatch.return_only_request_media_type_on_content_type`.
+    Defaults to `false` to maintain compatibility with previous versions of Rails, but is enabled as part of
+    Rails 8.0 defaults.
 
-    *Rafael Mendonça França*
+    *heka1024*
 
-*   Deprecate `Rails.application.config.action_controller.allow_deprecated_parameters_hash_equality`.
+*   Support `immutable` directive in Cache-Control
 
-    *Rafael Mendonça França*
-
-*   Remove deprecated comparison between `ActionController::Parameters` and `Hash`.
-
-    *Rafael Mendonça França*
-
-*   Remove deprecated constant `AbstractController::Helpers::MissingHelperError`.
-
-    *Rafael Mendonça França*
-
-*   Fix a race condition that could cause a `Text file busy - chromedriver`
-    error with parallel system tests.
+    ```ruby
+    expires_in 1.minute, public: true, immutable: true
+    # Cache-Control: public, max-age=60, immutable
+    ```
 
-    *Matt Brictson*
+    *heka1024*
 
-*   Add `racc` as a dependency since it will become a bundled gem in Ruby 3.4.0
+*   Add `:wasm_unsafe_eval` mapping for `content_security_policy`
 
-    *Hartley McGuire*
-*   Remove deprecated constant `ActionDispatch::IllegalStateError`.
+    ```ruby
+    # Before
+    policy.script_src "'wasm-unsafe-eval'"
 
-    *Rafael Mendonça França*
+    # After
+    policy.script_src :wasm_unsafe_eval
+    ```
 
-*   Add parameter filter capability for redirect locations.
+    *Joe Haig*
 
-    It uses the `config.filter_parameters` to match what needs to be filtered.
-    The result would be like this:
+*   Add `display_capture` and `keyboard_map` in `permissions_policy`
 
-        Redirected to http://secret.foo.bar?username=roque&password=[FILTERED]
+    *Cyril Blaecke*
 
-    Fixes #14055.
+*   Add `connect` route helper.
 
-    *Roque Pinel*, *Trevor Turk*, *tonytonyjan*
+    *Samuel Williams*
 
-Please check [7-1-stable](https://github.com/rails/rails/blob/7-1-stable/actionpack/CHANGELOG.md) for previous changes.
+Please check [7-2-stable](https://github.com/rails/rails/blob/7-2-stable/actionpack/CHANGELOG.md) for previous changes.

data/README.rdoc

@@ -52,6 +52,6 @@ Bug reports for the Ruby on \Rails project can be filed here:
 
 * https://github.com/rails/rails/issues
 
-Feature requests should be discussed on the rubyonrails-core forum here:
+Feature requests should be discussed on the rails-core mailing list here:
 
 * https://discuss.rubyonrails.org/c/rubyonrails-core

data/lib/abstract_controller/base.rb

@@ -86,10 +86,14 @@ module AbstractController
         controller.public_instance_methods(true) - methods
       end
 
-      # A `Set` of method names that should be considered actions. This includes all
+      # A list of method names that should be considered actions. This includes all
       # public instance methods on a controller, less any internal methods (see
       # internal_methods), adding back in any methods that are internal, but still
       # exist on the class itself.
+      #
+      # #### Returns
+      # *   `Set` - A set of all methods that should be considered actions.
+      #
       def action_methods
         @action_methods ||= begin
           # All public instance methods of this class, including ancestors except for
@@ -117,6 +121,9 @@ module AbstractController
       #
       #     MyApp::MyPostsController.controller_path # => "my_app/my_posts"
       #
+      # #### Returns
+      # *   `String`
+      #
       def controller_path
         @controller_path ||= name.delete_suffix("Controller").underscore unless anonymous?
       end
@@ -140,6 +147,10 @@ module AbstractController
     # The actual method that is called is determined by calling #method_for_action.
     # If no method can handle the action, then an AbstractController::ActionNotFound
     # error is raised.
+    #
+    # #### Returns
+    # *   `self`
+    #
     def process(action, ...)
       @_action_name = action.to_s
 

data/lib/abstract_controller/collector.rb

@@ -27,7 +27,7 @@ module AbstractController
     def method_missing(symbol, ...)
       unless mime_constant = Mime[symbol]
         raise NoMethodError, "To respond to a custom format, register it as a MIME type first: " \
-          "https://guides.rubyonrails.org/action_controller_advanced_topics.html#restful-downloads. " \
+          "https://guides.rubyonrails.org/action_controller_overview.html#restful-downloads. " \
           "If you meant to respond to a variant like :tablet or :phone, not a custom format, " \
           "be sure to nest your variant response within a format response: " \
           "format.html { |html| html.tablet { ... } }"

data/lib/abstract_controller/helpers.rb

@@ -90,7 +90,7 @@ module AbstractController
       #--
       # Implemented by Resolution#modules_for_helpers.
 
-      # :method: all_helpers_from_path
+      # :method: # all_helpers_from_path
       # :call-seq: all_helpers_from_path(path)
       #
       # Returns a list of helper names in a given path.
@@ -104,7 +104,6 @@ module AbstractController
       # Declare a controller method as a helper. For example, the following
       # makes the `current_user` and `logged_in?` controller methods available
       # to the view:
-      #
       #     class ApplicationController < ActionController::Base
       #       helper_method :current_user, :logged_in?
       #
@@ -119,7 +118,6 @@ module AbstractController
       #     end
       #
       # In a view:
-      #
       #     <% if logged_in? -%>Welcome, <%= current_user.name %><% end -%>
       #
       # #### Parameters

data/lib/action_controller/metal/allow_browser.rb

@@ -60,7 +60,7 @@ module ActionController # :nodoc:
         end
       end
 
-      class BrowserBlocker # :nodoc:
+      class BrowserBlocker
         SETS = {
           modern: { safari: 17.2, chrome: 120, firefox: 121, opera: 106, ie: false }
         }

data/lib/action_controller/metal/conditional_get.rb

@@ -259,6 +259,9 @@ module ActionController
     # `:stale_if_error`
     # :   Sets the value of the `stale-if-error` directive.
     #
+    # `:immutable`
+    # :   If true, adds the `immutable` directive.
+    #
     #
     # Any additional key-value pairs are concatenated as directives. For a list of
     # supported `Cache-Control` directives, see the [article on
@@ -292,6 +295,7 @@ module ActionController
         must_revalidate: options.delete(:must_revalidate),
         stale_while_revalidate: options.delete(:stale_while_revalidate),
         stale_if_error: options.delete(:stale_if_error),
+        immutable: options.delete(:immutable),
       )
       options.delete(:private)
 
@@ -315,7 +319,7 @@ module ActionController
     #     user's web browser. To allow proxies to cache the response, set `true` to
     #     indicate that they can serve the cached response to all users.
     def http_cache_forever(public: false)
-      expires_in 100.years, public: public
+      expires_in 100.years, public: public, immutable: true
 
       yield if stale?(etag: request.fullpath,
                       last_modified: Time.new(2011, 1, 1).utc,

data/lib/action_controller/metal/http_authentication.rb

@@ -513,11 +513,14 @@ module ActionController
         array_params.each { |param| (param[1] || +"").gsub! %r/^"|"$/, "" }
       end
 
+      WHITESPACED_AUTHN_PAIR_DELIMITERS = /\s*#{AUTHN_PAIR_DELIMITERS}\s*/
+      private_constant :WHITESPACED_AUTHN_PAIR_DELIMITERS
+
       # This method takes an authorization body and splits up the key-value pairs by
       # the standardized `:`, `;`, or `\t` delimiters defined in
       # `AUTHN_PAIR_DELIMITERS`.
       def raw_params(auth)
-        _raw_params = auth.sub(TOKEN_REGEX, "").split(AUTHN_PAIR_DELIMITERS).map(&:strip)
+        _raw_params = auth.sub(TOKEN_REGEX, "").split(WHITESPACED_AUTHN_PAIR_DELIMITERS)
         _raw_params.reject!(&:empty?)
 
         if !_raw_params.first&.start_with?(TOKEN_KEY)

data/lib/action_controller/metal/instrumentation.rb

@@ -2,7 +2,6 @@
 
 # :markup: markdown
 
-require "benchmark"
 require "abstract_controller/logger"
 
 module ActionController
@@ -29,7 +28,7 @@ module ActionController
     def render(*)
       render_output = nil
       self.view_runtime = cleanup_view_runtime do
-        Benchmark.ms { render_output = super }
+        ActiveSupport::Benchmark.realtime(:float_millisecond) { render_output = super }
       end
       render_output
     end

data/lib/action_controller/metal/live.rb

@@ -58,7 +58,7 @@ module ActionController
 
     module ClassMethods
       def make_response!(request)
-        if (request.get_header("SERVER_PROTOCOL") || request.get_header("HTTP_VERSION")) == "HTTP/1.0"
+        if request.get_header("HTTP_VERSION") == "HTTP/1.0"
           super
         else
           Live::Response.new.tap do |res|
@@ -307,6 +307,10 @@ module ActionController
               error = e
             end
           ensure
+            # Ensure we clean up any thread locals we copied so that the thread can reused.
+            ActiveSupport::IsolatedExecutionState.clear
+            locals.each { |k, _| t2[k] = nil }
+
             @_response.commit!
           end
         end
@@ -371,11 +375,15 @@ module ActionController
       # data from the response bodies. Nobody should call this method except in Rails
       # internals. Seriously!
       def new_controller_thread # :nodoc:
-        Thread.new {
+        ActionController::Live.live_thread_pool_executor.post do
           t2 = Thread.current
           t2.abort_on_exception = true
           yield
-        }
+        end
+      end
+
+      def self.live_thread_pool_executor
+        @live_thread_pool_executor ||= Concurrent::CachedThreadPool.new(name: "action_controller.live")
       end
 
       def log_error(exception)

data/lib/action_controller/metal/params_wrapper.rb

@@ -198,14 +198,14 @@ module ActionController
       #       # enables the parameter wrapper for XML format
       #
       #     wrap_parameters :person
-      #       # wraps parameters into params[:person] hash
+      #       # wraps parameters into +params[:person]+ hash
       #
       #     wrap_parameters Person
       #       # wraps parameters by determining the wrapper key from Person class
-      #       # (:person, in this case) and the list of attribute names
+      #       # (+person+, in this case) and the list of attribute names
       #
       #     wrap_parameters include: [:username, :title]
-      #       # wraps only :username and :title attributes from parameters.
+      #       # wraps only +:username+ and +:title+ attributes from parameters.
       #
       #     wrap_parameters false
       #       # disables parameters wrapping for this controller altogether.

data/lib/action_controller/metal/rate_limiting.rb

@@ -29,6 +29,9 @@ module ActionController # :nodoc:
       # datastore as your general caches, you can pass a custom store in the `store`
       # parameter.
       #
+      # If you want to use multiple rate limits per controller, you need to give each of
+      # them and explicit name via the `name:` option.
+      #
       # Examples:
       #
       #     class SessionsController < ApplicationController
@@ -44,14 +47,20 @@ module ActionController # :nodoc:
       #       RATE_LIMIT_STORE = ActiveSupport::Cache::RedisCacheStore.new(url: ENV["REDIS_URL"])
       #       rate_limit to: 10, within: 3.minutes, store: RATE_LIMIT_STORE
       #     end
-      def rate_limit(to:, within:, by: -> { request.remote_ip }, with: -> { head :too_many_requests }, store: cache_store, **options)
-        before_action -> { rate_limiting(to: to, within: within, by: by, with: with, store: store) }, **options
+      #
+      #     class SessionsController < ApplicationController
+      #       rate_limit to: 3, within: 2.seconds, name: "short-term"
+      #       rate_limit to: 10, within: 5.minutes, name: "long-term"
+      #     end
+      def rate_limit(to:, within:, by: -> { request.remote_ip }, with: -> { head :too_many_requests }, store: cache_store, name: nil, **options)
+        before_action -> { rate_limiting(to: to, within: within, by: by, with: with, store: store, name: name) }, **options
       end
     end
 
     private
-      def rate_limiting(to:, within:, by:, with:, store:)
-        count = store.increment("rate-limit:#{controller_path}:#{instance_exec(&by)}", 1, expires_in: within)
+      def rate_limiting(to:, within:, by:, with:, store:, name:)
+        cache_key = ["rate-limit", controller_path, name, instance_exec(&by)].compact.join(":")
+        count = store.increment(cache_key, 1, expires_in: within)
         if count && count > to
           ActiveSupport::Notifications.instrument("rate_limit.action_controller", request: request) do
             instance_exec(&with)

data/lib/action_controller/metal/redirecting.rb

@@ -106,14 +106,13 @@ module ActionController
 
       allow_other_host = response_options.delete(:allow_other_host) { _allow_other_host }
 
-      proposed_status = _extract_redirect_to_status(options, response_options)
+      self.status = _extract_redirect_to_status(options, response_options)
 
       redirect_to_location = _compute_redirect_to_location(request, options)
       _ensure_url_is_http_header_safe(redirect_to_location)
 
       self.location      = _enforce_open_redirect_protection(redirect_to_location, allow_other_host: allow_other_host)
       self.response_body = ""
-      self.status        = proposed_status
     end
 
     # Soft deprecated alias for #redirect_back_or_to where the `fallback_location`
@@ -212,9 +211,9 @@ module ActionController
 
       def _extract_redirect_to_status(options, response_options)
         if options.is_a?(Hash) && options.key?(:status)
-          ActionDispatch::Response.rack_status_code(options.delete(:status))
+          Rack::Utils.status_code(options.delete(:status))
         elsif response_options.key?(:status)
-          ActionDispatch::Response.rack_status_code(response_options[:status])
+          Rack::Utils.status_code(response_options[:status])
         else
           302
         end

data/lib/action_controller/metal/renderers.rb

@@ -154,7 +154,8 @@ module ActionController
     end
 
     add :json do |json, options|
-      json = json.to_json(options) unless json.kind_of?(String)
+      json_options = options.except(:callback, :content_type, :status)
+      json = json.to_json(json_options) unless json.kind_of?(String)
 
       if options[:callback].present?
         if media_type.nil? || media_type == Mime[:json]

data/lib/action_controller/metal/rendering.rb

@@ -232,7 +232,7 @@ module ActionController
         end
 
         if options[:status]
-          options[:status] = ActionDispatch::Response.rack_status_code(options[:status])
+          options[:status] = Rack::Utils.status_code(options[:status])
         end
 
         super

data/lib/action_controller/metal/request_forgery_protection.rb

@@ -142,7 +142,6 @@ module ActionController # :nodoc:
       #
       #
       # Built-in unverified request handling methods are:
-      #
       # *   `:exception` - Raises ActionController::InvalidAuthenticityToken
       #     exception.
       # *   `:reset_session` - Resets the session.
@@ -171,7 +170,6 @@ module ActionController # :nodoc:
       #
       #
       # Built-in session token strategies are:
-      #
       # *   `:session` - Store the CSRF token in the session.  Used as default if
       #     `:store` option is not specified.
       # *   `:cookie` - Store the CSRF token in an encrypted cookie.
@@ -500,7 +498,7 @@ module ActionController # :nodoc:
       # Checks the client's masked token to see if it matches the session token.
       # Essentially the inverse of `masked_authenticity_token`.
       def valid_authenticity_token?(session, encoded_masked_token) # :doc:
-        if !encoded_masked_token.is_a?(String) || encoded_masked_token.empty?
+        if encoded_masked_token.nil? || encoded_masked_token.empty? || !encoded_masked_token.is_a?(String)
           return false
         end