actionpack 3.2.22.5 → 4.0.0.beta1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: b2589906c64cd869c852384400c0faaa3ce38781
-  data.tar.gz: 791a03c38208269ba110b4d5afaa77b3144894b6
+  metadata.gz: b3463df116c388c7b2d15a3ac267fea12a100cf1
+  data.tar.gz: ad55681ebfbc24cbb11d1b06a5e31943a4515a96
 SHA512:
-  metadata.gz: ac4faea0a3986fbaa9644ec86c74bab96478b4b75786901f0d9142f563ada0d0efdf56e3c094af894eb7542fedfb7c88eaa93fa04fdb37be981c7e9267a65875
-  data.tar.gz: ef93100f309d422d5d4542e73dd02a7087cd4f0fc3b37e48d01fc9d0deedbc282550cf81780489d707ad2902e559f3a65711ca03c25b03ad2fce7ab28b5e5186
+  metadata.gz: 83abc4ab5ba7fe34ad23f5f29bc7eee985ae62a7ea949fc84b942b9dbd3b3c8caebd692f5c52765a972c0e993edd1efb18b2a244ffb8917358f3743718ab90f9
+  data.tar.gz: 91d22e18c2143a67a92fa61cf346adce168373835e7636de2a125de336958e3f528ba1a83807417dc7f541ce3156c08c88641273d05dacfc268f5ccea8cc05f5

data/CHANGELOG.md

@@ -1,394 +1,478 @@
-## Rails 3.2.22 (Jun 16, 2015) ##
+## Rails 4.0.0.beta1 (February 25, 2013) ##
 
-* No changes.
+*   Fix `respond_to` not using formats that have no block if all is present. *Michael Grosser*
 
+*   New applications use an encrypted session store by default.
 
-## Rails 3.2.19 (Jul 2, 2014) ##
+    *Santiago Pastorino*
 
-*   Fix regression when using `ActionView::Helpers::TranslationHelper#translate` with
-    `options[:raise]`.
+*   Determine the controller#action from only the matched path when using the
+    shorthand syntax. Previously the complete path was used, which led
+    to problems with nesting (scopes and namespaces).
+    Fixes #7554.
 
-    This regression was introduced at ec16ba75a5493b9da972eea08bae630eba35b62f.
+    Example:
 
-    *Shota Fukumori (sora_h)*
+        # This will route to questions#new.
+        scope ':locale' do
+          get 'questions/new'
+        end
 
+    *Yves Senn*
 
-## Rails 3.2.18 (May 6, 2014) ##
+*   Remove support for parsing XML parameters from request. If you still want to parse XML
+    parameters, please install `actionpack-xml_parser' gem.
 
-*   Only accept actions without File::SEPARATOR in the name.
+    *Prem Sichanugrist*
 
-    This will avoid directory traversal in implicit render.
+*   Remove support for parsing YAML parameters from request.
 
-    Fixes: CVE-2014-0130
+    *Aaron Patterson*
 
-    *Rafael Mendonça França*
+*   Add a message when you have no routes defined to both `rake routes` and
+    GET "/rails/info/routes" that lets you know you have none defined and links
+    to the Rails guide on the topic.
 
+    *Steve Klabnik*
 
-## Rails 3.2.17 (Feb 18, 2014) ##
+*   Change `image_alt` method to replace underscores/hyphens to spaces in filenames.
 
-*   Use the reference for the mime type to get the format
+    Previously, underscored filenames became `alt="A_long_file_name_with_underscores"`
+    in HTML, which is poor for accessibility. For instance, Apple's VoiceOver Utility
+    pronounces each underscore. `A_long_file_name` thus would be read as `A underscore
+    long underscore file underscore name.` Now underscored or hyphenated filenames
+    (both of which are very popular naming conventions) read more naturally in
+    screen readers by converting both hyphens and underscores to spaces.
 
-    Fixes: CVE-2014-0082
+    Before:
 
-*   Escape format, negative_format and units options of number helpers
+        image_tag('underscored_file_name.png')
+        # => <img alt="Underscored_file_name" src="/assets/underscored_file_name.png" />
 
-    Fixes: CVE-2014-0081
+    After:
 
+        image_tag('underscored_file_name.png')
+        # => <img alt="Underscored file name" src="/assets/underscored_file_name.png" />
 
-## Rails 3.2.16 (Dec 12, 2013) ##
+    *Nick Cox*
 
-*   Deep Munge the parameters for GET and POST Fixes CVE-2013-6417
+*   We don't support Ruby constant notation in the `:controller` option for route
+    definitions. So, this raises an `ArgumentError` now:
 
-*   Stop using i18n's built in HTML error handling.  Fixes: CVE-2013-4491
+        resources :posts, controller: "Admin::Posts" # WRONG
 
-*   Escape the unit value provided to number_to_currency Fixes CVE-2013-6415
+    Use path notation instead:
 
-*   Only use valid mime type symbols as cache keys CVE-2013-6414
+        resources :posts, controller: "admin/posts" # RIGHT
 
-## Rails 3.2.15 (Oct 16, 2013) ##
+    *Yves Senn*
 
-*   Fix `ActionDispatch::RemoteIp::GetIp#calculate_ip` to only check for spoofing
-    attacks if both `HTTP_CLIENT_IP` and `HTTP_X_FORWARDED_FOR` are set.
+*   `assert_template` can be used to verify the locals of partials,
+    which live inside a directory.
 
-    Fixes #12410
-    Backports #10844
+        # Prefixed partials inside directories worked and still work.
+        assert_template partial: 'directory/_partial', locals: {name: 'John'}
 
-    *Tamir Duberstein*
+        # This did not work but does now.
+        assert_template partial: 'directory/partial', locals: {name: 'John'}
 
-*   Fix the assert_recognizes test method so that it works when there are
-    constraints on the querystring.
+    Fixes #8516.
 
-    Issue/Pull Request #9368
-    Backport #5219
+    *Yves Senn*
 
-    *Brian Hahn*
+*   Fix `content_tag_for` with array HTML option.
+    It would embed array as string instead of joining it like `content_tag` does:
 
-*   Fix to render partial by context(#11605).
+        content_tag(:td, class: ["foo", "bar"]){}
+        # => <td class="foo bar"></td>
 
-    *Kassio Borges*
+    Before:
 
-*   Fix `ActionDispatch::Assertions::ResponseAssertions#assert_redirected_to`
-    does not show user-supplied message.
+        content_tag_for(:td, item, class: ["foo", "bar"])
+        # => <td class="item [&quot;foo&quot;, &quot;bar&quot;]" id="item_1"></td>
 
-    Issue: when `assert_redirected_to` fails due to the response redirect not
-    matching the expected redirect the user-supplied message (second parameter)
-    is not shown. This message is only shown if the response is not a redirect.
+    After:
 
-    *Alexey Chernenkov*
+        content_tag_for(:td, item, class: ["foo", "bar"])
+        # => <td class="item foo bar" id="item_1"></td>
 
+    *Semyon Perepelitsa*
 
-## Rails 3.2.14 (Jul 22, 2013) ##
+*   Remove `BestStandardsSupport` middleware, !DOCTYPE html already triggers
+    standards mode per http://msdn.microsoft.com/en-us/library/jj676915(v=vs.85).aspx
+    and ChromeFrame header has been moved to `config.action_dispatch.default_headers`
 
-*   Merge `:action` from routing scope and assign endpoint if both `:controller`
-    and `:action` are present. The endpoint assignment only occurs if there is
-    no `:to` present in the options hash so should only affect routes using the
-    shorthand syntax (i.e. endpoint is inferred from the the path).
+    *Guillermo Iguaran*
 
-    Fixes #9856
+*   Fix CSRF protection and `current_url?` helper to work with HEAD requests
+    now that `ActionDispatch::Head` has been removed in favor of `Rack::Head`.
 
-    *Yves Senn*, *Andrew White*
+    *Michiel Sikkes*
 
-*   Always escape the result of `link_to_unless` method.
+*   Change `asset_path` to not include `SCRIPT_NAME` when it's used
+    from a mounted engine. Fixes #8119.
 
-    Before:
+    *Piotr Sarnacki*
 
-        link_to_unless(true, '<b>Showing</b>', 'github.com')
-        # => "<b>Showing</b>"
+*   Add JavaScript based routing path matcher to `/rails/info/routes`.
+    Routes can now be filtered by whether or not they match a path.
 
-    After:
+    *Richard Schneeman*
 
-        link_to_unless(true, '<b>Showing</b>', 'github.com')
-        # => "&lt;b&gt;Showing&lt;/b&gt;"
+*   Change the behavior of route defaults so that explicit defaults are no longer
+    required where the key is not part of the path. For example:
 
-    *dtaniwaki*
+        resources :posts, bucket_type: 'posts'
 
-*   Use a case insensitive URI Regexp for #asset_path.
+    will be required whenever constructing the url from a hash such as a functional
+    test or using `url_for` directly. However using the explicit form alters the
+    behavior so it's not required:
 
-    This fix a problem where the same asset path using different case are generating
-    different URIs.
+        resources :projects, defaults: { bucket_type: 'projects' }
 
-    Before:
+    This changes existing behavior slightly in that any routes which only differ
+    in their defaults will match the first route rather than the closest match.
 
-        image_tag("HTTP://google.com")
-        # => "<img alt=\"Google\" src=\"/assets/HTTP://google.com\" />"
-        image_tag("http://google.com")
-        # => "<img alt=\"Google\" src=\"http://google.com\" />"
+    *Andrew White*
 
-    After:
+*   Add support for routing constraints other than Regexp and String.
+    For example this now allows the use of arrays like this:
+
+        get '/foo/:action', to: 'foo', constraints: { subdomain: %w[www admin] }
 
-        image_tag("HTTP://google.com")
-        # => "<img alt=\"Google\" src=\"HTTP://google.com\" />"
-        image_tag("http://google.com")
-        # => "<img alt=\"Google\" src=\"http://google.com\" />"
+    or constraints where the request method returns an Fixnum like this:
 
-    *David Celis + Rafael Mendonça França*
+        get '/foo', to: 'foo#index', constraints: { port: 8080 }
 
-*   Fix explicit names on multiple file fields. If a file field tag has
-    the multiple option, it is turned into an array field (appending `[]`),
-    but if an explicit name is passed to `file_field` the `[]` is not
-    appended.
-    Fixes #9830.
+    Note that this only applies to constraints on the request - path constraints
+    still need to be specified as Regexps as the various constraints are compiled
+    into a single Regexp.
 
-    *Ryan McGeary*
+    *Andrew White*
 
-*   Fix assets loading performance in 3.2.13.
+*   Fix a bug in integration tests where setting the port via a url passed to
+    the process method was ignored when constructing the request environment.
 
-    Issue #8756 uses Sprockets for resolving files that already exist on disk,
-    for those files their extensions don't need to be rewritten.
+    *Andrew White*
 
-    Fixes #9803.
+*   Allow `:selected` to be set on `date_select` tag helper.
 
-    *Fred Wu*
+    *Colin Burn-Murdoch*
 
-*   Fix `ActionController#action_missing` not being called.
-    Fixes #9799.
+*   Fixed JSON params parsing regression for non-object JSON content.
 
-    *Janko Luin*
+    *Dylan Smith*
 
-*   `ActionView::Helpers::NumberHelper#number_to_human` returns the number unaltered when
-    the units hash does not contain the needed key, e.g. when the number provided is less
-    than the largest key provided.
+*   Extract `ActionDispatch::PerformanceTest` into https://github.com/rails/rails-perftest
+    You can add the gem to your Gemfile to keep using performance tests.
 
-    Examples:
+        gem 'rails-perftest'
 
-        number_to_human(123, units: {})                # => 123
-        number_to_human(123, units: { thousand: 'k' }) # => 123
+    *Yves Senn*
 
-    Fixes #9269.
-    Backport #9347.
+*   Added view_cache_dependency API for declaring dependencies that affect
+    cache digest computation.
 
-    *Michael Hoffman*
+    *Jamis Buck*
 
-*   Include I18n locale fallbacks in view lookup.
-    Fixes GH#3512.
+*   `image_submit_tag` will set `alt` attribute from image source if not
+    specified.
 
-    *Juan Barreneche*
+    *Nihad Abbasov*
 
-*   Fix `ActionDispatch::Request#formats` when the Accept request-header is an
-    empty string. Fix #7774 [Backport #8977, #9541]
+*   Do not generate local variables for partials without object or collection.
+    Previously rendering a partial without giving `:object` or `:collection`
+    would generate a local variable with the partial name by default.
 
-    *Soylent + Maxime Réty*
+    *Carlos Antonio da Silva*
 
+*   Return the last valid, non-private IP address from the X-Forwarded-For,
+    Client-IP and Remote-Addr headers, in that order. Document the rationale
+    for that decision, and describe the options that can be passed to the
+    RemoteIp middleware to change it.
+    Fix #7979
 
-## Rails 3.2.13 (Mar 18, 2013) ##
+    *André Arko*, *Steve Klabnik*, *Alexey Gaziev*
 
-*   Fix incorrectly appended square brackets to a multiple select box
-    if an explicit name has been given and it already ends with "[]".
+*   Do not append second slash to `root_url` when using `trailing_slash: true`
+    Fix #8700
 
     Before:
 
-        select(:category, [], {}, multiple: true, name: "post[category][]")
-        # => <select name="post[category][][]" ...>
+        root_url(trailing_slash: true) # => http://test.host//
 
     After:
 
-        select(:category, [], {}, multiple: true, name: "post[category][]")
-        # => <select name="post[category][]" ...>
+        root_url(trailing_slash: true) # => http://test.host/
 
-    Backport #9616.
+    *Yves Senn*
 
-    *Olek Janiszewski*
+*   Allow to toggle dumps on error pages.
 
-*   Determine the controller#action from only the matched path when using the
-    shorthand syntax. Previously the complete path was used, which led
-    to problems with nesting (scopes and namespaces).
-    Fixes #7554.
-    Backport #9361.
+    *Gosha Arinich*
 
-    Example:
+*   Fix a bug in `content_tag_for` that prevents it from working without a block.
 
-        # this will route to questions#new
-        scope ':locale' do
-          get 'questions/new'
-        end
+    *Jasl*
+
+*   Change the stylesheet of exception pages for development mode.
+    Additionally display also the line of code and fragment that raised
+    the exception in all exceptions pages.
+
+    *Guillermo Iguaran + Jorge Cuadrado*
+
+*   Do not append `charset=` parameter when `head` is called with a
+    `:content_type` option.
+    Fix #8661.
 
     *Yves Senn*
 
-*   Fix `assert_template` with `render :stream => true`.
-    Fix #1743.
-    Backport #5288.
+*   Added `Mime::NullType` class. This  allows to use `html?`, `xml?`, `json?`, etc.
+    when the format of the request is unknown, without raising an exception.
 
-    *Sergey Nartimov*
+    *Angelo Capilleri*
 
-*   Eagerly populate the http method lookup cache so local project inflections do
-    not interfere with use of underscore method ( and we don't need locks )
+*   Integrate the Journey gem into Action Dispatch so that the global namespace
+    is not polluted with names that may be used as models.
 
-    *Aditya Sanghi*
+    *Andrew White*
 
-*   `BestStandardsSupport` no longer duplicates `X-UA-Compatible` values on
-    each request to prevent header size from blowing up.
+*   Extract support for email address obfuscation via `:encode`, `:replace_at`, and `replace_dot`
+    options from the `mail_to` helper into the `actionview-encoded_mail_to` gem.
 
-    *Edward Anderson*
+    *Nick Reed + DHH*
 
-*   Fixed JSON params parsing regression for non-object JSON content.
+*   Handle `:protocol` option in `stylesheet_link_tag` and `javascript_include_tag`
 
-    *Dylan Smith*
+    *Vasiliy Ermolovich*
 
-*   Prevent unnecessary asset compilation when using `javascript_include_tag` on
-    files with non-standard extensions.
+*   Clear url helper methods when routes are reloaded. *Andrew White*
 
-    *Noah Silas*
+*   Fix a bug in `ActionDispatch::Request#raw_post` that caused `env['rack.input']`
+    to be read but not rewound.
 
-*   Fixes issue where duplicate assets can be required with sprockets.
+    *Matt Venables*
 
-    *Jeremy Jackson*
+*   Prevent raising `EOFError` on multipart GET request (IE issue). *Adam Stankiewicz*
 
-*   Bump `rack` dependency to 1.4.3, eliminate `Rack::File` headers deprecation warning.
+*   Rename all action callbacks from *_filter to *_action to avoid the misconception that these
+    callbacks are only suited for transforming or halting the response. With the new style,
+    it's more inviting to use them as they were intended, like setting shared ivars for views.
 
-    *Sam Ruby + Carlos Antonio da Silva*
+    Example:
 
-*   Do not append second slash to `root_url` when using `trailing_slash: true`
+        class PeopleController < ActionController::Base
+          before_action :set_person,      except: [:index, :new, :create]
+          before_action :ensure_permission, only: [:edit, :update]
+
+          ...
+
+          private
+            def set_person
+              @person = current_account.people.find(params[:id])
+            end
+
+            def ensure_permission
+              current_person.can_change?(@person)
+            end
+        end
+
+    The old *_filter methods still work with no deprecation notice.
+
+    *DHH*
 
-    Fix #8700.
-    Backport #8701.
+*   Add `cache_if` and `cache_unless` for conditional fragment caching:
 
     Example:
-        # before
-        root_url # => http://test.host//
 
-        # after
-        root_url # => http://test.host/
+        <%= cache_if condition, project do %>
+          <b>All the topics on this project</b>
+          <%= render project.topics %>
+        <% end %>
 
-    *Yves Senn*
+        # and
 
-*   Fix a bug in `content_tag_for` that prevents it for work without a block.
+        <%= cache_unless condition, project do %>
+          <b>All the topics on this project</b>
+          <%= render project.topics %>
+        <% end %>
 
-    *Jasl*
+    *Stephen Ausman + Fabrizio Regini + Angelo Capilleri*
 
-*   Clear url helper methods when routes are reloaded by removing the methods
-    explicitly rather than just clearing the module because it didn't work
-    properly and could be the source of a memory leak.
+*   Add logging filter capability for redirect URLs:
 
-    *Andrew White*
+        config.filter_redirect << 'http://please.hide.it/'
 
-*   Fix a bug in `ActionDispatch::Request#raw_post` that caused `env['rack.input']`
-    to be read but not rewound.
+    *Fabrizio Regini*
 
-    *Matt Venables*
+*   Fixed a bug that ignores constraints on a glob route. This was caused because the constraint
+    regular expression is overwritten when the `routes.rb` file is processed. Fixes #7924
+
+    *Maura Fitzgerald*
 
 *   More descriptive error messages when calling `render :partial` with
     an invalid `:layout` argument.
 
     Fixes #8376.
 
-        render :partial => 'partial', :layout => true
+        render partial: 'partial', layout: true
+
         # results in ActionView::MissingTemplate: Missing partial /true
 
     *Yves Senn*
 
-*   Accept symbols as `#send_data` :disposition value. [Backport #8329] *Elia Schito*
+*   Sweepers was extracted from Action Controller as `rails-observers` gem.
+
+    *Rafael Mendonça França*
 
-*   Add i18n scope to `distance_of_time_in_words`. [Backport #7997] *Steve Klabnik*
+*   Add option flag to `CacheHelper#cache` to manually bypass automatic template digests:
 
-*   Fix side effect of `url_for` changing the `:controller` string option. [Backport #6003]
-    Before:
+        <% cache project, skip_digest: true do %>
+          ...
+        <% end %>
 
-        controller = '/projects'
-        url_for :controller => controller, :action => 'status'
+    *Drew Ulmer*
 
-        puts controller #=> 'projects'
+*   Do not sort Hash options in `grouped_options_for_select`. *Sergey Kojin*
 
-    After
+*   Accept symbols as `send_data :disposition` value *Elia Schito*
 
-        puts controller #=> '/projects'
+*   Add i18n scope to `distance_of_time_in_words`. *Steve Klabnik*
 
-    *Nikita Beloglazov + Andrew White*
+*   `assert_template`:
+    - is no more passing with empty string.
+    - is now validating option keys. It accepts: `:layout`, `:partial`, `:locals` and `:count`.
 
-*   Introduce `ActionView::Template::Handlers::ERB.escape_whitelist`. This is a list
-    of mime types where template text is not html escaped by default. It prevents `Jack & Joe`
-    from rendering as `Jack &amp; Joe` for the whitelisted mime types. The default whitelist
-    contains text/plain. Fix #7976 [Backport #8235]
+    *Roberto Soares*
 
-    *Joost Baaij*
+*   Allow setting a symbol as path in scope on routes. This is now allowed:
 
-*   `BestStandardsSupport` middleware now appends it's `X-UA-Compatible` value to app's
-    returned value if any. Fix #8086 [Backport #8093]
+        scope :api do
+          resources :users
+        end
 
-    *Nikita Afanasenko*
+    It is also possible to pass multiple symbols to scope to shorten multiple nested scopes:
 
-*   prevent double slashes in engine urls when `Rails.application.default_url_options[:trailing_slash] = true` is set
-    Fix #7842
+        scope :api do
+          scope :v1 do
+            resources :users
+          end
+        end
 
-    *Yves Senn*
+    can be rewritten as:
 
-*   Fix input name when `:multiple => true` and `:index` are set.
+        scope :api, :v1 do
+          resources :users
+        end
+
+    *Guillermo Iguaran + Amparo Luna*
+
+*   Fix error when using a non-hash query argument named "params" in `url_for`.
 
     Before:
 
-        check_box("post", "comment_ids", { :multiple => true, :index => "foo" }, 1)
-        #=> <input name=\"post[foo][comment_ids]\" type=\"hidden\" value=\"0\" /><input id=\"post_foo_comment_ids_1\" name=\"post[foo][comment_ids]\" type=\"checkbox\" value=\"1\" />
+        url_for(params: "") # => undefined method `reject!' for "":String
 
     After:
 
-        check_box("post", "comment_ids", { :multiple => true, :index => "foo" }, 1)
-        #=> <input name=\"post[foo][comment_ids][]\" type=\"hidden\" value=\"0\" /><input id=\"post_foo_comment_ids_1\" name=\"post[foo][comment_ids][]\" type=\"checkbox\" value=\"1\" />
+        url_for(params: "") # => http://www.example.com?params=
 
-    Fix #8108
+    *tumayun + Carlos Antonio da Silva*
 
-    *Daniel Fox, Grant Hutchins & Trace Wax*
+*   Render every partial with a new `ActionView::PartialRenderer`. This resolves
+    issues when rendering nested partials.
+    Fix #8197.
 
+    *Yves Senn*
 
-## Rails 3.2.12 (Feb 11, 2013) ##
+*   Introduce `ActionView::Template::Handlers::ERB.escape_whitelist`. This is a list
+    of mime types where template text is not html escaped by default. It prevents `Jack & Joe`
+    from rendering as `Jack &amp; Joe` for the whitelisted mime types. The default whitelist
+    contains `text/plain`.
+    Fix #7976.
 
-*   No changes.
+    *Joost Baaij*
 
+*   Fix input name when `multiple: true` and `:index` are set.
 
-## Rails 3.2.11 (Jan 8, 2013) ##
+    Before:
 
-*   Strip nils from collections on JSON and XML posts. [CVE-2013-0155]
+        check_box("post", "comment_ids", { multiple: true, index: "foo" }, 1)
+        # => <input name=\"post[foo][comment_ids]\" type=\"hidden\" value=\"0\" /><input id=\"post_foo_comment_ids_1\" name=\"post[foo][comment_ids]\" type=\"checkbox\" value=\"1\" />
 
+    After:
 
-## Rails 3.2.10 (Jan 2, 2013) ##
+        check_box("post", "comment_ids", { multiple: true, index: "foo" }, 1)
+        # => <input name=\"post[foo][comment_ids][]\" type=\"hidden\" value=\"0\" /><input id=\"post_foo_comment_ids_1\" name=\"post[foo][comment_ids][]\" type=\"checkbox\" value=\"1\" />
 
-*   No changes.
+    Fix #8108.
 
+    *Daniel Fox, Grant Hutchins & Trace Wax*
 
-## Rails 3.2.9 (Nov 12, 2012) ##
+*   `date_select` helper accepts `with_css_classes: true` to add css classes similar with type
+    of generated select tags.
 
-*   Clear url helpers when reloading routes.
+    *Pavel Nikitin*
 
-    *Santiago Pastorino*
+*   Only non-js/css under `app/assets` path will be included in default `config.assets.precompile`.
 
-*   Revert the shorthand routes scoped with `:module` option fix
-    This added a regression since it is changing the URL mapping.
-    This makes the stable release backward compatible.
+    *Josh Peek*
 
-    *Rafael Mendonça França*
+*   Remove support for the `RAILS_ASSET_ID` environment configuration
+    (no longer needed now that we have the asset pipeline).
 
-*   Revert the `assert_template` fix to not pass with ever string that matches the template name.
-    This added a regression since people were relying on this buggy behavior.
-    This will introduce back #3849 but this stable release will be backward compatible.
-    Fixes #8068.
+    *Josh Peek*
 
-    *Rafael Mendonça França*
+*   Remove old `asset_path` configuration (no longer needed now that we have the asset pipeline).
 
-*   Revert the rename of internal variable on ActionController::TemplateAssertions to prevent
-    naming collisions. This added a regression related with shoulda-matchers, since it is
-    expecting the [instance variable @layouts](https://github.com/thoughtbot/shoulda-matchers/blob/9e1188eea68c47d9a56ce6280e45027da6187ab1/lib/shoulda/matchers/action_controller/render_with_layout_matcher.rb#L74).
-    This will introduce back #7459 but this stable release will be backward compatible.
-    Fixes #8068.
+    *Josh Peek*
 
-    *Rafael Mendonça França*
+*   `assert_template` can be used to assert on the same template with different locals
+    Fix #3675.
+
+    *Yves Senn*
 
-*   Accept :remote as symbolic option for `link_to` helper. *Riley Lynch*
+*   Remove old asset tag concatenation (no longer needed now that we have the asset pipeline).
+
+    *Josh Peek*
+
+*   Accept `:remote` as symbolic option for `link_to` helper. *Riley Lynch*
 
 *   Warn when the `:locals` option is passed to `assert_template` outside of a view test case
-    Fix #3415
+    Fix #3415.
 
     *Yves Senn*
 
-*   Rename internal variables on ActionController::TemplateAssertions to prevent
-    naming collisions. @partials, @templates and @layouts are now prefixed with an underscore.
-    Fix #7459
+*   The `Rack::Cache` middleware is now disabled by default. To enable it,
+    set `config.action_dispatch.rack_cache = true` and add `gem rack-cache` to your Gemfile.
+
+    *Guillermo Iguaran*
+
+*   `ActionController::Base.page_cache_extension` option is deprecated
+    in favour of `ActionController::Base.default_static_extension`.
+
+    *Francesco Rodriguez*
+
+*   Action and Page caching has been extracted from Action Dispatch
+    as `actionpack-action_caching` and `actionpack-page_caching` gems.
+    Please read the `README.md` file on both gems for the usage.
+
+    *Francesco Rodriguez*
+
+*   Failsafe exception returns `text/plain`. *Steve Klabnik*
+
+*   Rename internal variables on `ActionController::TemplateAssertions` to prevent
+    naming collisions. `@partials`, `@templates` and `@layouts` are now prefixed with an underscore.
+    Fix #7459.
 
     *Yves Senn*
 
-*   `resource` and `resources` don't modify the passed options hash
-    Fix #7777
+*   `resource` and `resources` don't modify the passed options hash.
+    Fix #7777.
 
     *Yves Senn*
 
-*   Precompiled assets include aliases from foo.js to foo/index.js and vice versa.
+*   Precompiled assets include aliases from `foo.js` to `foo/index.js` and vice versa.
 
         # Precompiles phone-<digest>.css and aliases phone/index.css to phone.css.
         config.assets.precompile = [ 'phone.css' ]
@@ -421,366 +505,505 @@
 
     *Hugolnx*
 
-*   Handle `ActionDispatch::Http::UploadedFile` like `Rack::Test::UploadedFile`, don't call to_param on it. Since
-    `Rack::Test::UploadedFile` isn't API compatible this is needed to test file uploads that rely on `tempfile`
-    being available.
+*   `image_tag` will set the same width and height for image if numerical value
+    passed to `size` option.
 
-    *Tim Vandecasteele*
+    *Nihad Abbasov*
 
-*   Respect `config.digest = false` for `asset_path`
+*   Deprecate `Mime::Type#verify_request?` and `Mime::Type.browser_generated_types`,
+    since they are no longer used inside of Rails, they will be removed in Rails 4.1.
 
-    Previously, the `asset_path` internals only respected the `:digest`
-    option, but ignored the global config setting. This meant that
-    `config.digest = false` could not be used in conjunction with
-    `config.compile = false` this corrects the behavior.
+    *Michael Grosser*
 
-    *Peter Wagenet*
+*   `ActionDispatch::Http::UploadedFile` now delegates `close` to its tempfile. *Sergio Gil*
 
-*   Fix #7646, the log now displays the correct status code when an exception is raised.
+*   Add `ActionController::StrongParameters`, this module converts `params` hash into
+    an instance of ActionController::Parameters that allows whitelisting of permitted
+    parameters. Non-permitted parameters are forbidden to be used in Active Model by default
+    For more details check the documentation of the module or the
+    [strong_parameters gem](https://github.com/rails/strong_parameters)
 
-    *Yves Senn*
+    *DHH + Guillermo Iguaran*
 
-*   Fix handling of date selects when using both disabled and discard options.
-    Fixes #7431.
+*   Remove Integration between `attr_accessible`/`attr_protected` and
+    `ActionController::ParamsWrapper`. ParamWrapper now wraps all the parameters returned
+    by the class method `attribute_names`.
 
-    *Vasiliy Ermolovich*
+    *Guillermo Iguaran*
 
-*   Fix select_tag when option_tags is nil.
-    Fixes #7404.
+*   Log now displays the correct status code when an exception is raised.
+    Fix #7646.
 
-    *Sandeep Ravichandran*
+    *Yves Senn*
 
-*   `javascript_include_tag :all` will now not include `application.js` if the file does not exists. *Prem Sichanugrist*
+*   Allow pass couple extensions to `ActionView::Template.register_template_handler` call.
 
-*   Support cookie jar options (e.g., domain :all) for all session stores.
-    Fixes GH#3047, GH#2483.
+    *Tima Maslyuchenko*
 
-    *Ravil Bayramgalin*
+*   Sprockets integration has been extracted from Action Pack to the `sprockets-rails`
+    gem. `rails` gem is depending on `sprockets-rails` by default.
 
-*   Performance Improvement to send_file: Avoid having to pass an open file handle as the response body. Rack::Sendfile
-    will usually intercept the response and just uses the path directly, so no reason to open the file. This performance
-    improvement also resolves an issue with jRuby encodings, and is the reason for the backport, see issue #6844.
+    *Guillermo Iguaran*
 
-    *Jeremy Kemper & Erich Menge*
+*   `ActionDispatch::Session::MemCacheStore` now uses `dalli` instead of the deprecated
+    `memcache-client` gem.
 
+    *Arun Agrawal + Guillermo Iguaran*
 
-## Rails 3.2.8 (Aug 9, 2012) ##
+*   Support multiple etags in If-None-Match header. *Travis Warlick*
 
-*   There is an XSS vulnerability in the strip_tags helper in Ruby on Rails, the
-    helper doesn't correctly handle malformed html.  As a result an attacker can
-    execute arbitrary javascript through the use of specially crafted malformed
-    html.
+*   Allow to configure how unverified request will be handled using `:with`
+    option in `protect_from_forgery` method.
 
-    *Marek from Nethemba (www.nethemba.com) & Santiago Pastorino*
+    Valid unverified request handling methods are:
 
-*   When a "prompt" value is supplied to the `select_tag` helper, the "prompt" value is not escaped.
-    If untrusted data is not escaped, and is supplied as the prompt value, there is a potential for XSS attacks.
-    Vulnerable code will look something like this:
-    select_tag("name", options, :prompt => UNTRUSTED_INPUT)
+    - `:exception` - Raises ActionController::InvalidAuthenticityToken exception.
+    - `:reset_session` - Resets the session.
+    - `:null_session` - Provides an empty session during request but doesn't
+      reset it completely. Used as default if `:with` option is not specified.
 
-    *Santiago Pastorino*
+    New applications are generated with:
 
-*   Reverted the deprecation of `:confirm`. *Rafael Mendonça França*
+        protect_from_forgery with: :exception
 
-*   Reverted the deprecation of `:disable_with`. *Rafael Mendonça França*
+    *Sergey Nartimov*
 
-*   Reverted the deprecation of `:mouseover` option to `image_tag`. *Rafael Mendonça França*
+*   Add `.ruby` template handler, this handler simply allows arbitrary Ruby code as a template. *Guillermo Iguaran*
 
-*   Reverted the deprecation of `button_to_function` and `link_to_function` helpers.
+*   Add `separator` option for `ActionView::Helpers::TextHelper#excerpt`:
 
-    *Rafael Mendonça França*
+        excerpt('This is a very beautiful morning', 'very', separator: ' ', radius: 1)
+        # => ...a very beautiful...
 
+    *Guirec Corbel*
 
-## Rails 3.2.7 (Jul 26, 2012) ##
+*   Added controller-level etag additions that will be part of the action etag computation *Jeremy Kemper/DHH*
 
-*   Do not convert digest auth strings to symbols. CVE-2012-3424
+        class InvoicesController < ApplicationController
+          etag { current_user.try :id }
 
-*   Bump Journey requirements to 1.0.4
+          def show
+            # Etag will differ even for the same invoice when it's viewed by a different current_user
+            @invoice = Invoice.find(params[:id])
+            fresh_when(@invoice)
+          end
+        end
 
-*   Add support for optional root segments containing slashes
+*   Add automatic template digests to all `CacheHelper#cache` calls (originally spiked in the `cache_digests` plugin) *DHH*
 
-*   Fixed bug creating invalid HTML in select options
+*   When building a URL fails, add missing keys provided by Journey. Failed URL
+    generation now returns a 500 status instead of a 404.
 
-*   Show in log correct wrapped keys
+    *Richard Schneeman*
 
-*   Fix NumberHelper options wrapping to prevent verbatim blocks being rendered instead of line continuations.
+*   Deprecate availability of `ActionView::RecordIdentifier` in controllers by default.
+    It's view specific and can be easily included in controllers manually if someone
+    really needs it. Also deprecate calling `ActionController::RecordIdentifier.dom_id` and
+    `dom_class` directly, in favor of `ActionView::RecordIdentifier.dom_id` and `dom_class`.
+    `RecordIdentifier` will be removed from `ActionController::Base` in Rails 4.1.
 
-*   ActionController::Metal doesn't have logger method, check it and then delegate
+    *Piotr Sarnacki*
 
-*   ActionController::Caching depends on RackDelegation and AbstractController::Callbacks
+*   Fix `ActionView::RecordIdentifier` to work as a singleton. *Piotr Sarnacki*
 
+*   Deprecate `Template#mime_type`, it will be removed in Rails 4.1 in favor of `#type`.
+    *Piotr Sarnacki*
 
-## Rails 3.2.6 (Jun 12, 2012) ##
+*   Move vendored html-scanner from `action_controller` to `action_view` directory. If you
+    require it directly, please use 'action_view/vendor/html-scanner', reference to
+    'action_controller/vendor/html-scanner' will be removed in Rails 4.1. *Piot Sarnacki*
 
-*   nil is removed from array parameter values
+*   Fix handling of date selects when using both disabled and discard options.
+    Fixes #7431.
 
-    CVE-2012-2694
+    *Vasiliy Ermolovich*
 
-*   Deprecate `:confirm` in favor of `':data => { :confirm => "Text" }'` option for `button_to`, `button_tag`, `image_submit_tag`, `link_to` and `submit_tag` helpers.
+*   `ActiveRecord::SessionStore` is extracted out of Rails into a gem `activerecord-session_store`.
+    Setting `config.session_store` to `:active_record_store` will no longer work and will break
+    if the `activerecord-session_store` gem isn't available. *Prem Sichanugrist*
 
-    *Carlos Galdino*
+*   Fix `select_tag` when `option_tags` is nil.
+    Fixes #7404.
 
-*   Allow to use mounted_helpers (helpers for accessing mounted engines) in ActionView::TestCase. *Piotr Sarnacki*
+    *Sandeep Ravichandran*
 
-*   Include mounted_helpers (helpers for accessing mounted engines) in ActionDispatch::IntegrationTest by default. *Piotr Sarnacki*
+*   Add `Request#formats=(extensions)` that lets you set multiple formats directly in a prioritized order.
 
+    Example of using this for custom iphone views with an HTML fallback:
 
-## Rails 3.2.5 (Jun 1, 2012) ##
+        class ApplicationController < ActionController::Base
+          before_filter :adjust_format_for_iphone_with_html_fallback
 
-*   No changes.
+          private
+            def adjust_format_for_iphone_with_html_fallback
+              request.formats = [ :iphone, :html ] if request.env["HTTP_USER_AGENT"][/iPhone/]
+            end
+        end
 
+    *DHH*
 
-## Rails 3.2.4 (May 31, 2012) ##
+*   Add Routing Concerns to declare common routes that can be reused inside
+    others resources and routes.
 
-*   Deprecate old APIs for highlight, excerpt and word_wrap *Jeremy Walker*
+    Code before:
 
-*   Deprecate `:disable_with` in favor of `'data-disable-with'` option for `button_to`, `button_tag` and `submit_tag` helpers.
+        resources :messages do
+          resources :comments
+        end
 
-    *Carlos Galdino + Rafael Mendonça França*
+        resources :posts do
+          resources :comments
+          resources :images, only: :index
+        end
 
-*   Deprecate `:mouseover` option for `image_tag` helper. *Rafael Mendonça França*
+    Code after:
 
-*   Deprecate `button_to_function` and `link_to_function` helpers. *Rafael Mendonça França*
+        concern :commentable do
+          resources :comments
+        end
 
-*   Don't break Haml with textarea newline fix.  GH #393, #4000, #5190, #5191
+        concern :image_attachable do
+          resources :images, only: :index
+        end
 
-*   Fix options handling on labels. GH #2492, #5614
+        resources :messages, concerns: :commentable
 
-*   Added config.action_view.embed_authenticity_token_in_remote_forms to deal
-    with regression from 16ee611fa
+        resources :posts, concerns: [:commentable, :image_attachable]
 
-*   Set rendered_format when doing render :inline. GH #5632
+    *DHH + Rafael Mendonça França*
 
-*   Fix the redirect when it receive blocks with arity of 1. Closes #5677
+*   Add `start_hour` and `end_hour` options to the `select_hour` helper. *Evan Tann*
 
-*   Strip [nil] from parameters hash. Thanks to Ben Murphy for
-    reporting this! CVE-2012-2660
+*   Raises an `ArgumentError` when the first argument in `form_for` contain `nil`
+    or is empty.
 
+    *Richard Schneeman*
 
-## Rails 3.2.3 (March 30, 2012) ##
+*   Add 'X-Frame-Options' => 'SAMEORIGIN'
+    'X-XSS-Protection' => '1; mode=block' and
+    'X-Content-Type-Options' => 'nosniff'
+    as default headers.
 
-*   Allow to lazy load `default_form_builder` by passing a `String` instead of a constant. *Piotr Sarnacki*
+    *Egor Homakov*
 
-*   Fix #5632, render :inline set the proper rendered format. *Santiago Pastorino*
+*   Allow data attributes to be set as a first-level option for `form_for`, so you can write `form_for @record, data: { behavior: 'autosave' }` instead of `form_for @record, html: { data: { behavior: 'autosave' } }` *DHH*
 
-*   Fix textarea rendering when using plugins like HAML. Such plugins encode the first newline character in the content. This issue was introduced in https://github.com/rails/rails/pull/5191 *James Coleman*
+*   Deprecate `button_to_function` and `link_to_function` helpers.
 
-*   Remove the leading \n added by textarea on assert_select. *Santiago Pastorino*
+    We recommend the use of Unobtrusive JavaScript instead. For example:
 
-*   Add `config.action_view.embed_authenticity_token_in_remote_forms` (defaults to true) which allows to set if authenticity token will be included by default in remote forms. If you change it to false, you can still force authenticity token by passing `:authenticity_token => true` in form options *Piotr Sarnacki*
+        link_to "Greeting", "#", class: "nav_link"
 
-*   Do not include the authenticity token in forms where remote: true as ajax forms use the meta-tag value *DHH*
+        $(function() {
+          $('.nav_link').click(function() {
+            // Some complex code
 
-*   Turn off verbose mode of rack-cache, we still have X-Rack-Cache to
-    check that info. Closes #5245. *Santiago Pastorino*
+            return false;
+          });
+        });
 
-*   Fix #5238, rendered_format is not set when template is not rendered. *Piotr Sarnacki*
+    or
 
-*   Upgrade rack-cache to 1.2. *José Valim*
+        link_to "Greeting", '#', onclick: "alert('Hello world!'); return false", class: "nav_link"
 
-*   ActionController::SessionManagement is deprecated. *Santiago Pastorino*
+    for simple cases.
 
-*   Since the router holds references to many parts of the system like engines, controllers and the application itself, inspecting the route set can actually be really slow, therefore we default alias inspect to to_s. *José Valim*
+    *Rafael Mendonça França*
 
-*   Add a new line after the textarea opening tag. Closes #393 *Rafael Mendonça França*
+*   `javascript_include_tag :all` will now not include `application.js` if the file does not exists. *Prem Sichanugrist*
 
-*   Always pass a respond block from to responder. We should let the responder to decide what to do with the given overridden response block, and not short circuit it. *sikachu*
+*   Send an empty response body when call `head` with status between 100 and 199, 204, 205 or 304.
 
-*   Fixes layout rendering regression from 3.2.2. *José Valim*
+    *Armand du Plessis*
 
+*   Fixed issue with where digest authentication would not work behind a proxy. *Arthur Smith*
 
-## Rails 3.2.2 (March 1, 2012) ##
+*   Added `ActionController::Live`.  Mix it in to your controller and you can
+    stream data to the client live.  For example:
 
-*   Format lookup for partials is derived from the format in which the template is being rendered. Closes #5025 part 2 *Santiago Pastorino*
+        class FooController < ActionController::Base
+          include ActionController::Live
 
-*   Use the right format when a partial is missing. Closes #5025. *Santiago Pastorino*
+          def index
+            100.times {
+              # Client will see this as it's written
+              response.stream.write "hello world\n"
+              sleep 1
+            }
+            response.stream.close
+          end
+        end
 
-*   Default responder will now always use your overridden block in `respond_with` to render your response. *Prem Sichanugrist*
+    *Aaron Patterson*
 
-*   check_box helper with :disabled => true will generate a disabled hidden field to conform with the HTML convention where disabled fields are not submitted with the form.
-    This is a behavior change, previously the hidden tag had a value of the disabled checkbox.
-    *Tadas Tamosauskas*
+*   Remove `ActionDispatch::Head` middleware in favor of `Rack::Head`. *Santiago Pastorino*
 
+*   Deprecate `:confirm` in favor of `data: { confirm: "Text" }` option for `button_to`, `button_tag`, `image_submit_tag`, `link_to` and `submit_tag` helpers.
 
-## Rails 3.2.1 (January 26, 2012) ##
+    *Carlos Galdino + Rafael Mendonça França*
 
-*   Documentation improvements.
+*   Show routes in exception page while debugging a `RoutingError` in development.
 
-*   Allow `form.select` to accept ranges (regression). *Jeremy Walker*
+    *Richard Schneeman + Mattt Thompson + Yves Senn*
 
-*   `datetime_select` works with -/+ infinity dates. *Joe Van Dyk*
+*   Add `ActionController::Flash.add_flash_types` method to allow people to register their own flash types. e.g.:
 
+        class ApplicationController
+          add_flash_types :error, :warning
+        end
 
-## Rails 3.2.0 (January 20, 2012) ##
+    If you add the above code, you can use `<%= error %>` in an erb, and `redirect_to /foo, error: 'message'` in a controller.
 
-*   Setting config.assets.logger to false turn off Sprockets logger *Guillermo Iguaran*
+    *kennyj*
 
-*   Add `config.action_dispatch.default_charset` to configure default charset for ActionDispatch::Response. *Carlos Antonio da Silva*
+*   Remove Active Model dependency from Action Pack. *Guillermo Iguaran*
 
-*   Deprecate setting default charset at controller level, use the new `config.action_dispatch.default_charset` instead. *Carlos Antonio da Silva*
+*   Support unicode characters in routes. Route will be automatically escaped, so instead of manually escaping:
 
-*   Deprecate ActionController::UnknownAction in favour of AbstractController::ActionNotFound. *Carlos Antonio da Silva*
+        get Rack::Utils.escape('こんにちは') => 'home#index'
 
-*   Deprecate ActionController::DoubleRenderError in favour of AbstractController::DoubleRenderError. *Carlos Antonio da Silva*
+    You just have to write the unicode route:
 
-*   Deprecate method_missing handling for not found actions, use action_missing instead. *Carlos Antonio da Silva*
+        get 'こんにちは' => 'home#index'
 
-*   Deprecate ActionController#rescue_action, ActionController#initialize_template_class, and ActionController#assign_shortcuts.
-    These methods were not being used internally anymore and are going to be removed in Rails 4. *Carlos Antonio da Silva*
+    *kennyj*
 
-*   Add config.assets.logger to configure Sprockets logger *Rafael França*
+*   Return proper format on exceptions. *Santiago Pastorino*
 
-*   Use a BodyProxy instead of including a Module that responds to
-    close. Closes #4441 if Active Record is disabled assets are delivered
-    correctly *Santiago Pastorino*
+*   Allow to use `mounted_helpers` (helpers for accessing mounted engines) in `ActionView::TestCase`. *Piotr Sarnacki*
 
-*   Rails initialization with initialize_on_precompile = false should set assets_dir *Santiago Pastorino*
+*   Include `mounted_helpers` (helpers for accessing mounted engines) in `ActionDispatch::IntegrationTest` by default. *Piotr Sarnacki*
 
-*   Add font_path helper method *Santiago Pastorino*
+*   Extracted redirect logic from `ActionController::ForceSSL::ClassMethods.force_ssl`  into `ActionController::ForceSSL#force_ssl_redirect`
 
-*   Depends on rack ~> 1.4.0 *Santiago Pastorino*
+    *Jeremy Friesen*
 
-*   Add :gzip option to `caches_page`. The default option can be configured globally using `page_cache_compression` *Andrey Sitnik*
+*   Make possible to use a block in `button_to` if the button text is hard
+    to fit into the name parameter, e.g.:
 
-*   The ShowExceptions middleware now accepts a exceptions application that is responsible to render an exception when the application fails. The application is invoked with a copy of the exception in `env["action_dispatch.exception"]` and with the PATH_INFO rewritten to the status code. *José Valim*
+        <%= button_to [:make_happy, @user] do %>
+          Make happy <strong><%= @user.name %></strong>
+        <% end %>
+        # => "<form method="post" action="/users/1/make_happy" class="button_to">
+        #      <div>
+        #        <button type="submit">
+        #          Make happy <strong>Name</strong>
+        #        </button>
+        #      </div>
+        #    </form>"
 
-*   Add `button_tag` support to ActionView::Helpers::FormBuilder.
+    *Sergey Nartimov*
 
-    This support mimics the default behavior of `submit_tag`.
+*   Change a way of ordering helpers from several directories. Previously,
+    when loading helpers from multiple paths, all of the helpers files were
+    gathered into one array an then they were sorted. Helpers from different
+    directories should not be mixed before loading them to make loading more
+    predictable. The most common use case for such behavior is loading helpers
+    from engines. When you load helpers from application and engine Foo, in
+    that order, first rails will load all of the helpers from application,
+    sorted alphabetically and then it will do the same for Foo engine.
 
-    Example:
+    *Piotr Sarnacki*
 
-        <%= form_for @post do |f| %>
-          <%= f.button %>
-        <% end %>
+*   `truncate` now always returns an escaped HTML-safe string. The option `:escape` can be used as
+    false to not escape the result.
 
-*   Date helpers accept a new option, `:use_two_digit_numbers = true`, that renders select boxes for months and days with a leading zero without changing the respective values.
-    For example, this is useful for displaying ISO8601-style dates such as '2011-08-01'. *Lennart Fridén and Kim Persson*
+    *Li Ellis Gallardo + Rafael Mendonça França*
 
-*   Make ActiveSupport::Benchmarkable a default module for ActionController::Base, so the #benchmark method is once again available in the controller context like it used to be *DHH*
+*   `truncate` now accepts a block to show extra content when the text is truncated. *Li Ellis Gallardo*
 
-*   Deprecated implied layout lookup in controllers whose parent had a explicit layout set:
+*   Add `week_field`, `week_field_tag`, `month_field`, `month_field_tag`, `datetime_local_field`,
+    `datetime_local_field_tag`, `datetime_field` and `datetime_field_tag` helpers. *Carlos Galdino*
 
-        class ApplicationController
-          layout "application"
-        end
+*   Add `color_field` and `color_field_tag` helpers. *Carlos Galdino*
 
-        class PostsController < ApplicationController
-        end
+*   `assert_generates`, `assert_recognizes`, and `assert_routing` all raise
+    `Assertion` instead of `RoutingError` *David Chelimsky*
 
-    In the example above, Posts controller will no longer automatically look up for a posts layout.
+*   URL path parameters with invalid encoding now raise `ActionController::BadRequest`. *Andrew White*
 
-    If you need this functionality you could either remove `layout "application"` from ApplicationController or explicitly set it to nil in PostsController. *José Valim*
+*   Malformed query and request parameter hashes now raise `ActionController::BadRequest`. *Andrew White*
 
-*   Rails will now use your default layout (such as "layouts/application") when you specify a layout with `:only` and `:except` condition, and those conditions fail. *Prem Sichanugrist*
+*   Add `divider` option to `grouped_options_for_select` to generate a separator
+    `optgroup` automatically, and deprecate `prompt` as third argument, in favor
+    of using an options hash. *Nicholas Greenfield*
 
-    For example, consider this snippet:
+*   Add `time_field` and `time_field_tag` helpers which render an `input[type="time"]` tag. *Alex Soulim*
 
-        class CarsController
-          layout 'single_car', :only => :show
-        end
+*   Removed old text helper apis from `highlight`, `excerpt` and `word_wrap`. *Jeremy Walker*
 
-    Rails will use 'layouts/single_car' when a request comes in `:show` action, and use 'layouts/application' (or 'layouts/cars', if exists) when a request comes in for any other actions.
+*   Templates without a handler extension now raises a deprecation warning but still
+    defaults to ERB. In future releases, it will simply return the template contents. *Steve Klabnik*
 
-*   form_for with +:as+ option uses "#{action}_#{as}" as css class and id:
+*   Deprecate `:disable_with` in favor of `data: { disable_with: "Text" }` option from `submit_tag`, `button_tag` and `button_to` helpers.
 
-    Before:
+    *Carlos Galdino + Rafael Mendonça França*
 
-        form_for(@user, :as => 'client') # => "<form class="client_new">..."
+*   Remove `:mouseover` option from `image_tag` helper. *Rafael Mendonça França*
 
-    Now:
+*   The `select` method (select tag) forces `:include_blank` if `required` is true and
+    `display size` is one and `multiple` is not true. *Angelo Capilleri*
 
-        form_for(@user, :as => 'client') # => "<form class="new_client">..."
+*   Copy literal route constraints to defaults so that url generation know about them.
+    The copied constraints are `:protocol`, `:subdomain`, `:domain`, `:host` and `:port`.
 
-    *Vasiliy Ermolovich*
+    *Andrew White*
 
-*   Allow rescue responses to be configured through a railtie as in `config.action_dispatch.rescue_responses`. Please look at ActiveRecord::Railtie for an example *José Valim*
+*   `respond_to` and `respond_with` now raise `ActionController::UnknownFormat` instead
+    of directly returning head 406. The exception is rescued and converted to 406
+    in the exception handling middleware. *Steven Soroka*
 
-*   Allow fresh_when/stale? to take a record instead of an options hash *DHH*
+*   Allows `assert_redirected_to` to match against a regular expression. *Andy Lindeman*
 
-*   Assets should use the request protocol by default or default to relative if no request is available *Jonathan del Strother*
+*   Add backtrace to development routing error page. *Richard Schneeman*
 
-*   Log "Filter chain halted as CALLBACKNAME rendered or redirected" every time a before callback halts *José Valim*
+*   Replace `include_seconds` boolean argument with `include_seconds: true` option
+    in `distance_of_time_in_words` and `time_ago_in_words` signature. *Dmitriy Kiriyenko*
 
-*   You can provide a namespace for your form to ensure uniqueness of id attributes on form elements.
-    The namespace attribute will be prefixed with underscore on the generate HTML id. *Vasiliy Ermolovich*
+*   Make current object and counter (when it applies) variables accessible when
+    rendering templates with :object / :collection. *Carlos Antonio da Silva*
 
-    Example:
+*   JSONP now uses mimetype `text/javascript` instead of `application/json`. *omjokine*
 
-        <%= form_for(@offer, :namespace => 'namespace') do |f| %>
-          <%= f.label :version, 'Version' %>:
-          <%= f.text_field :version %>
-        <% end %>
+*   Allow to lazy load `default_form_builder` by passing a `String` instead of a constant. *Piotr Sarnacki*
 
-*   Refactor ActionDispatch::ShowExceptions. The controller is responsible for choosing to show exceptions when `consider_all_requests_local` is false.
+*   Session arguments passed to `process` calls in functional tests are now merged into
+    the existing session, whereas previously they would replace the existing session.
+    This change may break some existing tests if they are asserting the exact contents of
+    the session but should not break existing tests that only assert individual keys.
 
-    It's possible to override `show_detailed_exceptions?` in controllers to specify which requests should provide debugging information on errors. The default value is now false, meaning local requests in production will no longer show the detailed exceptions page unless `show_detailed_exceptions?` is overridden and set to `request.local?`.
+    *Andrew White*
 
-*   Responders now return 204 No Content for API requests without a response body (as in the new scaffold) *José Valim*
+*   Add `index` method to FormBuilder class. *Jorge Bejar*
 
-*   Added ActionDispatch::RequestId middleware that'll make a unique X-Request-Id header available to the response and enables the ActionDispatch::Request#uuid method. This makes it easy to trace requests from end-to-end in the stack and to identify individual requests in mixed logs like Syslog *DHH*
+*   Remove the leading \n added by textarea on `assert_select`. *Santiago Pastorino*
 
-*   Limit the number of options for select_year to 1000.
+*   Changed default value for `config.action_view.embed_authenticity_token_in_remote_forms`
+    to `false`. This change breaks remote forms that need to work also without JavaScript,
+    so if you need such behavior, you can either set it to `true` or explicitly pass
+    `authenticity_token: true` in form options.
 
-    Pass the :max_years_allowed option to set your own limit.
+*   Added `ActionDispatch::SSL` middleware that when included force all the requests to be under HTTPS protocol. *Rafael Mendonça França*
 
-    *Libo Cannici*
+*   Add `include_hidden` option to select tag. With `include_hidden: false` select with `multiple` attribute doesn't generate hidden input with blank value. *Vasiliy Ermolovich*
 
-*   Passing formats or handlers to render :template and friends is deprecated. For example: *Nick Sutterer & José Valim*
+*   Removed default `size` option from the `text_field`, `search_field`, `telephone_field`, `url_field`, `email_field` helpers. *Philip Arndt*
 
-        render :template => "foo.html.erb"
+*   Removed default `cols` and `rows` options from the `text_area` helper. *Philip Arndt*
 
-    Instead, you can provide :handlers and :formats directly as option:
-             render :template => "foo", :formats => [:html, :js], :handlers => :erb
+*   Adds support for layouts when rendering a partial with a given collection. *serabe*
 
-*   Changed log level of warning for missing CSRF token from :debug to :warn. *Mike Dillon*
+*   Allows the route helper `root` to take a string argument. For example, `root 'pages#main'`. *bcardarella*
 
-*   content_tag_for and div_for can now take the collection of records. It will also yield the record as the first argument if you set a receiving argument in your block *Prem Sichanugrist*
+*   Forms of persisted records use always PATCH (via the `_method` hack). *fxn*
 
-    So instead of having to do this:
+*   For resources, both PATCH and PUT are routed to the `update` action. *fxn*
 
-        @items.each do |item|
-          content_tag_for(:li, item) do
-             Title: <%= item.title %>
+*   Don't ignore `force_ssl` in development. This is a change of behavior - use a `:if` condition to recreate the old behavior.
+
+        class AccountsController < ApplicationController
+          force_ssl if: :ssl_configured?
+
+          def ssl_configured?
+            !Rails.env.development?
           end
         end
 
-    You can now do this:
+    *Pat Allan*
 
-        content_tag_for(:li, @items) do |item|
-          Title: <%= item.title %>
-        end
+*   Adds support for the PATCH verb:
+      * Request objects respond to `patch?`.
+      * Routes have a new `patch` method, and understand `:patch` in the
+        existing places where a verb is configured, like `:via`.
+      * New method `patch` available in functional tests.
+      * If `:patch` is the default verb for updates, edits are
+        tunneled as PATCH rather than as PUT, and routing acts accordingly.
+      * New method `patch_via_redirect` available in integration tests.
+
+    *dlee*
+
+*   Integration tests support the `OPTIONS` method. *Jeremy Kemper*
+
+*   `expires_in` accepts a `must_revalidate` flag. If true, "must-revalidate"
+    is added to the Cache-Control header. *fxn*
+
+*   Add `date_field` and `date_field_tag` helpers which render an `input[type="date"]` tag *Olek Janiszewski*
+
+*   Adds `image_url`, `javascript_url`, `stylesheet_url`, `audio_url`, `video_url`, and `font_url`
+    to assets tag helper. These URL helpers will return the full path to your assets. This is useful
+    when you are going to reference this asset from external host. *Prem Sichanugrist*
+
+*   Default responder will now always use your overridden block in `respond_with` to render your response. *Prem Sichanugrist*
+
+*   Allow `value_method` and `text_method` arguments from `collection_select` and
+    `options_from_collection_for_select` to receive an object that responds to `:call`,
+    such as a `proc`, to evaluate the option in the current element context. This works
+    the same way with `collection_radio_buttons` and `collection_check_boxes`.
+
+    *Carlos Antonio da Silva + Rafael Mendonça França*
+
+*   Add `collection_check_boxes` form helper, similar to `collection_select`:
+    Example:
+
+        collection_check_boxes :post, :author_ids, Author.all, :id, :name
+        # Outputs something like:
+        <input id="post_author_ids_1" name="post[author_ids][]" type="checkbox" value="1" />
+        <label for="post_author_ids_1">D. Heinemeier Hansson</label>
+        <input id="post_author_ids_2" name="post[author_ids][]" type="checkbox" value="2" />
+        <label for="post_author_ids_2">D. Thomas</label>
+        <input name="post[author_ids][]" type="hidden" value="" />
+
+    The label/check_box pairs can be customized with a block.
+
+    *Carlos Antonio da Silva + Rafael Mendonça França*
+
+*   Add `collection_radio_buttons` form helper, similar to `collection_select`:
+    Example:
+
+        collection_radio_buttons :post, :author_id, Author.all, :id, :name
+        # Outputs something like:
+        <input id="post_author_id_1" name="post[author_id]" type="radio" value="1" />
+        <label for="post_author_id_1">D. Heinemeier Hansson</label>
+        <input id="post_author_id_2" name="post[author_id]" type="radio" value="2" />
+        <label for="post_author_id_2">D. Thomas</label>
+
+    The label/radio_button pairs can be customized with a block.
+
+    *Carlos Antonio da Silva + Rafael Mendonça França*
+
+*   `check_box` with `:form` html5 attribute will now replicate the `:form`
+    attribute to the hidden field as well. *Carlos Antonio da Silva*
+
+*   `label` form helper accepts `for: nil` to not generate the attribute. *Carlos Antonio da Silva*
+
+*   Add `:format` option to `number_to_percentage`. *Rodrigo Flores*
+
+*   Add `config.action_view.logger` to configure logger for Action View. *Rafael Mendonça França*
+
+*   Deprecated `ActionController::Integration` in favour of `ActionDispatch::Integration`.
 
-*   send_file now guess the mime type *Esad Hajdarevic*
+*   Deprecated `ActionController::IntegrationTest` in favour of `ActionDispatch::IntegrationTest`.
 
-*   Mime type entries for PDF, ZIP and other formats were added *Esad Hajdarevic*
+*   Deprecated `ActionController::PerformanceTest` in favour of `ActionDispatch::PerformanceTest`.
 
-*   Generate hidden input before select with :multiple option set to true.
-    This is useful when you rely on the fact that when no options is set,
-    the state of select will be sent to rails application. Without hidden field
-    nothing is sent according to HTML spec *Bogdan Gusiev*
+*   Deprecated `ActionController::AbstractRequest` in favour of `ActionDispatch::Request`.
 
-*   Refactor ActionController::TestCase cookies *Andrew White*
+*   Deprecated `ActionController::Request` in favour of `ActionDispatch::Request`.
 
-    Assigning cookies for test cases should now use cookies[], e.g:
+*   Deprecated `ActionController::AbstractResponse` in favour of `ActionDispatch::Response`.
 
-        cookies[:email] = 'user@example.com'
-        get :index
-        assert_equal 'user@example.com', cookies[:email]
+*   Deprecated `ActionController::Response` in favour of `ActionDispatch::Response`.
 
-    To clear the cookies, use clear, e.g:
+*   Deprecated `ActionController::Routing` in favour of `ActionDispatch::Routing`.
 
-        cookies.clear
-        get :index
-        assert_nil cookies[:email]
+*   `check_box helper` with `disabled: true` will generate a disabled
+    hidden field to conform with the HTML convention where disabled fields are
+    not submitted with the form. This is a behavior change, previously the hidden
+    tag had a value of the disabled checkbox. *Tadas Tamosauskas*
 
-    We now no longer write out HTTP_COOKIE and the cookie jar is
-    persistent between requests so if you need to manipulate the environment
-    for your test you need to do it before the cookie jar is created.
+*   `favicon_link_tag` helper will now use the favicon in app/assets by default. *Lucas Caton*
 
-*   ActionController::ParamsWrapper on ActiveRecord models now only wrap
-    attr_accessible attributes if they were set, if not, only the attributes
-    returned by the class method attribute_names will be wrapped. This fixes
-    the wrapping of nested attributes by adding them to attr_accessible.
+*   `ActionView::Helpers::TextHelper#highlight` now defaults to the
+    HTML5 `mark` element. *Brian Cardarella*
 
-Please check [3-1-stable](https://github.com/rails/rails/blob/3-1-stable/actionpack/CHANGELOG.md) for previous changes.
+Please check [3-2-stable](https://github.com/rails/rails/blob/3-2-stable/actionpack/CHANGELOG.md) for previous changes.