activerecord 6.1.4.7 → 6.1.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6f94e41ee3dad511c9bd2fd67fa6527edc7097afc47ed29c8dfcf35f85d30b93
-  data.tar.gz: 60b172857703fad8ec944dc0c7015935caae5b3f794eccf9658693270883af6d
+  metadata.gz: c9b76baff5a3e39a0efb5a3780007e80b4da0ab9518c2707d120d035dc8c77ec
+  data.tar.gz: b4bf736f8d49fe9f3f65c6c0a763b138fdbcafbc0ab808e2bb9bd16c9bca6620
 SHA512:
-  metadata.gz: 631129932dee2df2645c38ee17a8b6d5064b45ef0acb48d73cce6a2d66f8e233c5c351ef10ba398dcc712d7ec6570d15bf57a552fd66967c41e748b6c22782ea
-  data.tar.gz: b79336dec7a85e5a52d2ad93e620081bd81e548b9730a1ffa2b543c4f67c6b7079410cac808c98a18271a3ac0fa510d8ce4df6b14b010da13bdcf370fef0e494
+  metadata.gz: 8a3961a9e8a96f9333e08cce6f4e1b3747e6d58e60a60353a1ab0f5512423c5b64c6796bf782f98f3080e5558f26a9875d5bf0f3a4f2ecb36edbb86d4fe2abb1
+  data.tar.gz: 3cf8d6bde005afc71b62ebb545457896b899cf2f2a0d78512e3f1134fe0226e58579e3e3b80a19c3130ea8a5a53dfb98c5b3273ee0c38e28c34c4f474d672aa5

data/CHANGELOG.md

@@ -1,3 +1,174 @@
+## Rails 6.1.7.1 (January 17, 2023) ##
+
+*   Make sanitize_as_sql_comment more strict
+
+    Though this method was likely never meant to take user input, it was
+    attempting sanitization. That sanitization could be bypassed with
+    carefully crafted input.
+
+    This commit makes the sanitization more robust by replacing any
+    occurrances of "/*" or "*/" with "/ *" or "* /". It also performs a
+    first pass to remove one surrounding comment to avoid compatibility
+    issues for users relying on the existing removal.
+
+    This also clarifies in the documentation of annotate that it should not
+    be provided user input.
+
+    [CVE-2023-22794]
+
+*   Added integer width check to PostgreSQL::Quoting
+
+    Given a value outside the range for a 64bit signed integer type
+    PostgreSQL will treat the column type as numeric. Comparing
+    integer values against numeric values can result in a slow
+    sequential scan.
+
+    This behavior is configurable via
+    ActiveRecord::Base.raise_int_wider_than_64bit which defaults to true.
+
+    [CVE-2022-44566]
+
+## Rails 6.1.7 (September 09, 2022) ##
+
+*   Symbol is allowed by default for YAML columns
+
+    *Étienne Barrié*
+
+*   Fix `ActiveRecord::Store` to serialize as a regular Hash
+
+    Previously it would serialize as an `ActiveSupport::HashWithIndifferentAccess`
+    which is wasteful and cause problem with YAML safe_load.
+
+    *Jean Boussier*
+
+*   Fix PG.connect keyword arguments deprecation warning on ruby 2.7
+
+    Fixes #44307.
+
+    *Nikita Vasilevsky*
+
+## Rails 6.1.6.1 (July 12, 2022) ##
+
+*   Change ActiveRecord::Coders::YAMLColumn default to safe_load
+
+    This adds two new configuration options The configuration options are as
+    follows:
+    
+    * `config.active_storage.use_yaml_unsafe_load`
+    
+    When set to true, this configuration option tells Rails to use the old
+    "unsafe" YAML loading strategy, maintaining the existing behavior but leaving
+    the possible escalation vulnerability in place.  Setting this option to true
+    is *not* recommended, but can aid in upgrading.
+    
+    * `config.active_record.yaml_column_permitted_classes`
+    
+    The "safe YAML" loading method does not allow all classes to be deserialized
+    by default.  This option allows you to specify classes deemed "safe" in your
+    application.  For example, if your application uses Symbol and Time in
+    serialized data, you can add Symbol and Time to the allowed list as follows:
+    
+    ```
+    config.active_record.yaml_column_permitted_classes = [Symbol, Date, Time]
+    ```
+
+    [CVE-2022-32224]
+
+
+## Rails 6.1.6 (May 09, 2022) ##
+
+*   No changes.
+
+
+## Rails 6.1.5.1 (April 26, 2022) ##
+
+*   No changes.
+
+
+## Rails 6.1.5 (March 09, 2022) ##
+
+*   Fix `ActiveRecord::ConnectionAdapters::SchemaCache#deep_deduplicate` for Ruby 2.6.
+
+    Ruby 2.6 and 2.7 have slightly different implementations of the `String#-@` method.
+    In Ruby 2.6, the receiver of the `String#-@` method is modified under certain circumstances.
+    This was later identified as a bug (https://bugs.ruby-lang.org/issues/15926) and only
+    fixed in Ruby 2.7.
+
+    Before the changes in this commit, the
+    `ActiveRecord::ConnectionAdapters::SchemaCache#deep_deduplicate` method, which internally
+    calls the `String#-@` method, could also modify an input string argument in Ruby 2.6 --
+    changing a tainted, unfrozen string into a tainted, frozen string.
+
+    Fixes #43056
+
+    *Eric O'Hanlon*
+
+*   Fix migration compatibility to create SQLite references/belongs_to column as integer when
+    migration version is 6.0.
+
+    `reference`/`belongs_to` in migrations with version 6.0 were creating columns as
+    bigint instead of integer for the SQLite Adapter.
+
+    *Marcelo Lauxen*
+
+*   Fix dbconsole for 3-tier config.
+
+    *Eileen M. Uchitelle*
+
+*   Better handle SQL queries with invalid encoding.
+
+    ```ruby
+    Post.create(name: "broken \xC8 UTF-8")
+    ```
+
+    Would cause all adapters to fail in a non controlled way in the code
+    responsible to detect write queries.
+
+    The query is now properly passed to the database connection, which might or might
+    not be able to handle it, but will either succeed or failed in a more correct way.
+
+    *Jean Boussier*
+
+*   Ignore persisted in-memory records when merging target lists.
+
+    *Kevin Sjöberg*
+
+*   Fix regression bug that caused ignoring additional conditions for preloading
+    `has_many` through relations.
+
+    Fixes #43132
+
+    *Alexander Pauly*
+
+*   Fix `ActiveRecord::InternalMetadata` to not be broken by
+    `config.active_record.record_timestamps = false`
+
+    Since the model always create the timestamp columns, it has to set them, otherwise it breaks
+    various DB management tasks.
+
+    Fixes #42983
+
+    *Jean Boussier*
+
+*   Fix duplicate active record objects on `inverse_of`.
+
+    *Justin Carvalho*
+
+*   Fix duplicate objects stored in has many association after save.
+
+    Fixes #42549.
+
+    *Alex Ghiculescu*
+
+*   Fix performance regression in `CollectionAssocation#build`.
+
+    *Alex Ghiculescu*
+
+*   Fix retrieving default value for text column for MariaDB.
+
+    *fatkodima*
+
+
 ## Rails 6.1.4.7 (March 08, 2022) ##
 
 *   No changes.
@@ -102,10 +273,10 @@
     ```
 
     In the example, `dog.treats` would still raise even though
-    `strict_loading` was set to false. This is a bug effecting more than
-    Active Storage which is why I made this PR superceeding #41461. We need
+    `strict_loading` was set to false. This is a bug affecting more than
+    Active Storage which is why I made this PR superseding #41461. We need
     to fix this for all applications since the behavior is a little
-    surprising. I took the test from ##41461 and the code suggestion from #41453
+    surprising. I took the test from #41461 and the code suggestion from #41453
     with some additions.
 
     *Eileen M. Uchitelle*, *Radamés Roriz*
@@ -607,7 +778,7 @@
 
         attribute :duration, :interval
 
-    To keep old behavior until 6.2 is released:
+    To keep old behavior until 7.0 is released:
 
         attribute :duration, :string
 
@@ -779,8 +950,8 @@
     *Ryuta Kamizono*
 
 *   Merging conditions on the same column no longer maintain both conditions,
-    and will be consistently replaced by the latter condition in Rails 6.2.
-    To migrate to Rails 6.2's behavior, use `relation.merge(other, rewhere: true)`.
+    and will be consistently replaced by the latter condition in Rails 7.0.
+    To migrate to Rails 7.0's behavior, use `relation.merge(other, rewhere: true)`.
 
     ```ruby
     # Rails 6.1 (IN clause is replaced by merger side equality condition)
@@ -789,10 +960,10 @@
     # Rails 6.1 (both conflict conditions exists, deprecated)
     Author.where(id: david.id..mary.id).merge(Author.where(id: bob)) # => []
 
-    # Rails 6.1 with rewhere to migrate to Rails 6.2's behavior
+    # Rails 6.1 with rewhere to migrate to Rails 7.0's behavior
     Author.where(id: david.id..mary.id).merge(Author.where(id: bob), rewhere: true) # => [bob]
 
-    # Rails 6.2 (same behavior with IN clause, mergee side condition is consistently replaced)
+    # Rails 7.0 (same behavior with IN clause, mergee side condition is consistently replaced)
     Author.where(id: [david.id, mary.id]).merge(Author.where(id: bob)) # => [bob]
     Author.where(id: david.id..mary.id).merge(Author.where(id: bob)) # => [bob]
     ```
@@ -884,7 +1055,7 @@
 
 *   Deprecate aggregations with group by duplicated fields.
 
-    To migrate to Rails 6.2's behavior, use `uniq!(:group)` to deduplicate group fields.
+    To migrate to Rails 7.0's behavior, use `uniq!(:group)` to deduplicate group fields.
 
     ```ruby
     accounts = Account.group(:firm_id)
@@ -908,7 +1079,7 @@
 
 *   Deprecate duplicated query annotations.
 
-    To migrate to Rails 6.2's behavior, use `uniq!(:annotate)` to deduplicate query annotations.
+    To migrate to Rails 7.0's behavior, use `uniq!(:annotate)` to deduplicate query annotations.
 
     ```ruby
     accounts = Account.where(id: [1, 2]).annotate("david and mary")
@@ -1329,13 +1500,13 @@
 
 *   Deprecate `#remove_connection` in favor of `#remove_connection_pool` when called on the handler.
 
-    `#remove_connection` is deprecated in order to support returning a `DatabaseConfig` object instead of a `Hash`. Use `#remove_connection_pool`, `#remove_connection` will be removed in 6.2.
+    `#remove_connection` is deprecated in order to support returning a `DatabaseConfig` object instead of a `Hash`. Use `#remove_connection_pool`, `#remove_connection` will be removed in Rails 7.0.
 
     *Eileen M. Uchitelle*, *John Crepezzi*
 
 *   Deprecate `#default_hash` and it's alias `#[]` on database configurations.
 
-    Applications should use `configs_for`. `#default_hash` and `#[]` will be removed in 6.2.
+    Applications should use `configs_for`. `#default_hash` and `#[]` will be removed in Rails 7.0.
 
     *Eileen M. Uchitelle*, *John Crepezzi*
 

data/MIT-LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2004-2020 David Heinemeier Hansson
+Copyright (c) 2004-2022 David Heinemeier Hansson
 
 Arel originally copyright (c) 2007-2016 Nick Kallen, Bryan Helmkamp, Emilio Tagua, Aaron Patterson
 

data/lib/active_record/associations/collection_association.rb

@@ -75,6 +75,7 @@ module ActiveRecord
       def reset
         super
         @target = []
+        @replaced_or_added_targets = Set.new
         @association_ids = nil
       end
 
@@ -279,10 +280,7 @@ module ActiveRecord
       end
 
       def add_to_target(record, skip_callbacks: false, replace: false, &block)
-        if replace || association_scope.distinct_value
-          index = @target.index(record)
-        end
-        replace_on_target(record, index, skip_callbacks, &block)
+        replace_on_target(record, skip_callbacks, replace: replace || association_scope.distinct_value, &block)
       end
 
       def target=(record)
@@ -292,7 +290,7 @@ module ActiveRecord
         when Array
           super
         else
-          add_to_target(record, skip_callbacks: true, replace: true)
+          replace_on_target(record, true, replace: true, inversing: true)
         end
       end
 
@@ -342,7 +340,7 @@ module ActiveRecord
             end
           end
 
-          persisted + memory
+          persisted + memory.reject(&:persisted?)
         end
 
         def _create_record(attributes, raise = false, &block)
@@ -425,7 +423,7 @@ module ActiveRecord
           common_records = intersection(new_target, original_target)
           common_records.each do |record|
             skip_callbacks = true
-            replace_on_target(record, @target.index(record), skip_callbacks)
+            replace_on_target(record, skip_callbacks, replace: true)
           end
         end
 
@@ -448,7 +446,11 @@ module ActiveRecord
           records
         end
 
-        def replace_on_target(record, index, skip_callbacks)
+        def replace_on_target(record, skip_callbacks, replace:, inversing: false)
+          if replace && (!record.new_record? || @replaced_or_added_targets.include?(record))
+            index = @target.index(record)
+          end
+
           catch(:abort) do
             callback(:before_add, record)
           end || return unless skip_callbacks
@@ -459,6 +461,12 @@ module ActiveRecord
 
           yield(record) if block_given?
 
+          if !index && @replaced_or_added_targets.include?(record)
+            index = @target.index(record)
+          end
+
+          @replaced_or_added_targets << record if inversing || index || record.new_record?
+
           if index
             target[index] = record
           elsif @_was_loaded || !loaded?

data/lib/active_record/associations/preloader/association.rb

@@ -129,9 +129,7 @@ module ActiveRecord
           end
 
           def reflection_scope
-            @reflection_scope ||= begin
-              reflection.join_scopes(klass.arel_table, klass.predicate_builder, klass).inject(&:merge!) || klass.unscoped
-            end
+            @reflection_scope ||= reflection.join_scopes(klass.arel_table, klass.predicate_builder, klass).inject(klass.unscoped, &:merge!)
           end
 
           def build_scope

data/lib/active_record/coders/yaml_column.rb

@@ -47,11 +47,23 @@ module ActiveRecord
 
         if YAML.respond_to?(:unsafe_load)
           def yaml_load(payload)
-            YAML.unsafe_load(payload)
+            if ActiveRecord::Base.use_yaml_unsafe_load
+              YAML.unsafe_load(payload)
+            elsif YAML.method(:safe_load).parameters.include?([:key, :permitted_classes])
+              YAML.safe_load(payload, permitted_classes: ActiveRecord::Base.yaml_column_permitted_classes, aliases: true)
+            else
+              YAML.safe_load(payload, ActiveRecord::Base.yaml_column_permitted_classes, [], true)
+            end
           end
         else
           def yaml_load(payload)
-            YAML.load(payload)
+            if ActiveRecord::Base.use_yaml_unsafe_load
+              YAML.load(payload)
+            elsif YAML.method(:safe_load).parameters.include?([:key, :permitted_classes])
+              YAML.safe_load(payload, permitted_classes: ActiveRecord::Base.yaml_column_permitted_classes, aliases: true)
+            else
+              YAML.safe_load(payload, ActiveRecord::Base.yaml_column_permitted_classes, [], true)
+            end
           end
         end
     end

data/lib/active_record/connection_adapters/abstract/connection_pool.rb

@@ -1177,7 +1177,7 @@ module ActiveRecord
           return owner_to_pool_manager[owner] if owner_to_pool_manager.key?(owner)
 
           if owner == "primary"
-            ActiveSupport::Deprecation.warn("Using `\"primary\"` as a `connection_specification_name` is deprecated and will be removed in Rails 6.2.0. Please use `ActiveRecord::Base`.")
+            ActiveSupport::Deprecation.warn("Using `\"primary\"` as a `connection_specification_name` is deprecated and will be removed in Rails 7.0.0. Please use `ActiveRecord::Base`.")
             owner_to_pool_manager[Base.name]
           end
         end

data/lib/active_record/connection_adapters/abstract/quoting.rb

@@ -12,7 +12,7 @@ module ActiveRecord
         if value.is_a?(Base)
           ActiveSupport::Deprecation.warn(<<~MSG)
             Passing an Active Record object to `quote` directly is deprecated
-            and will be no longer quoted as id value in Rails 6.2.
+            and will be no longer quoted as id value in Rails 7.0.
           MSG
           value = value.id_for_database
         end
@@ -27,14 +27,14 @@ module ActiveRecord
         if value.is_a?(Base)
           ActiveSupport::Deprecation.warn(<<~MSG)
             Passing an Active Record object to `type_cast` directly is deprecated
-            and will be no longer type casted as id value in Rails 6.2.
+            and will be no longer type casted as id value in Rails 7.0.
           MSG
           value = value.id_for_database
         end
 
         if column
           ActiveSupport::Deprecation.warn(<<~MSG)
-            Passing a column to `type_cast` is deprecated and will be removed in Rails 6.2.
+            Passing a column to `type_cast` is deprecated and will be removed in Rails 7.0.
           MSG
           type = lookup_cast_type_from_column(column)
           value = type.serialize(value)
@@ -138,7 +138,16 @@ module ActiveRecord
       end
 
       def sanitize_as_sql_comment(value) # :nodoc:
-        value.to_s.gsub(%r{ (/ (?: | \g<1>) \*) \+? \s* | \s* (\* (?: | \g<2>) /) }x, "")
+        # Sanitize a string to appear within a SQL comment
+        # For compatibility, this also surrounding "/*+", "/*", and "*/"
+        # charcacters, possibly with single surrounding space.
+        # Then follows that by replacing any internal "*/" or "/ *" with
+        # "* /" or "/ *"
+        comment = value.to_s.dup
+        comment.gsub!(%r{\A\s*/\*\+?\s?|\s?\*/\s*\Z}, "")
+        comment.gsub!("*/", "* /")
+        comment.gsub!("/*", "/ *")
+        comment
       end
 
       def column_name_matcher # :nodoc:

data/lib/active_record/connection_adapters/abstract/schema_definitions.rb

@@ -198,6 +198,10 @@ module ActiveRecord
 
         def index_options(table_name)
           index_options = as_options(index)
+
+          # legacy reference index names are used on versions 6.0 and earlier
+          return index_options if options[:_uses_legacy_reference_index_name]
+
           index_options[:name] ||= polymorphic_index_name(table_name) if polymorphic
           index_options
         end

data/lib/active_record/connection_adapters/mysql/database_statements.rb

@@ -26,6 +26,8 @@ module ActiveRecord
 
         def write_query?(sql) # :nodoc:
           !READ_QUERY.match?(sql)
+        rescue ArgumentError # Invalid encoding
+          !READ_QUERY.match?(sql.b)
         end
 
         def explain(arel, binds = [])

data/lib/active_record/connection_adapters/mysql/schema_statements.rb

@@ -167,6 +167,9 @@ module ActiveRecord
             elsif type_metadata.extra == "DEFAULT_GENERATED"
               default = +"(#{default})" unless default.start_with?("(")
               default, default_function = nil, default
+            elsif type_metadata.type == :text && default
+              # strip and unescape quotes
+              default = default[1...-1].gsub("\\'", "'")
             end
 
             MySQL::Column.new(
@@ -203,7 +206,7 @@ module ActiveRecord
           def data_source_sql(name = nil, type: nil)
             scope = quoted_scope(name, type: type)
 
-            sql = +"SELECT table_name FROM (SELECT * FROM information_schema.tables "
+            sql = +"SELECT table_name FROM (SELECT table_name, table_type FROM information_schema.tables "
             sql << " WHERE table_schema = #{scope[:schema]}) _subquery"
             if scope[:type] || scope[:name]
               conditions = []

data/lib/active_record/connection_adapters/postgresql/database_statements.rb

@@ -28,6 +28,8 @@ module ActiveRecord
 
         def write_query?(sql) # :nodoc:
           !READ_QUERY.match?(sql)
+        rescue ArgumentError # Invalid encoding
+          !READ_QUERY.match?(sql.b)
         end
 
         # Executes an SQL statement, returning a PG::Result object on success

data/lib/active_record/connection_adapters/postgresql/quoting.rb

@@ -4,6 +4,12 @@ module ActiveRecord
   module ConnectionAdapters
     module PostgreSQL
       module Quoting
+        class IntegerOutOf64BitRange < StandardError
+          def initialize(msg)
+            super(msg)
+          end
+        end
+
         # Escapes binary strings for bytea input to the database.
         def escape_bytea(value)
           @connection.escape_bytea(value) if value
@@ -120,7 +126,27 @@ module ActiveRecord
             super(query_value("SELECT #{quote(sql_type)}::regtype::oid", "SCHEMA").to_i)
           end
 
+          def check_int_in_range(value)
+            if value.to_int > 9223372036854775807 || value.to_int < -9223372036854775808
+              exception = <<~ERROR
+                Provided value outside of the range of a signed 64bit integer.
+
+                PostgreSQL will treat the column type in question as a numeric.
+                This may result in a slow sequential scan due to a comparison
+                being performed between an integer or bigint value and a numeric value.
+
+                To allow for this potentially unwanted behavior, set
+                ActiveRecord::Base.raise_int_wider_than_64bit to false.
+              ERROR
+              raise IntegerOutOf64BitRange.new exception
+            end
+          end
+
           def _quote(value)
+            if ActiveRecord::Base.raise_int_wider_than_64bit && value.is_a?(Integer)
+              check_int_in_range(value)
+            end
+
             case value
             when OID::Xml::Data
               "xml '#{quote_string(value.to_s)}'"

data/lib/active_record/connection_adapters/postgresql_adapter.rb

@@ -75,7 +75,7 @@ module ActiveRecord
 
       class << self
         def new_client(conn_params)
-          PG.connect(conn_params)
+          PG.connect(**conn_params)
         rescue ::PG::Error => error
           if conn_params && conn_params[:dbname] && error.message.include?(conn_params[:dbname])
             raise ActiveRecord::NoDatabaseError
@@ -247,7 +247,7 @@ module ActiveRecord
       def initialize(connection, logger, connection_parameters, config)
         super(connection, logger, config)
 
-        @connection_parameters = connection_parameters
+        @connection_parameters = connection_parameters || {}
 
         # @local_tz is initialized as nil to avoid warnings when connect tries to use it
         @local_tz = nil

data/lib/active_record/connection_adapters/schema_cache.rb

@@ -198,16 +198,40 @@ module ActiveRecord
           @indexes      = deep_deduplicate(@indexes)
         end
 
-        def deep_deduplicate(value)
-          case value
-          when Hash
-            value.transform_keys { |k| deep_deduplicate(k) }.transform_values { |v| deep_deduplicate(v) }
-          when Array
-            value.map { |i| deep_deduplicate(i) }
-          when String, Deduplicable
-            -value
-          else
-            value
+        if RUBY_VERSION < "2.7"
+          def deep_deduplicate(value)
+            case value
+            when Hash
+              value.transform_keys { |k| deep_deduplicate(k) }.transform_values { |v| deep_deduplicate(v) }
+            when Array
+              value.map { |i| deep_deduplicate(i) }
+            when String
+              if value.tainted?
+                # Ruby 2.6 and 2.7 have slightly different implementations of the String#-@ method.
+                # In Ruby 2.6, the receiver of the String#-@ method is modified under certain
+                # circumstances, and this was later identified as a bug
+                # (https://bugs.ruby-lang.org/issues/15926) and only fixed in Ruby 2.7.
+                value = value.dup
+              end
+              -value
+            when Deduplicable
+              -value
+            else
+              value
+            end
+          end
+        else
+          def deep_deduplicate(value)
+            case value
+            when Hash
+              value.transform_keys { |k| deep_deduplicate(k) }.transform_values { |v| deep_deduplicate(v) }
+            when Array
+              value.map { |i| deep_deduplicate(i) }
+            when String, Deduplicable
+              -value
+            else
+              value
+            end
           end
         end
 

data/lib/active_record/connection_adapters/sqlite3/database_statements.rb

@@ -11,6 +11,8 @@ module ActiveRecord
 
         def write_query?(sql) # :nodoc:
           !READ_QUERY.match?(sql)
+        rescue ArgumentError # Invalid encoding
+          !READ_QUERY.match?(sql.b)
         end
 
         def explain(arel, binds = [])

data/lib/active_record/connection_handling.rb

@@ -135,7 +135,7 @@ module ActiveRecord
     #     Dog.first # finds first Dog record stored on the shard one replica
     #   end
     #
-    # The database kwarg is deprecated and will be removed in 6.2.0 without replacement.
+    # The database kwarg is deprecated and will be removed in Rails 7.0.0 without replacement.
     def connected_to(database: nil, role: nil, shard: nil, prevent_writes: false, &blk)
       if legacy_connection_handling
         if self != Base
@@ -154,7 +154,7 @@ module ActiveRecord
       if database && (role || shard)
         raise ArgumentError, "`connected_to` cannot accept a `database` argument with any other arguments."
       elsif database
-        ActiveSupport::Deprecation.warn("The database key in `connected_to` is deprecated. It will be removed in Rails 6.2.0 without replacement.")
+        ActiveSupport::Deprecation.warn("The database key in `connected_to` is deprecated. It will be removed in Rails 7.0.0 without replacement.")
 
         if database.is_a?(Hash)
           role, database = database.first

data/lib/active_record/core.rb

@@ -155,6 +155,21 @@ module ActiveRecord
 
       mattr_accessor :legacy_connection_handling, instance_writer: false, default: true
 
+      # Application configurable boolean that instructs the YAML Coder to use
+      # an unsafe load if set to true.
+      mattr_accessor :use_yaml_unsafe_load, instance_writer: false, default: false
+
+      # Application configurable array that provides additional permitted classes
+      # to Psych safe_load in the YAML Coder
+      mattr_accessor :yaml_column_permitted_classes, instance_writer: false, default: [Symbol]
+
+      ##
+      # :singleton-method:
+      # Application configurable boolean that denotes whether or not to raise
+      # an exception when the PostgreSQLAdapter is provided with an integer that is
+      # wider than signed 64bit representation
+      mattr_accessor :raise_int_wider_than_64bit, instance_writer: false, default: true
+
       self.filter_attributes = []
 
       def self.connection_handler
@@ -278,11 +293,11 @@ module ActiveRecord
       end
 
       def self.allow_unsafe_raw_sql # :nodoc:
-        ActiveSupport::Deprecation.warn("ActiveRecord::Base.allow_unsafe_raw_sql is deprecated and will be removed in Rails 6.2")
+        ActiveSupport::Deprecation.warn("ActiveRecord::Base.allow_unsafe_raw_sql is deprecated and will be removed in Rails 7.0")
       end
 
       def self.allow_unsafe_raw_sql=(value) # :nodoc:
-        ActiveSupport::Deprecation.warn("ActiveRecord::Base.allow_unsafe_raw_sql= is deprecated and will be removed in Rails 6.2")
+        ActiveSupport::Deprecation.warn("ActiveRecord::Base.allow_unsafe_raw_sql= is deprecated and will be removed in Rails 7.0")
       end
 
       self.default_connection_handler = ConnectionAdapters::ConnectionHandler.new

data/lib/active_record/database_configurations/connection_url_resolver.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "uri"
 require "active_support/core_ext/enumerable"
 
 module ActiveRecord

data/lib/active_record/database_configurations/hash_config.rb

@@ -32,7 +32,7 @@ module ActiveRecord
       end
 
       def config
-        ActiveSupport::Deprecation.warn("DatabaseConfig#config will be removed in 6.2.0 in favor of DatabaseConfigurations#configuration_hash which returns a hash with symbol keys")
+        ActiveSupport::Deprecation.warn("DatabaseConfig#config will be removed in 7.0.0 in favor of DatabaseConfig#configuration_hash which returns a hash with symbol keys")
         configuration_hash.stringify_keys
       end
 

data/lib/active_record/database_configurations.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "uri"
 require "active_record/database_configurations/database_config"
 require "active_record/database_configurations/hash_config"
 require "active_record/database_configurations/url_config"
@@ -40,7 +41,7 @@ module ActiveRecord
     def configs_for(env_name: nil, spec_name: nil, name: nil, include_replicas: false)
       if spec_name
         name = spec_name
-        ActiveSupport::Deprecation.warn("The kwarg `spec_name` is deprecated in favor of `name`. `spec_name` will be removed in Rails 6.2")
+        ActiveSupport::Deprecation.warn("The kwarg `spec_name` is deprecated in favor of `name`. `spec_name` will be removed in Rails 7.0")
       end
 
       env_name ||= default_env if name

data/lib/active_record/gem_version.rb

@@ -9,8 +9,8 @@ module ActiveRecord
   module VERSION
     MAJOR = 6
     MINOR = 1
-    TINY  = 4
-    PRE   = "7"
+    TINY  = 7
+    PRE   = "1"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

data/lib/active_record/internal_metadata.rb

@@ -10,6 +10,8 @@ module ActiveRecord
   # This is enabled by default. To disable this functionality set
   # `use_metadata_table` to false in your database configuration.
   class InternalMetadata < ActiveRecord::Base # :nodoc:
+    self.record_timestamps = true
+
     class << self
       def enabled?
         ActiveRecord::Base.connection.use_metadata_table?

data/lib/active_record/legacy_yaml_adapter.rb

@@ -10,7 +10,7 @@ module ActiveRecord
       else
         ActiveSupport::Deprecation.warn(<<-MSG.squish)
           YAML loading from legacy format older than Rails 5.0 is deprecated
-          and will be removed in Rails 6.2.
+          and will be removed in Rails 7.0.
         MSG
         if coder["attributes"].is_a?(ActiveModel::AttributeSet)
           Rails420.convert(klass, coder)

data/lib/active_record/migration/compatibility.rb

@@ -24,9 +24,8 @@ module ActiveRecord
 
         module TableDefinition
           def references(*args, **options)
-            args.each do |ref_name|
-              ReferenceDefinition.new(ref_name, **options).add_to(self)
-            end
+            options[:_uses_legacy_reference_index_name] = true
+            super
           end
           alias :belongs_to :references
         end
@@ -56,8 +55,12 @@ module ActiveRecord
         end
 
         def add_reference(table_name, ref_name, **options)
-          ReferenceDefinition.new(ref_name, **options)
-            .add_to(connection.update_table_definition(table_name, self))
+          if connection.adapter_name == "SQLite"
+            options[:type] = :integer
+          end
+
+          options[:_uses_legacy_reference_index_name] = true
+          super
         end
         alias :add_belongs_to :add_reference
 
@@ -126,7 +129,7 @@ module ActiveRecord
             class << t
               prepend TableDefinition
             end
-            t
+            super
           end
 
           def command_recorder

data/lib/active_record/model_schema.rb

@@ -630,7 +630,7 @@ module ActiveRecord
           if column.sql_type.start_with?("interval")
             precision_arguments = column.precision.presence && ", precision: #{column.precision}"
             ActiveSupport::Deprecation.warn(<<~WARNING)
-              The behavior of the `:interval` type will be changing in Rails 6.2
+              The behavior of the `:interval` type will be changing in Rails 7.0
               to return an `ActiveSupport::Duration` object. If you'd like to keep
               the old behavior, you can add this line to #{self.name} model:
 

data/lib/active_record/railties/databases.rake

@@ -464,7 +464,7 @@ db_namespace = namespace :db do
 
     task load_if_ruby: ["db:create", :environment] do
       ActiveSupport::Deprecation.warn(<<-MSG.squish)
-        Using `bin/rails db:schema:load_if_ruby` is deprecated and will be removed in Rails 6.2.
+        Using `bin/rails db:schema:load_if_ruby` is deprecated and will be removed in Rails 7.0.
         Configure the format using `config.active_record.schema_format = :ruby` to use `schema.rb` and run `bin/rails db:schema:load` instead.
       MSG
       db_namespace["schema:load"].invoke if ActiveRecord::Base.schema_format == :ruby
@@ -527,7 +527,7 @@ db_namespace = namespace :db do
     desc "Dumps the database structure to db/structure.sql. Specify another file with SCHEMA=db/my_structure.sql"
     task dump: :load_config do
       ActiveSupport::Deprecation.warn(<<-MSG.squish)
-        Using `bin/rails db:structure:dump` is deprecated and will be removed in Rails 6.2.
+        Using `bin/rails db:structure:dump` is deprecated and will be removed in Rails 7.0.
         Configure the format using `config.active_record.schema_format = :sql` to use `structure.sql` and run `bin/rails db:schema:dump` instead.
       MSG
 
@@ -538,7 +538,7 @@ db_namespace = namespace :db do
     desc "Recreates the databases from the structure.sql file"
     task load: [:load_config, :check_protected_environments] do
       ActiveSupport::Deprecation.warn(<<-MSG.squish)
-        Using `bin/rails db:structure:load` is deprecated and will be removed in Rails 6.2.
+        Using `bin/rails db:structure:load` is deprecated and will be removed in Rails 7.0.
         Configure the format using `config.active_record.schema_format = :sql` to use `structure.sql` and run `bin/rails db:schema:load` instead.
       MSG
       db_namespace["schema:load"].invoke
@@ -546,7 +546,7 @@ db_namespace = namespace :db do
 
     task load_if_sql: ["db:create", :environment] do
       ActiveSupport::Deprecation.warn(<<-MSG.squish)
-        Using `bin/rails db:structure:load_if_sql` is deprecated and will be removed in Rails 6.2.
+        Using `bin/rails db:structure:load_if_sql` is deprecated and will be removed in Rails 7.0.
         Configure the format using `config.active_record.schema_format = :sql` to use `structure.sql` and run `bin/rails db:schema:load` instead.
       MSG
       db_namespace["schema:load"].invoke if ActiveRecord::Base.schema_format == :sql
@@ -557,7 +557,7 @@ db_namespace = namespace :db do
         desc "Dumps the #{name} database structure to db/structure.sql. Specify another file with SCHEMA=db/my_structure.sql"
         task name => :load_config do
           ActiveSupport::Deprecation.warn(<<-MSG.squish)
-            Using `bin/rails db:structure:dump:#{name}` is deprecated and will be removed in Rails 6.2.
+            Using `bin/rails db:structure:dump:#{name}` is deprecated and will be removed in Rails 7.0.
             Configure the format using `config.active_record.schema_format = :sql` to use `structure.sql` and run `bin/rails db:schema:dump:#{name}` instead.
           MSG
           db_namespace["schema:dump:#{name}"].invoke
@@ -571,7 +571,7 @@ db_namespace = namespace :db do
         desc "Recreates the #{name} database from the structure.sql file"
         task name => :load_config do
           ActiveSupport::Deprecation.warn(<<-MSG.squish)
-            Using `bin/rails db:structure:load:#{name}` is deprecated and will be removed in Rails 6.2.
+            Using `bin/rails db:structure:load:#{name}` is deprecated and will be removed in Rails 7.0.
             Configure the format using `config.active_record.schema_format = :sql` to use `structure.sql` and run `bin/rails db:schema:load:#{name}` instead.
           MSG
           db_namespace["schema:load:#{name}"].invoke
@@ -603,7 +603,7 @@ db_namespace = namespace :db do
     # desc "Recreate the test database from an existent structure.sql file"
     task load_structure: %w(db:test:purge) do
       ActiveSupport::Deprecation.warn(<<-MSG.squish)
-        Using `bin/rails db:test:load_structure` is deprecated and will be removed in Rails 6.2.
+        Using `bin/rails db:test:load_structure` is deprecated and will be removed in Rails 7.0.
         Configure the format using `config.active_record.schema_format = :sql` to use `structure.sql` and run `bin/rails db:test:load_schema` instead.
       MSG
       db_namespace["test:load_schema"].invoke
@@ -650,7 +650,7 @@ db_namespace = namespace :db do
       namespace :load_structure do
         task name => "db:test:purge:#{name}" do
           ActiveSupport::Deprecation.warn(<<-MSG.squish)
-            Using `bin/rails db:test:load_structure:#{name}` is deprecated and will be removed in Rails 6.2.
+            Using `bin/rails db:test:load_structure:#{name}` is deprecated and will be removed in Rails 7.0.
             Configure the format using `config.active_record.schema_format = :sql` to use `structure.sql` and run `bin/rails db:test:load_structure:#{name}` instead.
           MSG
           db_namespace["test:load_schema:#{name}"].invoke

data/lib/active_record/relation/calculations.rb

@@ -321,8 +321,8 @@ module ActiveRecord
 
         unless group_fields == group_values
           ActiveSupport::Deprecation.warn(<<-MSG.squish)
-            `#{operation}` with group by duplicated fields does no longer affect to result in Rails 6.2.
-            To migrate to Rails 6.2's behavior, use `uniq!(:group)` to deduplicate group fields
+            `#{operation}` with group by duplicated fields does no longer affect to result in Rails 7.0.
+            To migrate to Rails 7.0's behavior, use `uniq!(:group)` to deduplicate group fields
             (`#{klass.name&.tableize || klass.table_name}.uniq!(:group).#{operation}(#{column_name.inspect})`).
           MSG
           group_fields = group_values

data/lib/active_record/relation/finder_methods.rb

@@ -369,7 +369,7 @@ module ActiveRecord
           blank_value = order_values.first
           ActiveSupport::Deprecation.warn(<<~MSG.squish)
             `.reorder(#{blank_value.inspect})` with `.first` / `.first!` no longer
-            takes non-deterministic result in Rails 6.2.
+            takes non-deterministic result in Rails 7.0.
             To continue taking non-deterministic result, use `.take` / `.take!` instead.
           MSG
         end

data/lib/active_record/relation/query_methods.rb

@@ -1035,6 +1035,8 @@ module ActiveRecord
     #   # SELECT "users"."name" FROM "users" /* selecting */ /* user */ /* names */
     #
     # The SQL block comment delimiters, "/*" and "*/", will be added automatically.
+    #
+    # Some escaping is performed, however untrusted user input should not be used.
     def annotate(*args)
       check_if_method_has_arguments!(:annotate, args)
       spawn.annotate!(*args)
@@ -1157,8 +1159,8 @@ module ActiveRecord
           annotates = annotates.uniq if annotates.size > 1
           unless annotates == annotate_values
             ActiveSupport::Deprecation.warn(<<-MSG.squish)
-              Duplicated query annotations are no longer shown in queries in Rails 6.2.
-              To migrate to Rails 6.2's behavior, use `uniq!(:annotate)` to deduplicate query annotations
+              Duplicated query annotations are no longer shown in queries in Rails 7.0.
+              To migrate to Rails 7.0's behavior, use `uniq!(:annotate)` to deduplicate query annotations
               (`#{klass.name&.tableize || klass.table_name}.uniq!(:annotate)`).
             MSG
             annotates = annotate_values

data/lib/active_record/relation/where_clause.rb

@@ -168,8 +168,8 @@ module ActiveRecord
             else
               ActiveSupport::Deprecation.warn(<<-MSG.squish)
                 Merging (#{node.to_sql}) and (#{ref.to_sql}) no longer maintain
-                both conditions, and will be replaced by the latter in Rails 6.2.
-                To migrate to Rails 6.2's behavior, use `relation.merge(other, rewhere: true)`.
+                both conditions, and will be replaced by the latter in Rails 7.0.
+                To migrate to Rails 7.0's behavior, use `relation.merge(other, rewhere: true)`.
               MSG
               false
             end

data/lib/active_record/store.rb

@@ -268,7 +268,7 @@ module ActiveRecord
         end
 
         def dump(obj)
-          @coder.dump self.class.as_indifferent_hash(obj)
+          @coder.dump as_regular_hash(obj)
         end
 
         def load(yaml)
@@ -285,6 +285,11 @@ module ActiveRecord
             ActiveSupport::HashWithIndifferentAccess.new
           end
         end
+
+        private
+          def as_regular_hash(obj)
+            obj.respond_to?(:to_hash) ? obj.to_hash : {}
+          end
       end
   end
 end

data/lib/active_record/tasks/database_tasks.rb

@@ -340,7 +340,7 @@ module ActiveRecord
         db_config = resolve_configuration(configuration)
 
         if environment || name
-          ActiveSupport::Deprecation.warn("`environment` and `name` will be removed as parameters in 6.2.0, you may now pass an ActiveRecord::DatabaseConfigurations::DatabaseConfig as `configuration` instead.")
+          ActiveSupport::Deprecation.warn("`environment` and `name` will be removed as parameters in 7.0.0, you may now pass an ActiveRecord::DatabaseConfigurations::DatabaseConfig as `configuration` instead.")
         end
 
         name ||= db_config.name

data/lib/active_record/test_fixtures.rb

@@ -134,7 +134,7 @@ module ActiveRecord
         @connection_subscriber = ActiveSupport::Notifications.subscribe("!connection.active_record") do |_, _, _, _, payload|
           spec_name = payload[:spec_name] if payload.key?(:spec_name)
           shard = payload[:shard] if payload.key?(:shard)
-          setup_shared_connection_pool
+          setup_shared_connection_pool if ActiveRecord::Base.legacy_connection_handling
 
           if spec_name
             begin
@@ -143,10 +143,14 @@ module ActiveRecord
               connection = nil
             end
 
-            if connection && !@fixture_connections.include?(connection)
-              connection.begin_transaction joinable: false, _lazy: false
-              connection.pool.lock_thread = true if lock_threads
-              @fixture_connections << connection
+            if connection
+              setup_shared_connection_pool unless ActiveRecord::Base.legacy_connection_handling
+
+              if !@fixture_connections.include?(connection)
+                connection.begin_transaction joinable: false, _lazy: false
+                connection.pool.lock_thread = true if lock_threads
+                @fixture_connections << connection
+              end
             end
           end
         end

data/lib/active_record.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 #--
-# Copyright (c) 2004-2020 David Heinemeier Hansson
+# Copyright (c) 2004-2022 David Heinemeier Hansson
 #
 # Permission is hereby granted, free of charge, to any person obtaining
 # a copy of this software and associated documentation files (the

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activerecord
 version: !ruby/object:Gem::Version
-  version: 6.1.4.7
+  version: 6.1.7.1
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-03-08 00:00:00.000000000 Z
+date: 2023-01-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.4.7
+        version: 6.1.7.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.4.7
+        version: 6.1.7.1
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.4.7
+        version: 6.1.7.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.4.7
+        version: 6.1.7.1
 description: Databases on Rails. Build a persistent domain model by mapping database
   tables to Ruby classes. Strong conventions for associations, validations, aggregations,
   migrations, and testing come baked-in.
@@ -390,10 +390,11 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v6.1.4.7/activerecord/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v6.1.4.7/
+  changelog_uri: https://github.com/rails/rails/blob/v6.1.7.1/activerecord/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v6.1.7.1/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v6.1.4.7/activerecord
+  source_code_uri: https://github.com/rails/rails/tree/v6.1.7.1/activerecord
+  rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options:
 - "--main"
@@ -411,7 +412,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.6
+rubygems_version: 3.4.3
 signing_key:
 specification_version: 4
 summary: Object-relational mapper framework (part of Rails).