rails 4.0.13 → 4.1.0.beta1

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of rails might be problematic. Click here for more details.

Files changed (95) hide show
  1. checksums.yaml +4 -4
  2. data/README.md +20 -15
  3. data/guides/CHANGELOG.md +5 -74
  4. data/guides/assets/images/edge_badge.png +0 -0
  5. data/guides/assets/images/feature_tile.gif +0 -0
  6. data/guides/assets/images/footer_tile.gif +0 -0
  7. data/guides/assets/images/fxn.png +0 -0
  8. data/guides/assets/images/getting_started/challenge.png +0 -0
  9. data/guides/assets/images/getting_started/forbidden_attributes_for_new_post.png +0 -0
  10. data/guides/assets/images/getting_started/new_post.png +0 -0
  11. data/guides/assets/images/getting_started/routing_error_no_controller.png +0 -0
  12. data/guides/assets/images/getting_started/routing_error_no_route_matches.png +0 -0
  13. data/guides/assets/images/getting_started/template_is_missing_posts_new.png +0 -0
  14. data/guides/assets/images/getting_started/unknown_action_create_for_posts.png +0 -0
  15. data/guides/assets/images/getting_started/unknown_action_new_for_posts.png +0 -0
  16. data/guides/assets/images/header_tile.gif +0 -0
  17. data/guides/assets/images/icons/README +1 -1
  18. data/guides/assets/images/icons/callouts/11.png +0 -0
  19. data/guides/assets/images/icons/callouts/12.png +0 -0
  20. data/guides/assets/images/icons/callouts/13.png +0 -0
  21. data/guides/assets/images/icons/callouts/15.png +0 -0
  22. data/guides/assets/images/icons/caution.png +0 -0
  23. data/guides/assets/images/icons/example.png +0 -0
  24. data/guides/assets/images/radar.png +0 -0
  25. data/guides/assets/images/rails4_features.png +0 -0
  26. data/guides/assets/images/rails_guides_kindle_cover.jpg +0 -0
  27. data/guides/assets/images/vijaydev.jpg +0 -0
  28. data/guides/assets/javascripts/guides.js +30 -34
  29. data/guides/assets/stylesheets/main.css +2 -1
  30. data/guides/assets/stylesheets/print.css +1 -1
  31. data/guides/bug_report_templates/action_controller_gem.rb +2 -0
  32. data/guides/bug_report_templates/action_controller_master.rb +2 -0
  33. data/guides/bug_report_templates/active_record_gem.rb +1 -1
  34. data/guides/bug_report_templates/active_record_master.rb +2 -1
  35. data/guides/code/getting_started/Gemfile +1 -1
  36. data/guides/code/getting_started/app/assets/javascripts/application.js +1 -2
  37. data/guides/code/getting_started/config/environments/development.rb +1 -1
  38. data/guides/code/getting_started/public/404.html +2 -0
  39. data/guides/code/getting_started/public/422.html +2 -0
  40. data/guides/code/getting_started/public/500.html +2 -0
  41. data/guides/rails_guides/helpers.rb +1 -1
  42. data/guides/source/2_2_release_notes.md +2 -2
  43. data/guides/source/2_3_release_notes.md +8 -8
  44. data/guides/source/3_0_release_notes.md +1 -2
  45. data/guides/source/3_1_release_notes.md +1 -1
  46. data/guides/source/3_2_release_notes.md +12 -12
  47. data/guides/source/4_0_release_notes.md +79 -46
  48. data/guides/source/4_1_release_notes.md +601 -0
  49. data/guides/source/_welcome.html.erb +1 -1
  50. data/guides/source/action_controller_overview.md +117 -31
  51. data/guides/source/action_mailer_basics.md +19 -19
  52. data/guides/source/action_view_overview.md +131 -12
  53. data/guides/source/active_model_basics.md +6 -6
  54. data/guides/source/active_record_basics.md +15 -15
  55. data/guides/source/active_record_callbacks.md +18 -16
  56. data/guides/source/active_record_querying.md +67 -39
  57. data/guides/source/active_record_validations.md +31 -31
  58. data/guides/source/active_support_core_extensions.md +63 -74
  59. data/guides/source/active_support_instrumentation.md +13 -4
  60. data/guides/source/api_documentation_guidelines.md +19 -5
  61. data/guides/source/asset_pipeline.md +544 -249
  62. data/guides/source/association_basics.md +81 -22
  63. data/guides/source/caching_with_rails.md +15 -6
  64. data/guides/source/command_line.md +28 -19
  65. data/guides/source/configuring.md +98 -50
  66. data/guides/source/contributing_to_ruby_on_rails.md +11 -11
  67. data/guides/source/credits.html.erb +2 -2
  68. data/guides/source/debugging_rails_applications.md +36 -5
  69. data/guides/source/development_dependencies_install.md +89 -8
  70. data/guides/source/documents.yaml +7 -1
  71. data/guides/source/engines.md +648 -224
  72. data/guides/source/form_helpers.md +56 -45
  73. data/guides/source/generators.md +7 -3
  74. data/guides/source/getting_started.md +379 -164
  75. data/guides/source/i18n.md +59 -23
  76. data/guides/source/index.html.erb +1 -1
  77. data/guides/source/initialization.md +153 -56
  78. data/guides/source/kindle/toc.html.erb +1 -1
  79. data/guides/source/layout.html.erb +3 -3
  80. data/guides/source/layouts_and_rendering.md +12 -11
  81. data/guides/source/maintenance_policy.md +4 -23
  82. data/guides/source/migrations.md +41 -37
  83. data/guides/source/nested_model_forms.md +3 -3
  84. data/guides/source/plugins.md +27 -23
  85. data/guides/source/rails_application_templates.md +25 -6
  86. data/guides/source/rails_on_rack.md +35 -51
  87. data/guides/source/routing.md +108 -99
  88. data/guides/source/ruby_on_rails_guides_guidelines.md +2 -2
  89. data/guides/source/security.md +33 -31
  90. data/guides/source/testing.md +37 -34
  91. data/guides/source/upgrading_ruby_on_rails.md +335 -16
  92. data/guides/source/working_with_javascript_in_rails.md +18 -10
  93. metadata +66 -39
  94. data/guides/assets/images/jaimeiniesta.jpg +0 -0
  95. data/guides/source/kindle/KINDLE.md +0 -26
@@ -17,7 +17,7 @@ module RailsGuides
17
17
  end
18
18
 
19
19
  def documents_flat
20
- documents_by_section.map {|section| section['documents']}.flatten
20
+ documents_by_section.flat_map {|section| section['documents']}
21
21
  end
22
22
 
23
23
  def finished_documents(documents)
@@ -327,7 +327,7 @@ Other features of memoization include `unmemoize`, `unmemoize_all`, and `memoize
327
327
  The `each_with_object` method provides an alternative to `inject`, using a method backported from Ruby 1.9. It iterates over a collection, passing the current element and the memo into the block.
328
328
 
329
329
  ```ruby
330
- %w(foo bar).each_with_object({}) { |str, hsh| hsh[str] = str.upcase } #=> {'foo' => 'FOO', 'bar' => 'BAR'}
330
+ %w(foo bar).each_with_object({}) { |str, hsh| hsh[str] = str.upcase } # => {'foo' => 'FOO', 'bar' => 'BAR'}
331
331
  ```
332
332
 
333
333
  Lead Contributor: [Adam Keys](http://therealadam.com/)
@@ -366,7 +366,7 @@ Lead Contributor: [Daniel Schierbeck](http://workingwithrails.com/person/5830-da
366
366
  * `Inflector#parameterize` produces a URL-ready version of its input, for use in `to_param`.
367
367
  * `Time#advance` recognizes fractional days and weeks, so you can do `1.7.weeks.ago`, `1.5.hours.since`, and so on.
368
368
  * The included TzInfo library has been upgraded to version 0.3.12.
369
- * `ActiveSuport::StringInquirer` gives you a pretty way to test for equality in strings: `ActiveSupport::StringInquirer.new("abc").abc? => true`
369
+ * `ActiveSupport::StringInquirer` gives you a pretty way to test for equality in strings: `ActiveSupport::StringInquirer.new("abc").abc? => true`
370
370
 
371
371
  Railties
372
372
  --------
@@ -40,7 +40,7 @@ Here's a summary of the rack-related changes:
40
40
  * `ActiveRecord::QueryCache` middleware is automatically inserted onto the middleware stack if `ActiveRecord` has been loaded. This middleware sets up and flushes the per-request Active Record query cache.
41
41
  * The Rails router and controller classes follow the Rack spec. You can call a controller directly with `SomeController.call(env)`. The router stores the routing parameters in `rack.routing_args`.
42
42
  * `ActionController::Request` inherits from `Rack::Request`.
43
- * Instead of `config.action_controller.session = { :session_key => 'foo', ...` use `config.action_controller.session = { :key => 'foo', ...`.
43
+ * Instead of `config.action_controller.session = { :session_key => 'foo', ...` use `config.action_controller.session = { :key => 'foo', ...`.
44
44
  * Using the `ParamsParser` middleware preprocesses any XML, JSON, or YAML requests so they can be read normally with any `Rack::Request` object after it.
45
45
 
46
46
  ### Renewed Support for Rails Engines
@@ -173,8 +173,8 @@ before_save :update_credit_rating, :if => :active,
173
173
  Rails now has a `:having` option on find (as well as on `has_many` and `has_and_belongs_to_many` associations) for filtering records in grouped finds. As those with heavy SQL backgrounds know, this allows filtering based on grouped results:
174
174
 
175
175
  ```ruby
176
- developers = Developer.find(:all, :group => "salary",
177
- :having => "sum(salary) > 10000", :select => "salary")
176
+ developers = Developer.find(:all, :group => "salary",
177
+ :having => "sum(salary) > 10000", :select => "salary")
178
178
  ```
179
179
 
180
180
  * Lead Contributor: [Emilio Tagua](http://github.com/miloops)
@@ -237,7 +237,7 @@ If you're one of the people who has always been bothered by the special-case nam
237
237
 
238
238
  ### HTTP Digest Authentication Support
239
239
 
240
- Rails now has built-in support for HTTP digest authentication. To use it, you call `authenticate_or_request_with_http_digest` with a block that returns the users password (which is then hashed and compared against the transmitted credentials):
240
+ Rails now has built-in support for HTTP digest authentication. To use it, you call `authenticate_or_request_with_http_digest` with a block that returns the user's password (which is then hashed and compared against the transmitted credentials):
241
241
 
242
242
  ```ruby
243
243
  class PostsController < ApplicationController
@@ -451,11 +451,11 @@ select(:post, :category, Post::CATEGORIES, :disabled => 'private')
451
451
  returns
452
452
 
453
453
  ```html
454
- <select name=“post[category]“>
454
+ <select name="post[category]">
455
455
  <option>story</option>
456
456
  <option>joke</option>
457
457
  <option>poem</option>
458
- <option disabled=“disabled“>private</option>
458
+ <option disabled="disabled">private</option>
459
459
  </select>
460
460
  ```
461
461
 
@@ -604,9 +604,9 @@ Deprecated
604
604
  A few pieces of older code are deprecated in this release:
605
605
 
606
606
  * If you're one of the (fairly rare) Rails developers who deploys in a fashion that depends on the inspector, reaper, and spawner scripts, you'll need to know that those scripts are no longer included in core Rails. If you need them, you'll be able to pick up copies via the [irs_process_scripts](http://github.com/rails/irs_process_scripts/tree) plugin.
607
- * `render_component` goes from "deprecated" to "nonexistent" in Rails 2.3. If you still need it, you can install the [render_component plugin](http://github.com/rails/render_component/tree/master.)
607
+ * `render_component` goes from "deprecated" to "nonexistent" in Rails 2.3. If you still need it, you can install the [render_component plugin](http://github.com/rails/render_component/tree/master).
608
608
  * Support for Rails components has been removed.
609
- * If you were one of the people who got used to running `script/performance/request` to look at performance based on integration tests, you need to learn a new trick: that script has been removed from core Rails now. Theres a new request_profiler plugin that you can install to get the exact same functionality back.
609
+ * If you were one of the people who got used to running `script/performance/request` to look at performance based on integration tests, you need to learn a new trick: that script has been removed from core Rails now. There's a new request_profiler plugin that you can install to get the exact same functionality back.
610
610
  * `ActionController::Base#session_enabled?` is deprecated because sessions are lazy-loaded now.
611
611
  * The `:digest` and `:secret` options to `protect_from_forgery` are deprecated and have no effect.
612
612
  * Some integration test helpers have been removed. `response.headers["Status"]` and `headers["Status"]` will no longer return anything. Rack does not allow "Status" in its return headers. However you can still use the `status` and `status_message` helpers. `response.headers["cookie"]` and `headers["cookie"]` will no longer return any CGI cookies. You can inspect `headers["Set-Cookie"]` to see the raw cookie header or use the `cookies` helper to get a hash of the cookies sent to the client.
@@ -340,7 +340,7 @@ Helpers that do something else, like `cache` or `content_for`, are not affected
340
340
  * Helpers now output HTML 5 by default.
341
341
  * Form label helper now pulls values from I18n with a single value, so `f.label :name` will pull the `:name` translation.
342
342
  * I18n select label on should now be :en.helpers.select instead of :en.support.select.
343
- * You no longer need to place a minus sign at the end of a ruby interpolation inside an ERb template to remove the trailing carriage return in the HTML output.
343
+ * You no longer need to place a minus sign at the end of a Ruby interpolation inside an ERB template to remove the trailing carriage return in the HTML output.
344
344
  * Added `grouped_collection_select` helper to Action View.
345
345
  * `content_for?` has been added allowing you to check for the existence of content in a view before rendering.
346
346
  * passing `:value => nil` to form helpers will set the field's `value` attribute to nil as opposed to using the default value
@@ -609,4 +609,3 @@ Credits
609
609
  See the [full list of contributors to Rails](http://contributors.rubyonrails.org/) for the many people who spent many hours making Rails 3. Kudos to all of them.
610
610
 
611
611
  Rails 3.0 Release Notes were compiled by [Mikel Lindsaar](http://lindsaar.net.)
612
-
@@ -286,7 +286,7 @@ Action Pack
286
286
  end
287
287
  ```
288
288
 
289
- You can restrict it to some actions by using `:only` or `:except`. Please read the docs at [`ActionController::Streaming`](http://api.rubyonrails.org/classes/ActionController/Streaming.html) for more information.
289
+ You can restrict it to some actions by using `:only` or `:except`. Please read the docs at [`ActionController::Streaming`](http://api.rubyonrails.org/v3.1.0/classes/ActionController/Streaming.html) for more information.
290
290
 
291
291
  * The redirect route method now also accepts a hash of options which will only change the parts of the url in question, or an object which responds to call, allowing for redirects to be reused.
292
292
 
@@ -21,7 +21,7 @@ If you're upgrading an existing application, it's a great idea to have good test
21
21
 
22
22
  Rails 3.2 requires Ruby 1.8.7 or higher. Support for all of the previous Ruby versions has been dropped officially and you should upgrade as early as possible. Rails 3.2 is also compatible with Ruby 1.9.2.
23
23
 
24
- TIP: Note that Ruby 1.8.7 p248 and p249 have marshaling bugs that crash Rails. Ruby Enterprise Edition has these fixed since the release of 1.8.7-2010.02. On the 1.9 front, Ruby 1.9.1 is not usable because it outright segfaults, so if you want to use 1.9.x, jump on to 1.9.2 or 1.9.3 for smooth sailing.
24
+ TIP: Note that Ruby 1.8.7 p248 and p249 have marshalling bugs that crash Rails. Ruby Enterprise Edition has these fixed since the release of 1.8.7-2010.02. On the 1.9 front, Ruby 1.9.1 is not usable because it outright segfaults, so if you want to use 1.9.x, jump on to 1.9.2 or 1.9.3 for smooth sailing.
25
25
 
26
26
  ### What to update in your apps
27
27
 
@@ -137,7 +137,7 @@ Railties
137
137
 
138
138
  * Update `Rails::Rack::Logger` middleware to apply any tags set in `config.log_tags` to `ActiveSupport::TaggedLogging`. This makes it easy to tag log lines with debug information like subdomain and request id -- both very helpful in debugging multi-user production applications.
139
139
 
140
- * Default options to `rails new` can be set in `~/.railsrc`. You can specify extra command-line arguments to be used every time 'rails new' runs in the `.railsrc` configuration file in your home directory.
140
+ * Default options to `rails new` can be set in `~/.railsrc`. You can specify extra command-line arguments to be used every time `rails new` runs in the `.railsrc` configuration file in your home directory.
141
141
 
142
142
  * Add an alias `d` for `destroy`. This works for engines too.
143
143
 
@@ -185,9 +185,9 @@ Action Pack
185
185
  end
186
186
  ```
187
187
 
188
- Rails will use 'layouts/single_car' when a request comes in :show action, and use 'layouts/application' (or 'layouts/cars', if exists) when a request comes in for any other actions.
188
+ Rails will use `layouts/single_car` when a request comes in `:show` action, and use `layouts/application` (or `layouts/cars`, if exists) when a request comes in for any other actions.
189
189
 
190
- * form\_for is changed to use "#{action}\_#{as}" as the css class and id if `:as` option is provided. Earlier versions used "#{as}\_#{action}".
190
+ * `form\_for` is changed to use `#{action}\_#{as}` as the css class and id if `:as` option is provided. Earlier versions used `#{as}\_#{action}`.
191
191
 
192
192
  * `ActionController::ParamsWrapper` on Active Record models now only wrap `attr_accessible` attributes if they were set. If not, only the attributes returned by the class method `attribute_names` will be wrapped. This fixes the wrapping of nested attributes by adding them to `attr_accessible`.
193
193
 
@@ -219,7 +219,7 @@ Action Pack
219
219
 
220
220
  * MIME type entries for PDF, ZIP and other formats were added.
221
221
 
222
- * Allow fresh_when/stale? to take a record instead of an options hash.
222
+ * Allow `fresh_when/stale?` to take a record instead of an options hash.
223
223
 
224
224
  * Changed log level of warning for missing CSRF token from `:debug` to `:warn`.
225
225
 
@@ -227,7 +227,7 @@ Action Pack
227
227
 
228
228
  #### Deprecations
229
229
 
230
- * Deprecated implied layout lookup in controllers whose parent had a explicit layout set:
230
+ * Deprecated implied layout lookup in controllers whose parent had an explicit layout set:
231
231
 
232
232
  ```ruby
233
233
  class ApplicationController
@@ -238,13 +238,13 @@ Action Pack
238
238
  end
239
239
  ```
240
240
 
241
- In the example above, Posts controller will no longer automatically look up for a posts layout. If you need this functionality you could either remove `layout "application"` from `ApplicationController` or explicitly set it to `nil` in `PostsController`.
241
+ In the example above, `PostsController` will no longer automatically look up for a posts layout. If you need this functionality you could either remove `layout "application"` from `ApplicationController` or explicitly set it to `nil` in `PostsController`.
242
242
 
243
- * Deprecated `ActionController::UnknownAction` in favour of `AbstractController::ActionNotFound`.
243
+ * Deprecated `ActionController::UnknownAction` in favor of `AbstractController::ActionNotFound`.
244
244
 
245
- * Deprecated `ActionController::DoubleRenderError` in favour of `AbstractController::DoubleRenderError`.
245
+ * Deprecated `ActionController::DoubleRenderError` in favor of `AbstractController::DoubleRenderError`.
246
246
 
247
- * Deprecated `method_missing` in favour of `action_missing` for missing actions.
247
+ * Deprecated `method_missing` in favor of `action_missing` for missing actions.
248
248
 
249
249
  * Deprecated `ActionController#rescue_action`, `ActionController#initialize_template_class` and `ActionController#assign_shortcuts`.
250
250
 
@@ -254,7 +254,7 @@ Action Pack
254
254
 
255
255
  * Added `ActionDispatch::RequestId` middleware that'll make a unique X-Request-Id header available to the response and enables the `ActionDispatch::Request#uuid` method. This makes it easy to trace requests from end-to-end in the stack and to identify individual requests in mixed logs like Syslog.
256
256
 
257
- * The `ShowExceptions` middleware now accepts a exceptions application that is responsible to render an exception when the application fails. The application is invoked with a copy of the exception in `env["action_dispatch.exception"]` and with the `PATH_INFO` rewritten to the status code.
257
+ * The `ShowExceptions` middleware now accepts an exceptions application that is responsible to render an exception when the application fails. The application is invoked with a copy of the exception in `env["action_dispatch.exception"]` and with the `PATH_INFO` rewritten to the status code.
258
258
 
259
259
  * Allow rescue responses to be configured through a railtie as in `config.action_dispatch.rescue_responses`.
260
260
 
@@ -375,7 +375,7 @@ Active Record
375
375
 
376
376
  * Support index sort order in SQLite, MySQL and PostgreSQL adapters.
377
377
 
378
- * Allow the `:class_name` option for associations to take a symbol in addition to a string. This is to avoid confusing newbies, and to be consistent with the fact that other options like :foreign_key already allow a symbol or a string.
378
+ * Allow the `:class_name` option for associations to take a symbol in addition to a string. This is to avoid confusing newbies, and to be consistent with the fact that other options like `:foreign_key` already allow a symbol or a string.
379
379
 
380
380
  ```ruby
381
381
  has_many :clients, :class_name => :Client # Note that the symbol need to be capitalized
@@ -8,17 +8,14 @@ Highlights in Rails 4.0:
8
8
  * Turbolinks
9
9
  * Russian Doll Caching
10
10
 
11
- These release notes cover only the major changes. To learn about various bug
12
- fixes and changes, please refer to the change logs or check out the [list of
13
- commits](https://github.com/rails/rails/commits/4-0-stable) in the main Rails
14
- repository on GitHub.
11
+ These release notes cover only the major changes. To know about various bug fixes and changes, please refer to the change logs or check out the [list of commits](https://github.com/rails/rails/commits/master) in the main Rails repository on GitHub.
15
12
 
16
13
  --------------------------------------------------------------------------------
17
14
 
18
15
  Upgrading to Rails 4.0
19
16
  ----------------------
20
17
 
21
- If you're upgrading an existing application, it's a great idea to have good test coverage before going in. You should also first upgrade to Rails 3.2 in case you haven't and make sure your application still runs as expected before attempting an update to Rails 4.0. A list of things to watch out for when upgrading is available in the [Upgrading to Rails](upgrading_ruby_on_rails.html#upgrading-from-rails-3-2-to-rails-4-0) guide.
18
+ If you're upgrading an existing application, it's a great idea to have good test coverage before going in. You should also first upgrade to Rails 3.2 in case you haven't and make sure your application still runs as expected before attempting an update to Rails 4.0. A list of things to watch out for when upgrading is available in the [Upgrading Ruby on Rails](upgrading_ruby_on_rails.html#upgrading-from-rails-3-2-to-rails-4-0) guide.
22
19
 
23
20
 
24
21
  Creating a Rails 4.0 application
@@ -53,10 +50,47 @@ $ ruby /path/to/rails/railties/bin/rails new myapp --dev
53
50
  Major Features
54
51
  --------------
55
52
 
56
- TODO. Give a list and then talk about each of them briefly. We can point to relevant code commits or documentation from these sections.
57
-
58
53
  [![Rails 4.0](images/rails4_features.png)](http://guides.rubyonrails.org/images/rails4_features.png)
59
54
 
55
+ ### Upgrade
56
+
57
+ * **Ruby 1.9.3** ([commit](https://github.com/rails/rails/commit/a0380e808d3dbd2462df17f5d3b7fcd8bd812496)) - Ruby 2.0 preferred; 1.9.3+ required
58
+ * **[New deprecation policy](http://www.youtube.com/watch?v=z6YgD6tVPQs)** - Deprecated features are warnings in Rails 4.0 and will be removed in Rails 4.1.
59
+ * **ActionPack page and action caching** ([commit](https://github.com/rails/rails/commit/b0a7068564f0c95e7ef28fc39d0335ed17d93e90)) - Page and action caching are extracted to a separate gem. Page and action caching requires too much manual intervention (manually expiring caches when the underlying model objects are updated). Instead, use Russian doll caching.
60
+ * **ActiveRecord observers** ([commit](https://github.com/rails/rails/commit/ccecab3ba950a288b61a516bf9b6962e384aae0b)) - Observers are extracted to a separate gem. Observers are only needed for page and action caching, and can lead to spaghetti code.
61
+ * **ActiveRecord session store** ([commit](https://github.com/rails/rails/commit/0ffe19056c8e8b2f9ae9d487b896cad2ce9387ad)) - The ActiveRecord session store is extracted to a separate gem. Storing sessions in SQL is costly. Instead, use cookie sessions, memcache sessions, or a custom session store.
62
+ * **ActiveModel mass assignment protection** ([commit](https://github.com/rails/rails/commit/f8c9a4d3e88181cee644f91e1342bfe896ca64c6)) - Rails 3 mass assignment protection is deprecated. Instead, use strong parameters.
63
+ * **ActiveResource** ([commit](https://github.com/rails/rails/commit/f1637bf2bb00490203503fbd943b73406e043d1d)) - ActiveResource is extracted to a separate gem. ActiveResource was not widely used.
64
+ * **vendor/plugins removed** ([commit](https://github.com/rails/rails/commit/853de2bd9ac572735fa6cf59fcf827e485a231c3)) - Use a Gemfile to manage installed gems.
65
+
66
+ ### ActionPack
67
+
68
+ * **Strong parameters** ([commit](https://github.com/rails/rails/commit/a8f6d5c6450a7fe058348a7f10a908352bb6c7fc)) - Only allow whitelisted parameters to update model objects (`params.permit(:title, :text)`).
69
+ * **Routing concerns** ([commit](https://github.com/rails/rails/commit/0dd24728a088fcb4ae616bb5d62734aca5276b1b)) - In the routing DSL, factor out common subroutes (`comments` from `/posts/1/comments` and `/videos/1/comments`).
70
+ * **ActionController::Live** ([commit](https://github.com/rails/rails/commit/af0a9f9eefaee3a8120cfd8d05cbc431af376da3)) - Stream JSON with `response.stream`.
71
+ * **Declarative ETags** ([commit](https://github.com/rails/rails/commit/ed5c938fa36995f06d4917d9543ba78ed506bb8d)) - Add controller-level etag additions that will be part of the action etag computation
72
+ * **[Russian doll caching](http://37signals.com/svn/posts/3113-how-key-based-cache-expiration-works)** ([commit](https://github.com/rails/rails/commit/4154bf012d2bec2aae79e4a49aa94a70d3e91d49)) - Cache nested fragments of views. Each fragment expires based on a set of dependencies (a cache key). The cache key is usually a template version number and a model object.
73
+ * **Turbolinks** ([commit](https://github.com/rails/rails/commit/e35d8b18d0649c0ecc58f6b73df6b3c8d0c6bb74)) - Serve only one initial HTML page. When the user navigates to another page, use pushState to update the URL and use AJAX to update the title and body.
74
+ * **Decouple ActionView from ActionController** ([commit](https://github.com/rails/rails/commit/78b0934dd1bb84e8f093fb8ef95ca99b297b51cd)) - ActionView was decoupled from ActionPack and will be moved to a separated gem in Rails 4.1.
75
+ * **Do not depend on ActiveModel** ([commit](https://github.com/rails/rails/commit/166dbaa7526a96fdf046f093f25b0a134b277a68)) - ActionPack no longer depends on ActiveModel.
76
+
77
+ ### General
78
+
79
+ * **ActiveModel::Model** ([commit](https://github.com/rails/rails/commit/3b822e91d1a6c4eab0064989bbd07aae3a6d0d08)) - `ActiveModel::Model`, a mixin to make normal Ruby objects to work with ActionPack out of box (ex. for `form_for`)
80
+ * **New scope API** ([commit](https://github.com/rails/rails/commit/50cbc03d18c5984347965a94027879623fc44cce)) - Scopes must always use callables.
81
+ * **Schema cache dump** ([commit](https://github.com/rails/rails/commit/5ca4fc95818047108e69e22d200e7a4a22969477)) - To improve Rails boot time, instead of loading the schema directly from the database, load the schema from a dump file.
82
+ * **Support for specifying transaction isolation level** ([commit](https://github.com/rails/rails/commit/392eeecc11a291e406db927a18b75f41b2658253)) - Choose whether repeatable reads or improved performance (less locking) is more important.
83
+ * **Dalli** ([commit](https://github.com/rails/rails/commit/82663306f428a5bbc90c511458432afb26d2f238)) - Use Dalli memcache client for the memcache store.
84
+ * **Notifications start &amp; finish** ([commit](https://github.com/rails/rails/commit/f08f8750a512f741acb004d0cebe210c5f949f28)) - Active Support instrumentation reports start and finish notifications to subscribers.
85
+ * **Thread safe by default** ([commit](https://github.com/rails/rails/commit/5d416b907864d99af55ebaa400fff217e17570cd)) - Rails can run in threaded app servers without additional configuration. Note: Check that the gems you are using are threadsafe.
86
+ * **PATCH verb** ([commit](https://github.com/rails/rails/commit/eed9f2539e3ab5a68e798802f464b8e4e95e619e)) - In Rails, PATCH replaces PUT. PATCH is used for partial updates of resources.
87
+
88
+ ### Security
89
+
90
+ * **match do not catch all** ([commit](https://github.com/rails/rails/commit/90d2802b71a6e89aedfe40564a37bd35f777e541)) - In the routing DSL, match requires the HTTP verb or verbs to be specified.
91
+ * **html entities escaped by default** ([commit](https://github.com/rails/rails/commit/5f189f41258b83d49012ec5a0678d827327e7543)) - Strings rendered in erb are escaped unless wrapped with `raw` or `html_safe` is called.
92
+ * **New security headers** ([commit](https://github.com/rails/rails/commit/6794e92b204572d75a07bd6413bdae6ae22d5a82)) - Rails sends the following headers with every HTTP request: `X-Frame-Options` (prevents clickjacking by forbidding the browser from embedding the page in a frame), `X-XSS-Protection` (asks the browser to halt script injection) and `X-Content-Type-Options` (prevents the browser from opening a jpeg as an exe).
93
+
60
94
  Extraction of features to gems
61
95
  ---------------------------
62
96
 
@@ -82,13 +116,13 @@ Documentation
82
116
  Railties
83
117
  --------
84
118
 
85
- Please refer to the [Changelog](https://github.com/rails/rails/blob/master/railties/CHANGELOG.md) for detailed changes.
119
+ Please refer to the [Changelog](https://github.com/rails/rails/blob/4-0-stable/railties/CHANGELOG.md) for detailed changes.
86
120
 
87
121
  ### Notable changes
88
122
 
89
- * New test locations `test/models`, `test/helpers`, `test/controllers`, and `test/mailers`. Corresponding rake tasks added as well. ([Pull Request](https://github.com/rails/rails/pull/7878))
123
+ * New test locations `test/models`, `test/helpers`, `test/controllers`, and `test/mailers`. Corresponding rake tasks added as well. ([Pull Request](https://github.com/rails/rails/pull/7878))
90
124
 
91
- * Your app's executables now live in the `bin/` dir. Run `rake rails:update:bin` to get `bin/bundle`, `bin/rails`, and `bin/rake`.
125
+ * Your app's executables now live in the `bin/` directory. Run `rake rails:update:bin` to get `bin/bundle`, `bin/rails`, and `bin/rake`.
92
126
 
93
127
  * Threadsafe on by default
94
128
 
@@ -105,7 +139,7 @@ Please refer to the [Changelog](https://github.com/rails/rails/blob/master/railt
105
139
  Action Mailer
106
140
  -------------
107
141
 
108
- Please refer to the [Changelog](https://github.com/rails/rails/blob/master/actionmailer/CHANGELOG.md) for detailed changes.
142
+ Please refer to the [Changelog](https://github.com/rails/rails/blob/4-0-stable/actionmailer/CHANGELOG.md) for detailed changes.
109
143
 
110
144
  ### Notable changes
111
145
 
@@ -114,31 +148,30 @@ Please refer to the [Changelog](https://github.com/rails/rails/blob/master/actio
114
148
  Active Model
115
149
  ------------
116
150
 
117
- Please refer to the [Changelog](https://github.com/rails/rails/blob/master/activemodel/CHANGELOG.md) for detailed changes.
151
+ Please refer to the [Changelog](https://github.com/rails/rails/blob/4-0-stable/activemodel/CHANGELOG.md) for detailed changes.
118
152
 
119
153
  ### Notable changes
120
154
 
121
- * Add `ActiveModel::ForbiddenAttributesProtection`, a simple module to protect attributes from mass assignment when non-permitted attributes are passed.
155
+ * Add `ActiveModel::ForbiddenAttributesProtection`, a simple module to protect attributes from mass assignment when non-permitted attributes are passed.
122
156
 
123
- * Added `ActiveModel::Model`, a mixin to make Ruby objects work with
124
- Action Pack out of box.
157
+ * Added `ActiveModel::Model`, a mixin to make Ruby objects work with Action Pack out of box.
125
158
 
126
159
  ### Deprecations
127
160
 
128
161
  Active Support
129
162
  --------------
130
163
 
131
- Please refer to the [Changelog](https://github.com/rails/rails/blob/master/activesupport/CHANGELOG.md) for detailed changes.
164
+ Please refer to the [Changelog](https://github.com/rails/rails/blob/4-0-stable/activesupport/CHANGELOG.md) for detailed changes.
132
165
 
133
166
  ### Notable changes
134
167
 
135
- * Replace deprecated `memcache-client` gem with `dalli` in ActiveSupport::Cache::MemCacheStore.
168
+ * Replace deprecated `memcache-client` gem with `dalli` in `ActiveSupport::Cache::MemCacheStore`.
136
169
 
137
- * Optimize ActiveSupport::Cache::Entry to reduce memory and processing overhead.
170
+ * Optimize `ActiveSupport::Cache::Entry` to reduce memory and processing overhead.
138
171
 
139
- * Inflections can now be defined per locale. `singularize` and `pluralize` accept locale as an extra argument.
172
+ * Inflections can now be defined per locale. `singularize` and `pluralize` accept locale as an extra argument.
140
173
 
141
- * `Object#try` will now return nil instead of raise a NoMethodError if the receiving object does not implement the method, but you can still get the old behavior by using the new `Object#try!`.
174
+ * `Object#try` will now return nil instead of raise a NoMethodError if the receiving object does not implement the method, but you can still get the old behavior by using the new `Object#try!`.
142
175
 
143
176
  * `String#to_date` now raises `ArgumentError: invalid date` instead of `NoMethodError: undefined method 'div' for nil:NilClass`
144
177
  when given an invalid date. It is now the same as `Date.parse`, and it accepts more invalid dates than 3.x, such as:
@@ -155,22 +188,22 @@ Please refer to the [Changelog](https://github.com/rails/rails/blob/master/activ
155
188
 
156
189
  ### Deprecations
157
190
 
158
- * Deprecate `ActiveSupport::TestCase#pending` method, use `skip` from MiniTest instead.
191
+ * Deprecate `ActiveSupport::TestCase#pending` method, use `skip` from MiniTest instead.
159
192
 
160
- * `ActiveSupport::Benchmarkable#silence` has been deprecated due to its lack of thread safety. It will be removed without replacement in Rails 4.1.
193
+ * `ActiveSupport::Benchmarkable#silence` has been deprecated due to its lack of thread safety. It will be removed without replacement in Rails 4.1.
161
194
 
162
- * `ActiveSupport::JSON::Variable` is deprecated. Define your own `#as_json` and `#encode_json` methods for custom JSON string literals.
195
+ * `ActiveSupport::JSON::Variable` is deprecated. Define your own `#as_json` and `#encode_json` methods for custom JSON string literals.
163
196
 
164
- * Deprecates the compatibility method `Module#local_constant_names`, use `Module#local_constants` instead (which returns symbols).
197
+ * Deprecates the compatibility method `Module#local_constant_names`, use `Module#local_constants` instead (which returns symbols).
165
198
 
166
- * `BufferedLogger` is deprecated. Use `ActiveSupport::Logger`, or the logger from Ruby standard library.
199
+ * `BufferedLogger` is deprecated. Use `ActiveSupport::Logger`, or the logger from Ruby standard library.
167
200
 
168
- * Deprecate `assert_present` and `assert_blank` in favor of `assert object.blank?` and `assert object.present?`
201
+ * Deprecate `assert_present` and `assert_blank` in favor of `assert object.blank?` and `assert object.present?`
169
202
 
170
203
  Action Pack
171
204
  -----------
172
205
 
173
- Please refer to the [Changelog](https://github.com/rails/rails/blob/master/actionpack/CHANGELOG.md) for detailed changes.
206
+ Please refer to the [Changelog](https://github.com/rails/rails/blob/4-0-stable/actionpack/CHANGELOG.md) for detailed changes.
174
207
 
175
208
  ### Notable changes
176
209
 
@@ -182,11 +215,11 @@ Please refer to the [Changelog](https://github.com/rails/rails/blob/master/actio
182
215
  Active Record
183
216
  -------------
184
217
 
185
- Please refer to the [Changelog](https://github.com/rails/rails/blob/master/activerecord/CHANGELOG.md) for detailed changes.
218
+ Please refer to the [Changelog](https://github.com/rails/rails/blob/4-0-stable/activerecord/CHANGELOG.md) for detailed changes.
186
219
 
187
220
  ### Notable changes
188
221
 
189
- * Improve ways to write `change` migrations, making the old `up` & `down` methods no longer necessary.
222
+ * Improve ways to write `change` migrations, making the old `up` & `down` methods no longer necessary.
190
223
 
191
224
  * The methods `drop_table` and `remove_column` are now reversible, as long as the necessary information is given.
192
225
  The method `remove_column` used to accept multiple column names; instead use `remove_columns` (which is not revertible).
@@ -199,43 +232,43 @@ Please refer to the [Changelog](https://github.com/rails/rails/blob/master/activ
199
232
  If migrating down, the given migration / block is run normally.
200
233
  See the [Guide on Migration](https://github.com/rails/rails/blob/master/guides/source/migrations.md#reverting-previous-migrations)
201
234
 
202
- * Adds PostgreSQL array type support. Any datatype can be used to create an array column, with full migration and schema dumper support.
235
+ * Adds PostgreSQL array type support. Any datatype can be used to create an array column, with full migration and schema dumper support.
203
236
 
204
- * Add `Relation#load` to explicitly load the record and return `self`.
237
+ * Add `Relation#load` to explicitly load the record and return `self`.
205
238
 
206
- * `Model.all` now returns an `ActiveRecord::Relation`, rather than an array of records. Use `Relation#to_a` if you really want an array. In some specific cases, this may cause breakage when upgrading.
239
+ * `Model.all` now returns an `ActiveRecord::Relation`, rather than an array of records. Use `Relation#to_a` if you really want an array. In some specific cases, this may cause breakage when upgrading.
207
240
 
208
- * Added `ActiveRecord::Migration.check_pending!` that raises an error if migrations are pending.
241
+ * Added `ActiveRecord::Migration.check_pending!` that raises an error if migrations are pending.
209
242
 
210
- * Added custom coders support for `ActiveRecord::Store`. Now you can set your custom coder like this:
243
+ * Added custom coders support for `ActiveRecord::Store`. Now you can set your custom coder like this:
211
244
 
212
245
  store :settings, accessors: [ :color, :homepage ], coder: JSON
213
246
 
214
- * `mysql` and `mysql2` connections will set `SQL_MODE=STRICT_ALL_TABLES` by default to avoid silent data loss. This can be disabled by specifying `strict: false` in your `database.yml`.
247
+ * `mysql` and `mysql2` connections will set `SQL_MODE=STRICT_ALL_TABLES` by default to avoid silent data loss. This can be disabled by specifying `strict: false` in your `database.yml`.
215
248
 
216
- * Remove IdentityMap.
249
+ * Remove IdentityMap.
217
250
 
218
- * Remove automatic execution of EXPLAIN queries. The option `active_record.auto_explain_threshold_in_seconds` is no longer used and should be removed.
251
+ * Remove automatic execution of EXPLAIN queries. The option `active_record.auto_explain_threshold_in_seconds` is no longer used and should be removed.
219
252
 
220
- * Adds `ActiveRecord::NullRelation` and `ActiveRecord::Relation#none` implementing the null object pattern for the Relation class.
253
+ * Adds `ActiveRecord::NullRelation` and `ActiveRecord::Relation#none` implementing the null object pattern for the Relation class.
221
254
 
222
- * Added `create_join_table` migration helper to create HABTM join tables.
255
+ * Added `create_join_table` migration helper to create HABTM join tables.
223
256
 
224
- * Allows PostgreSQL hstore records to be created.
257
+ * Allows PostgreSQL hstore records to be created.
225
258
 
226
259
  ### Deprecations
227
260
 
228
- * Deprecated the old-style hash based finder API. This means that methods which previously accepted "finder options" no longer do.
261
+ * Deprecated the old-style hash based finder API. This means that methods which previously accepted "finder options" no longer do.
229
262
 
230
- * All dynamic methods except for `find_by_...` and `find_by_...!` are deprecated. Here's
231
- how you can rewrite the code:
263
+ * All dynamic methods except for `find_by_...` and `find_by_...!` are deprecated. Here's
264
+ how you can rewrite the code:
232
265
 
233
266
  * `find_all_by_...` can be rewritten using `where(...)`.
234
267
  * `find_last_by_...` can be rewritten using `where(...).last`.
235
268
  * `scoped_by_...` can be rewritten using `where(...)`.
236
- * `find_or_initialize_by_...` can be rewritten using `where(...).first_or_initialize`.
237
- * `find_or_create_by_...` can be rewritten using `find_or_create_by(...)` or `where(...).first_or_create`.
238
- * `find_or_create_by_...!` can be rewritten using `find_or_create_by!(...)` or `where(...).first_or_create!`.
269
+ * `find_or_initialize_by_...` can be rewritten using `find_or_initialize_by(...)`.
270
+ * `find_or_create_by_...` can be rewritten using `find_or_create_by(...)`.
271
+ * `find_or_create_by_...!` can be rewritten using `find_or_create_by!(...)`.
239
272
 
240
273
  Credits
241
274
  -------
@@ -0,0 +1,601 @@
1
+ Ruby on Rails 4.1 Release Notes
2
+ ===============================
3
+
4
+ Highlights in Rails 4.1:
5
+
6
+ * Spring application preloader
7
+ * `config/secrets.yml`
8
+ * Action Pack variants
9
+ * Action Mailer previews
10
+
11
+ These release notes cover only the major changes. To know about various bug
12
+ fixes and changes, please refer to the change logs or check out the
13
+ [list of commits](https://github.com/rails/rails/commits/master) in the main
14
+ Rails repository on GitHub.
15
+
16
+ --------------------------------------------------------------------------------
17
+
18
+ Upgrading to Rails 4.1
19
+ ----------------------
20
+
21
+ If you're upgrading an existing application, it's a great idea to have good test
22
+ coverage before going in. You should also first upgrade to Rails 4.0 in case you
23
+ haven't and make sure your application still runs as expected before attempting
24
+ an update to Rails 4.1. A list of things to watch out for when upgrading is
25
+ available in the
26
+ [Upgrading Ruby on Rails](upgrading_ruby_on_rails.html#upgrading-from-rails-4-0-to-rails-4-1)
27
+ guide.
28
+
29
+
30
+ Major Features
31
+ --------------
32
+
33
+ ### Spring application preloader
34
+
35
+ Spring is a Rails application preloader. It speeds up development by keeping
36
+ your application running in the background so you don't need to boot it every
37
+ time you run a test, rake task or migration.
38
+
39
+ New Rails 4.1 applications will ship with "springified" binstubs. This means
40
+ that `bin/rails` and `bin/rake` will automatically take advantage of preloaded
41
+ spring environments.
42
+
43
+ **running rake tasks:**
44
+
45
+ ```
46
+ bin/rake routes
47
+ ```
48
+
49
+ **running tests:**
50
+
51
+ ```
52
+ bin/rake test
53
+ bin/rake test test/models
54
+ bin/rake test test/models/user_test.rb
55
+ ```
56
+
57
+ **running a console:**
58
+
59
+ ```
60
+ bin/rails console
61
+ ```
62
+
63
+ **spring introspection:**
64
+
65
+ ```
66
+ $ bin/spring status
67
+ Spring is running:
68
+
69
+ 1182 spring server | my_app | started 29 mins ago
70
+ 3656 spring app | my_app | started 23 secs ago | test mode
71
+ 3746 spring app | my_app | started 10 secs ago | development mode
72
+ ```
73
+
74
+ Have a look at the
75
+ [Spring README](https://github.com/jonleighton/spring/blob/master/README.md) to
76
+ see all available features.
77
+
78
+ See the [Upgrading Ruby on Rails](upgrading_ruby_on_rails.html#spring)
79
+ guide on how to migrate existing applications to use this feature.
80
+
81
+ ### `config/secrets.yml`
82
+
83
+ Rails 4.1 will generate a new `secrets.yml` file in the `config` folder for new
84
+ applications. By default, this file contains the application's `secret_key_base`,
85
+ but it could also be used to store other secrets such as access keys for external
86
+ APIs.
87
+
88
+ The secrets added to this file will be accessible via `Rails.application.secrets`.
89
+ For example, with the following `secrets.yml`:
90
+
91
+ ```yaml
92
+ development:
93
+ secret_key_base: 3b7cd727ee24e8444053437c36cc66c3
94
+ some_api_key: SOMEKEY
95
+ ```
96
+
97
+ `Rails.application.secrets.some_api_key` will return `SOMEKEY` in the development
98
+ environment.
99
+
100
+ See the [Upgrading Ruby on Rails](upgrading_ruby_on_rails.html#config-secrets-yml)
101
+ guide on how to migrate existing applications to use this feature.
102
+
103
+ ### Action Pack variants
104
+
105
+ We often want to render different html/json/xml templates for phones,
106
+ tablets, and desktop browsers. Variants makes it easy.
107
+
108
+ The request variant is a specialization of the request format, like `:tablet`,
109
+ `:phone`, or `:desktop`.
110
+
111
+ You can set the variant in a `before_action`:
112
+
113
+ ```ruby
114
+ request.variant = :tablet if request.user_agent =~ /iPad/
115
+ ```
116
+
117
+ Respond to variants in the action just like you respond to formats:
118
+
119
+ ```ruby
120
+ respond_to do |format|
121
+ format.html do |html|
122
+ html.tablet # renders app/views/projects/show.html+tablet.erb
123
+ html.phone { extra_setup; render ... }
124
+ end
125
+ end
126
+ ```
127
+
128
+ Provide separate templates for each format and variant:
129
+
130
+ ```
131
+ app/views/projects/show.html.erb
132
+ app/views/projects/show.html+tablet.erb
133
+ app/views/projects/show.html+phone.erb
134
+ ```
135
+
136
+ You can also simplify the variants definition using the inline syntax:
137
+
138
+ ```ruby
139
+ respond_to do |format|
140
+ format.js { render "trash" }
141
+ format.html.phone { redirect_to progress_path }
142
+ format.html.none { render "trash" }
143
+ end
144
+ ```
145
+
146
+ ### Action Mailer previews
147
+
148
+ Preview email templates in the browser without delivering them.
149
+
150
+ ```ruby
151
+ class NotifierPreview < ActionMailer::Preview
152
+ # Accessible from http://localhost:3000/rails/mailers/notifier/welcome
153
+ def welcome
154
+ Notifier.welcome(User.first)
155
+ end
156
+ end
157
+ ```
158
+
159
+ By default, these preview files live in <tt>test/mailers/previews</tt>.
160
+ This can be configured using the <tt>preview_path</tt> option.
161
+
162
+ See
163
+ [action_mailer/base.rb](api.rubyonrails.org/v4.1.0/classes/ActionMailer/Base.html)
164
+ for a detailed write up.
165
+
166
+ ### Active Record enums
167
+
168
+ Declare an enum attribute where the values map to integers in the database, but
169
+ can be queried by name.
170
+
171
+ ```ruby
172
+ class Conversation < ActiveRecord::Base
173
+ enum status: [ :active, :archived ]
174
+ end
175
+
176
+ conversation.archived!
177
+ conversation.active? # => false
178
+ conversation.status # => "archived"
179
+
180
+ Conversation.archived # => Relation for all archived Conversations
181
+ ```
182
+
183
+ See
184
+ [active_record/enum.rb](api.rubyonrails.org/v4.1.0/classes/ActiveRecord/Enum.html)
185
+ for a detailed write up.
186
+
187
+ ### Application message verifier
188
+
189
+ Create a message verifier that can be used to generate and verify signed
190
+ messages in the application.
191
+
192
+ ```ruby
193
+ message = Rails.application.message_verifier('salt').generate('my sensible data')
194
+ Rails.application.message_verifier('salt').verify(message)
195
+ # => 'my sensible data'
196
+ ```
197
+
198
+ ### Module#concerning
199
+
200
+ A natural, low-ceremony way to separate responsibilities within a class:
201
+
202
+ ```ruby
203
+ class Todo < ActiveRecord::Base
204
+ concerning :EventTracking do
205
+ included do
206
+ has_many :events
207
+ end
208
+
209
+ def latest_event
210
+ ...
211
+ end
212
+
213
+ private
214
+ def some_internal_method
215
+ ...
216
+ end
217
+ end
218
+ end
219
+ ```
220
+
221
+ This example is equivalent to defining a `EventTracking` module inline,
222
+ extending it with `ActiveSupport::Concern`, then mixing it in to the
223
+ `Todo` class.
224
+
225
+ ### CSRF protection from remote `<script>` tags
226
+
227
+ Cross-site request forgery (CSRF) protection now covers GET requests with
228
+ JavaScript responses, too. That prevents a third-party site from referencing
229
+ your JavaScript URL and attempting to run it to extract sensitive data.
230
+
231
+ This means any of your tests that hit `.js` URLs will now fail CSRF protection
232
+ unless they use `xhr`. Upgrade your tests to be explicit about expecting
233
+ XmlHttpRequests. Instead of `post :create, format: :js`, switch to the explicit
234
+ `xhr :post, :create, format: :js`.
235
+
236
+ Railties
237
+ --------
238
+
239
+ Please refer to the
240
+ [Changelog](https://github.com/rails/rails/blob/4-1-stable/railties/CHANGELOG.md)
241
+ for detailed changes.
242
+
243
+ ### Removals
244
+
245
+ * Removed `update:application_controller` rake task.
246
+
247
+ * Removed deprecated `Rails.application.railties.engines`.
248
+
249
+ * Removed deprecated `threadsafe!` from Rails Config.
250
+
251
+ * Removed deprecated `ActiveRecord::Generators::ActiveModel#update_attributes` in
252
+ favor of `ActiveRecord::Generators::ActiveModel#update`.
253
+
254
+ * Removed deprecated `config.whiny_nils` option.
255
+
256
+ * Removed deprecated rake tasks for running tests: `rake test:uncommitted` and
257
+ `rake test:recent`.
258
+
259
+ ### Notable changes
260
+
261
+ * The [Spring application
262
+ preloader](https://github.com/jonleighton/spring) is now installed
263
+ by default for new applications. It uses the development group of
264
+ the Gemfile, so will not be installed in
265
+ production. ([Pull Request](https://github.com/rails/rails/pull/12958))
266
+
267
+ * `BACKTRACE` environment variable to show unfiltered backtraces for test
268
+ failures. ([Commit](https://github.com/rails/rails/commit/84eac5dab8b0fe9ee20b51250e52ad7bfea36553))
269
+
270
+ * Exposed `MiddlewareStack#unshift` to environment
271
+ configuration. ([Pull Request](https://github.com/rails/rails/pull/12479))
272
+
273
+ * Add `Application#message_verifier` method to return a message
274
+ verifier. ([Pull Request](https://github.com/rails/rails/pull/12995))
275
+
276
+ Action Pack
277
+ -----------
278
+
279
+ Please refer to the
280
+ [Changelog](https://github.com/rails/rails/blob/4-1-stable/actionpack/CHANGELOG.md)
281
+ for detailed changes.
282
+
283
+ ### Removals
284
+
285
+ * Removed deprecated Rails application fallback for integration testing, set
286
+ `ActionDispatch.test_app` instead.
287
+
288
+ * Removed deprecated `page_cache_extension` config.
289
+
290
+ * Removed deprecated `ActionController::RecordIdentifier`, use
291
+ `ActionView::RecordIdentifier` instead.
292
+
293
+ * Removed deprecated constants from Action Controller:
294
+
295
+ ActionController::AbstractRequest => ActionDispatch::Request
296
+ ActionController::Request => ActionDispatch::Request
297
+ ActionController::AbstractResponse => ActionDispatch::Response
298
+ ActionController::Response => ActionDispatch::Response
299
+ ActionController::Routing => ActionDispatch::Routing
300
+ ActionController::Integration => ActionDispatch::Integration
301
+ ActionController::IntegrationTest => ActionDispatch::IntegrationTest
302
+
303
+ ### Notable changes
304
+
305
+ * `protect_from_forgery` also prevents cross-origin `<script>` tags.
306
+ Update your tests to use `xhr :get, :foo, format: :js` instead of
307
+ `get :foo, format: :js`.
308
+ ([Pull Request](https://github.com/rails/rails/pull/13345))
309
+
310
+ * `#url_for` takes a hash with options inside an
311
+ array. ([Pull Request](https://github.com/rails/rails/pull/9599))
312
+
313
+ * Added `session#fetch` method fetch behaves similarly to
314
+ [Hash#fetch](http://www.ruby-doc.org/core-1.9.3/Hash.html#method-i-fetch),
315
+ with the exception that the returned value is always saved into the
316
+ session. ([Pull Request](https://github.com/rails/rails/pull/12692))
317
+
318
+ * Separated Action View completely from Action
319
+ Pack. ([Pull Request](https://github.com/rails/rails/pull/11032))
320
+
321
+ Action Mailer
322
+ -------------
323
+
324
+ Please refer to the
325
+ [Changelog](https://github.com/rails/rails/blob/4-1-stable/actionmailer/CHANGELOG.md)
326
+ for detailed changes.
327
+
328
+ ### Notable changes
329
+
330
+ * Instrument the generation of Action Mailer messages. The time it takes to
331
+ generate a message is written to the log. ([Pull Request](https://github.com/rails/rails/pull/12556))
332
+
333
+ Active Record
334
+ -------------
335
+
336
+ Please refer to the
337
+ [Changelog](https://github.com/rails/rails/blob/4-1-stable/activerecord/CHANGELOG.md)
338
+ for detailed changes.
339
+
340
+ ### Removals
341
+
342
+ * Removed deprecated nil-passing to the following `SchemaCache` methods:
343
+ `primary_keys`, `tables`, `columns` and `columns_hash`.
344
+
345
+ * Removed deprecated block filter from `ActiveRecord::Migrator#migrate`.
346
+
347
+ * Removed deprecated String constructor from `ActiveRecord::Migrator`.
348
+
349
+ * Removed deprecated `scope` use without passing a callable object.
350
+
351
+ * Removed deprecated `transaction_joinable=` in favor of `begin_transaction`
352
+ with `d:joinable` option.
353
+
354
+ * Removed deprecated `decrement_open_transactions`.
355
+
356
+ * Removed deprecated `increment_open_transactions`.
357
+
358
+ * Removed deprecated `PostgreSQLAdapter#outside_transaction?`
359
+ methodd. You can use `#transaction_open?` instead.
360
+
361
+ * Removed deprecated `ActiveRecord::Fixtures.find_table_name` in favor of
362
+ `ActiveRecord::Fixtures.default_fixture_model_name`.
363
+
364
+ * Removed deprecated `columns_for_remove` from `SchemaStatements`.
365
+
366
+ * Removed deprecated `SchemaStatements#distinct`.
367
+
368
+ * Moved deprecated `ActiveRecord::TestCase` into the Rails test
369
+ suite. The class is no longer public and is only used for internal
370
+ Rails tests.
371
+
372
+ * Removed support for deprecated option `:restrict` for `:dependent`
373
+ in associations.
374
+
375
+ * Removed support for deprecated `:delete_sql`, `:insert_sql`, `:finder_sql`
376
+ and `:counter_sql` options in associations.
377
+
378
+ * Removed deprecated method `type_cast_code` from Column.
379
+
380
+ * Removed deprecated `ActiveRecord::Base#connection` method.
381
+ Make sure to access it via the class.
382
+
383
+ * Removed deprecation warning for `auto_explain_threshold_in_seconds`.
384
+
385
+ * Removed deprecated `:distinct` option from `Relation#count`.
386
+
387
+ * Removed deprecated methods `partial_updates`, `partial_updates?` and
388
+ `partial_updates=`.
389
+
390
+ * Removed deprecated method `scoped`.
391
+
392
+ * Removed deprecated method `default_scopes?`.
393
+
394
+ * Remove implicit join references that were deprecated in 4.0.
395
+
396
+ * Removed `activerecord-deprecated_finders` as a dependency.
397
+
398
+ * Removed usage of `implicit_readonly`. Please use `readonly` method
399
+ explicitly to mark records as
400
+ `readonly`. ([Pull Request](https://github.com/rails/rails/pull/10769))
401
+
402
+ ### Deprecations
403
+
404
+ * Deprecated `quoted_locking_column` method, which isn't used anywhere.
405
+
406
+ * Deprecated the delegation of Array bang methods for associations.
407
+ To use them, instead first call `#to_a` on the association to access the
408
+ array to be acted
409
+ on. ([Pull Request](https://github.com/rails/rails/pull/12129))
410
+
411
+ * Deprecated `ConnectionAdapters::SchemaStatements#distinct`,
412
+ as it is no longer used by internals. ([Pull Request](https://github.com/rails/rails/pull/10556))
413
+
414
+ ### Notable changes
415
+
416
+ * Added `ActiveRecord::Base.to_param` for convenient "pretty" URLs derived from
417
+ a model's attribute or
418
+ method. ([Pull Request](https://github.com/rails/rails/pull/12891))
419
+
420
+ * Added `ActiveRecord::Base.no_touching`, which allows ignoring touch on
421
+ models. ([Pull Request](https://github.com/rails/rails/pull/12772))
422
+
423
+ * Unify boolean type casting for `MysqlAdapter` and `Mysql2Adapter`.
424
+ `type_cast` will return `1` for `true` and `0` for `false`. ([Pull Request](https://github.com/rails/rails/pull/12425))
425
+
426
+ * `.unscope` now removes conditions specified in
427
+ `default_scope`. ([Commit](https://github.com/rails/rails/commit/94924dc32baf78f13e289172534c2e71c9c8cade))
428
+
429
+ * Added `ActiveRecord::QueryMethods#rewhere` which will overwrite an existing,
430
+ named where condition. ([Commit](https://github.com/rails/rails/commit/f950b2699f97749ef706c6939a84dfc85f0b05f2))
431
+
432
+ * Extended `ActiveRecord::Base#cache_key` to take an optional list of timestamp
433
+ attributes of which the highest will be used. ([Commit](https://github.com/rails/rails/commit/e94e97ca796c0759d8fcb8f946a3bbc60252d329))
434
+
435
+ * Added `ActiveRecord::Base#enum` for declaring enum attributes where the values
436
+ map to integers in the database, but can be queried by
437
+ name. ([Commit](https://github.com/rails/rails/commit/db41eb8a6ea88b854bf5cd11070ea4245e1639c5))
438
+
439
+ * Type cast json values on write, so that the value is consistent with reading
440
+ from the database. ([Pull Request](https://github.com/rails/rails/pull/12643))
441
+
442
+ * Type cast hstore values on write, so that the value is consistent
443
+ with reading from the database. ([Commit](https://github.com/rails/rails/commit/5ac2341fab689344991b2a4817bd2bc8b3edac9d))
444
+
445
+ * Make `next_migration_number` accessible for third party
446
+ generators. ([Pull Request](https://github.com/rails/rails/pull/12407))
447
+
448
+ * Calling `update_attributes` will now throw an `ArgumentError` whenever it
449
+ gets a `nil` argument. More specifically, it will throw an error if the
450
+ argument that it gets passed does not respond to to
451
+ `stringify_keys`. ([Pull Request](https://github.com/rails/rails/pull/9860))
452
+
453
+ * `CollectionAssociation#first`/`#last` (e.g. `has_many`) use a `LIMIT`ed
454
+ query to fetch results rather than loading the entire
455
+ collection. ([Pull Request](https://github.com/rails/rails/pull/12137))
456
+
457
+ * `inspect` on Active Record model classes does not initiate a new
458
+ connection. This means that calling `inspect`, when the database is missing,
459
+ will no longer raise an exception. ([Pull Request](https://github.com/rails/rails/pull/11014))
460
+
461
+ * Removed column restrictions for `count`, let the database raise if the SQL is
462
+ invalid. ([Pull Request](https://github.com/rails/rails/pull/10710))
463
+
464
+ * Rails now automatically detects inverse associations. If you do not set the
465
+ `:inverse_of` option on the association, then Active Record will guess the
466
+ inverse association based on heuristics. ([Pull Request](https://github.com/rails/rails/pull/10886))
467
+
468
+ * Handle aliased attributes in ActiveRecord::Relation. When using symbol keys,
469
+ ActiveRecord will now translate aliased attribute names to the actual column
470
+ name used in the database. ([Pull Request](https://github.com/rails/rails/pull/7839))
471
+
472
+ * The ERB in fixture files is no longer evaluated in the context of the main
473
+ object. Helper methods used by multiple fixtures should be defined on modules
474
+ included in `ActiveRecord::FixtureSet.context_class`. ([Pull Request](https://github.com/rails/rails/pull/13022))
475
+
476
+ Active Model
477
+ ------------
478
+
479
+ Please refer to the
480
+ [Changelog](https://github.com/rails/rails/blob/4-1-stable/activemodel/CHANGELOG.md)
481
+ for detailed changes.
482
+
483
+ ### Deprecations
484
+
485
+ * Deprecate `Validator#setup`. This should be done manually now in the
486
+ validator's constructor. ([Commit](https://github.com/rails/rails/commit/7d84c3a2f7ede0e8d04540e9c0640de7378e9b3a))
487
+
488
+ ### Notable changes
489
+
490
+ * Added new API methods `reset_changes` and `changes_applied` to
491
+ `ActiveModel::Dirty` that control changes state.
492
+
493
+
494
+ Active Support
495
+ --------------
496
+
497
+ Please refer to the
498
+ [Changelog](https://github.com/rails/rails/blob/4-1-stable/activesupport/CHANGELOG.md)
499
+ for detailed changes.
500
+
501
+
502
+ ### Removals
503
+
504
+ * Removed `MultiJSON` dependency. As a result, `ActiveSupport::JSON.decode`
505
+ no longer accepts an options hash for `MultiJSON`. ([Pull Request](https://github.com/rails/rails/pull/10576) / [More Details](upgrading_ruby_on_rails.html#changes-in-json-handling))
506
+
507
+ * Removed support for the `encode_json` hook used for encoding custom objects into
508
+ JSON. This feature has been extracted into the [activesupport-json_encoder](https://github.com/rails/activesupport-json_encoder)
509
+ gem.
510
+ ([Related Pull Request](https://github.com/rails/rails/pull/12183) /
511
+ [More Details](upgrading_ruby_on_rails.html#changes-in-json-handling))
512
+
513
+ * Removed deprecated `ActiveSupport::JSON::Variable` with no replacement.
514
+
515
+ * Removed deprecated `String#encoding_aware?` core extensions (`core_ext/string/encoding`).
516
+
517
+ * Removed deprecated `Module#local_constant_names` in favor of `Module#local_constants`.
518
+
519
+ * Removed deprecated `DateTime.local_offset` in favor of `DateTime.civil_from_fromat`.
520
+
521
+ * Removed deprecated `Logger` core extensions (`core_ext/logger.rb`).
522
+
523
+ * Removed deprecated `Time#time_with_datetime_fallback`, `Time#utc_time` and
524
+ `Time#local_time` in favor of `Time#utc` and `Time#local`.
525
+
526
+ * Removed deprecated `Hash#diff` with no replacement.
527
+
528
+ * Removed deprecated `Date#to_time_in_current_zone` in favor of `Date#in_time_zone`.
529
+
530
+ * Removed deprecated `Proc#bind` with no replacement.
531
+
532
+ * Removed deprecated `Array#uniq_by` and `Array#uniq_by!`, use native
533
+ `Array#uniq` and `Array#uniq!` instead.
534
+
535
+ * Removed deprecated `ActiveSupport::BasicObject`, use
536
+ `ActiveSupport::ProxyObject` instead.
537
+
538
+ * Removed deprecated `BufferedLogger`, use `ActiveSupport::Logger` instead.
539
+
540
+ * Removed deprecated `assert_present` and `assert_blank` methods, use `assert
541
+ object.blank?` and `assert object.present?` instead.
542
+
543
+ ### Deprecations
544
+
545
+ * Deprecated `Numeric#{ago,until,since,from_now}`, the user is expected to
546
+ explicitly convert the value into an AS::Duration, i.e. `5.ago` => `5.seconds.ago`
547
+ ([Pull Request](https://github.com/rails/rails/pull/12389))
548
+
549
+ * Deprecated the require path `active_support/core_ext/object/to_json`. Require
550
+ `active_support/core_ext/object/json` instead. ([Pull Request](https://github.com/rails/rails/pull/12203))
551
+
552
+ * Deprecated `ActiveSupport::JSON::Encoding::CircularReferenceError`. This feature
553
+ has been extracted into the [activesupport-json_encoder](https://github.com/rails/activesupport-json_encoder)
554
+ gem.
555
+ ([Pull Request](https://github.com/rails/rails/pull/12785) /
556
+ [More Details](upgrading_ruby_on_rails.html#changes-in-json-handling))
557
+
558
+ * Deprecated `ActiveSupport.encode_big_decimal_as_string` option. This feature has
559
+ been extracetd into the [activesupport-json_encoder](https://github.com/rails/activesupport-json_encoder)
560
+ gem.
561
+ ([Pull Request](https://github.com/rails/rails/pull/13060) /
562
+ [More Details](upgrading_ruby_on_rails.html#changes-in-json-handling))
563
+
564
+ ### Notable changes
565
+
566
+ * `ActiveSupport`'s JSON encoder has been rewritten to take advantage of the
567
+ JSON gem rather than doing custom encoding in pure-Ruby.
568
+ ([Pull Request](https://github.com/rails/rails/pull/12183) /
569
+ [More Details](upgrading_ruby_on_rails.html#changes-in-json-handling))
570
+
571
+ * Improved compatibility with the JSON gem.
572
+ ([Pull Request](https://github.com/rails/rails/pull/12862) /
573
+ [More Details](upgrading_ruby_on_rails.html#changes-in-json-handling))
574
+
575
+ * Added `ActiveSupport::Testing::TimeHelpers#travel` and `#travel_to`. These
576
+ methods change current time to the given time or time difference by stubbing
577
+ `Time.now` and
578
+ `Date.today`. ([Pull Request](https://github.com/rails/rails/pull/12824))
579
+
580
+ * Added `Numeric#in_milliseconds`, like `1.hour.in_milliseconds`, so we can feed
581
+ them to JavaScript functions like
582
+ `getTime()`. ([Commit](https://github.com/rails/rails/commit/423249504a2b468d7a273cbe6accf4f21cb0e643))
583
+
584
+ * Added `Date#middle_of_day`, `DateTime#middle_of_day` and `Time#middle_of_day`
585
+ methods. Also added `midday`, `noon`, `at_midday`, `at_noon` and
586
+ `at_middle_of_day` as
587
+ aliases. ([Pull Request](https://github.com/rails/rails/pull/10879))
588
+
589
+ * Added `String#remove(pattern)` as a short-hand for the common pattern of
590
+ `String#gsub(pattern,'')`. ([Commit](https://github.com/rails/rails/commit/5da23a3f921f0a4a3139495d2779ab0d3bd4cb5f))
591
+
592
+ * Removed 'cow' => 'kine' irregular inflection from default
593
+ inflections. ([Commit](https://github.com/rails/rails/commit/c300dca9963bda78b8f358dbcb59cabcdc5e1dc9))
594
+
595
+ Credits
596
+ -------
597
+
598
+ See the
599
+ [full list of contributors to Rails](http://contributors.rubyonrails.org/) for
600
+ the many people who spent many hours making Rails, the stable and robust
601
+ framework it is. Kudos to all of them.