actionpack 8.1.1 → 8.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c53f4cddcbfff66aa4ff4a9ffaafc317d3b08c72b31cff8197a4091275fa67ea
-  data.tar.gz: e76e733e0add77c1edc5f7cbcb919b6b5afa55da290de9f90e0fb42e7c55fe00
+  metadata.gz: b072680373752ca3a9a2b837cac08f7b0f91dd61026dcbad3c8639aff3d3d87e
+  data.tar.gz: 5c5835d778ba95993c1ddb1da5321c5f3b81dc1cd2041ef7ab259e041c694463
 SHA512:
-  metadata.gz: a7b50973de12321c35604c52232fe9452257d7f613b3c59068d3a900042f3cfd22e0aa36507f7f31e86a7031060390136a6a36b2c76e10a602c8c4309a893e41
-  data.tar.gz: 4b67fa19b19074660c1ceae3ec08470408cf19a59f851da9bf8471ca3bb5bf50add910c7e904e7190e0cfc78bdffebaec04493c55fb4c2f0e3009d46ab83c8b4
+  metadata.gz: 0b7ba997d7ee51886a1c6e1c49c397b60deb477c5608f54740529c21857142ed45d79a6a4f5aa917095f2005199d2289153223b54d57cb4249b11226d64558ef
+  data.tar.gz: d2a9daa41336f39a153b0c2e864edf732533a768a38385795a2a8e86b34e4ff10969be62b83e635d3e517e497726f9346609a7ecb48a39f3aa9d7c02888cad22

data/CHANGELOG.md

@@ -1,3 +1,30 @@
+## Rails 8.1.2 (January 08, 2026) ##
+
+*   Add `config.action_controller.live_streaming_excluded_keys` to control execution state sharing in ActionController::Live.
+
+    When using ActionController::Live, actions are executed in a separate thread that shares
+    state from the parent thread. This new configuration allows applications to opt-out specific
+    state keys that should not be shared.
+
+    This is useful when streaming inside a `connected_to` block, where you may want
+    the streaming thread to use its own database connection context.
+
+    ```ruby
+    # config/application.rb
+    config.action_controller.live_streaming_excluded_keys = [:active_record_connected_to_stack]
+    ```
+
+    By default, all keys are shared.
+
+    *Eileen M. Uchitelle*
+
+*   Fix `IpSpoofAttackError` message to include `Forwarded` header content.
+
+    Without it, the error message may be misleading.
+
+    *zzak*
+
+
 ## Rails 8.1.1 (October 28, 2025) ##
 
 *   Allow methods starting with underscore to be action methods.

data/lib/action_controller/log_subscriber.rb

@@ -52,7 +52,11 @@ module ActionController
     # Manually subscribed below
     def rescue_from_callback(event)
       exception = event.payload[:exception]
-      info { "rescue_from handled #{exception.class} (#{exception.message}) - #{exception.backtrace.first.delete_prefix("#{Rails.root}/")}" }
+
+      exception_backtrace = exception.backtrace&.first
+      exception_backtrace = exception_backtrace&.delete_prefix("#{Rails.root}/") if defined?(Rails.root) && Rails.root
+
+      info { "rescue_from handled #{exception.class} (#{exception.message}) - #{exception_backtrace}" }
     end
     subscribe_log_level :rescue_from_callback, :info
 

data/lib/action_controller/metal/live.rb

@@ -53,9 +53,50 @@ module ActionController
   #       response.headers["Last-Modified"] = Time.now.httpdate # Add this line if your Rack version is 2.2.x
   #       ...
   #     end
+  #
+  # ## Streaming and Execution State
+  #
+  # When streaming, the action is executed in a separate thread. By default, this thread
+  # shares execution state from the parent thread.
+  #
+  # You can configure which execution state keys should be excluded from being shared
+  # using the `config.action_controller.live_streaming_excluded_keys` configuration:
+  #
+  #   # config/application.rb
+  #   config.action_controller.live_streaming_excluded_keys = [:active_record_connected_to_stack]
+  #
+  # This is useful when using ActionController::Live inside a `connected_to` block. For example,
+  # if the parent request is reading from a replica using `connected_to(role: :reading)`, you may
+  # want the streaming thread to use its own connection context instead of inheriting the read-only
+  # context:
+  #
+  #   # Without configuration, streaming thread inherits read-only connection
+  #   ActiveRecord::Base.connected_to(role: :reading) do
+  #     @posts = Post.all
+  #     render stream: true # Streaming thread cannot write to database
+  #   end
+  #
+  #   # With configuration, streaming thread gets fresh connection context
+  #   # config.action_controller.live_streaming_excluded_keys = [:active_record_connected_to_stack]
+  #   ActiveRecord::Base.connected_to(role: :reading) do
+  #     @posts = Post.all
+  #     render stream: true # Streaming thread can write to database if needed
+  #   end
+  #
+  # Common keys you might want to exclude:
+  # - `:active_record_connected_to_stack` - Database connection routing and roles
+  # - `:active_record_prohibit_shard_swapping` - Shard swapping restrictions
+  #
+  # By default, no keys are excluded to maintain backward compatibility.
   module Live
     extend ActiveSupport::Concern
 
+    mattr_accessor :live_streaming_excluded_keys, default: []
+
+    included do
+      class_attribute :live_streaming_excluded_keys, instance_accessor: false, default: Live.live_streaming_excluded_keys
+    end
+
     module ClassMethods
       def make_response!(request)
         if (request.get_header("SERVER_PROTOCOL") || request.get_header("HTTP_VERSION")) == "HTTP/1.0"
@@ -278,7 +319,8 @@ module ActionController
           # Since we're processing the view in a different thread, copy the thread locals
           # from the main thread to the child thread. :'(
           locals.each { |k, v| t2[k] = v }
-          ActiveSupport::IsolatedExecutionState.share_with(t1) do
+
+          ActiveSupport::IsolatedExecutionState.share_with(t1, except: self.class.live_streaming_excluded_keys) do
             super(name)
           rescue => e
             if @_response.committed?

data/lib/action_controller/metal/redirecting.rb

@@ -117,7 +117,7 @@ module ActionController
     # The `action_on_open_redirect` configuration option controls the behavior when an unsafe
     # redirect is detected:
     # * `:log` - Logs a warning but allows the redirect
-    # * `:notify` - Sends an ActiveSupport notification for monitoring
+    # * `:notify` - Sends an Active Support notification for monitoring
     # * `:raise` - Raises an UnsafeRedirectError
     #
     # To allow any external redirects pass `allow_other_host: true`, though using a
@@ -144,7 +144,7 @@ module ActionController
     #     config.action_controller.action_on_path_relative_redirect = :raise
     #
     # * `:log` - Logs a warning but allows the redirect
-    # * `:notify` - Sends an ActiveSupport notification but allows the redirect
+    # * `:notify` - Sends an Active Support notification but allows the redirect
     #   (includes stack trace to help identify the source)
     # * `:raise` - Raises an UnsafeRedirectError
     def redirect_to(options = {}, response_options = {})

data/lib/action_controller/railtie.rb

@@ -33,6 +33,10 @@ module ActionController
       ActionController::Helpers.helpers_path = app.helpers_paths
     end
 
+    initializer "action_controller.live_streaming_excluded_keys" do |app|
+      ActionController::Live.live_streaming_excluded_keys = app.config.action_controller.live_streaming_excluded_keys
+    end
+
     initializer "action_controller.parameters_config" do |app|
       options = app.config.action_controller
 
@@ -83,6 +87,7 @@ module ActionController
           :action_on_unpermitted_parameters,
           :always_permitted_parameters,
           :wrap_parameters_by_default,
+          :live_streaming_excluded_keys
         )
 
         filtered_options.each do |k, v|

data/lib/action_controller/structured_event_subscriber.rb

@@ -46,10 +46,14 @@ module ActionController
 
     def rescue_from_callback(event)
       exception = event.payload[:exception]
+
+      exception_backtrace = exception.backtrace&.first
+      exception_backtrace = exception_backtrace&.delete_prefix("#{Rails.root}/") if defined?(Rails.root) && Rails.root
+
       emit_event("action_controller.rescue_from_handled",
         exception_class: exception.class.name,
         exception_message: exception.message,
-        exception_backtrace: exception.backtrace&.first&.delete_prefix("#{Rails.root}/")
+        exception_backtrace:
       )
     end
 

data/lib/action_dispatch/middleware/remote_ip.rb

@@ -152,7 +152,8 @@ module ActionDispatch
           # We don't know which came from the proxy, and which from the user
           raise IpSpoofAttackError, "IP spoofing attack?! " \
             "HTTP_CLIENT_IP=#{@req.client_ip.inspect} " \
-            "HTTP_X_FORWARDED_FOR=#{@req.x_forwarded_for.inspect}"
+            "HTTP_X_FORWARDED_FOR=#{@req.x_forwarded_for.inspect}" \
+            " HTTP_FORWARDED=" + @req.forwarded_for.map { "for=#{_1}" }.join(", ").inspect if @req.forwarded_for.any?
         end
 
         # We assume these things about the IP headers:

data/lib/action_dispatch/system_test_case.rb

@@ -22,8 +22,8 @@ module ActionDispatch
   #
   # To create a system test in your application, extend your test class from
   # `ApplicationSystemTestCase`. System tests use Capybara as a base and allow you
-  # to configure the settings through your `application_system_test_case.rb` file
-  # that is generated with a new application or scaffold.
+  # to configure the settings through the `application_system_test_case.rb` file,
+  # which is created when you generate your first system test.
   #
   # Here is an example system test:
   #
@@ -41,7 +41,7 @@ module ActionDispatch
   #       end
   #     end
   #
-  # When generating an application or scaffold, an
+  # When generating system tests, an
   # `application_system_test_case.rb` file will also be generated containing the
   # base class for system testing. This is where you can change the driver, add
   # Capybara settings, and other configuration for your system tests.

data/lib/action_pack/gem_version.rb

@@ -11,7 +11,7 @@ module ActionPack
   module VERSION
     MAJOR = 8
     MINOR = 1
-    TINY  = 1
+    TINY  = 2
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: actionpack
 version: !ruby/object:Gem::Version
-  version: 8.1.1
+  version: 8.1.2
 platform: ruby
 authors:
 - David Heinemeier Hansson
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.1
+        version: 8.1.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.1
+        version: 8.1.2
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -127,28 +127,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.1
+        version: 8.1.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.1
+        version: 8.1.2
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.1
+        version: 8.1.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.1
+        version: 8.1.2
 description: Web apps on Rails. Simple, battle-tested conventions for building and
   testing MVC web applications. Works with any Rack-compatible server.
 email: david@loudthinking.com
@@ -352,10 +352,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v8.1.1/actionpack/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v8.1.1/
+  changelog_uri: https://github.com/rails/rails/blob/v8.1.2/actionpack/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v8.1.2/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v8.1.1/actionpack
+  source_code_uri: https://github.com/rails/rails/tree/v8.1.2/actionpack
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
@@ -372,7 +372,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 3.6.9
+rubygems_version: 4.0.3
 specification_version: 4
 summary: Web-flow and rendering framework putting the VC in MVC (part of Rails).
 test_files: []