jets 1.4.11 → 1.5.0

data/vendor/rails/MIT-LICENSE

@@ -0,0 +1,20 @@
+Copyright (c) 2005-2018 David Heinemeier Hansson
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/vendor/rails/RAILS_VERSION

@@ -0,0 +1 @@
+5.2.2

data/vendor/rails/README.md

@@ -0,0 +1,97 @@
+# Welcome to Rails
+
+Rails is a web-application framework that includes everything needed to
+create database-backed web applications according to the
+[Model-View-Controller (MVC)](http://en.wikipedia.org/wiki/Model-view-controller)
+pattern.
+
+Understanding the MVC pattern is key to understanding Rails. MVC divides your
+application into three layers, each with a specific responsibility.
+
+The _Model layer_ represents your domain model (such as Account, Product,
+Person, Post, etc.) and encapsulates the business logic that is specific to
+your application. In Rails, database-backed model classes are derived from
+`ActiveRecord::Base`. Active Record allows you to present the data from
+database rows as objects and embellish these data objects with business logic
+methods. You can read more about Active Record in its [README](activerecord/README.rdoc).
+Although most Rails models are backed by a database, models can also be ordinary
+Ruby classes, or Ruby classes that implement a set of interfaces as provided by
+the Active Model module. You can read more about Active Model in its [README](activemodel/README.rdoc).
+
+The _Controller layer_ is responsible for handling incoming HTTP requests and
+providing a suitable response. Usually this means returning HTML, but Rails controllers
+can also generate XML, JSON, PDFs, mobile-specific views, and more. Controllers load and
+manipulate models, and render view templates in order to generate the appropriate HTTP response.
+In Rails, incoming requests are routed by Action Dispatch to an appropriate controller, and
+controller classes are derived from `ActionController::Base`. Action Dispatch and Action Controller
+are bundled together in Action Pack. You can read more about Action Pack in its
+[README](actionpack/README.rdoc).
+
+The _View layer_ is composed of "templates" that are responsible for providing
+appropriate representations of your application's resources. Templates can
+come in a variety of formats, but most view templates are HTML with embedded
+Ruby code (ERB files). Views are typically rendered to generate a controller response,
+or to generate the body of an email. In Rails, View generation is handled by Action View.
+You can read more about Action View in its [README](actionview/README.rdoc).
+
+Active Record, Active Model, Action Pack, and Action View can each be used independently outside Rails.
+In addition to that, Rails also comes with Action Mailer ([README](actionmailer/README.rdoc)), a library
+to generate and send emails; Active Job ([README](activejob/README.md)), a
+framework for declaring jobs and making them run on a variety of queueing
+backends; Action Cable ([README](actioncable/README.md)), a framework to
+integrate WebSockets with a Rails application;
+Active Storage ([README](activestorage/README.md)), a library to attach cloud
+and local files to Rails applications;
+and Active Support ([README](activesupport/README.rdoc)), a collection
+of utility classes and standard library extensions that are useful for Rails,
+and may also be used independently outside Rails.
+
+## Getting Started
+
+1. Install Rails at the command prompt if you haven't yet:
+
+        $ gem install rails
+
+2. At the command prompt, create a new Rails application:
+
+        $ rails new myapp
+
+   where "myapp" is the application name.
+
+3. Change directory to `myapp` and start the web server:
+
+        $ cd myapp
+        $ rails server
+
+   Run with `--help` or `-h` for options.
+
+4. Using a browser, go to `http://localhost:3000` and you'll see:
+"Yay! You’re on Rails!"
+
+5. Follow the guidelines to start developing your application. You may find
+   the following resources handy:
+    * [Getting Started with Rails](http://guides.rubyonrails.org/getting_started.html)
+    * [Ruby on Rails Guides](http://guides.rubyonrails.org)
+    * [The API Documentation](http://api.rubyonrails.org)
+    * [Ruby on Rails Tutorial](https://www.railstutorial.org/book)
+
+## Contributing
+
+[![Code Triage Badge](https://www.codetriage.com/rails/rails/badges/users.svg)](https://www.codetriage.com/rails/rails)
+
+We encourage you to contribute to Ruby on Rails! Please check out the
+[Contributing to Ruby on Rails guide](http://edgeguides.rubyonrails.org/contributing_to_ruby_on_rails.html) for guidelines about how to proceed. [Join us!](http://contributors.rubyonrails.org)
+
+Trying to report a possible security vulnerability in Rails? Please
+check out our [security policy](http://rubyonrails.org/security/) for
+guidelines about how to proceed.
+
+Everyone interacting in Rails and its sub-projects' codebases, issue trackers, chat rooms, and mailing lists is expected to follow the Rails [code of conduct](http://rubyonrails.org/conduct/).
+
+## Code Status
+
+[![Build Status](https://travis-ci.org/rails/rails.svg?branch=5-2-stable)](https://travis-ci.org/rails/rails)
+
+## License
+
+Ruby on Rails is released under the [MIT License](https://opensource.org/licenses/MIT).

data/vendor/rails/RELEASING_RAILS.md

@@ -0,0 +1,225 @@
+# Releasing Rails
+
+In this document, we'll cover the steps necessary to release Rails. Each
+section contains steps to take during that time before the release. The times
+suggested in each header are just that: suggestions. However, they should
+really be considered as minimums.
+
+## 10 Days before release
+
+Today is mostly coordination tasks. Here are the things you must do today:
+
+### Is the CI green? If not, make it green. (See "Fixing the CI")
+
+Do not release with a Red CI. You can find the CI status here:
+
+```
+http://travis-ci.org/rails/rails
+```
+
+### Is Sam Ruby happy? If not, make him happy.
+
+Sam Ruby keeps a [test suite](https://github.com/rubys/awdwr) that makes
+sure the code samples in his book
+([Agile Web Development with Rails](https://pragprog.com/titles/rails5/agile-web-development-with-rails-5th-edition))
+all work. These are valuable system tests
+for Rails. You can check the status of these tests here:
+
+[http://intertwingly.net/projects/dashboard.html](http://intertwingly.net/projects/dashboard.html)
+
+Do not release with Red AWDwR tests.
+
+### Do we have any Git dependencies? If so, contact those authors.
+
+Having Git dependencies indicates that we depend on unreleased code.
+Obviously Rails cannot be released when it depends on unreleased code.
+Contact the authors of those particular gems and work out a release date that
+suits them.
+
+### Contact the security team (either tenderlove or rafaelfranca)
+
+Let them know of your plans to release. There may be security issues to be
+addressed, and that can impact your release date.
+
+### Notify implementors.
+
+Ruby implementors have high stakes in making sure Rails works. Be kind and
+give them a heads up that Rails will be released soonish.
+
+This is only required for major and minor releases, bugfix releases aren't a
+big enough deal, and are supposed to be backward compatible.
+
+Send an email just giving a heads up about the upcoming release to these
+lists:
+
+* team@jruby.org
+* community@rubini.us
+* rubyonrails-core@googlegroups.com
+
+Implementors will love you and help you.
+
+## 3 Days before release
+
+This is when you should release the release candidate. Here are your tasks
+for today:
+
+### Is the CI green? If not, make it green.
+
+### Is Sam Ruby happy? If not, make him happy.
+
+### Contact the security team. CVE emails must be sent on this day.
+
+### Create a release branch.
+
+From the stable branch, create a release branch. For example, if you're
+releasing Rails 3.0.10, do this:
+
+```
+[aaron@higgins rails (3-0-stable)]$ git checkout -b 3-0-10
+Switched to a new branch '3-0-10'
+[aaron@higgins rails (3-0-10)]$
+```
+
+### Update each CHANGELOG.
+
+Many times commits are made without the CHANGELOG being updated. You should
+review the commits since the last release, and fill in any missing information
+for each CHANGELOG.
+
+You can review the commits for the 3.0.10 release like this:
+
+```
+[aaron@higgins rails (3-0-10)]$ git log v3.0.9..
+```
+
+If you're doing a stable branch release, you should also ensure that all of
+the CHANGELOG entries in the stable branch are also synced to the master
+branch.
+
+### Put the new version in the RAILS_VERSION file.
+
+Include an RC number if appropriate, e.g. `6.0.0.rc1`.
+
+### Build and test the gem.
+
+Run `rake verify` to generate the gems and install them locally. `verify` also
+generates a Rails app with a migration and boots it to smoke test with in your
+browser.
+
+This will stop you from looking silly when you push an RC to rubygems.org and
+then realize it is broken.
+
+### Release to RubyGems and NPM.
+
+IMPORTANT: The Action Cable client and Action View's UJS adapter are released
+as NPM packages, so you must have Node.js installed, have an NPM account
+(npmjs.com), and be a package owner for `actioncable` and `rails-ujs` (you can
+check this via `npm owner ls actioncable` and `npm owner ls rails-ujs`) in
+order to do a full release. Do not release until you're set up with NPM!
+
+The release task will sign the release tag. If you haven't got commit signing
+set up, use https://git-scm.com/book/tr/v2/Git-Tools-Signing-Your-Work as a
+guide. You can generate keys with the GPG suite from here: https://gpgtools.org.
+
+Run `rake changelog:header` to put a header with the new version in every
+CHANGELOG. Don't commit this, the release task handles it.
+
+Run `rake release`. This will populate the gemspecs and NPM package.json with
+the current RAILS_VERSION, commit the changes, tag it, and push the gems to
+rubygems.org.
+
+### Send Rails release announcements
+
+Write a release announcement that includes the version, changes, and links to
+GitHub where people can find the specific commit list. Here are the mailing
+lists where you should announce:
+
+* rubyonrails-core@googlegroups.com
+* rubyonrails-talk@googlegroups.com
+* ruby-talk@ruby-lang.org
+
+Use Markdown format for your announcement. Remember to ask people to report
+issues with the release candidate to the rails-core mailing list.
+
+NOTE: For patch releases, there's a `rake announce` task to generate the release
+post. It supports multiple patch releases too:
+
+```
+VERSIONS="5.0.5.rc1,5.1.3.rc1" rake announce
+```
+
+IMPORTANT: If any users experience regressions when using the release
+candidate, you *must* postpone the release. Bugfix releases *should not*
+break existing applications.
+
+### Post the announcement to the Rails blog.
+
+If you used Markdown format for your email, you can just paste it into the
+blog.
+
+* http://weblog.rubyonrails.org
+
+### Post the announcement to the Rails Twitter account.
+
+## Time between release candidate and actual release
+
+Check the rails-core mailing list and the GitHub issue list for regressions in
+the RC.
+
+If any regressions are found, fix the regressions and repeat the release
+candidate process. We will not release the final until 72 hours after the
+last release candidate has been pushed. This means that if users find
+regressions, the scheduled release date must be postponed.
+
+When you fix the regressions, do not create a new branch. Fix them on the
+stable branch, then cherry pick the commit to your release branch. No other
+commits should be added to the release branch besides regression fixing commits.
+
+## Day of release
+
+Many of these steps are the same as for the release candidate, so if you need
+more explanation on a particular step, see the RC steps.
+
+Today, do this stuff in this order:
+
+* Apply security patches to the release branch
+* Update CHANGELOG with security fixes
+* Update RAILS_VERSION to remove the rc
+* Build and test the gem
+* Release the gems
+* If releasing a new stable version:
+  - Trigger stable docs generation (see below)
+  - Update the version in the home page
+* Email security lists
+* Email general announcement lists
+
+### Emailing the Rails security announce list
+
+Email the security announce list once for each vulnerability fixed.
+
+You can do this, or ask the security team to do it.
+
+Email the security reports to:
+
+* rubyonrails-security@googlegroups.com
+* oss-security@lists.openwall.com
+
+Be sure to note the security fixes in your announcement along with CVE numbers
+and links to each patch. Some people may not be able to upgrade right away,
+so we need to give them the security fixes in patch form.
+
+* Blog announcements
+* Twitter announcements
+* Merge the release branch to the stable branch
+* Drink beer (or other cocktail)
+
+## Misc
+
+### Fixing the CI
+
+There are two simple steps for fixing the CI:
+
+1. Identify the problem
+2. Fix it
+
+Repeat these steps until the CI is green.

data/vendor/rails/Rakefile

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+require "net/http"
+
+$:.unshift __dir__
+require "tasks/release"
+require "railties/lib/rails/api/task"
+
+desc "Build gem files for all projects"
+task build: "all:build"
+
+desc "Build, install and verify the gem files in a generated Rails app."
+task verify: "all:verify"
+
+desc "Prepare the release"
+task prep_release: "all:prep_release"
+
+desc "Release all gems to rubygems and create a tag"
+task release: "all:release"
+
+desc "Run all tests by default"
+task default: %w(test test:isolated)
+
+%w(test test:isolated package gem).each do |task_name|
+  desc "Run #{task_name} task for all projects"
+  task task_name do
+    errors = []
+    FRAMEWORKS.each do |project|
+      system(%(cd #{project} && #{$0} #{task_name} --trace)) || errors << project
+    end
+    fail("Errors in #{errors.join(', ')}") unless errors.empty?
+  end
+end
+
+desc "Smoke-test all projects"
+task :smoke do
+  (FRAMEWORKS - %w(activerecord)).each do |project|
+    system %(cd #{project} && #{$0} test:isolated --trace)
+  end
+  system %(cd activerecord && #{$0} sqlite3:isolated_test --trace)
+end
+
+desc "Install gems for all projects."
+task install: "all:install"
+
+desc "Generate documentation for the Rails framework"
+if ENV["EDGE"]
+  Rails::API::EdgeTask.new("rdoc")
+else
+  Rails::API::StableTask.new("rdoc")
+end
+
+desc "Bump all versions to match RAILS_VERSION"
+task update_versions: "all:update_versions"
+
+# We have a webhook configured in GitHub that gets invoked after pushes.
+# This hook triggers the following tasks:
+#
+#   * updates the local checkout
+#   * updates Rails Contributors
+#   * generates and publishes edge docs
+#   * if there's a new stable tag, generates and publishes stable docs
+#
+# Everything is automated and you do NOT need to run this task normally.
+desc "Publishes docs, run this AFTER a new stable tag has been pushed"
+task :publish_docs do
+  Net::HTTP.new("api.rubyonrails.org", 8080).start do |http|
+    request  = Net::HTTP::Post.new("/rails-master-hook")
+    response = http.request(request)
+    puts response.body
+  end
+end

data/vendor/rails/actionpack/CHANGELOG.md

@@ -0,0 +1,407 @@
+## Rails 5.2.2 (December 04, 2018) ##
+
+*   Reset Capybara sessions if failed system test screenshot raising an exception.
+
+    Reset Capybara sessions if `take_failed_screenshot` raise exception
+    in system test `after_teardown`.
+
+    *Maxim Perepelitsa*
+
+*   Use request object for context if there's no controller
+
+    There is no controller instance when using a redirect route or a
+    mounted rack application so pass the request object as the context
+    when resolving dynamic CSP sources in this scenario.
+
+    Fixes #34200.
+
+    *Andrew White*
+
+*   Apply mapping to symbols returned from dynamic CSP sources
+
+    Previously if a dynamic source returned a symbol such as :self it
+    would be converted to a string implicity, e.g:
+
+        policy.default_src -> { :self }
+
+    would generate the header:
+
+        Content-Security-Policy: default-src self
+
+    and now it generates:
+
+        Content-Security-Policy: default-src 'self'
+
+    *Andrew White*
+
+*   Fix `rails routes -c` for controller name consists of multiple word.
+
+    *Yoshiyuki Kinjo*
+
+*   Call the `#redirect_to` block in controller context.
+
+    *Steven Peckins*
+
+
+## Rails 5.2.1.1 (November 27, 2018) ##
+
+*   No changes.
+
+
+## Rails 5.2.1 (August 07, 2018) ##
+
+*   Prevent `?null=` being passed on JSON encoded test requests.
+
+    `RequestEncoder#encode_params` won't attempt to parse params if
+    there are none.
+
+    So call like this will no longer append a `?null=` query param.
+
+        get foos_url, as: :json
+
+    *Alireza Bashiri*
+
+*   Ensure `ActionController::Parameters#transform_values` and
+    `ActionController::Parameters#transform_values!` converts hashes into
+    parameters.
+
+    *Kevin Sjöberg*
+
+*   Fix strong parameters `permit!` with nested arrays.
+
+    Given:
+    ```
+    params = ActionController::Parameters.new(nested_arrays: [[{ x: 2, y: 3 }, { x: 21, y: 42 }]])
+    params.permit!
+    ```
+
+    `params[:nested_arrays][0][0].permitted?` will now return `true` instead of `false`.
+
+    *Steve Hull*
+
+*   Reset `RAW_POST_DATA` and `CONTENT_LENGTH` request environment between test requests in
+    `ActionController::TestCase` subclasses.
+
+    *Eugene Kenny*
+
+*   Output only one Content-Security-Policy nonce header value per request.
+
+    Fixes #32597.
+
+    *Andrey Novikov*, *Andrew White*
+
+*   Only disable GPUs for headless Chrome on Windows.
+
+    It is not necessary anymore for Linux and macOS machines.
+
+    https://bugs.chromium.org/p/chromium/issues/detail?id=737678#c1
+
+    *Stefan Wrobel*
+
+*   Fix system tests transactions not closed between examples.
+
+    *Sergey Tarasov*
+
+
+## Rails 5.2.0 (April 09, 2018) ##
+
+*   Check exclude before flagging cookies as secure.
+
+    *Catherine Khuu*
+
+*   Always yield a CSP policy instance from `content_security_policy`
+
+    This allows a controller action to enable the policy individually
+    for a controller and/or specific actions.
+
+    *Andrew White*
+
+*   Add the ability to disable the global CSP in a controller, e.g:
+
+        class LegacyPagesController < ApplicationController
+          content_security_policy false, only: :index
+        end
+
+    *Andrew White*
+
+*   Add alias method `to_hash` to `to_h` for `cookies`.
+    Add alias method `to_h` to `to_hash` for `session`.
+
+    *Igor Kasyanchuk*
+
+*   Update the default HSTS max-age value to 31536000 seconds (1 year)
+    to meet the minimum max-age requirement for https://hstspreload.org/.
+
+    *Grant Bourque*
+
+*   Add support for automatic nonce generation for Rails UJS.
+
+    Because the UJS library creates a script tag to process responses it
+    normally requires the script-src attribute of the content security
+    policy to include 'unsafe-inline'.
+
+    To work around this we generate a per-request nonce value that is
+    embedded in a meta tag in a similar fashion to how CSRF protection
+    embeds its token in a meta tag. The UJS library can then read the
+    nonce value and set it on the dynamically generated script tag to
+    enable it to execute without needing 'unsafe-inline' enabled.
+
+    Nonce generation isn't 100% safe - if your script tag is including
+    user generated content in someway then it may be possible to exploit
+    an XSS vulnerability which can take advantage of the nonce. It is
+    however an improvement on a blanket permission for inline scripts.
+
+    It is also possible to use the nonce within your own script tags by
+    using `nonce: true` to set the nonce value on the tag, e.g
+
+        <%= javascript_tag nonce: true do %>
+          alert('Hello, World!');
+        <% end %>
+
+    Fixes #31689.
+
+    *Andrew White*
+
+*   Matches behavior of `Hash#each` in `ActionController::Parameters#each`.
+
+    *Dominic Cleal*
+
+*   Add `Referrer-Policy` header to default headers set.
+
+    *Guillermo Iguaran*
+
+*   Changed the system tests to set Puma as default server only when the
+    user haven't specified manually another server.
+
+    *Guillermo Iguaran*
+
+*   Add secure `X-Download-Options` and `X-Permitted-Cross-Domain-Policies` to
+    default headers set.
+
+    *Guillermo Iguaran*
+
+*   Add headless firefox support to System Tests.
+
+    *bogdanvlviv*
+
+*   Changed the default system test screenshot output from `inline` to `simple`.
+
+    `inline` works well for iTerm2 but not everyone uses iTerm2. Some terminals like
+    Terminal.app ignore the `inline` and output the path to the file since it can't
+    render the image. Other terminals, like those on Ubuntu, cannot handle the image
+    inline, but also don't handle it gracefully and instead of outputting the file
+    path, it dumps binary into the terminal.
+
+    Commit 9d6e28 fixes this by changing the default for screenshot to be `simple`.
+
+    *Eileen M. Uchitelle*
+
+*   Register most popular audio/video/font mime types supported by modern browsers.
+
+    *Guillermo Iguaran*
+
+*   Fix optimized url helpers when using relative url root.
+
+    Fixes #31220.
+
+    *Andrew White*
+
+*   Add DSL for configuring Content-Security-Policy header.
+
+    The DSL allows you to configure a global Content-Security-Policy
+    header and then override within a controller. For more information
+    about the Content-Security-Policy header see MDN:
+
+    https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
+
+    Example global policy:
+
+        # config/initializers/content_security_policy.rb
+        Rails.application.config.content_security_policy do |p|
+          p.default_src :self, :https
+          p.font_src    :self, :https, :data
+          p.img_src     :self, :https, :data
+          p.object_src  :none
+          p.script_src  :self, :https
+          p.style_src   :self, :https, :unsafe_inline
+        end
+
+    Example controller overrides:
+
+        # Override policy inline
+        class PostsController < ApplicationController
+          content_security_policy do |p|
+            p.upgrade_insecure_requests true
+          end
+        end
+
+        # Using literal values
+        class PostsController < ApplicationController
+          content_security_policy do |p|
+            p.base_uri "https://www.example.com"
+          end
+        end
+
+        # Using mixed static and dynamic values
+        class PostsController < ApplicationController
+          content_security_policy do |p|
+            p.base_uri :self, -> { "https://#{current_user.domain}.example.com" }
+          end
+        end
+
+    Allows you to also only report content violations for migrating
+    legacy content using the `content_security_policy_report_only`
+    configuration attribute, e.g;
+
+        # config/initializers/content_security_policy.rb
+        Rails.application.config.content_security_policy_report_only = true
+
+        # controller override
+        class PostsController < ApplicationController
+          content_security_policy_report_only only: :index
+        end
+
+    Note that this feature does not validate the header for performance
+    reasons since the header is calculated at runtime.
+
+    *Andrew White*
+
+*   Make `assert_recognizes` to traverse mounted engines.
+
+    *Yuichiro Kaneko*
+
+*   Remove deprecated `ActionController::ParamsParser::ParseError`.
+
+    *Rafael Mendonça França*
+
+*   Add `:allow_other_host` option to `redirect_back` method.
+
+    When `allow_other_host` is set to `false`, the `redirect_back` will not allow redirecting from a
+    different host. `allow_other_host` is `true` by default.
+
+    *Tim Masliuchenko*
+
+*   Add headless chrome support to System Tests.
+
+    *Yuji Yaginuma*
+
+*   Add ability to enable Early Hints for HTTP/2
+
+    If supported by the server, and enabled in Puma this allows H2 Early Hints to be used.
+
+    The `javascript_include_tag` and the `stylesheet_link_tag` automatically add Early Hints if requested.
+
+    *Eileen M. Uchitelle*, *Aaron Patterson*
+
+*   Simplify cookies middleware with key rotation support
+
+    Use the `rotate` method for both `MessageEncryptor` and
+    `MessageVerifier` to add key rotation support for encrypted and
+    signed cookies. This also helps simplify support for legacy cookie
+    security.
+
+    *Michael J Coyne*
+
+*   Use Capybara registered `:puma` server config.
+
+    The Capybara registered `:puma` server ensures the puma server is run in process so
+    connection sharing and open request detection work correctly by default.
+
+    *Thomas Walpole*
+
+*   Cookies `:expires` option supports `ActiveSupport::Duration` object.
+
+        cookies[:user_name] = { value: "assain", expires: 1.hour }
+        cookies[:key] = { value: "a yummy cookie", expires: 6.months }
+
+    Pull Request: #30121
+
+    *Assain Jaleel*
+
+*   Enforce signed/encrypted cookie expiry server side.
+
+    Rails can thwart attacks by malicious clients that don't honor a cookie's expiry.
+
+    It does so by stashing the expiry within the written cookie and relying on the
+    signing/encrypting to vouch that it hasn't been tampered with. Then on a
+    server-side read, the expiry is verified and any expired cookie is discarded.
+
+    Pull Request: #30121
+
+    *Assain Jaleel*
+
+*   Make `take_failed_screenshot` work within engine.
+
+    Fixes #30405.
+
+    *Yuji Yaginuma*
+
+*   Deprecate `ActionDispatch::TestResponse` response aliases.
+
+    `#success?`, `#missing?` & `#error?` are not supported by the actual
+    `ActionDispatch::Response` object and can produce false-positives. Instead,
+    use the response helpers provided by `Rack::Response`.
+
+    *Trevor Wistaff*
+
+*   Protect from forgery by default
+
+    Rather than protecting from forgery in the generated `ApplicationController`,
+    add it to `ActionController::Base` depending on
+    `config.action_controller.default_protect_from_forgery`. This configuration
+    defaults to false to support older versions which have removed it from their
+    `ApplicationController`, but is set to true for Rails 5.2.
+
+    *Lisa Ugray*
+
+*   Fallback `ActionController::Parameters#to_s` to `Hash#to_s`.
+
+    *Kir Shatrov*
+
+*   `driven_by` now registers poltergeist and capybara-webkit.
+
+    If poltergeist or capybara-webkit are set as drivers is set for System Tests,
+    `driven_by` will register the driver and set additional options passed via
+    the `:options` parameter.
+
+    Refer to the respective driver's documentation to see what options can be passed.
+
+    *Mario Chavez*
+
+*   AEAD encrypted cookies and sessions with GCM.
+
+    Encrypted cookies now use AES-GCM which couples authentication and
+    encryption in one faster step and produces shorter ciphertexts. Cookies
+    encrypted using AES in CBC HMAC mode will be seamlessly upgraded when
+    this new mode is enabled via the
+    `action_dispatch.use_authenticated_cookie_encryption` configuration value.
+
+    *Michael J Coyne*
+
+*   Change the cache key format for fragments to make it easier to debug key churn. The new format is:
+
+        views/template/action.html.erb:7a1156131a6928cb0026877f8b749ac9/projects/123
+              ^template path           ^template tree digest            ^class   ^id
+
+    *DHH*
+
+*   Add support for recyclable cache keys with fragment caching. This uses the new versioned entries in the
+    `ActiveSupport::Cache` stores and relies on the fact that Active Record has split `#cache_key` and `#cache_version`
+    to support it.
+
+    *DHH*
+
+*   Add `action_controller_api` and `action_controller_base` load hooks to be called in `ActiveSupport.on_load`
+
+    `ActionController::Base` and `ActionController::API` have differing implementations. This means that
+    the one umbrella hook `action_controller` is not able to address certain situations where a method
+    may not exist in a certain implementation.
+
+    This is fixed by adding two new hooks so you can target `ActionController::Base` vs `ActionController::API`
+
+    Fixes #27013.
+
+    *Julian Nadeau*
+
+
+Please check [5-1-stable](https://github.com/rails/rails/blob/5-1-stable/actionpack/CHANGELOG.md) for previous changes.