railties 7.0.8.7 → 7.1.5.1

data/CHANGELOG.md

@@ -1,55 +1,221 @@
-## Rails 7.0.8.7 (December 10, 2024) ##
+## Rails 7.1.5.1 (December 10, 2024) ##
 
 *   No changes.
 
 
-## Rails 7.0.8.6 (October 23, 2024) ##
+## Rails 7.1.5 (October 30, 2024) ##
 
 *   No changes.
 
 
-## Rails 7.0.8.5 (October 15, 2024) ##
+## Rails 7.1.4.2 (October 23, 2024) ##
 
 *   No changes.
 
 
-## Rails 7.0.8.4 (June 04, 2024) ##
+## Rails 7.1.4.1 (October 15, 2024) ##
 
 *   No changes.
 
 
-## Rails 7.0.8.3 (May 17, 2024) ##
+## Rails 7.1.4 (August 22, 2024) ##
 
-*   No changes.
+*   Preserve `--asset-pipeline propshaft` when running `app:update`.
+
+    *Zacharias Knudsen*
+
+*   Allow string keys for SQLCommenter.
+
+    *Ngan Pham*
+
+*   Fix derived foreign key to return correctly when association id is part of query constraints.
+
+    *Varun Sharma*
+
+*   Show warning for `secret_key_base` in development too.
+
+    *fatkodima*
+
+*   Fix sanitizer vendor configuration in 7.1 defaults.
+
+    In apps where `rails-html-sanitizer` was not eagerly loaded, the sanitizer default could end up
+    being Rails::HTML4::Sanitizer when it should be set to `Rails::HTML5::Sanitizer`.
+
+    *Mike Dalessio*, *Rafael Mendonça França*
 
+*   Revert the use of `Concurrent.physical_processor_count` in default Puma config
 
-## Rails 7.0.8.2 (May 16, 2024) ##
+    While for many people this saves one config to set, for many others using
+    a shared hosting solution, this cause the default configuration to spawn
+    way more workers than reasonable.
+
+    There is unfortunately no reliable way to detect how many cores an application
+    can realistically use, and even then, assuming the application should use
+    all the machine resources is often wrong.
+
+    *Jean Boussier*
+
+
+## Rails 7.1.3.4 (June 04, 2024) ##
 
 *   No changes.
 
 
-## Rails 7.0.8.1 (February 21, 2024) ##
+## Rails 7.1.3.3 (May 16, 2024) ##
 
 *   No changes.
 
 
-## Rails 7.0.8 (September 09, 2023) ##
+## Rails 7.1.3.2 (February 21, 2024) ##
 
-*   Omit `webdrivers` gem dependency from `Gemfile` template
+*   No changes.
 
-    *Sean Doyle*
 
-## Rails 7.0.7.2 (August 22, 2023) ##
+## Rails 7.1.3.1 (February 21, 2024) ##
 
 *   No changes.
 
 
-## Rails 7.0.7.1 (August 22, 2023) ##
+## Rails 7.1.3 (January 16, 2024) ##
+
+*   Make sure `config.after_routes_loaded` hook runs on boot.
+
+    *Rafael Mendonça França*
+
+*   Fix `config.log_level` not being respected when using a `BroadcastLogger`
+
+    *Édouard Chin*
+
+*   Fix isolated engines to take `ActiveRecord::Base.table_name_prefix` into consideration.
+    This will allow for engine defined models, such as inside Active Storage, to respect
+    Active Record table name prefix configuration.
+
+    *Chedli Bourguiba*
+
+*   The `bin/rails app:template` command will no longer add potentially unwanted
+    gem platforms via `bundle lock --add-platform=...` commands.
+
+    *Jonathan Hefner*
+
+
+## Rails 7.1.2 (November 10, 2023) ##
+
+*   Fix running `db:system:change` when app has no Dockerfile.
+
+    *Hartley McGuire*
+
+*   If you accessed `config.eager_load_paths` and friends, later changes to
+    `config.paths` were not reflected in the expected auto/eager load paths.
+    Now, they are.
+
+    This bug has been latent since Rails 3.
+
+    Fixes #49629.
+
+    *Xavier Noria*
+
+## Rails 7.1.1 (October 11, 2023) ##
+
+*   Ensures the Rails generated Dockerfile uses correct ruby version and matches Gemfile.
+
+    *Abhay Nikam*
+
+
+## Rails 7.1.0 (October 05, 2023) ##
 
 *   No changes.
 
 
-## Rails 7.0.7 (August 09, 2023) ##
+## Rails 7.1.0.rc2 (October 01, 2023) ##
+
+*   Always set the Rails logger to be an instance of `ActiveSupport::BroadcastLogger`.
+
+    *Edouard Chin*
+
+
+## Rails 7.1.0.rc1 (September 27, 2023) ##
+
+*   Require `concurrent-ruby` in `config/puma.rb` so that Puma can boot in
+    production when `WEB_CONCURRENCY` is not explicitly specified.
+
+    Fixes #49323.
+
+    *Matt Brictson*
+
+*   Raise error when generating attribute with dangerous name.
+
+    The following will now raise an error as `save` and `hash` are already
+    defined by Active Record.
+
+    ```bash
+    $ bin/rails generate model Post save
+    $ bin/rails generate model Post hash
+    ```
+
+    *Petrik de Heus*
+
+
+## Rails 7.1.0.beta1 (September 13, 2023) ##
+
+*   Add ability to show slow tests to the test runner
+
+    ```bash
+    $ bin/test --profile # additionally prints 10 (default) slowest tests
+    # or
+    $ bin/test --profile 20 # prints 20 slowest tests
+    ```
+
+    *fatkodima*
+
+*   `rails new --javascript` generator now supports Bun
+
+    ```bash
+    $ rails new my_new_app --javascript=bun
+    ```
+
+    *Jason Meller*
+
+*   bin/setup uses `bun` instead of `yarn` when generated an app with bun
+
+    Use `bun install` on `bin/setup` when using `bun`.
+
+    *Cadu Ribeiro*
+
+*   `config/application.rb` now includes
+
+    ```ruby
+    config.autoload_lib(ignore: %w(assets tasks))
+    ```
+
+    In practice, this means that new 7.1 applications autoload from `lib` out of the box.
+
+    *Xavier Noria*
+
+*   Add an option to start rails console in sandbox mode by default
+
+    `sandbox_by_default` option is added to start rails console in sandbox
+    mode by default. With this option turned on, `--no-sandbox` must be
+    specified to start rails in non-sandbox mode.
+
+    Note that this option is ignored when rails environment is development
+    or test.
+
+    *Shouichi Kamiya*
+
+*   Omit `webdrivers` gem dependency from `Gemfile` template
+
+    *Sean Doyle*
+
+*   Support filtering tests by line ranges
+
+    The new syntax allows you to filter tests by line ranges. For example, the
+    following command runs tests from line 10 to 20.
+
+    ```bash
+    $ rails test test/models/user_test.rb:10-20
+    ```
+
+    *Shouichi Kamiya*, *Seonggi Yang*, *oljfte*, *Ryohei UEDA*
 
 *   Update default scaffold templates to set 303 (See Other) as status code
     on redirect for the update action for XHR requests other than GET or POST
@@ -58,386 +224,728 @@
 
     *Guillermo Iguaran*
 
+*   The new `config.autoload_lib_once` is similar to `config.autoload_lib`,
+    except that it adds `lib` to `config.autoload_once_paths` instead.
 
-## Rails 7.0.6 (June 29, 2023) ##
-*   Avoid escaping paths when editing credentials.
+    By calling `config.autoload_lib_once`, classes and modules in `lib` can be
+    autoloaded, even from application initializers, but won't be reloaded.
 
-    *Jonathan Hefner*
+    Please, see further details in the [autoloading
+    guide](https://guides.rubyonrails.org/v7.1/autoloading_and_reloading_constants.html).
 
+    *Xavier Noria*
 
-## Rails 7.0.5.1 (June 26, 2023) ##
+*   Add `config.action_dispatch.debug_exception_log_level` to configure the log
+    level used by `ActionDispatch::DebugExceptions`.
 
-*   No changes.
+    The default is `:fatal`, but with `load_defaults "7.1"` the default will be
+    `:error`.
 
+    *Hartley McGuire*
 
-## Rails 7.0.5 (May 24, 2023) ##
+*   Add `DATABASE` option to `railties:install:migrations`
 
-*   Add puma app server to Gemfile in order to start test/dummy.
+    This allows you to specify which database the migrations should be copied to
+    when running `rails railties:install:migrations`.
 
-    *Donapieppo*
+    ```bash
+    $ rails railties:install:migrations DATABASE=animals
+    ```
 
-*   Rails console now disables `IRB`'s autocompletion feature in production by default.
+    *Matthew Hirst*
 
-    Setting `IRB_USE_AUTOCOMPLETE=true` can override this default.
+*   The new method `config.autoload_lib(ignore:)` provides a simple way to
+    autoload from `lib`:
 
-    *Stan Lo*
+    ```ruby
+    # config/application.rb
+    config.autoload_lib(ignore: %w(assets tasks))
+    ```
 
-*   Send 303 See Other status code back for the destroy action on newly generated
-    scaffold controllers.
+    Please, see further details in the [autoloading
+    guide](https://guides.rubyonrails.org/v7.1/autoloading_and_reloading_constants.html).
 
-    *Tony Drake*
+    *Xavier Noria*
 
+*   Don't show secret_key_base for `Rails.application.config#inspect`.
 
-## Rails 7.0.4.3 (March 13, 2023) ##
+    Before:
 
-*   No changes.
+    ```ruby
+    Rails.application.config.inspect
+    "#<Rails::Application::Configuration:0x00000001132b02a0 @root=... @secret_key_base=\"b3c631c314c0bbca50c1b2843150fe33\" ... >"
+    ```
 
+    After:
 
-## Rails 7.0.4.2 (January 24, 2023) ##
+    ```ruby
+    Rails.application.config.inspect
+    "#<Rails::Application::Configuration:0x00000001132b02a0>"
+    ```
 
-*   No changes.
+    *Petrik de Heus*
 
+*   Deprecate calling `Rails.application.secrets`.
 
-## Rails 7.0.4.1 (January 17, 2023) ##
+    Rails `secrets` have been deprecated in favor of `credentials`.
+    Calling `Rails.application.secrets` should show a deprecation warning.
 
-*   No changes.
+    *Petrik de Heus*
 
+*   Store `secret_key_base` in `Rails.config` for local environments.
 
-## Rails 7.0.4 (September 09, 2022) ##
+    Rails `secrets` have been deprecated in favor of `credentials`.
+    For the local environments the `secret_key_base` is now stored in
+    `Rails.config.secret_key_base` instead of the soft deprecated
+    `Rails.application.secrets.secret_key_base`.
 
-*   `config.allow_concurrency = false` now use a `Monitor` instead of a `Mutex`
+    *Petrik de Heus*
 
-    This allows to enable `config.active_support.executor_around_test_case` even
-    when `config.allow_concurrency` is disabled.
+*   Enable force_ssl=true in production by default: Force all access to the app over SSL,
+    use Strict-Transport-Security, and use secure cookies
 
-    *Jean Boussier*
+    *Justin Searls*, *Aaron Patterson*, *Guillermo Iguaran*, *Vinícius Bispo*
 
-*   Skip Active Storage and Action Mailer if Active Job is skipped.
+*   Add engine's draw paths to application route set, so that the application
+    can draw route files defined in engine paths.
 
-    *Étienne Barrié*
+    *Gannon McGibbon*
 
-*   Correctly check if frameworks are disabled when running app:update.
+*   Support `VISUAL` environment variable for commands which open an editor,
+    and prefer it over `EDITOR`.
 
-    *Étienne Barrié* and *Paulo Barros*
+    *Summer ☀️*
 
-*   Fixed `config.active_support.cache_format_version` never being applied.
+*   Add engine's `test/fixtures` path to `fixture_paths` in `on_load` hook if
+    path exists and is under the Rails application root.
 
-    Rails 7.0 shipped with a new serializer for Rails.cache, but the associated config
-    wasn't working properly. Note that even after this fix, it can only be applied from
-    the `application.rb` file.
+    *Chris Salzberg*
 
-    *Alex Ghiculescu*
+*   `bin/rails app:template` now runs `bundle install` and any `after_bundle`
+    blocks after the template is executed.
 
+    *Jonathan Hefner* and *Gerry Caulfield*
 
-## Rails 7.0.3.1 (July 12, 2022) ##
+*   Enable passing column size to migration generator
 
-*   No changes.
+    Previously you could pass a limit to the migration generator:
 
+    `rails generate migration CreateAuthor name:text{65535}`
 
-## Rails 7.0.3 (May 09, 2022) ##
+    Now, a size attribute can be passed to the migration generator:
 
-*   If reloading and eager loading are both enabled, after a reload Rails eager loads again the application code.
+    `rails generate migration CreateAuthor name:text{medium}`
 
-    *Xavier Noria*
+    This generates a migration which includes the size attribute:
 
-*   Use `controller_class_path` in `Rails::Generators::NamedBase#route_url`
+    ```ruby
+    class CreateAuthor < ActiveRecord::Migration[7.1]
+      def change
+        create_table :authors do |t|
+          t.text :name, size: :medium
+        end
+      end
+    end
+    ```
 
-    The `route_url` method now returns the correct path when generating
-    a namespaced controller with a top-level model using `--model-name`.
+    *Josh Broughton*, *Hartley McGuire*
 
-    Previously, when running this command:
+*   Trying to set a config key with the same name of a method now raises:
 
-    ``` sh
-    bin/rails generate scaffold_controller Admin/Post --model-name Post
+    ```ruby
+    config.load_defaults = 7.0
+    # NoMethodError: Cannot assign to `load_defaults`, it is a configuration method
     ```
 
-    the comments above the controller action would look like:
+    *Xavier Noria*
 
-    ``` ruby
-    # GET /posts
-    def index
-      @posts = Post.all
-    end
-    ```
+*   Deprecate `secrets:edit/show` and remove `secrets:setup`
 
-    afterwards, they now look like this:
+    `bin/rails secrets:setup` has been deprecated since Rails 5.2 in favor of
+    credentials. This command has been removed.
 
-    ``` ruby
-    # GET /admin/posts
-    def index
-      @posts = Post.all
-    end
+    `bin/rails secrets:show` and `bin/rails secrets:edit` have been deprecated
+    in favor of credentials.
+
+    Run `bin/rails credentials:help` for more information
+
+    *Petrik de Heus*
+
+*   `bin/rails --help` will now list only framework and plugin commands. Rake
+    tasks defined in `lib/tasks/*.rake` files will no longer be included. For a
+    list of those tasks, use `rake -T`.
+
+    *Jonathan Hefner*
+
+*   Allow calling `bin/rails restart` outside of app directory.
+
+    The following would previously fail with a "No Rakefile found" error.
+
+    ```bash
+    $ blog/bin/rails restart
     ```
 
-    Fixes #44662.
+    *Petrik de Heus*
 
-    *Andrew White*
+*   Support prerelease rubies in Gemfile template if RubyGems version is 3.3.13 or higher.
 
-## Rails 7.0.2.4 (April 26, 2022) ##
+    *Yasuo Honda*, *David Rodríguez*
 
-*   No changes.
+*   Autoloading setup honors root directories manually set by the user.
 
+    This is relevant for custom namespaces. For example, if you'd like classes
+    and modules under `app/services` to be defined in the `Services` namespace
+    without an extra `app/services/services` directory, this is now enough:
 
-## Rails 7.0.2.3 (March 08, 2022) ##
+    ```ruby
+    # config/initializers/autoloading.rb
 
-*   No changes.
+    # The namespace has to exist.
+    #
+    # In this example we define the module on the spot. Could also be created
+    # elsewhere and its definition loaded here with an ordinary `require`. In
+    # any case, `push_dir` expects a class or module object.
+    module Services; end
 
+    Rails.autoloaders.main.push_dir("#{Rails.root}/app/services", namespace: Services)
+    ```
 
-## Rails 7.0.2.2 (February 11, 2022) ##
+    Check the autoloading guide for further details.
 
-*   No changes.
+    *Xavier Noria*
 
+*   Railties now requires the irb gem as a dependency, which means when you install Rails, irb will also
+    be installed as a gem. Rails will then use the installed version of irb for its console instead of
+    relying on Ruby's built-in version.
+    This ensures that Rails has access to the most up-to-date and reliable version of irb for its console.
 
-## Rails 7.0.2.1 (February 11, 2022) ##
+    *Stan Lo*
 
-*   No changes.
+*   Use infinitive form for all rails command descriptions verbs.
 
+    *Petrik de Heus*
 
-## Rails 7.0.2 (February 08, 2022) ##
+*   Credentials commands (e.g. `bin/rails credentials:edit`) now respect
+    `config.credentials.content_path` and `config.credentials.key_path` when set
+    in `config/application.rb` or `config/environments/#{Rails.env}.rb`.
 
-*   No changes.
+    Before:
 
+      * `bin/rails credentials:edit` ignored `RAILS_ENV`, and would always edit
+        `config/credentials.yml.enc`.
 
-## Rails 7.0.1 (January 06, 2022) ##
+      * `bin/rails credentials:edit --environment foo` would create and edit
+        `config/credentials/foo.yml.enc`.
 
-*   Prevent duplicate entries in plugin Gemfile.
+      * If `config.credentials.content_path` or `config.credentials.key_path`
+        was set, `bin/rails credentials:edit` could not be used to edit the
+        credentials.  Editing credentials required using `bin/rails
+        encrypted:edit path/to/credentials --key path/to/key`.
 
-    *Jonathan Hefner*
+    After:
 
-*   Fix asset pipeline errors for plugin dummy apps.
+      * `bin/rails credentials:edit` will edit the credentials file that the app
+        would load for the current `RAILS_ENV`.
 
-    *Jonathan Hefner*
+      * `bin/rails credentials:edit` respects `config.credentials.content_path`
+        and `config.credentials.key_path` when set in `config/application.rb`
+        or `config/environments/#{Rails.env}.rb`.
 
-*   Fix generated route revocation.
+      * `bin/rails credentials:edit --environment foo` will create and edit
+        `config/credentials/foo.yml.enc` _if_ `config.credentials.content_path`
+        has not been set for the `foo` environment.  Ultimately, it will edit
+        the credentials file that the app would load for the `foo` environment.
 
     *Jonathan Hefner*
 
-*   Addresses an issue in which Sidekiq jobs could not reload certain
-    namespaces.
+*   Add descriptions for non-Rake commands when running `rails -h`.
 
-    See [fxn/zeitwerk#198](https://github.com/fxn/zeitwerk/issues/198) for
-    details.
+    *Petrik de Heus*
 
-    *Xavier Noria*
+*   Show relevant commands when calling help
 
-*   Fix plugin generator to a plugin that pass all the tests.
+    When running `rails -h` or just `rails` outside a Rails application,
+    Rails outputs all options for running the `rails new` command. This can be
+    confusing to users when they probably want to see the common Rails commands.
 
-    *Rafael Mendonça França*
+    Instead, we should always show the common commands when running `rails -h`
+    inside or outside a Rails application.
 
+    As the relevant commands inside a Rails application differ from the
+    commands outside an application, the help USAGE file has been split to
+    show the most relevant commands for the context.
 
-## Rails 7.0.0 (December 15, 2021) ##
+    *Petrik de Heus*
 
-*   No changes.
+*   Add Rails::HealthController#show and map it to /up for newly generated applications.
+    Load balancers and uptime monitors all need a basic endpoint to tell whether the app is up.
+    This is a good starting point that'll work in many situations.
 
+    *DHH*
 
-## Rails 7.0.0.rc3 (December 14, 2021) ##
+*   Only use HostAuthorization middleware if `config.hosts` is not empty
 
-*   Allow localhost with a port by default in development
+    *Hartley McGuire*
 
-    [Fixes: #43864]
+*   Raise an exception when a `before_action`'s "only" or "except" filter
+    options reference an action that doesn't exist. This will be enabled by
+    default but can be overridden via config.
 
-## Rails 7.0.0.rc2 (December 14, 2021) ##
+    ```ruby
+    # config/environments/production.rb
+    config.action_controller.raise_on_missing_callback_actions = false
+    ```
 
-*   No changes
+    *Jess Bees*
 
-## Rails 7.0.0.rc1 (December 06, 2021) ##
+*   Use physical processor count as the default Puma worker count in production.
+    This can be overridden by setting `ENV["WEB_CONCURRENCY"]` or editing the
+    generated "config/puma.rb" directly.
 
-*   Remove deprecated `config` in `dbconsole`.
+    *DHH*
 
-    *Rafael Mendonça França*
+*   Add Docker files by default to new apps: Dockerfile, .dockerignore, bin/docker-entrypoint.
+    These files can be skipped with `--skip-docker`. They're intended as a starting point for
+    a production deploy of the application. Not intended for development (see Docked Rails for that).
 
-*   Change default `X-XSS-Protection` header to disable XSS auditor
+    Example:
 
-    This header has been deprecated and the XSS auditor it triggered
-    has been removed from all major modern browsers (in favour of
-    Content Security Policy) that implemented this header to begin with
-    (Firefox never did).
+    ```bash
+    $ docker build -t app .
+    $ docker volume create app-storage
+    $ docker run --rm -it -v app-storage:/rails/storage -p 3000:3000 --env RAILS_MASTER_KEY=<see config/master.key> app
+    ```
 
-    [OWASP](https://owasp.org/www-project-secure-headers/#x-xss-protection)
-    suggests setting this header to '0' to disable the default behaviour
-    on old browsers as it can introduce additional security issues.
+    You can also start a console or a runner from this image:
 
-    Added the new behaviour as a framework default from Rails 7.0.
+    ```bash
+    $ docker run --rm -it -v app-storage:/rails/storage --env RAILS_MASTER_KEY=<see config/master.key> app console
+    ```
 
-    *Christian Sutter*
+    To create a multi-platform image on Apple Silicon to deploy on AMD or Intel and push to Docker Hub for user/app:
 
-*   Scaffolds now use date_field, time_field and datetime_field instead of
-    date_select, time_select and datetime_select; thus providing native date/time pickers.
+    ```bash
+    $ docker login -u <user>
+    $ docker buildx create --use
+    $ docker buildx build --push --platform=linux/amd64,linux/arm64 -t <user/image> .
+    ```
 
-    *Martijn Lafeber*
+    *DHH, Sam Ruby*
 
-*   Fix a regression in which autoload paths were initialized too late.
+*   Add ENV["SECRET_KEY_BASE_DUMMY"] for starting production environment with a generated secret base key,
+    which can be used to run tasks like `assets:precompile` without making the RAILS_MASTER_KEY available
+    to the build process.
 
-    *Xavier Noria*
+    Dockerfile layer example:
 
-## Rails 7.0.0.alpha2 (September 15, 2021) ##
+    ```
+    RUN SECRET_KEY_BASE_DUMMY=1 bundle exec rails assets:precompile
+    ```
 
-*   Fix activestorage dependency in the npm package.
+    *DHH*
 
-    *Rafael Mendonça França*
+*   Show descriptions for all commands in Rails help
 
-## Rails 7.0.0.alpha1 (September 15, 2021) ##
+    When calling `rails help` most commands missed their description. We now
+    show the same descriptions as shown in `rails -T`.
 
-*   New and upgraded Rails apps no longer generate `config/initializers/application_controller_renderer.rb`
-    or `config/initializers/cookies_serializer.rb`
+    *Petrik de Heus*
 
-    The default value for `cookies_serializer` (`:json`) has been moved to `config.load_defaults("7.0")`.
-    The new framework defaults file can be used to upgrade the serializer.
+*   Always generate the storage/ directory with rails new to ensure there's a stable place to
+    put permanent files, and a single mount point for containers to map. Then default sqlite3 databases
+    to live there instead of db/, which is only meant for configuration, not data.
 
-    *Alex Ghiculescu*
+    *DHH*
 
-*   New applications get a dependency on the new `debug` gem, replacing `byebug`.
+*   Rails console now disables `IRB`'s autocompletion feature in production by default.
 
-    *Xavier Noria*
+    Setting `IRB_USE_AUTOCOMPLETE=true` can override this default.
 
-*   Add SSL support for postgresql in `bin/rails dbconsole`.
+    *Stan Lo*
 
-    Fixes #43114.
+*   Add `config.precompile_filter_parameters`, which enables precompilation of
+    `config.filter_parameters` using `ActiveSupport::ParameterFilter.precompile_filters`.
+    Precompilation can improve filtering performance, depending on the quantity
+    and types of filters.
 
-    *Michael Bayucot*
+    `config.precompile_filter_parameters` defaults to `true` for
+    `config.load_defaults 7.1` and above.
 
-*   Add support for comments above gem declaration in Rails application templates, e.g. `gem("nokogiri", comment: "For XML")`.
+    *Jonathan Hefner*
 
-    *Linas Juškevičius*
+*   Add `after_routes_loaded` hook to `Rails::Railtie::Configuration` for
+    engines to add a hook to be called after application routes have been
+    loaded.
 
-*   The setter `config.autoloader=` has been deleted. `zeitwerk` is the only
-    available autoloading mode.
+    ```ruby
+    MyEngine.config.after_routes_loaded do
+      # code that must happen after routes have been loaded
+    end
+    ```
 
-    *Xavier Noria*
+    *Chris Salzberg*
 
-*   `config.autoload_once_paths` can be configured in the body of the
-    application class defined in `config/application.rb` or in the configuration
-    for environments in `config/environments/*`.
+*   Send 303 See Other status code back for the destroy action on newly generated
+    scaffold controllers.
 
-    Similarly, engines can configure that collection in the class body of the
-    engine class or in the configuration for environments.
+    *Tony Drake*
 
-    After that, the collection is frozen, and you can autoload from those paths.
-    They are managed by the `Rails.autoloaders.once` autoloader, which does not
-    reload, only autoloads/eager loads.
+*   Add `Rails.application.deprecators` as a central point to manage deprecators
+    for an application.
 
-    *Xavier Noria*
+    Individual deprecators can be added and retrieved from the collection:
 
-*   During initialization, you cannot autoload reloadable classes or modules
-    like application models, unless they are wrapped in a `to_prepare` block.
-    For example, from `config/initializers/*`, or in application, engines, or
-    railties initializers.
+    ```ruby
+    Rails.application.deprecators[:my_gem] = ActiveSupport::Deprecation.new("2.0", "MyGem")
+    Rails.application.deprecators[:other_gem] = ActiveSupport::Deprecation.new("3.0", "OtherGem")
+    ```
 
-    Please check the [autoloading
-    guide](https://guides.rubyonrails.org/v7.0/autoloading_and_reloading_constants.html#autoloading-when-the-application-boots)
-    for details.
+    And the collection's configuration methods affect all deprecators in the
+    collection:
 
-    *Xavier Noria*
+    ```ruby
+    Rails.application.deprecators.debug = true
 
-*   While they are allowed to have elements in common, it is no longer required
-    that `config.autoload_once_paths` is a subset of `config.autoload_paths`.
-    The former are managed by the `once` autoloader. The `main` autoloader
-    manages the latter minus the former.
+    Rails.application.deprecators[:my_gem].debug
+    # => true
+    Rails.application.deprecators[:other_gem].debug
+    # => true
+    ```
 
-    *Xavier Noria*
+    Additionally, all deprecators in the collection can be silenced for the
+    duration of a given block:
 
-*   Show Rake task description if command is run with `-h`.
+    ```ruby
+    Rails.application.deprecators.silence do
+      Rails.application.deprecators[:my_gem].warn    # => silenced (no warning)
+      Rails.application.deprecators[:other_gem].warn # => silenced (no warning)
+    end
+    ```
 
-    Adding `-h` (or `--help`) to a Rails command that's a Rake task now outputs
-    the task description instead of the general Rake help.
+    *Jonathan Hefner*
 
-    *Petrik de Heus*
+*   Move dbconsole logic to Active Record connection adapter.
 
-*   Add missing `plugin new` command to help.
+    Instead of hosting the connection logic in the command object, the
+    database adapter should be responsible for connecting to a console session.
+    This patch moves #find_cmd_and_exec to the adapter and exposes a new API to
+    lookup the adapter class without instantiating it.
 
-    *Petrik de Heus
+    *Gannon McGibbon*, *Paarth Madan*
 
-*   Fix `config_for` error when there's only a shared root array.
+*   Add `Rails.application.message_verifiers` as a central point to configure
+    and create message verifiers for an application.
 
-    *Loïc Delmaire*
+    This allows applications to, for example, rotate old `secret_key_base`
+    values:
 
-*   Raise an error in generators if an index type is invalid.
+    ```ruby
+    config.before_initialize do |app|
+      app.message_verifiers.rotate(secret_key_base: "old secret_key_base")
+    end
+    ```
+
+    And for libraries to create preconfigured message verifiers:
+
+    ```ruby
+    ActiveStorage.verifier = Rails.application.message_verifiers["ActiveStorage"]
+    ```
+
+    *Jonathan Hefner*
+
+*   Support MySQL's ssl-mode option for the dbconsole command.
+
+    Verifying the identity of the database server requires setting the ssl-mode
+    option to VERIFY_CA or VERIFY_IDENTITY. This option was previously ignored
+    for the dbconsole command.
 
     *Petrik de Heus*
 
-*   `package.json` now uses a strict version constraint for Rails JavaScript packages on new Rails apps.
+*   Delegate application record generator description to orm hooked generator.
 
-    *Zachary Scott*, *Alex Ghiculescu*
+    *Gannon McGibbon*
 
-*   Modified scaffold generator template so that running
-    `rails g scaffold Author` no longer generates tests called "creating
-    a Author", "updating a Author", and "destroying a Author".
+*   Show BCC recipients when present in Action Mailer previews.
 
-    Fixes #40744.
+    *Akshay Birajdar*
 
-    *Michael Duchemin*
+*   Extend `routes --grep` to also filter routes by matching against path.
 
-*   Raise an error in generators if a field type is invalid.
+    Example:
 
-    *Petrik de Heus*
+    ```bash
+    $ bin/rails routes --grep /cats/1
+    Prefix Verb   URI Pattern         Controller#Action
+       cat GET    /cats/:id(.:format) cats#show
+           PATCH  /cats/:id(.:format) cats#update
+           PUT    /cats/:id(.:format) cats#update
+           DELETE /cats/:id(.:format) cats#destroy
+    ```
+
+    *Orhan Toy*
 
-*   `bin/rails tmp:clear` deletes also files and directories in `tmp/storage`.
+*   Improve `rails runner` output when given a file path that doesn't exist.
 
-    *George Claghorn*
+    *Tekin Suleyman*
 
-*   Fix compatibility with `psych >= 4`.
+*   `config.allow_concurrency = false` now use a `Monitor` instead of a `Mutex`
 
-    Starting in Psych 4.0.0 `YAML.load` behaves like `YAML.safe_load`. To preserve compatibility
-    `Rails.application.config_for` now uses `YAML.unsafe_load` if available.
+    This allows to enable `config.active_support.executor_around_test_case` even
+    when `config.allow_concurrency` is disabled.
 
     *Jean Boussier*
 
-*   Allow loading nested locales in engines.
+*   Add `routes --unused` option to detect extraneous routes.
+
+    Example:
+
+    ```bash
+    $ bin/rails routes --unused
+
+    Found 2 unused routes:
+
+    Prefix Verb URI Pattern    Controller#Action
+       one GET  /one(.:format) action#one
+       two GET  /two(.:format) action#two
+    ```
+
+    *Gannon McGibbon*
+
+*   Add `--parent` option to controller generator to specify parent class of job.
+
+    Example:
+
+    `bin/rails g controller admin/users --parent=admin_controller` generates:
+
+    ```ruby
+    class Admin::UsersController < AdminController
+      # ...
+    end
+    ```
 
     *Gannon McGibbon*
 
-*   Ensure `Rails.application.config_for` always cast hashes to `ActiveSupport::OrderedOptions`.
+*   In-app custom credentials templates are now supported.  When a credentials
+    file does not exist, `rails credentials:edit` will now try to use
+    `lib/templates/rails/credentials/credentials.yml.tt` to generate the
+    credentials file, before falling back to the default template.
 
-    *Jean Boussier*
+    This allows e.g. an open-source Rails app (which would not include encrypted
+    credentials files in its repo) to include a credentials template, so that
+    users who install the app will get a custom pre-filled credentials file when
+    they run `rails credentials:edit`.
+
+    *Jonathan Hefner*
 
-*   Remove `Rack::Runtime` from the default middleware stack and deprecate
-    referencing it in middleware operations without adding it back.
+*   Except for `dev` and `test` environments, newly generated per-environment
+    credentials files (e.g. `config/credentials/production.yml.enc`) now include
+    a `secret_key_base` for convenience, just as `config/credentials.yml.enc`
+    does.
 
-    *Hartley McGuire*
+    *Jonathan Hefner*
+
+*   `--no-*` options now work with the app generator's `--minimal` option, and
+    are both comprehensive and precise.  For example:
+
+    ```bash
+    $ rails new my_cool_app --minimal
+    Based on the specified options, the following options will also be activated:
+
+      --skip-active-job [due to --minimal]
+      --skip-action-mailer [due to --skip-active-job, --minimal]
+      --skip-active-storage [due to --skip-active-job, --minimal]
+      --skip-action-mailbox [due to --skip-active-storage, --minimal]
+      --skip-action-text [due to --skip-active-storage, --minimal]
+      --skip-javascript [due to --minimal]
+      --skip-hotwire [due to --skip-javascript, --minimal]
+      --skip-action-cable [due to --minimal]
+      --skip-bootsnap [due to --minimal]
+      --skip-dev-gems [due to --minimal]
+      --skip-system-test [due to --minimal]
+
+    ...
+
+    $ rails new my_cool_app --minimal --no-skip-active-storage
+    Based on the specified options, the following options will also be activated:
+
+      --skip-action-mailer [due to --minimal]
+      --skip-action-mailbox [due to --minimal]
+      --skip-action-text [due to --minimal]
+      --skip-javascript [due to --minimal]
+      --skip-hotwire [due to --skip-javascript, --minimal]
+      --skip-action-cable [due to --minimal]
+      --skip-bootsnap [due to --minimal]
+      --skip-dev-gems [due to --minimal]
+      --skip-system-test [due to --minimal]
+
+    ...
+    ```
 
-*   Allow adding additional authorized hosts in development via `ENV['RAILS_DEVELOPMENT_HOSTS']`.
+    *Brad Trick* and *Jonathan Hefner*
 
-    *Josh Abernathy*, *Debbie Milburn*
+*   Add `--skip-dev-gems` option to app generator to skip adding development
+    gems (like `web-console`) to the Gemfile.
 
-*   Add app concern and test keepfiles to generated engine plugins.
+    *Brad Trick*
+
+*   Skip Active Storage and Action Mailer if Active Job is skipped.
+
+    *Étienne Barrié*
+
+*   Correctly check if frameworks are disabled when running app:update.
+
+    *Étienne Barrié* and *Paulo Barros*
+
+*   Delegate model generator description to orm hooked generator.
 
     *Gannon McGibbon*
 
-*   Stop generating a license for in-app plugins.
+*   Execute `rails runner` scripts inside the executor.
+
+    Enables error reporting, query cache, etc.
+
+    *Jean Boussier*
+
+*   Avoid booting in development then test for test tasks.
+
+    Running one of the rails test subtasks (e.g. test:system, test:models) would
+    go through Rake and cause the app to be booted twice. Now all the test:*
+    subtasks are defined as Thor tasks and directly load the test environment.
+
+    *Étienne Barrié*
+
+*   Deprecate `Rails::Generators::Testing::Behaviour` in favor of `Rails::Generators::Testing::Behavior`.
 
     *Gannon McGibbon*
 
-*   `rails app:update` no longer prompts you to overwrite files that are generally modified in the
-    course of developing a Rails app. See [#41083](https://github.com/rails/rails/pull/41083) for
-    the full list of changes.
+*   Allow configuration of logger size for local and test environments
 
-    *Alex Ghiculescu*
+    `config.log_file_size`
 
-*   Change default branch for new Rails projects and plugins to `main`.
+    Defaults to `100` megabytes.
 
-    *Prateek Choudhary*
+    *Bernie Chiu*
 
-*   The new method `Rails.benchmark` gives you a quick way to measure and log the execution time taken by a block:
+*   Enroll new apps in decrypted diffs of credentials by default.  This behavior
+    can be opted out of with the app generator's `--skip-decrypted-diffs` flag.
 
-        def test_expensive_stuff
-          Rails.benchmark("test_expensive_stuff") { ... }
-        end
+    *Jonathan Hefner*
 
-    This functionality was available in some contexts only before.
+*   Support declarative-style test name filters with `bin/rails test`.
 
-    *Simon Perepelitsa*
+    This makes it possible to run a declarative-style test such as:
 
-*   Applications generated with `--skip-sprockets` no longer get `app/assets/config/manifest.js` and `app/assets/stylesheets/application.css`.
+    ```ruby
+    class MyTest < ActiveSupport::TestCase
+      test "does something" do
+        # ...
+      end
+    end
+    ```
 
-    *Cindy Gao*
+    Using its declared name:
 
-*   Add support for stylesheets and ERB views to `rails stats`.
+    ```bash
+    $ bin/rails test test/my_test.rb -n "does something"
+    ```
 
-    *Joel Hawksley*
+    Instead of having to specify its expanded method name:
 
-*   Allow appended root routes to take precedence over internal welcome controller.
+    ```bash
+    $ bin/rails test test/my_test.rb -n test_does_something
+    ```
 
-    *Gannon McGibbon*
+    *Jonathan Hefner*
+
+*   Add `--js` and `--skip-javascript` options to `rails new`
+
+    `--js` alias to `rails new --javascript ...`
+
+    Same as `-j`, e.g. `rails new --js esbuild ...`
+
+    `--skip-js` alias to `rails new --skip-javascript ...`
+
+    Same as `-J`, e.g. `rails new --skip-js ...`
+
+    *Dorian Marié*
+
+*   Allow relative paths with leading dot slash to be passed to `rails test`.
+
+    Fix `rails test ./test/model/post_test.rb` to run a single test file.
+
+    *Shouichi Kamiya* and *oljfte*
+
+*   Deprecate `config.enable_dependency_loading`. This flag addressed a limitation of the `classic` autoloader and has no effect nowadays. To fix this deprecation, please just delete the reference.
+
+    *Xavier Noria*
+
+*   Define `config.enable_reloading` to be `!config.cache_classes` for a more intuitive name. While `config.enable_reloading` and `config.reloading_enabled?` are preferred from now on, `config.cache_classes` is supported for backwards compatibility.
+
+    *Xavier Noria*
+
+*   Add JavaScript dependencies installation on bin/setup
+
+    Add  `yarn install` to bin/setup when using esbuild, webpack, or rollout.
+
+    *Carlos Ribeiro*
+
+*   Use `controller_class_path` in `Rails::Generators::NamedBase#route_url`
+
+    The `route_url` method now returns the correct path when generating
+    a namespaced controller with a top-level model using `--model-name`.
+
+    Previously, when running this command:
+
+    ```bash
+    $ bin/rails generate scaffold_controller Admin/Post --model-name Post
+    ```
+
+    the comments above the controller action would look like:
+
+    ``` ruby
+    # GET /posts
+    def index
+      @posts = Post.all
+    end
+    ```
+
+    afterwards, they now look like this:
+
+    ``` ruby
+    # GET /admin/posts
+    def index
+      @posts = Post.all
+    end
+    ```
+
+    Fixes #44662.
+
+    *Andrew White*
+
+*   No longer add autoloaded paths to `$LOAD_PATH`.
+
+    This means it won't be possible to load them with a manual `require` call, the class or module can be referenced instead.
+
+    Reducing the size of `$LOAD_PATH` speed-up `require` calls for apps not using `bootsnap`, and reduce the
+    size of the `bootsnap` cache for the others.
+
+    *Jean Boussier*
+
+*   Remove default `X-Download-Options` header
+
+    This header is currently only used by Internet Explorer which
+    will be discontinued in 2022 and since Rails 7 does not fully
+    support Internet Explorer this header should not be a default one.
+
+    *Harun Sabljaković*
+
+*   Add .node-version files for Rails apps that use Node.js
+
+    Node version managers that make use of this file:
+      https://github.com/shadowspawn/node-version-usage#node-version-file-usage
+
+    The generated Dockerfile will use the same node version.
 
+    *Sam Ruby*
 
-Please check [6-1-stable](https://github.com/rails/rails/blob/6-1-stable/railties/CHANGELOG.md) for previous changes.
+Please check [7-0-stable](https://github.com/rails/rails/blob/7-0-stable/railties/CHANGELOG.md) for previous changes.