activesupport 4.2.11.1 → 5.2.4.3

data/CHANGELOG.md

@@ -1,678 +1,648 @@
-## Rails 4.2.11.1 (March 11, 2019) ##
+## Rails 5.2.4.3 (May 18, 2020) ##
 
-*   No changes.
-
-
-## Rails 4.2.11 (November 27, 2018) ##
-
-*   No changes.
+*   [CVE-2020-8165] Deprecate Marshal.load on raw cache read in RedisCacheStore
 
+*   [CVE-2020-8165] Avoid Marshal.load on raw cache value in MemCacheStore
 
-## Rails 4.2.10 (September 27, 2017) ##
+## Rails 5.2.4.1 (December 18, 2019) ##
 
 *   No changes.
 
 
-## Rails 4.2.9 (June 26, 2017) ##
-
-*   Fixed bug in `DateAndTime::Compatibility#to_time` that caused it to
-    raise `RuntimeError: can't modify frozen Time` when called on any frozen `Time`.
-    Properly pass through the frozen `Time` or `ActiveSupport::TimeWithZone` object
-    when calling `#to_time`.
-
-    *Kevin McPhillips* & *Andrew White*
-
-*   Restore the return type of `DateTime#utc`
-
-    In Rails 5.0 the return type of `DateTime#utc` was changed to `Time` to be
-    consistent with the new `DateTime#localtime` method. When these changes were
-    backported in #27553 this inadvertently changed the return type in a patcn
-    release. Since `DateTime#localtime` was new in Rails 4.2.8 it's okay to
-    restore the return type of `DateTime#utc` but keep `DateTime#localtime` as
-    returning `Time` without breaking backwards compatibility.
-
-    *Andrew White*
-
-*   In Core Extensions, make `MarshalWithAutoloading#load` pass through the second, optional
-    argument for `Marshal#load( source [, proc] )`. This way we don't have to do
-    `Marshal.method(:load).super_method.call(sourse, proc)` just to be able to pass a proc.
-
-    *Jeff Latz*
-
-*   Cache `ActiveSupport::TimeWithZone#to_datetime` before freezing.
+## Rails 5.2.4 (November 27, 2019) ##
 
-    *Adam Rice*
+*   Make ActiveSupport::Logger Fiber-safe. Fixes #36752.
 
-*   `AS::Testing::TimeHelpers#travel_to` now changes `DateTime.now` as well as
-    `Time.now` and `Date.today`.
+    Use `Fiber.current.__id__` in `ActiveSupport::Logger#local_level=` in order
+    to make log level local to Ruby Fibers in addition to Threads.
 
-    *Yuki Nishijima*
+    Example:
 
+        logger = ActiveSupport::Logger.new(STDOUT)
+        logger.level = 1
+        p "Main is debug? #{logger.debug?}"
 
-## Rails 4.2.8 (February 21, 2017) ##
-
-*   Make `getlocal` and `getutc` always return instances of `Time` for
-    `ActiveSupport::TimeWithZone` and `DateTime`. This eliminates a possible
-    stack level too deep error in `to_time` where `ActiveSupport::TimeWithZone`
-    was wrapping a `DateTime` instance. As a consequence of this the internal
-    time value in `ActiveSupport::TimeWithZone` is now always an instance of
-    `Time` in the UTC timezone, whether that's as the UTC time directly or
-    a representation of the local time in the timezone. There should be no
-    consequences of this internal change and if there are it's a bug due to
-    leaky abstractions.
-
-    *Andrew White*
+        Fiber.new {
+          logger.local_level = 0
+          p "Thread is debug? #{logger.debug?}"
+        }.resume
 
-*   Add `DateTime#subsec` to return the fraction of a second as a `Rational`.
-
-    *Andrew White*
-
-*   Add additional aliases for `DateTime#utc` to mirror the ones on
-    `ActiveSupport::TimeWithZone` and `Time`.
-
-    *Andrew White*
+        p "Main is debug? #{logger.debug?}"
 
-*   Add `DateTime#localtime` to return an instance of `Time` in the system's
-    local timezone. Also aliased to `getlocal`.
-
-    *Andrew White*, *Yuichiro Kaneko*
-
-*   Add `Time#sec_fraction` to return the fraction of a second as a `Rational`.
-
-    *Andrew White*
-
-*   Add `ActiveSupport.to_time_preserves_timezone` config option to control
-    how `to_time` handles timezones. In Ruby 2.4+ the behavior will change
-    from converting to the local system timezone, to preserving the timezone
-    of the receiver. This config option defaults to false so that apps made
-    with earlier versions of Rails are not affected when upgrading, e.g:
-
-        >> ENV['TZ'] = 'US/Eastern'
+    Before:
 
-        >> "2016-04-23T10:23:12.000Z".to_time
-        => "2016-04-23T06:23:12.000-04:00"
+        Main is debug? false
+        Thread is debug? true
+        Main is debug? true
 
-        >> ActiveSupport.to_time_preserves_timezone = true
+    After:
 
-        >> "2016-04-23T10:23:12.000Z".to_time
-        => "2016-04-23T10:23:12.000Z"
+        Main is debug? false
+        Thread is debug? true
+        Main is debug? false
 
-    Fixes #24617.
+    *Alexander Varnin*
 
-    *Andrew White*
 
-*   Add `init_with` to `ActiveSupport::TimeWithZone` and `ActiveSupport::TimeZone`
+## Rails 5.2.3 (March 27, 2019) ##
 
-    It is helpful to be able to run apps concurrently written in successive
-    versions of Rails to aid migration, e.g. run Rails 4.2 and 5.0 variants
-    of your application at the same time to carry out A/B testing.
+*   Add `ActiveSupport::HashWithIndifferentAccess#assoc`.
 
-    To do this serialization formats need to be cross compatible and the
-    change in 3aa26cf didn't meet this criteria because the Psych loader
-    checks for the existence of `init_with` before setting the instance
-    variables and the wrapping behavior of `ActiveSupport::TimeWithZone`
-    tries to see if the `Time` instance responds to `init_with` before the
-    `@time` variable is set.
+    `assoc` can now be called with either a string or a symbol.
 
-    To fix this we backported just the `init_with` behavior from the change
-    in 3aa26cf. If the revived instance is then written out to YAML again
-    it will revert to the default Rails 4.2 behavior of converting it to
-    a UTC timestamp string.
+    *Stefan Schüßler*
 
-    Fixes #26296.
-
-    *Andrew White*
+*   Fix `String#safe_constantize` throwing a `LoadError` for incorrectly cased constant references.
 
-*   Fix `ActiveSupport::TimeWithZone#in` across DST boundaries.
+    *Keenan Brock*
 
-    Previously calls to `in` were being sent to the non-DST aware
-    method `Time#since` via `method_missing`. It is now aliased to
-    the DST aware `ActiveSupport::TimeWithZone#since` which handles
-    transitions across DST boundaries, e.g:
+*   Allow Range#=== and Range#cover? on Range
 
-        Time.zone = "US/Eastern"
+    `Range#cover?` can now accept a range argument like `Range#include?` and
+    `Range#===`. `Range#===` works correctly on Ruby 2.6. `Range#include?` is moved
+    into a new file, with these two methods.
 
-        t = Time.zone.local(2016,11,6,1)
-        # => Sun, 06 Nov 2016 01:00:00 EDT -05:00
+    *utilum*
 
-        t.in(1.hour)
-        # => Sun, 06 Nov 2016 01:00:00 EST -05:00
+*   If the same block is `included` multiple times for a Concern, an exception is no longer raised.
 
-    Fixes #26580.
+    *Mark J. Titorenko*, *Vlad Bokov*
 
-    *Thomas Balthazar*
 
+## Rails 5.2.2.1 (March 11, 2019) ##
 
-## Rails 4.2.7 (July 12, 2016) ##
-
-*   Fixed `ActiveSupport::Logger.broadcast` so that calls to `#silence` now
-    properly delegate to all loggers. Silencing now properly suppresses logging
-    to both the log and the console.
+*   No changes.
 
-    *Kevin McPhillips*
 
-*   Backported `ActiveSupport::LoggerThreadSafeLevel`. Assigning the
-    `Rails.logger.level` is now thread safe.
+## Rails 5.2.2 (December 04, 2018) ##
 
-    *Kevin McPhillips*
+*   Fix bug where `#to_options` for `ActiveSupport::HashWithIndifferentAccess`
+    would not act as alias for `#symbolize_keys`.
 
-*   Fixed a problem with ActiveSupport::SafeBuffer.titleize calling capitalize
-    on nil.
+    *Nick Weiland*
 
-    *Brian McManus*
+*   Improve the logic that detects non-autoloaded constants.
 
-*   Time zones: Ensure that the UTC offset reflects DST changes that occurred
-    since the app started. Removes UTC offset caching, reducing performance,
-    but this is still relatively quick and isn't in any hot paths.
+    *Jan Habermann*, *Xavier Noria*
 
-    *Alexey Shein*
+*   Fix bug where `URI.unescape` would fail with mixed Unicode/escaped character input:
 
-*   Prevent `Marshal.load` from looping infinitely when trying to autoload a constant
-    which resolves to a different name.
+        URI.unescape("\xe3\x83\x90")  # => "バ"
+        URI.unescape("%E3%83%90")  # => "バ"
+        URI.unescape("\xe3\x83\x90%E3%83%90")  # => Encoding::CompatibilityError
 
-    *Olek Janiszewski*
+    *Ashe Connor*, *Aaron Patterson*
 
 
-## Rails 4.2.6 (March 07, 2016) ##
+## Rails 5.2.1.1 (November 27, 2018) ##
 
 *   No changes.
 
 
-## Rails 4.2.5.2 (February 26, 2016) ##
+## Rails 5.2.1 (August 07, 2018) ##
 
-*   No changes.
+*   Redis cache store: `delete_matched` no longer blocks the Redis server.
+    (Switches from evaled Lua to a batched SCAN + DEL loop.)
 
+    *Gleb Mazovetskiy*
 
-## Rails 4.2.5.1 (January 25, 2015) ##
+*   Fix bug where `ActiveSupport::Timezone.all` would fail when tzinfo data for
+    any timezone defined in `ActiveSupport::TimeZone::MAPPING` is missing.
 
-*   No changes.
+    *Dominik Sander*
 
+*   Fix bug where `ActiveSupport::Cache` will massively inflate the storage
+    size when compression is enabled (which is true by default). This patch
+    does not attempt to repair existing data: please manually flush the cache
+    to clear out the problematic entries.
 
-## Rails 4.2.5 (November 12, 2015) ##
+    *Godfrey Chan*
 
-*   Fix `TimeWithZone#eql?` to properly handle `TimeWithZone` created from `DateTime`:
-        twz = DateTime.now.in_time_zone
-        twz.eql?(twz.dup) => true
+*   Fix `ActiveSupport::Cache#read_multi` bug with local cache enabled that was
+    returning instances of `ActiveSupport::Cache::Entry` instead of the raw values.
 
-    Fixes #14178.
+    *Jason Lee*
 
-    *Roque Pinel*
 
-*   Handle invalid UTF-8 characters in `MessageVerifier.verify`.
+## Rails 5.2.0 (April 09, 2018) ##
 
-    *Roque Pinel*, *Grey Baker*
+*   Caching: MemCache and Redis `read_multi` and `fetch_multi` speedup.
+    Read from the local in-memory cache before consulting the backend.
 
+    *Gabriel Sobrinho*
 
-## Rails 4.2.4 (August 24, 2015) ##
+*   Return all mappings for a timezone identifier in `country_zones`.
 
-*   Fix a `SystemStackError` when encoding an `Enumerable` with `json` gem and
-    with the Active Support JSON encoder loaded.
+    Some timezones like `Europe/London` have multiple mappings in
+    `ActiveSupport::TimeZone::MAPPING` so return all of them instead
+    of the first one found by using `Hash#value`. e.g:
 
-    Fixes #20775.
+        # Before
+        ActiveSupport::TimeZone.country_zones("GB") # => ["Edinburgh"]
 
-    *Sammy Larbi*, *Prathamesh Sonpatki*
+        # After
+        ActiveSupport::TimeZone.country_zones("GB") # => ["Edinburgh", "London"]
 
-*   Fix not calling `#default` on `HashWithIndifferentAcess#to_hash` when only
-    `default_proc` is set, which could raise.
+    Fixes #31668.
 
-    *Simon Eskildsen*
+    *Andrew White*
 
-*   Fix setting `default_proc` on `HashWithIndifferentAccess#dup`
+*   Add support for connection pooling on RedisCacheStore.
 
-    *Simon Eskildsen*
+    *fatkodima*
 
+*   Support hash as first argument in `assert_difference`. This allows to specify multiple
+    numeric differences in the same assertion.
 
-## Rails 4.2.3 (June 25, 2015) ##
+        assert_difference ->{ Article.count } => 1, ->{ Post.count } => 2
 
-*   Fix a range of values for parameters of the Time#change
+    *Julien Meichelbeck*
 
-    *Nikolay Kondratyev*
+*   Add missing instrumentation for `read_multi` in `ActiveSupport::Cache::Store`.
 
-*   Add some missing `require 'active_support/deprecation'`
+    *Ignatius Reza Lesmana*
 
-    *Akira Matsuda*
+*   `assert_changes` will always assert that the expression changes,
+    regardless of `from:` and `to:` argument combinations.
 
+    *Daniel Ma*
 
-## Rails 4.2.2 (June 16, 2015) ##
+*   Use SHA-1 to generate non-sensitive digests, such as the ETag header.
 
-*   Fix XSS vulnerability in `ActiveSupport::JSON.encode` method.
+    Enabled by default for new apps; upgrading apps can opt in by setting
+    `config.active_support.use_sha1_digests = true`.
 
-    CVE-2015-3226.
+    *Dmitri Dolguikh*, *Eugene Kenny*
 
-    *Rafael Mendonça França*
+*   Changed default behaviour of `ActiveSupport::SecurityUtils.secure_compare`,
+    to make it not leak length information even for variable length string.
 
-*   Fix denial of service vulnerability in the XML processing.
+    Renamed old `ActiveSupport::SecurityUtils.secure_compare` to `fixed_length_secure_compare`,
+    and started raising `ArgumentError` in case of length mismatch of passed strings.
 
-    CVE-2015-3227.
+    *Vipul A M*
 
-    *Aaron Patterson*
+*   Make `ActiveSupport::TimeZone.all` return only time zones that are in
+    `ActiveSupport::TimeZone::MAPPING`.
 
+    Fixes #7245.
 
-## Rails 4.2.1 (March 19, 2015) ##
+    *Chris LaRose*
 
-*   Fixed a problem where String#truncate_words would get stuck with a complex
-    string.
+*   MemCacheStore: Support expiring counters.
 
-    *Henrik Nygren*
+    Pass `expires_in: [seconds]` to `#increment` and `#decrement` options
+    to set the Memcached TTL (time-to-live) if the counter doesn't exist.
+    If the counter exists, Memcached doesn't extend its expiry when it's
+    incremented or decremented.
 
-*   Fixed a roundtrip problem with AS::SafeBuffer where primitive-like strings
-    will be dumped as primitives:
+    ```
+    Rails.cache.increment("my_counter", 1, expires_in: 2.minutes)
+    ```
 
-    Before:
+    *Takumasa Ochi*
 
-        YAML.load ActiveSupport::SafeBuffer.new("Hello").to_yaml  # => "Hello"
-        YAML.load ActiveSupport::SafeBuffer.new("true").to_yaml   # => true
-        YAML.load ActiveSupport::SafeBuffer.new("false").to_yaml  # => false
-        YAML.load ActiveSupport::SafeBuffer.new("1").to_yaml      # => 1
-        YAML.load ActiveSupport::SafeBuffer.new("1.1").to_yaml    # => 1.1
+*   Handle `TZInfo::AmbiguousTime` errors.
 
-     After:
+    Make `ActiveSupport::TimeWithZone` match Ruby's handling of ambiguous
+    times by choosing the later period, e.g.
 
-        YAML.load ActiveSupport::SafeBuffer.new("Hello").to_yaml  # => "Hello"
-        YAML.load ActiveSupport::SafeBuffer.new("true").to_yaml   # => "true"
-        YAML.load ActiveSupport::SafeBuffer.new("false").to_yaml  # => "false"
-        YAML.load ActiveSupport::SafeBuffer.new("1").to_yaml      # => "1"
-        YAML.load ActiveSupport::SafeBuffer.new("1.1").to_yaml    # => "1.1"
+    Ruby:
+    ```
+    ENV["TZ"] = "Europe/Moscow"
+    Time.local(2014, 10, 26, 1, 0, 0)   # => 2014-10-26 01:00:00 +0300
+    ```
 
-    *Godfrey Chan*
+    Before:
+    ```
+    >> "2014-10-26 01:00:00".in_time_zone("Moscow")
+    TZInfo::AmbiguousTime: 26/10/2014 01:00 is an ambiguous local time.
+    ```
 
-*   Replace fixed `:en` with `I18n.default_locale` in `Duration#inspect`.
+    After:
+    ```
+    >> "2014-10-26 01:00:00".in_time_zone("Moscow")
+    => Sun, 26 Oct 2014 01:00:00 MSK +03:00
+    ```
 
-    *Dominik Masur*
+    Fixes #17395.
 
-*   Add missing time zone definitions for Russian Federation and sync them
-    with `zone.tab` file from tzdata version 2014j (latest).
+    *Andrew White*
 
-    *Andrey Novikov*
+*   Redis cache store.
 
+    ```
+    # Defaults to `redis://localhost:6379/0`. Only use for dev/test.
+    config.cache_store = :redis_cache_store
 
-## Rails 4.2.0 (December 20, 2014) ##
+    # Supports all common cache store options (:namespace, :compress,
+    # :compress_threshold, :expires_in, :race_condition_ttl) and all
+    # Redis options.
+    cache_password = Rails.application.secrets.redis_cache_password
+    config.cache_store = :redis_cache_store, driver: :hiredis,
+      namespace: 'myapp-cache', compress: true, timeout: 1,
+      url: "redis://:#{cache_password}@myapp-cache-1:6379/0"
 
-*   The decorated `load` and `require` methods are now kept private.
+    # Supports Redis::Distributed with multiple hosts
+    config.cache_store = :redis_cache_store, driver: :hiredis
+      namespace: 'myapp-cache', compress: true,
+      url: %w[
+        redis://myapp-cache-1:6379/0
+        redis://myapp-cache-1:6380/0
+        redis://myapp-cache-2:6379/0
+        redis://myapp-cache-2:6380/0
+        redis://myapp-cache-3:6379/0
+        redis://myapp-cache-3:6380/0
+      ]
 
-    Fixes #17553.
+    # Or pass a builder block
+    config.cache_store = :redis_cache_store,
+      namespace: 'myapp-cache', compress: true,
+      redis: -> { Redis.new … }
+    ```
 
-    *Xavier Noria*
+    Deployment note: Take care to use a *dedicated Redis cache* rather
+    than pointing this at your existing Redis server. It won't cope well
+    with mixed usage patterns and it won't expire cache entries by default.
 
-*   `String#remove` and `String#remove!` accept multiple arguments.
+    Redis cache server setup guide: https://redis.io/topics/lru-cache
 
-    *Pavel Pravosud*
+    *Jeremy Daer*
 
-*   `TimeWithZone#strftime` now delegates every directive to `Time#strftime` except for '%Z',
-    it also now correctly handles escaped '%' characters placed just before time zone related directives.
+*   Cache: Enable compression by default for values > 1kB.
 
-    *Pablo Herrero*
+    Compression has long been available, but opt-in and at a 16kB threshold.
+    It wasn't enabled by default due to CPU cost. Today it's cheap and typical
+    cache data is eminently compressible, such as HTML or JSON fragments.
+    Compression dramatically reduces Memcached/Redis mem usage, which means
+    the same cache servers can store more data, which means higher hit rates.
 
-*   Corrected `Inflector#underscore` handling of multiple successive acroynms.
+    To disable compression, pass `compress: false` to the initializer.
 
-    *James Le Cuirot*
+    *Jeremy Daer*
 
-*   Delegation now works with ruby reserved words passed to `:to` option.
+*   Allow `Range#include?` on TWZ ranges.
 
-    Fixes #16956.
+    In #11474 we prevented TWZ ranges being iterated over which matched
+    Ruby's handling of Time ranges and as a consequence `include?`
+    stopped working with both Time ranges and TWZ ranges. However in
+    ruby/ruby@b061634 support was added for `include?` to use `cover?`
+    for 'linear' objects. Since we have no way of making Ruby consider
+    TWZ instances as 'linear' we have to override `Range#include?`.
 
-    *Agis Anastasopoulos*
+    Fixes #30799.
 
-*   Added method `#eql?` to `ActiveSupport::Duration`, in addition to `#==`.
+    *Andrew White*
 
-    Currently, the following returns `false`, contrary to expectation:
+*   Fix acronym support in `humanize`.
 
-        1.minute.eql?(1.minute)
+    Acronym inflections are stored with lowercase keys in the hash but
+    the match wasn't being lowercased before being looked up in the hash.
+    This shouldn't have any performance impact because before it would
+    fail to find the acronym and perform the `downcase` operation anyway.
 
-    Adding method `#eql?` will make this behave like expected. Method `#eql?` is
-    just a bit stricter than `#==`, as it checks whether the argument is also a duration. Their
-    parts may be different though.
+    Fixes #31052.
 
-        1.minute.eql?(60.seconds)  # => true
-        1.minute.eql?(60)          # => false
+    *Andrew White*
 
-    *Joost Lubach*
+*   Add same method signature for `Time#prev_year` and `Time#next_year`
+    in accordance with `Date#prev_year`, `Date#next_year`.
 
-*   `Time#change` can now change nanoseconds (`:nsec`) as a higher-precision
-    alternative to microseconds (`:usec`).
+    Allows pass argument for `Time#prev_year` and `Time#next_year`.
 
-    *Agis Anastasooulos*
+    Before:
+    ```
+    Time.new(2017, 9, 16, 17, 0).prev_year    # => 2016-09-16 17:00:00 +0300
+    Time.new(2017, 9, 16, 17, 0).prev_year(1)
+    # => ArgumentError: wrong number of arguments (given 1, expected 0)
 
-*   `MessageVerifier.new` raises an appropriate exception if the secret is `nil`.
-    This prevents `MessageVerifier#generate` from raising a cryptic error later on.
+    Time.new(2017, 9, 16, 17, 0).next_year    # => 2018-09-16 17:00:00 +0300
+    Time.new(2017, 9, 16, 17, 0).next_year(1)
+    # => ArgumentError: wrong number of arguments (given 1, expected 0)
+    ```
 
-    *Kostiantyn Kahanskyi*
+    After:
+    ```
+    Time.new(2017, 9, 16, 17, 0).prev_year    # => 2016-09-16 17:00:00 +0300
+    Time.new(2017, 9, 16, 17, 0).prev_year(1) # => 2016-09-16 17:00:00 +0300
 
-*   Introduced new configuration option `active_support.test_order` for
-    specifying the order in which test cases are executed. This option currently defaults
-    to `:sorted` but will be changed to `:random` in Rails 5.0.
+    Time.new(2017, 9, 16, 17, 0).next_year    # => 2018-09-16 17:00:00 +0300
+    Time.new(2017, 9, 16, 17, 0).next_year(1) # => 2018-09-16 17:00:00 +0300
+    ```
 
-    *Akira Matsuda*, *Godfrey Chan*
+    *bogdanvlviv*
 
-*   Fixed a bug in `Inflector#underscore` where acroynms in nested constant names
-    are incorrectly parsed as camelCase.
+*   Add same method signature for `Time#prev_month` and `Time#next_month`
+    in accordance with `Date#prev_month`, `Date#next_month`.
 
-    Fixes #8015.
+    Allows pass argument for `Time#prev_month` and `Time#next_month`.
 
-    *Fred Wu*, *Matthew Draper*
+    Before:
+    ```
+    Time.new(2017, 9, 16, 17, 0).prev_month    # => 2017-08-16 17:00:00 +0300
+    Time.new(2017, 9, 16, 17, 0).prev_month(1)
+    # => ArgumentError: wrong number of arguments (given 1, expected 0)
 
-*   Make `Time#change` throw an exception if the `:usec` option is out of range and
-    the time has an offset other than UTC or local.
+    Time.new(2017, 9, 16, 17, 0).next_month    # => 2017-10-16 17:00:00 +0300
+    Time.new(2017, 9, 16, 17, 0).next_month(1)
+    # => ArgumentError: wrong number of arguments (given 1, expected 0)
+    ```
 
-    *Agis Anastasopoulos*
+    After:
+    ```
+    Time.new(2017, 9, 16, 17, 0).prev_month    # => 2017-08-16 17:00:00 +0300
+    Time.new(2017, 9, 16, 17, 0).prev_month(1) # => 2017-08-16 17:00:00 +0300
 
-*   `Method` objects now report themselves as not `duplicable?`. This allows
-    hashes and arrays containing `Method` objects to be `deep_dup`ed.
+    Time.new(2017, 9, 16, 17, 0).next_month    # => 2017-10-16 17:00:00 +0300
+    Time.new(2017, 9, 16, 17, 0).next_month(1) # => 2017-10-16 17:00:00 +0300
+    ```
 
-    *Peter Jaros*
+    *bogdanvlviv*
 
-*   `determine_constant_from_test_name` does no longer shadow `NameError`s
-    which happens during constant autoloading.
+*   Add same method signature for `Time#prev_day` and `Time#next_day`
+    in accordance with `Date#prev_day`, `Date#next_day`.
 
-    Fixes #9933.
+    Allows pass argument for `Time#prev_day` and `Time#next_day`.
 
-    *Guo Xiang Tan*
+    Before:
+    ```
+    Time.new(2017, 9, 16, 17, 0).prev_day    # => 2017-09-15 17:00:00 +0300
+    Time.new(2017, 9, 16, 17, 0).prev_day(1)
+    # => ArgumentError: wrong number of arguments (given 1, expected 0)
 
-*   Added instance_eval version to Object#try and Object#try!, so you can do this:
+    Time.new(2017, 9, 16, 17, 0).next_day    # => 2017-09-17 17:00:00 +0300
+    Time.new(2017, 9, 16, 17, 0).next_day(1)
+    # => ArgumentError: wrong number of arguments (given 1, expected 0)
+    ```
 
-        person.try { name.first }
+    After:
+    ```
+    Time.new(2017, 9, 16, 17, 0).prev_day    # => 2017-09-15 17:00:00 +0300
+    Time.new(2017, 9, 16, 17, 0).prev_day(1) # => 2017-09-15 17:00:00 +0300
 
-    instead of:
+    Time.new(2017, 9, 16, 17, 0).next_day    # => 2017-09-17 17:00:00 +0300
+    Time.new(2017, 9, 16, 17, 0).next_day(1) # => 2017-09-17 17:00:00 +0300
+    ```
 
-        person.try { |person| person.name.first }
+    *bogdanvlviv*
 
-    *DHH*, *Ari Pollak*
+*   `IO#to_json` now returns the `to_s` representation, rather than
+    attempting to convert to an array. This fixes a bug where `IO#to_json`
+    would raise an `IOError` when called on an unreadable object.
 
-*   Fix the `ActiveSupport::Duration#instance_of?` method to return the right
-    value with the class itself since it was previously delegated to the
-    internal value.
+    Fixes #26132.
 
-    *Robin Dupret*
+    *Paul Kuruvilla*
 
-*   Fix rounding errors with `#travel_to` by resetting the usec on any passed time to zero, so we only travel
-    with per-second precision, not anything deeper than that.
+*   Remove deprecated `halt_callback_chains_on_return_false` option.
 
-    *DHH*
+    *Rafael Mendonça França*
 
-*   Fix DateTime comparison with `DateTime::Infinity` object.
+*   Remove deprecated `:if` and `:unless` string filter for callbacks.
 
     *Rafael Mendonça França*
 
-*   Added Object#itself which returns the object itself. Useful when dealing with a chaining scenario, like Active Record scopes:
+*   `Hash#slice` now falls back to Ruby 2.5+'s built-in definition if defined.
 
-        Event.public_send(state.presence_in([ :trashed, :drafted ]) || :itself).order(:created_at)
+    *Akira Matsuda*
 
-    *DHH*
+*   Deprecate `secrets.secret_token`.
 
-*   `Object#with_options` executes block in merging option context when
-    explicit receiver in not passed.
+    The architecture for secrets had a big upgrade between Rails 3 and Rails 4,
+    when the default changed from using `secret_token` to `secret_key_base`.
 
-    *Pavel Pravosud*
+    `secret_token` has been soft deprecated in documentation for four years
+    but is still in place to support apps created before Rails 4.
+    Deprecation warnings have been added to help developers upgrade their
+    applications to `secret_key_base`.
 
-*   Fixed a compatibility issue with the `Oj` gem when cherry-picking the file
-    `active_support/core_ext/object/json` without requiring `active_support/json`.
+    *claudiob*, *Kasper Timm Hansen*
 
-    Fixes #16131.
+*   Return an instance of `HashWithIndifferentAccess` from `HashWithIndifferentAccess#transform_keys`.
 
-    *Godfrey Chan*
+    *Yuji Yaginuma*
 
-*   Make `Hash#with_indifferent_access` copy the default proc too.
+*   Add key rotation support to `MessageEncryptor` and `MessageVerifier`.
 
-    *arthurnn*, *Xanders*
+    This change introduces a `rotate` method to both the `MessageEncryptor` and
+    `MessageVerifier` classes. This method accepts the same arguments and
+    options as the given classes' constructor. The `encrypt_and_verify` method
+    for `MessageEncryptor` and the `verified` method for `MessageVerifier` also
+    accept an optional keyword argument `:on_rotation` block which is called
+    when a rotated instance is used to decrypt or verify the message.
 
-*   Add `String#truncate_words` to truncate a string by a number of words.
+    *Michael J Coyne*
 
-    *Mohamed Osama*
+*   Deprecate `Module#reachable?` method.
 
-*   Deprecate `capture` and `quietly`.
+    *bogdanvlviv*
 
-    These methods are not thread safe and may cause issues when used in threaded environments.
-    To avoid problems we are deprecating them.
+*   Add `config/credentials.yml.enc` to store production app secrets.
 
-    *Tom Meier*
+    Allows saving any authentication credentials for third party services
+    directly in repo encrypted with `config/master.key` or `ENV["RAILS_MASTER_KEY"]`.
 
-*   `DateTime#to_f` now preserves the fractional seconds instead of always
-    rounding to `.0`.
+    This will eventually replace `Rails.application.secrets` and the encrypted
+    secrets introduced in Rails 5.1.
 
-    Fixes #15994.
+    *DHH*, *Kasper Timm Hansen*
 
-    *John Paul Ashenfelter*
+*   Add `ActiveSupport::EncryptedFile` and `ActiveSupport::EncryptedConfiguration`.
 
-*   Add `Hash#transform_values` to simplify a common pattern where the values of a
-    hash must change, but the keys are left the same.
+    Allows for stashing encrypted files or configuration directly in repo by
+    encrypting it with a key.
 
-    *Sean Griffin*
+    Backs the new credentials setup above, but can also be used independently.
 
-*   Always instrument `ActiveSupport::Cache`.
+    *DHH*, *Kasper Timm Hansen*
 
-    Since `ActiveSupport::Notifications` only instruments items when there
-    are attached subscribers, we don't need to disable instrumentation.
+*   `Module#delegate_missing_to` now raises `DelegationError` if target is nil,
+    similar to `Module#delegate`.
 
-    *Peter Wagenet*
+    *Anton Khamets*
 
-*   Make the `apply_inflections` method case-insensitive when checking
-    whether a word is uncountable or not.
+*   Update `String#camelize` to provide feedback when wrong option is passed.
 
-    *Robin Dupret*
+    `String#camelize` was returning nil without any feedback when an
+    invalid option was passed as a parameter.
 
-*   Make Dependencies pass a name to NameError error.
+    Previously:
 
-    *arthurnn*
+        'one_two'.camelize(true)
+        # => nil
 
-*   Fixed `ActiveSupport::Cache::FileStore` exploding with long paths.
+    Now:
 
-    *Adam Panzer*, *Michael Grosser*
+        'one_two'.camelize(true)
+        # => ArgumentError: Invalid option, use either :upper or :lower.
 
-*   Fixed `ActiveSupport::TimeWithZone#-` so precision is not unnecessarily lost
-    when working with objects with a nanosecond component.
+    *Ricardo Díaz*
 
-    `ActiveSupport::TimeWithZone#-` should return the same result as if we were
-    using `Time#-`:
+*   Fix modulo operations involving durations.
 
-        Time.now.end_of_day - Time.now.beginning_of_day # => 86399.999999999
+    Rails 5.1 introduced `ActiveSupport::Duration::Scalar` as a wrapper
+    around numeric values as a way of ensuring a duration was the outcome of
+    an expression. However, the implementation was missing support for modulo
+    operations. This support has now been added and should result in a duration
+    being returned from expressions involving modulo operations.
 
-    Before:
+    Prior to Rails 5.1:
 
-        Time.zone.now.end_of_day.nsec # => 999999999
-        Time.zone.now.end_of_day - Time.zone.now.beginning_of_day # => 86400.0
+        5.minutes % 2.minutes
+        # => 60
 
-    After:
+    Now:
 
-        Time.zone.now.end_of_day - Time.zone.now.beginning_of_day
-        # => 86399.999999999
+        5.minutes % 2.minutes
+        # => 1 minute
 
-    *Gordon Chan*
+    Fixes #29603 and #29743.
 
-*   Fixed precision error in NumberHelper when using Rationals.
+    *Sayan Chakraborty*, *Andrew White*
 
-    Before:
+*   Fix division where a duration is the denominator.
 
-        ActiveSupport::NumberHelper.number_to_rounded Rational(1000, 3), precision: 2
-        # => "330.00"
+    PR #29163 introduced a change in behavior when a duration was the denominator
+    in a calculation - this was incorrect as dividing by a duration should always
+    return a `Numeric`. The behavior of previous versions of Rails has been restored.
 
-    After:
+    Fixes #29592.
 
-        ActiveSupport::NumberHelper.number_to_rounded Rational(1000, 3), precision: 2
-        # => "333.33"
+    *Andrew White*
 
-    See #15379.
+*   Add purpose and expiry support to `ActiveSupport::MessageVerifier` and
+   `ActiveSupport::MessageEncryptor`.
 
-    *Juanjo Bazán*
+    For instance, to ensure a message is only usable for one intended purpose:
 
-*   Removed deprecated `Numeric#ago` and friends
+        token = @verifier.generate("x", purpose: :shipping)
 
-    Replacements:
+        @verifier.verified(token, purpose: :shipping) # => "x"
+        @verifier.verified(token)                     # => nil
 
-        5.ago   => 5.seconds.ago
-        5.until => 5.seconds.until
-        5.since => 5.seconds.since
-        5.from_now => 5.seconds.from_now
+    Or make it expire after a set time:
 
-    See #12389 for the history and rationale behind this.
+        @verifier.generate("x", expires_in: 1.month)
+        @verifier.generate("y", expires_at: Time.now.end_of_year)
 
-    *Godfrey Chan*
+    Showcased with `ActiveSupport::MessageVerifier`, but works the same for
+    `ActiveSupport::MessageEncryptor`'s `encrypt_and_sign` and `decrypt_and_verify`.
 
-*   DateTime `advance` now supports partial days.
+    Pull requests: #29599, #29854
 
-    Before:
-
-        DateTime.now.advance(days: 1, hours: 12)
+    *Assain Jaleel*
 
-    After:
+*   Make the order of `Hash#reverse_merge!` consistent with `HashWithIndifferentAccess`.
 
-        DateTime.now.advance(days: 1.5)
+    *Erol Fornoles*
 
-    Fixes #12005.
+*   Add `freeze_time` helper which freezes time to `Time.now` in tests.
 
-    *Shay Davidson*
+    *Prathamesh Sonpatki*
 
-*   `Hash#deep_transform_keys` and `Hash#deep_transform_keys!` now transform hashes
-    in nested arrays.  This change also applies to `Hash#deep_stringify_keys`,
-    `Hash#deep_stringify_keys!`, `Hash#deep_symbolize_keys` and
-    `Hash#deep_symbolize_keys!`.
+*   Default `ActiveSupport::MessageEncryptor` to use AES 256 GCM encryption.
 
-    *OZAWA Sakuro*
+    On for new Rails 5.2 apps. Upgrading apps can find the config as a new
+    framework default.
 
-*   Fixed confusing `DelegationError` in `Module#delegate`.
+    *Assain Jaleel*
 
-    See #15186.
+*   Cache: `write_multi`.
 
-    *Vladimir Yarotsky*
+        Rails.cache.write_multi foo: 'bar', baz: 'qux'
 
-*   Fixed `ActiveSupport::Subscriber` so that no duplicate subscriber is created
-    when a subscriber method is redefined.
+    Plus faster fetch_multi with stores that implement `write_multi_entries`.
+    Keys that aren't found may be written to the cache store in one shot
+    instead of separate writes.
 
-    *Dennis Schön*
+    The default implementation simply calls `write_entry` for each entry.
+    Stores may override if they're capable of one-shot bulk writes, like
+    Redis `MSET`.
 
-*   Remove deprecated string based terminators for `ActiveSupport::Callbacks`.
+    *Jeremy Daer*
 
-    *Eileen M. Uchitelle*
+*   Add default option to module and class attribute accessors.
 
-*   Fixed an issue when using
-    `ActiveSupport::NumberHelper::NumberToDelimitedConverter` to
-    convert a value that is an `ActiveSupport::SafeBuffer` introduced
-    in 2da9d67.
+        mattr_accessor :settings, default: {}
 
-    See #15064.
+    Works for `mattr_reader`, `mattr_writer`, `cattr_accessor`, `cattr_reader`,
+    and `cattr_writer` as well.
 
-    *Mark J. Titorenko*
+    *Genadi Samokovarov*
 
-*   `TimeZone#parse` defaults the day of the month to '1' if any other date
-    components are specified. This is more consistent with the behavior of
-    `Time#parse`.
+*   Add `Date#prev_occurring` and `Date#next_occurring` to return specified next/previous occurring day of week.
 
-    *Ulysse Carion*
+    *Shota Iguchi*
 
-*   `humanize` strips leading underscores, if any.
+*   Add default option to `class_attribute`.
 
     Before:
 
-        '_id'.humanize # => ""
-
-    After:
-
-        '_id'.humanize # => "Id"
-
-    *Xavier Noria*
-
-*   Fixed backward compatibility issues introduced in 326e652.
-
-    Empty Hash or Array should not be present in serialization result.
-
-        {a: []}.to_query # => ""
-        {a: {}}.to_query # => ""
-
-    For more info see #14948.
+        class_attribute :settings
+        self.settings = {}
 
-    *Bogdan Gusiev*
+    Now:
 
-*   Add `Digest::UUID::uuid_v3` and `Digest::UUID::uuid_v5` to support stable
-    UUID fixtures on PostgreSQL.
+        class_attribute :settings, default: {}
 
-    *Roderick van Domburg*
-
-*   Fixed `ActiveSupport::Duration#eql?` so that `1.second.eql?(1.second)` is
-    true.
-
-    This fixes the current situation of:
-
-        1.second.eql?(1.second) # => false
-
-    `eql?` also requires that the other object is an `ActiveSupport::Duration`.
-    This requirement makes `ActiveSupport::Duration`'s behavior consistent with
-    the behavior of Ruby's numeric types:
+    *DHH*
 
-        1.eql?(1.0) # => false
-        1.0.eql?(1) # => false
+*   `#singularize` and `#pluralize` now respect uncountables for the specified locale.
 
-        1.second.eql?(1) # => false (was true)
-        1.eql?(1.second) # => false
+    *Eilis Hamilton*
 
-        { 1 => "foo", 1.0 => "bar" }
-        # => { 1 => "foo", 1.0 => "bar" }
+*   Add `ActiveSupport::CurrentAttributes` to provide a thread-isolated attributes singleton.
+    Primary use case is keeping all the per-request attributes easily available to the whole system.
 
-        { 1 => "foo", 1.second => "bar" }
-        # now => { 1 => "foo", 1.second => "bar" }
-        # was => { 1 => "bar" }
+    *DHH*
 
-    And though the behavior of these hasn't changed, for reference:
+*   Fix implicit coercion calculations with scalars and durations.
 
-        1 == 1.0 # => true
-        1.0 == 1 # => true
+    Previously, calculations where the scalar is first would be converted to a duration
+    of seconds, but this causes issues with dates being converted to times, e.g:
 
-        1 == 1.second # => true
-        1.second == 1 # => true
+        Time.zone = "Beijing"           # => Asia/Shanghai
+        date = Date.civil(2017, 5, 20)  # => Mon, 20 May 2017
+        2 * 1.day                       # => 172800 seconds
+        date + 2 * 1.day                # => Mon, 22 May 2017 00:00:00 CST +08:00
 
-    *Emily Dobervich*
+    Now, the `ActiveSupport::Duration::Scalar` calculation methods will try to maintain
+    the part structure of the duration where possible, e.g:
 
-*   `ActiveSupport::SafeBuffer#prepend` acts like `String#prepend` and modifies
-    instance in-place, returning self. `ActiveSupport::SafeBuffer#prepend!` is
-    deprecated.
+        Time.zone = "Beijing"           # => Asia/Shanghai
+        date = Date.civil(2017, 5, 20)  # => Mon, 20 May 2017
+        2 * 1.day                       # => 2 days
+        date + 2 * 1.day                # => Mon, 22 May 2017
 
-    *Pavel Pravosud*
+    Fixes #29160, #28970.
 
-*   `HashWithIndifferentAccess` better respects `#to_hash` on objects it
-    receives. In particular, `.new`, `#update`, `#merge`, and `#replace` accept
-    objects which respond to `#to_hash`, even if those objects are not hashes
-    directly.
+    *Andrew White*
 
-    *Peter Jaros*
+*   Add support for versioned cache entries. This enables the cache stores to recycle cache keys, greatly saving
+    on storage in cases with frequent churn. Works together with the separation of `#cache_key` and `#cache_version`
+    in Active Record and its use in Action Pack's fragment caching.
 
-*   Deprecate `Class#superclass_delegating_accessor`, use `Class#class_attribute` instead.
+    *DHH*
 
-    *Akshay Vishnoi*
+*   Pass gem name and deprecation horizon to deprecation notifications.
 
-*   Ensure classes which `include Enumerable` get `#to_json` in addition to
-    `#as_json`.
+    *Willem van Bergen*
 
-    *Sammy Larbi*
+*   Add support for `:offset` and `:zone` to `ActiveSupport::TimeWithZone#change`.
 
-*   Change the signature of `fetch_multi` to return a hash rather than an
-    array. This makes it consistent with the output of `read_multi`.
+    *Andrew White*
 
-    *Parker Selbert*
+*   Add support for `:offset` to `Time#change`.
 
-*   Introduce `Concern#class_methods` as a sleek alternative to clunky
-    `module ClassMethods`. Add `Kernel#concern` to define at the toplevel
-    without chunky `module Foo; extend ActiveSupport::Concern` boilerplate.
+    Fixes #28723.
 
-        # app/models/concerns/authentication.rb
-        concern :Authentication do
-          included do
-            after_create :generate_private_key
-          end
+    *Andrew White*
 
-          class_methods do
-            def authenticate(credentials)
-              # ...
-            end
-          end
+*   Add `fetch_values` for `HashWithIndifferentAccess`.
 
-          def generate_private_key
-            # ...
-          end
-        end
+    The method was originally added to `Hash` in Ruby 2.3.0.
 
-        # app/models/user.rb
-        class User < ActiveRecord::Base
-          include Authentication
-        end
+    *Josh Pencheon*
 
-    *Jeremy Kemper*
 
-Please check [4-1-stable](https://github.com/rails/rails/blob/4-1-stable/activesupport/CHANGELOG.md) for previous changes.
+Please check [5-1-stable](https://github.com/rails/rails/blob/5-1-stable/activesupport/CHANGELOG.md) for previous changes.