RubyGems - railties - Versions diffs - 7.2.3.1 → 8.1.4.1 - Mend

railties 7.2.3.1 → 8.1.4.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (165) hide show

checksums.yaml CHANGED Viewed

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6901f0b92ef11f501dfc346db6917e4f8c5612cfe69dcf286b2fe34c7984d00d
-  data.tar.gz: fc0584d1aa4d6a4900ccbaa846eef834deb35a96e253c0fb3abc47e9216f5ffe
+  metadata.gz: 334123c655e707744a770bc40fe4c32e679609cad3292e4cdc7fd347283beca8
+  data.tar.gz: c032c9b6c7028a0a1046cfb4a9f5e45e185d3d514a92a9688d4165e65b4499cb
 SHA512:
-  metadata.gz: 105b31ef811832df283f6b185b0e2a3277023e949ed32b45bfb64ff99733df720c74b60b83d38679411069a52671f0df1b46add11385219f610c13a9894e2446
-  data.tar.gz: ef33b6491ada406372baa50d9e1f5ea70e0cae44abca697bea78748610109eca8e91fb68b077c1a5b55e5388f1d7108d78812b4d29da0b8f88143fd93da0f2e3
+  metadata.gz: 48815eb77c1c3a69aadfddfb471343fc9e1c5358ebeaf79786cb7708acc96a70c2c4be9b61f49b2a630850bacc7ac4bf643c262be0550e5005126d4ddb012fb9
+  data.tar.gz: 57c562bbc170ba845385604f4cfd14324b5d83db23d6f9b73fa310e55a86592cbee756fbd80ffcd34768af6f58d95612e37a2b12526f95e83e78a605c60c1f2d

data/CHANGELOG.md CHANGED Viewed

@@ -1,403 +1,322 @@
-## Rails 7.2.3.1 (March 23, 2026) ##
+## Rails 8.1.4.1 (November 03, 2026) ##
 *   No changes.
-## Rails 7.2.3 (October 28, 2025) ##
-*   Use `secret_key_base` from ENV or credentials when present locally.
-    When ENV["SECRET_KEY_BASE"] or
-    `Rails.application.credentials.secret_key_base` is set for test or
-    development, it is used for the `Rails.config.secret_key_base`,
-    instead of generating a `tmp/local_secret.txt` file.
-    *Petrik de Heus*
-## Rails 7.2.2.2 (August 13, 2025) ##
-*   No changes.
+## Rails 8.1.4 (September 24, 2026) ##
+*   Include the offending value in the `secret_key_base=` error message.
-## Rails 7.2.2.1 (December 10, 2024) ##
+    *Jean Boussier*
-*   No changes.
+*   Load database config when a connection is absent from the shared section.
+    `database_configuration` no longer raises `NoMethodError` when a shared
+    config section is missing a subsection for a particular connection name.
-## Rails 7.2.2 (October 30, 2024) ##
+    *Kenta Ishizaki*
-*   No changes.
+*   Round-trip the `null: false` attribute modifier in `GeneratedAttribute#to_s`.
+    `rails generate` now emits the `!` modifier for attributes with `null: false`,
+    so the generated command string can be used to regenerate the same migration.
-## Rails 7.2.1.2 (October 23, 2024) ##
+    *Kenta Ishizaki*
-*   No changes.
+*   Fix infinite route reload when `after_routes_loaded` hooks access routes.
+    The `:loading` state is now held across `after_routes_loaded` hooks, so a
+    hook that touches routes no longer triggers a redundant reload.
-## Rails 7.2.1.1 (October 15, 2024) ##
+    *Chedli Bourguiba*
-*   No changes.
+*   Fix `LazyRouteSet` thrashing when `url_helpers` are included into `Object`.
+    `method_missing` and `respond_to_missing?` now only trigger a route reload
+    for methods ending in `_path` or `_url`, preventing every `respond_to?`
+    call from re-entering the route loader.
-## Rails 7.2.1 (August 22, 2024) ##
+    *Chedli Bourguiba*
-*   Fix `rails console` for application with non default application constant.
+*   Add `RoutesReloader#loaded` to check whether routes have been loaded.
-    The wrongly assumed the Rails application would be named `AppNamespace::Application`,
-    which is the default but not an obligation.
+    *Rafael Mendonça França*
-    *Jean Boussier*
+*   Mark routes as loaded when the routes reloader executes standalone.
-*   Fix the default Dockerfile to include the full sqlite3 package.
+    `RoutesReloader#execute` now sets the load state to `loaded`, so calling
+    it directly (outside of `execute_unless_loaded`) no longer leaves the
+    reloader in a state where routes are considered unloaded.
-    Prior to this it only included `libsqlite3`, so it wasn't enough to
-    run `rails dbconsole`.
+    *Kenta Ishizaki*
-    *Jerome Dalbert*
+*   Make mounted route helpers (e.g. `main_app`, engine mount proxies) trigger
+    the lazy route load instead of raising `NoMethodError` when called before
+    routes are drawn.
-*   Don't update public directory during `app:update` command for API-only Applications.
+    Named url helpers already loaded routes on demand, but mounted helpers are
+    only defined when `mount` runs during the route draw, so calling one first
+    (in the console or a test) failed until something else drew the routes.
-    *y-yagi*
+    *Abdelkader Boudih*
-*   Don't add bin/brakeman if brakeman is not in bundle when upgrading an application.
+*   Make lazy route loading thread-safe.
-    *Etienne Barrié*
+    Since routes are drawn on the first request in environments where
+    `config.eager_load` is `false` (development and test by default),
+    concurrent first requests could dispatch against an empty or half-drawn
+    route set, resulting in a 404 for a perfectly valid route. Route drawing
+    is now synchronized: concurrent requests wait for the initial draw to
+    complete and are then dispatched against the fully drawn route set.
-*   Remove PWA views and routes if its an API only project.
+    *grk*
-    *Jean Boussier*
+*   Validate subcommand in `rails plugin` command.
-*   Simplify generated Puma configuration
+    `rails plugin foo bar` silently ignored the invalid subcommand "foo"
+    and proceeded to create a plugin named "bar". Now it prints an error
+    and exits with status 1.
-    *DHH*, *Rafael Mendonça França*
+    Fixes #57430.
+    *Ruy Rocha*
-## Rails 7.2.0 (August 09, 2024) ##
+*   Prevent the internal development welcome route from being duplicated on route reloads.
-*   The new `bin/rails boot` command boots the application and exits. Supports the
-    standard `-e/--environment` options.
+    *Elliot Temple*
-    *Xavier Noria*
-*   Create a Dev Container Generator that generates a Dev Container setup based on the current configuration
-    of the application. Usage:
+## Rails 8.1.3.1 (July 29, 2026) ##
-    `bin/rails devcontainer`
+*   No changes.
-    *Andrew Novoselac*
-*   Add Rubocop and GitHub Actions to plugin generator.
-    This can be skipped using --skip-rubocop and --skip-ci.
+## Rails 8.1.3 (March 24, 2026) ##
-    *Chris Oliver*
+*   Add `libvips` to generated `ci.yml`
-*   Remove support for `oracle`, `sqlserver` and JRuby specific database adapters from the
-    `rails new` and `rails db:system:change` commands.
+    Conditionally adds `libvips` to `ci.yml`.
-    The supported options are `sqlite3`, `mysql`, `postgresql` and `trilogy`.
+    *Steve Polito*
-    *Andrew Novoselac*
-*   Add options to `bin/rails app:update`.
+## Rails 8.1.2.1 (March 23, 2026) ##
-    `bin/rails app:update` now supports the same generic options that generators do:
+*   No changes.
-    * `--force`: Accept all changes to existing files
-    * `--skip`: Refuse all changes to existing files
-    * `--pretend`: Don't make any changes
-    * `--quiet`: Don't output all changes made
-    *Étienne Barrié*
+## Rails 8.1.2 (January 08, 2026) ##
-*   Implement Rails console commands and helpers with IRB v1.13's extension APIs.
+*   Skip all system test files on app generation.
-    Rails console users will now see `helper`, `controller`, `new_session`, and `app` under
-    IRB help message's `Helper methods` category. And `reload!` command will be displayed under
-    the new `Rails console` commands category.
+    *Eileen M. Uchitelle*
-    Prior to this change, Rails console's commands and helper methods are added through IRB's
-    private components and don't show up in its help message, which led to poor discoverability.
+*   Fix `db:system:change` to correctly update Dockerfile base packages.
-    *Stan Lo*
+    *Josiah Smith*
-*   Remove deprecated `Rails::Generators::Testing::Behaviour`.
+*   Fix devcontainer volume mount when app name differs from folder name.
     *Rafael Mendonça França*
-*   Remove deprecated `find_cmd_and_exec` console helper.
+*   Fixed the `rails notes` command to properly extract notes in CSS files.
-    *Rafael Mendonça França*
+    *David White*
-*   Remove deprecated `Rails.config.enable_dependency_loading`.
+*   Fixed the default Dockerfile to properly include the `vendor/` directory during `bundle install`.
-    *Rafael Mendonça França*
+    *Zhong Sheng*
-*   Remove deprecated `Rails.application.secrets`.
-    *Rafael Mendonça França*
+## Rails 8.1.1 (October 28, 2025) ##
-*   Generated Gemfile will include `require: "debug/prelude"` for the `debug` gem.
+*   Do not assume and force SSL in production by default when using Kamal, to allow for out of the box Kamal deployments.
-    Requiring `debug` gem directly automatically activates it, which could introduce
-    additional overhead and memory usage even without entering a debugging session.
+    It is still recommended to assume and force SSL in production as soon as you can.
-    By making Bundler require `debug/prelude` instead, developers can keep their access
-    to breakpoint methods like `debugger` or `binding.break`, but the debugger won't be
-    activated until a breakpoint is hit.
+    *Jerome Dalbert*
-    *Stan Lo*
+## Rails 8.1.0 (October 22, 2025) ##
-*   Skip generating a `test` job in ci.yml when a new application is generated with the
-    `--skip-test` option.
+*   Suggest `bin/rails action_text:install` from Action Dispatch error page
-    *Steve Polito*
+    *Sean Doyle*
-*   Update the `.node-version` file conditionally generated for new applications to 20.11.1
+*   Remove deprecated `STATS_DIRECTORIES`.
-    *Steve Polito*
+    *Rafael Mendonça França*
-*   Fix sanitizer vendor configuration in 7.1 defaults.
+*   Remove deprecated `bin/rake stats` command.
-    In apps where rails-html-sanitizer was not eagerly loaded, the sanitizer default could end up
-    being Rails::HTML4::Sanitizer when it should be set to Rails::HTML5::Sanitizer.
+    *Rafael Mendonça França*
-    *Mike Dalessio*, *Rafael Mendonça França*
+*   Remove deprecated `rails/console/methods.rb` file.
-*   Set `action_mailer.default_url_options` values in `development` and `test`.
+    *Rafael Mendonça França*
-    Prior to this commit, new Rails applications would raise `ActionView::Template::Error`
-    if a mailer included a url built with a `*_path` helper.
+*   Don't generate system tests by default.
-    *Steve Polito*
+    Rails scaffold generator will no longer generate system tests by default. To enable this pass `--system-tests=true` or generate them with `bin/rails generate system_test name_of_test`.
-*   Introduce `Rails::Generators::Testing::Assertions#assert_initializer`.
+    *Eileen M. Uchitelle*
-    Compliments the existing `initializer` generator action.
+*   Optionally skip bundler-audit.
-    ```rb
-    assert_initializer "mail_interceptors.rb"
-    ```
+    Skips adding the `bin/bundler-audit` & `config/bundler-audit.yml` if the gem is not installed when `bin/rails app:update` runs.
-    *Steve Polito*
+    Passes an option to `--skip-bundler-audit` when new apps are generated & adds that same option to the `--minimal` generator flag.
-*   Generate a .devcontainer folder and its contents when creating a new app.
+    *Jill Klang*
-    The .devcontainer folder includes everything needed to boot the app and do development in a remote container.
+*   Show engine routes in `/rails/info/routes` as well.
-    The container setup includes:
-     - A redis container for Kredis, ActionCable etc.
-     - A database (SQLite, Postgres, MySQL or MariaDB)
-     - A Headless chrome container for system tests
-     - Active Storage configured to use the local disk and with preview features working
+    *Petrik de Heus*
-    If any of these options are skipped in the app setup they will not be included in the container configuration.
+*   Exclude `asset_path` configuration from Kamal `deploy.yml` for API applications.
-    These files can be skipped using the `--skip-devcontainer` option.
+    API applications don't serve assets, so the `asset_path` configuration in `deploy.yml`
+    is not needed and can cause 404 errors on in-flight requests. The asset_path is now
+    only included for regular Rails applications that serve assets.
-    *Andrew Novoselac & Rafael Mendonça França*
+    *Saiqul Haq*
-*   Introduce `SystemTestCase#served_by` for configuring the System Test application server.
+*   Reverted the incorrect default `config.public_file_server.headers` config.
-    By default this is localhost. This method allows the host and port to be specified manually.
+    If you created a new application using Rails `8.1.0.beta1`, make sure to regenerate
+    `config/environments/production.rb`, or to manually edit the `config.public_file_server.headers`
+    configuration to just be:
     ```ruby
-    class ApplicationSystemTestCase < ActionDispatch::SystemTestCase
-      served_by host: "testserver", port: 45678
-    end
+    # Cache assets for far-future expiry since they are all digest stamped.
+    config.public_file_server.headers = { "cache-control" => "public, max-age=#{1.year.to_i}" }
     ```
-    *Andrew Novoselac & Rafael Mendonça França*
-*   `bin/rails test` will no longer load files named `*_test.rb` if they are located in the `fixtures` folder.
-    *Edouard Chin*
-*   Ensure logger tags configured with `config.log_tags` are still active in `request.action_dispatch` handlers.
-    *KJ Tsanaktsidis*
-*   Setup jemalloc in the default Dockerfile for memory optimization.
-    *Matt Almeida*, *Jean Boussier*
-*   Commented out lines in .railsrc file should not be treated as arguments when using
-    rails new generator command. Update ARGVScrubber to ignore text after `#` symbols.
-    *Willian Tenfen*
-*   Skip CSS when generating APIs.
-    *Ruy Rocha*
+    *Jean Boussier*
-*   Rails console now indicates application name and the current Rails environment:
+*   Add command `rails credentials:fetch PATH` to get the value of a credential from the credentials file.
-    ```txt
-    my-app(dev)> # for RAILS_ENV=development
-    my-app(test)> # for RAILS_ENV=test
-    my-app(prod)> # for RAILS_ENV=production
-    my-app(my_env)> # for RAILS_ENV=my_env
+    ```bash
+    $ bin/rails credentials:fetch kamal_registry.password
     ```
-    The application name is derived from the application's module name from `config/application.rb`.
-    For example, `MyApp` will displayed as `my-app` in the prompt.
+    *Matthew Nguyen*, *Jean Boussier*
-    Additionally, the environment name will be colorized when the environment is
-    `development` (blue), `test` (blue), or `production` (red), if your
-    terminal supports it.
+*   Generate static BCrypt password digests in fixtures instead of dynamic ERB expressions.
-    *Stan Lo*
+    Previously, fixtures with password digest attributes used `<%= BCrypt::Password.create("secret") %>`,
+    which regenerated the hash on each test run. Now generates a static hash with a comment
+    showing how to recreate it.
-*   Ensure `autoload_paths`, `autoload_once_paths`, `eager_load_paths`, and
-    `load_paths` only have directories when initialized from engine defaults.
+    *Nate Smith*, *Cassia Scheffer*
-    Previously, files under the `app` directory could end up there too.
+*   Broaden the `.gitignore` entry when adding a credentials key to ignore all key files.
-    *Takumasa Ochi*
+    *Greg Molnar*
-*   Prevent unnecessary application reloads in development.
-    Previously, some files outside autoload paths triggered unnecessary reloads.
-    With this fix, application reloads according to `Rails.autoloaders.main.dirs`,
-    thereby preventing unnecessary reloads.
-    *Takumasa Ochi*
-*   Use `oven-sh/setup-bun` in GitHub CI when generating an app with Bun.
+*   Remove unnecessary `ruby-version` input from `ruby/setup-ruby`
     *TangRufus*
-*   Disable `pidfile` generation in the `production` environment.
+*   Add --reset option to bin/setup which will call db:reset as part of the setup.
-    *Hans Schnedlitz*
-*   Set `config.action_view.annotate_rendered_view_with_filenames` to `true` in
-    the `development` environment.
+    *DHH*
-    *Adrian Marin*
+*   Add RuboCop cache restoration to RuboCop job in GitHub Actions workflow templates.
-*   Support the `BACKTRACE` environment variable to turn off backtrace cleaning.
+    *Lovro Bikić*
-    Useful for debugging framework code:
+*   Skip generating mailer-related files in authentication generator if the application does
+    not use ActionMailer
-    ```sh
-    BACKTRACE=1 bin/rails server
-    ```
+    *Rami Massoud*
-    *Alex Ghiculescu*
+*   Introduce `bin/ci` for running your tests, style checks, and security audits locally or in the cloud.
-*   Raise `ArgumentError` when reading `config.x.something` with arguments:
+    The specific steps are defined by a new DSL in `config/ci.rb`.
     ```ruby
-    config.x.this_works.this_raises true # raises ArgumentError
+    ActiveSupport::ContinuousIntegration.run do
+      step "Setup", "bin/setup --skip-server"
+      step "Style: Ruby", "bin/rubocop"
+      step "Security: Gem audit", "bin/bundler-audit"
+      step "Tests: Rails", "bin/rails test test:system"
+    end
     ```
-    *Sean Doyle*
-*   Add default PWA files for manifest and service-worker that are served from `app/views/pwa` and can be dynamically rendered through ERB. Mount these files explicitly at the root with default routes in the generated routes file.
+    Optionally use [gh-signoff](https://github.com/basecamp/gh-signoff) to
+    set a green PR status - ready for merge.
-    *DHH*
+    *Jeremy Daer*, *DHH*
-*   Updated system tests to now use headless Chrome by default for the new applications.
+*   Generate session controller tests when running the authentication generator.
-    *DHH*
+    *Jerome Dalbert*
-*   Add GitHub CI files for Dependabot, Brakeman, RuboCop, and running tests by default. Can be skipped with `--skip-ci`.
+*   Add bin/bundler-audit and config/bundler-audit.yml for discovering and managing known security problems with app gems.
     *DHH*
-*   Add Brakeman by default for static analysis of security vulnerabilities. Allow skipping with `--skip-brakeman option`.
-    *vipulnsward*
-*   Add RuboCop with rules from `rubocop-rails-omakase` by default. Skip with `--skip-rubocop`.
-    *DHH* and *zzak*
-*   Use `bin/rails runner --skip-executor` to not wrap the runner script with an
-    Executor.
-    *Ben Sheldon*
-*   Fix isolated engines to take `ActiveRecord::Base.table_name_prefix` into consideration.
+*   Rails no longer generates a `bin/bundle` binstub when creating new applications.
-    This will allow for engine defined models, such as inside Active Storage, to respect
-    Active Record table name prefix configuration.
+    The `bin/bundle` binstub used to help activate the right version of bundler.
+    This is no longer necessary as this mechanism is now part of Rubygem itself.
-    *Chedli Bourguiba*
-*   Fix running `db:system:change` when the app has no Dockerfile.
-    *Hartley McGuire*
-*   In Action Mailer previews, list inline attachments separately from normal
-    attachments.
-    For example, attachments that were previously listed like
-      > Attachments: logo.png file1.pdf file2.pdf
-    will now be listed like
-      > Attachments: file1.pdf file2.pdf (Inline: logo.png)
-    *Christian Schmidt* and *Jonathan Hefner*
-*   In mailer preview, only show SMTP-To if it differs from the union of To, Cc and Bcc.
+    *Edouard Chin*
-    *Christian Schmidt*
+*   Add a `SessionTestHelper` module with `sign_in_as(user)` and `sign_out` test helpers when
+    running `rails g authentication`. Simplifies authentication in integration tests.
-*   Enable YJIT by default on new applications running Ruby 3.3+.
+    *Bijan Rahnema*
-    This can be disabled by setting `Rails.application.config.yjit = false`
+*   Rate limit password resets in authentication generator
-    *Jean Boussier*, *Rafael Mendonça França*
+    This helps mitigate abuse from attackers spamming the password reset form.
-*   In Action Mailer previews, show date from message `Date` header if present.
+    *Chris Oliver*
-    *Sampat Badhe*
+*   Update `rails new --minimal` option
-*   Exit with non-zero status when the migration generator fails.
+    Extend the `--minimal` flag to exclude recently added features:
+    `skip_brakeman`, `skip_ci`, `skip_docker`, `skip_kamal`, `skip_rubocop`, `skip_solid` and `skip_thruster`.
-    *Katsuhiko YOSHIDA*
+    *eelcoj*
-*   Use numeric UID and GID in Dockerfile template.
+*   Add `application-name` metadata to application layout
-    The Dockerfile generated by `rails new` sets the default user and group
-    by name instead of UID:GID. This can cause the following error in Kubernetes:
+    The following metatag will be added to `app/views/layouts/application.html.erb`
-    ```
-    container has runAsNonRoot and image has non-numeric user (rails), cannot verify user is non-root
+    ```html
+    <meta name="application-name" content="Name of Rails Application">
     ```
-    This change sets default user and group by their numeric values.
+    *Steve Polito*
+*   Use `secret_key_base` from ENV or credentials when present locally.
-    *Ivan Fedotov*
+    When ENV["SECRET_KEY_BASE"] or
+    `Rails.application.credentials.secret_key_base` is set for test or
+    development, it is used for the `Rails.config.secret_key_base`,
+    instead of generating a `tmp/local_secret.txt` file.
-*   Disallow invalid values for rails new options.
+    *Petrik de Heus*
-    The `--database`, `--asset-pipeline`, `--css`, and `--javascript` options
-    for `rails new` take different arguments. This change validates them.
+*   Introduce `RAILS_MASTER_KEY` placeholder in generated ci.yml files
-    *Tony Drake*, *Akhil G Krishnan*, *Petrik de Heus*
+    *Steve Polito*
-*   Conditionally print `$stdout` when invoking `run_generator`.
+*   Colorize the Rails console prompt even on non standard environments.
-    In an effort to improve the developer experience when debugging
-    generator tests, we add the ability to conditionally print `$stdout`
-    instead of capturing it.
+    *Lorenzo Zabot*
-    This allows for calls to `binding.irb` and `puts` work as expected.
+*   Don't enable YJIT in development and test environments
-    ```sh
-    RAILS_LOG_TO_STDOUT=true ./bin/test test/generators/actions_test.rb
-    ```
+    Development and test environments tend to reload code and redefine methods (e.g. mocking),
+    hence YJIT isn't generally faster in these environments.
-    *Steve Polito*
+    *Ali Ismayilov*, *Jean Boussier*
-*   Remove the option `config.public_file_server.enabled` from the generators
-    for all environments, as the value is the same in all environments.
+*   Only include PermissionsPolicy::Middleware if policy is configured.
-    *Adrian Hirt*
+    *Petrik de Heus*
-Please check [7-1-stable](https://github.com/rails/rails/blob/7-1-stable/railties/CHANGELOG.md) for previous changes.
+Please check [8-0-stable](https://github.com/rails/rails/blob/8-0-stable/railties/CHANGELOG.md) for previous changes.