actionpack 7.2.3.1 → 8.0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0f632afaf7276803c12ae1982dea2f181773d3cd0c8aece77746c30ab2fea034
-  data.tar.gz: '0850461c63c8f120819bd46ee69a293174ebd6eaa24d04553a02114978055c9c'
+  metadata.gz: f4cafacead9b35453fc666d10a2485209e2b271f584b2b30aff8cc232ed99a92
+  data.tar.gz: 70fd43dc74a864660b401e580067fd5d0dfdb2fb56b446a10080dabd8a868903
 SHA512:
-  metadata.gz: 5bde81c0c852642c34f6b00e34b9d405c005cab6999939530204e015ac3c2c2f0dcecffc6318aa96278f0431f4e9ab9d680058c7276067404aea028a538298a6
-  data.tar.gz: c0dad94620adb34c30bb106d188bbb5a4b22883b05fc677f7d6ece653579cf8c92e15d42f8b4b9ef15f63512be0af30a22ee941ba600a0e68cc78265f9e48f45
+  metadata.gz: 9078e1c90c3e45687f8c1e0b815798259d414679c574eb6522e8bebda8faab18709642e29cf5a688e2601451804b116fab8039ee10bc27b2d46ff56a4ad45a5a
+  data.tar.gz: 96fb1152a53e8f172772f0d1be0fab5feb9a511a80d421f6a0c693a8628d157426dcf0152fefefc9f091b6bd3199fb9e4571d4e13fede9da7a9e30eaf17f7966

data/CHANGELOG.md

@@ -1,14 +1,59 @@
-## Rails 7.2.3.1 (March 23, 2026) ##
+## Rails 8.0.5.1 (July 29, 2026) ##
 
 *   No changes.
 
 
-## Rails 7.2.3 (October 28, 2025) ##
+## Rails 8.0.5 (March 24, 2026) ##
+
+*   Add `config.action_controller.live_streaming_excluded_keys` to control execution state sharing in ActionController::Live.
+
+    When using ActionController::Live, actions are executed in a separate thread that shares
+    state from the parent thread. This new configuration allows applications to opt-out specific
+    state keys that should not be shared.
+
+    This is useful when streaming inside a `connected_to` block, where you may want
+    the streaming thread to use its own database connection context.
+
+    ```ruby
+    # config/application.rb
+    config.action_controller.live_streaming_excluded_keys = [:active_record_connected_to_stack]
+    ```
+
+    By default, all keys are shared.
+
+    *Eileen M. Uchitelle*
+
+
+## Rails 8.0.4.1 (March 23, 2026) ##
+
+*   No changes.
+
+
+## Rails 8.0.4 (October 28, 2025) ##
 
 *   Submit test requests using `as: :html` with `Content-Type: x-www-form-urlencoded`
 
     *Sean Doyle*
 
+
+## Rails 8.0.3 (September 22, 2025) ##
+
+*   URL helpers for engines mounted at the application root handle `SCRIPT_NAME` correctly.
+
+    Fixed an issue where `SCRIPT_NAME` is not applied to paths generated for routes in an engine
+    mounted at "/".
+
+    *Mike Dalessio*
+
+*   Fix `Rails.application.reload_routes!` from clearing almost all routes.
+
+    When calling `Rails.application.reload_routes!` inside a middleware of
+    a Rake task, it was possible under certain conditions that all routes would be cleared.
+    If ran inside a middleware, this would result in getting a 404 on most page you visit.
+    This issue was only happening in development.
+
+    *Edouard Chin*
+
 *   Address `rack 3.2` deprecations warnings.
 
     ```
@@ -16,10 +61,14 @@
     Please use :unprocessable_content instead.
     ```
 
-    Rails API will transparently convert one into the other for the forseable future.
+    Rails API will transparently convert one into the other for the foreseeable future.
 
     *Earlopain*, *Jean Boussier*
 
+*   Support hash-source in Content Security Policy.
+
+    *madogiwa*
+
 *   Always return empty body for HEAD requests in `PublicExceptions` and
     `DebugExceptions`.
 
@@ -27,218 +76,248 @@
 
     *Hartley McGuire*
 
-*   Fix `url_for` to handle `:path_params` gracefully when it's not a `Hash`.
-
-    Prevents various security scanners from causing exceptions.
 
-    *Martin Emde*
+## Rails 8.0.2.1 (August 13, 2025) ##
 
-*   Fix `ActionDispatch::Executor` to unwrap exceptions like other error reporting middlewares.
+*   No changes.
 
-    *Jean Boussier*
+## Rails 8.0.2 (March 12, 2025) ##
 
-*   Fix NoMethodError when a non-string CSRF token is passed through headers.
+*   Improve `with_routing` test helper to not rebuild the middleware stack.
 
-    *Ryan Heneise*
+    Otherwise some middleware configuration could be lost.
 
-*   Fix invalid response when rescuing `ActionController::Redirecting::UnsafeRedirectError` in a controller.
+    *Édouard Chin*
 
-    *Alex Ghiculescu*
+*   Add resource name to the `ArgumentError` that's raised when invalid `:only` or `:except` options are given to `#resource` or `#resources`
 
+    This makes it easier to locate the source of the problem, especially for routes drawn by gems.
 
-## Rails 7.2.2.2 (August 13, 2025) ##
+    Before:
+    ```
+    :only and :except must include only [:index, :create, :new, :show, :update, :destroy, :edit], but also included [:foo, :bar]
+    ```
 
-*   No changes.
+    After:
+    ```
+    Route `resources :products` - :only and :except must include only [:index, :create, :new, :show, :update, :destroy, :edit], but also included [:foo, :bar]
+    ```
 
+    *Jeremy Green*
 
-## Rails 7.2.2.1 (December 10, 2024) ##
+*   Fix `url_for` to handle `:path_params` gracefully when it's not a `Hash`.
 
-*   Add validation to content security policies to disallow spaces and semicolons.
-    Developers should use multiple arguments, and different directive methods instead.
+    Prevents various security scanners from causing exceptions.
 
-    [CVE-2024-54133]
+    *Martin Emde*
 
-    *Gannon McGibbon*
+*   Fix `ActionDispatch::Executor` to unwrap exceptions like other error reporting middlewares.
 
+    *Jean Boussier*
 
-## Rails 7.2.2 (October 30, 2024) ##
 
-*   Fix non-GET requests not updating cookies in `ActionController::TestCase`.
+## Rails 8.0.1 (December 13, 2024) ##
 
-    *Jon Moss*, *Hartley McGuire*
+*   Add `ActionDispatch::Request::Session#store` method to conform Rack spec.
 
+    *Yaroslav*
 
-## Rails 7.2.1.2 (October 23, 2024) ##
 
-*   No changes.
+## Rails 8.0.0.1 (December 10, 2024) ##
 
+*   Add validation to content security policies to disallow spaces and semicolons.
+    Developers should use multiple arguments, and different directive methods instead.
 
-## Rails 7.2.1.1 (October 15, 2024) ##
+    [CVE-2024-54133]
 
-*   Avoid regex backtracking in HTTP Token authentication
+    *Gannon McGibbon*
 
-    [CVE-2024-47887]
 
-    *John Hawthorn*
+## Rails 8.0.0 (November 07, 2024) ##
 
-*   Avoid regex backtracking in query parameter filtering
+*   No changes.
 
-    [CVE-2024-41128]
 
-    *John Hawthorn*
+## Rails 8.0.0.rc2 (October 30, 2024) ##
 
+*   Fix routes with `::` in the path.
 
-## Rails 7.2.1 (August 22, 2024) ##
+    *Rafael Mendonça França*
 
-*   Fix `Request#raw_post` raising `NoMethodError` when `rack.input` is `nil`.
+*   Maintain Rack 2 parameter parsing behaviour.
 
-    *Hartley McGuire*
+    *Matthew Draper*
 
 
-## Rails 7.2.0 (August 09, 2024) ##
+## Rails 8.0.0.rc1 (October 19, 2024) ##
 
-*   Allow bots to ignore `allow_browser`.
+*   Remove `Rails.application.config.action_controller.allow_deprecated_parameters_hash_equality`.
 
-    *Matthew Nguyen*
+    *Rafael Mendonça França*
 
-*   Include the HTTP Permissions-Policy on non-HTML Content-Types
-    [CVE-2024-28103]
+*   Improve `ActionController::TestCase` to expose a binary encoded `request.body`.
 
-    *Aaron Patterson*, *Zack Deveau*
+    The rack spec clearly states:
 
-*   Fix `Mime::Type.parse` handling type parameters for HTTP Accept headers.
+    > The input stream is an IO-like object which contains the raw HTTP POST data.
+    > When applicable, its external encoding must be “ASCII-8BIT” and it must be opened in binary mode.
 
-    *Taylor Chaparro*
+    Until now its encoding was generally UTF-8, which doesn't accurately reflect production
+    behavior.
 
-*   Fix the error page that is displayed when a view template is missing to account for nested controller paths in the
-    suggested correct location for the missing template.
+    *Jean Boussier*
 
-    *Joshua Young*
+*   Update `ActionController::AllowBrowser` to support passing method names to `:block`
 
-*   Add `save_and_open_page` helper to `IntegrationTest`.
+    ```ruby
+    class ApplicationController < ActionController::Base
+      allow_browser versions: :modern, block: :handle_outdated_browser
 
-    `save_and_open_page` is a helpful helper to keep a short feedback loop when working on system tests.
-    A similar helper with matching signature has been added to integration tests.
+      private
+        def handle_outdated_browser
+          render file: Rails.root.join("public/custom-error.html"), status: :not_acceptable
+        end
+    end
+    ```
 
-    *Joé Dupuis*
+    *Sean Doyle*
 
-*   Fix a regression in 7.1.3 passing a `to:` option without a controller when the controller is already defined by a scope.
+*   Raise an `ArgumentError` when invalid `:only` or `:except` options are passed into `#resource` and `#resources`.
 
-    ```ruby
-    Rails.application.routes.draw do
-      controller :home do
-        get "recent", to: "recent_posts"
-      end
-    end
-    ```
+    *Joshua Young*
 
-    *Étienne Barrié*
+## Rails 8.0.0.beta1 (September 26, 2024) ##
 
-*   Request Forgery takes relative paths into account.
+*   Fix non-GET requests not updating cookies in `ActionController::TestCase`.
 
-    *Stefan Wienert*
+    *Jon Moss*, *Hartley McGuire*
 
-*   Add ".test" as a default allowed host in development to ensure smooth golden-path setup with puma.dev.
+*   Update `ActionController::Live` to use a thread-pool to reuse threads across requests.
 
-    *DHH*
+    *Adam Renberg Tamm*
 
-*   Add `allow_browser` to set minimum browser versions for the application.
+*   Introduce safer, more explicit params handling method with `params#expect` such that
+    `params.expect(table: [ :attr ])` replaces `params.require(:table).permit(:attr)`
 
-    A browser that's blocked will by default be served the file in `public/406-unsupported-browser.html` with a HTTP status code of "406 Not Acceptable".
+    Ensures params are filtered with consideration for the expected
+    types of values, improving handling of params and avoiding ignorable
+    errors caused by params tampering.
 
     ```ruby
-    class ApplicationController < ActionController::Base
-      # Allow only browsers natively supporting webp images, web push, badges, import maps, CSS nesting + :has
-      allow_browser versions: :modern
-    end
+    # If the url is altered to ?person=hacked
+    # Before
+    params.require(:person).permit(:name, :age, pets: [:name])
+    # raises NoMethodError, causing a 500 and potential error reporting
+
+    # After
+    params.expect(person: [ :name, :age, pets: [[:name]] ])
+    # raises ActionController::ParameterMissing, correctly returning a 400 error
+    ```
 
-    class ApplicationController < ActionController::Base
-      # All versions of Chrome and Opera will be allowed, but no versions of "internet explorer" (ie). Safari needs to be 16.4+ and Firefox 121+.
-      allow_browser versions: { safari: 16.4, firefox: 121, ie: false }
-    end
+    You may also notice the new double array `[[:name]]`. In order to
+    declare when a param is expected to be an array of parameter hashes,
+    this new double array syntax is used to explicitly declare an array.
+    `expect` requires you to declare expected arrays in this way, and will
+    ignore arrays that are passed when, for example, `pet: [:name]` is used.
 
-    class MessagesController < ApplicationController
-      # In addition to the browsers blocked by ApplicationController, also block Opera below 104 and Chrome below 119 for the show action.
-      allow_browser versions: { opera: 104, chrome: 119 }, only: :show
-    end
-    ```
+    In order to preserve compatibility, `permit` does not adopt the new
+    double array syntax and is therefore more permissive about unexpected
+    types. Using `expect` everywhere is recommended.
 
-    *DHH*
+    We suggest replacing `params.require(:person).permit(:name, :age)`
+    with the direct replacement `params.expect(person: [:name, :age])`
+    to prevent external users from manipulating params to trigger 500
+    errors. A 400 error will be returned instead, using public/400.html
 
-*   Add rate limiting API.
+    Usage of `params.require(:id)` should likewise be replaced with
+    `params.expect(:id)` which is designed to ensure that `params[:id]`
+    is a scalar and not an array or hash, also requiring the param.
 
     ```ruby
-    class SessionsController < ApplicationController
-      rate_limit to: 10, within: 3.minutes, only: :create
-    end
+    # Before
+    User.find(params.require(:id)) # allows an array, altering behavior
 
-    class SignupsController < ApplicationController
-      rate_limit to: 1000, within: 10.seconds,
-        by: -> { request.domain }, with: -> { redirect_to busy_controller_url, alert: "Too many signups!" }, only: :new
-    end
+    # After
+    User.find(params.expect(:id)) # expect only returns non-blank permitted scalars (excludes Hash, Array, nil, "", etc)
     ```
 
-    *DHH*, *Jean Boussier*
+    *Martin Emde*
 
-*   Add `image/svg+xml` to the compressible content types of `ActionDispatch::Static`.
+*   System Testing: Disable Chrome's search engine choice by default in system tests.
 
-    *Georg Ledermann*
+    *glaszig*
 
-*   Add instrumentation for `ActionController::Live#send_stream`.
+*   Fix `Request#raw_post` raising `NoMethodError` when `rack.input` is `nil`.
 
-    Allows subscribing to `send_stream` events. The event payload contains the filename, disposition, and type.
+    *Hartley McGuire*
 
-    *Hannah Ramadan*
+*   Remove `racc` dependency by manually writing `ActionDispatch::Journey::Scanner`.
 
-*   Add support for `with_routing` test helper in `ActionDispatch::IntegrationTest`.
+    *Gannon McGibbon*
+
+*   Speed up `ActionDispatch::Routing::Mapper::Scope#[]` by merging frame hashes.
 
     *Gannon McGibbon*
 
-*   Remove deprecated support to set `Rails.application.config.action_dispatch.show_exceptions` to `true` and `false`.
+*   Allow bots to ignore `allow_browser`.
 
-    *Rafael Mendonça França*
+    *Matthew Nguyen*
 
-*   Remove deprecated `speaker`, `vibrate`, and `vr` permissions policy directives.
+*   Deprecate drawing routes with multiple paths to make routing faster.
+    You may use `with_options` or a loop to make drawing multiple paths easier.
 
-    *Rafael Mendonça França*
+    ```ruby
+    # Before
+    get "/users", "/other_path", to: "users#index"
 
-*   Remove deprecated `Rails.application.config.action_dispatch.return_only_request_media_type_on_content_type`.
+    # After
+    get "/users", to: "users#index"
+    get "/other_path", to: "users#index"
+    ```
 
-    *Rafael Mendonça França*
+    *Gannon McGibbon*
 
-*   Deprecate `Rails.application.config.action_controller.allow_deprecated_parameters_hash_equality`.
+*   Make `http_cache_forever` use `immutable: true`
 
-    *Rafael Mendonça França*
+    *Nate Matykiewicz*
 
-*   Remove deprecated comparison between `ActionController::Parameters` and `Hash`.
+*   Add `config.action_dispatch.strict_freshness`.
 
-    *Rafael Mendonça França*
+    When set to `true`, the `ETag` header takes precedence over the `Last-Modified` header when both are present,
+    as specified by RFC 7232, Section 6.
 
-*   Remove deprecated constant `AbstractController::Helpers::MissingHelperError`.
+    Defaults to `false` to maintain compatibility with previous versions of Rails, but is enabled as part of
+    Rails 8.0 defaults.
 
-    *Rafael Mendonça França*
+    *heka1024*
 
-*   Fix a race condition that could cause a `Text file busy - chromedriver`
-    error with parallel system tests.
+*   Support `immutable` directive in Cache-Control
 
-    *Matt Brictson*
+    ```ruby
+    expires_in 1.minute, public: true, immutable: true
+    # Cache-Control: public, max-age=60, immutable
+    ```
 
-*   Add `racc` as a dependency since it will become a bundled gem in Ruby 3.4.0
+    *heka1024*
 
-    *Hartley McGuire*
-*   Remove deprecated constant `ActionDispatch::IllegalStateError`.
+*   Add `:wasm_unsafe_eval` mapping for `content_security_policy`
 
-    *Rafael Mendonça França*
+    ```ruby
+    # Before
+    policy.script_src "'wasm-unsafe-eval'"
+
+    # After
+    policy.script_src :wasm_unsafe_eval
+    ```
 
-*   Add parameter filter capability for redirect locations.
+    *Joe Haig*
 
-    It uses the `config.filter_parameters` to match what needs to be filtered.
-    The result would be like this:
+*   Add `display_capture` and `keyboard_map` in `permissions_policy`
 
-        Redirected to http://secret.foo.bar?username=roque&password=[FILTERED]
+    *Cyril Blaecke*
 
-    Fixes #14055.
+*   Add `connect` route helper.
 
-    *Roque Pinel*, *Trevor Turk*, *tonytonyjan*
+    *Samuel Williams*
 
-Please check [7-1-stable](https://github.com/rails/rails/blob/7-1-stable/actionpack/CHANGELOG.md) for previous changes.
+Please check [7-2-stable](https://github.com/rails/rails/blob/7-2-stable/actionpack/CHANGELOG.md) for previous changes.

data/lib/abstract_controller/rendering.rb

@@ -5,7 +5,6 @@
 require "abstract_controller/error"
 require "action_view"
 require "action_view/view_paths"
-require "set"
 
 module AbstractController
   class DoubleRenderError < Error

data/lib/action_controller/base.rb

@@ -266,7 +266,7 @@ module ActionController
       ParamsWrapper
     ]
 
-    # Note: Documenting these severely degrates the performance of rdoc
+    # Note: Documenting these severely degrades the performance of rdoc
     # :stopdoc:
     include AbstractController::Rendering
     include AbstractController::Translation

data/lib/action_controller/form_builder.rb

@@ -22,10 +22,10 @@ module ActionController
   #       default_form_builder AdminFormBuilder
   #     end
   #
-  # Then in the view any form using `form_for` will be an instance of the
-  # specified form builder:
+  # Then in the view any form using `form_with` or `form_for` will be an
+  # instance of the specified form builder:
   #
-  #     <%= form_for(@instance) do |builder| %>
+  #     <%= form_with(model: @instance) do |builder| %>
   #       <%= builder.special_field(:name) %>
   #     <% end %>
   module FormBuilder

data/lib/action_controller/metal/allow_browser.rb

@@ -36,6 +36,16 @@ module ActionController # :nodoc:
       #     end
       #
       #     class ApplicationController < ActionController::Base
+      #       # Allow only browsers natively supporting webp images, web push, badges, import maps, CSS nesting, and CSS :has
+      #       allow_browser versions: :modern, block: :handle_outdated_browser
+      #
+      #       private
+      #         def handle_outdated_browser
+      #           render file: Rails.root.join("public/custom-error.html"), status: :not_acceptable
+      #         end
+      #     end
+      #
+      #     class ApplicationController < ActionController::Base
       #       # All versions of Chrome and Opera will be allowed, but no versions of "internet explorer" (ie). Safari needs to be 16.4+ and Firefox 121+.
       #       allow_browser versions: { safari: 16.4, firefox: 121, ie: false }
       #     end
@@ -55,7 +65,7 @@ module ActionController # :nodoc:
 
         if BrowserBlocker.new(request, versions: versions).blocked?
           ActiveSupport::Notifications.instrument("browser_block.action_controller", request: request, versions: versions) do
-            instance_exec(&block)
+            block.is_a?(Symbol) ? send(block) : instance_exec(&block)
           end
         end
       end

data/lib/action_controller/metal/conditional_get.rb

@@ -259,6 +259,9 @@ module ActionController
     # `:stale_if_error`
     # :   Sets the value of the `stale-if-error` directive.
     #
+    # `:immutable`
+    # :   If true, adds the `immutable` directive.
+    #
     #
     # Any additional key-value pairs are concatenated as directives. For a list of
     # supported `Cache-Control` directives, see the [article on
@@ -292,6 +295,7 @@ module ActionController
         must_revalidate: options.delete(:must_revalidate),
         stale_while_revalidate: options.delete(:stale_while_revalidate),
         stale_if_error: options.delete(:stale_if_error),
+        immutable: options.delete(:immutable),
       )
       options.delete(:private)
 
@@ -315,7 +319,7 @@ module ActionController
     #     user's web browser. To allow proxies to cache the response, set `true` to
     #     indicate that they can serve the cached response to all users.
     def http_cache_forever(public: false)
-      expires_in 100.years, public: public
+      expires_in 100.years, public: public, immutable: true
 
       yield if stale?(etag: request.fullpath,
                       last_modified: Time.new(2011, 1, 1).utc,

data/lib/action_controller/metal/data_streaming.rb

@@ -28,7 +28,8 @@ module ActionController # :nodoc:
       # `send_file(params[:path])` allows a malicious user to download any file on
       # your server.
       #
-      # Options:
+      # #### Options:
+      #
       # *   `:filename` - suggests a filename for the browser to use. Defaults to
       #     `File.basename(path)`.
       # *   `:type` - specifies an HTTP content type. You can specify either a string
@@ -90,7 +91,8 @@ module ActionController # :nodoc:
       # inline data. You may also set the content type, the file name, and other
       # things.
       #
-      # Options:
+      # #### Options:
+      #
       # *   `:filename` - suggests a filename for the browser to use.
       # *   `:type` - specifies an HTTP content type. Defaults to
       #     `application/octet-stream`. You can specify either a string or a symbol

data/lib/action_controller/metal/instrumentation.rb

@@ -2,7 +2,6 @@
 
 # :markup: markdown
 
-require "benchmark"
 require "abstract_controller/logger"
 
 module ActionController
@@ -29,7 +28,7 @@ module ActionController
     def render(*)
       render_output = nil
       self.view_runtime = cleanup_view_runtime do
-        Benchmark.ms { render_output = super }
+        ActiveSupport::Benchmark.realtime(:float_millisecond) { render_output = super }
       end
       render_output
     end