railties 8.0.0 → 8.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 98b996fe16bdc5403b3bc164f4020af94fdebd90ad6564e43a3da0c23ae5c074
-  data.tar.gz: 7f2e8333f29178df6e5d57362747d654fb8191b9243d1ad177d610b56e8e34db
+  metadata.gz: ca3632394597a25e87e2bc8fe4df39a8c6866a3b27ddeafc405e71517eac81d4
+  data.tar.gz: '02469d5ca0b08fa86f9cdc182c33188694db329c49cdb4728fe8b7f3516d75ed'
 SHA512:
-  metadata.gz: 4981c730953983dc395b6ba77ad9c3b9a9e81ba89e94b32614f6c46737da43092f650fd12eb23ecd62048b7ad9ec58118cfe5723ad02f38f443336ba67809f21
-  data.tar.gz: 93bda06707eebb1f93f6d9b3b97e70a297d87cb34e5efe6215803ea0e1178ec0ae82ccc090c158d651d5f970ad1c0bd7b1d3e8b6de000dfee8a79376d92159ed
+  metadata.gz: f7f7f4ed53efe93f3adda429e8b43ef0e9436d821046dad05d6af7df49508e10a6341d84091a80d55081a73737245780ea850c24dae6ff3d5f52589d4abb9122
+  data.tar.gz: 0e657ed1142b0f74c2cf15eff6be224a67949ec65b14251536351bbe444eda45c9468aa6bdf68b10e930ec994933ad1c363f9d04d117f9a51542af539d1acea1

data/CHANGELOG.md

@@ -1,226 +1,215 @@
-## Rails 8.0.0 (November 07, 2024) ##
+## Rails 8.1.2 (January 08, 2026) ##
 
-*   No changes.
+*   Skip all system test files on app generation.
 
+    *Eileen M. Uchitelle*
 
-## Rails 8.0.0.rc2 (October 30, 2024) ##
+*   Fix `db:system:change` to correctly update Dockerfile base packages.
 
-*   Fix incorrect database.yml with `skip_solid`.
+    *Josiah Smith*
 
-    *Joé Dupuis*
-
-*   Set `Regexp.timeout` to `1`s by default to improve security over Regexp Denial-of-Service attacks.
+*   Fix devcontainer volume mount when app name differs from folder name.
 
     *Rafael Mendonça França*
 
+*   Fixed the `rails notes` command to properly extract notes in CSS files.
 
-## Rails 8.0.0.rc1 (October 19, 2024) ##
+    *David White*
 
-*   Remove deprecated support to extend Rails console through `Rails::ConsoleMethods`.
+*   Fixed the default Dockerfile to properly include the `vendor/` directory during `bundle install`.
 
-    *Rafael Mendonça França*
+    *Zhong Sheng*
 
-*   Remove deprecated file `rails/console/helpers`.
 
-    *Rafael Mendonça França*
+## Rails 8.1.1 (October 28, 2025) ##
 
-*   Remove deprecated file `rails/console/app`.
+*   Do not assume and force SSL in production by default when using Kamal, to allow for out of the box Kamal deployments.
 
-    *Rafael Mendonça França*
+    It is still recommended to assume and force SSL in production as soon as you can.
 
-*   Remove deprecated `config.read_encrypted_secrets`.
+    *Jerome Dalbert*
 
-    *Rafael Mendonça França*
+## Rails 8.1.0 (October 22, 2025) ##
 
-*   Add Kamal support for devcontainers
+*   Suggest `bin/rails action_text:install` from Action Dispatch error page
 
-    Previously generated devcontainer could not use docker and therefore Kamal.
+    *Sean Doyle*
 
-    *Joé Dupuis*
+*   Remove deprecated `STATS_DIRECTORIES`.
 
+    *Rafael Mendonça França*
 
-## Rails 8.0.0.beta1 (September 26, 2024) ##
+*   Remove deprecated `bin/rake stats` command.
 
-*   Exit `rails g` with code 1 if generator could not be found.
+    *Rafael Mendonça França*
 
-    Previously `rails g` returned 0, which would make it harder to catch typos in scripts calling `rails g`.
+*   Remove deprecated `rails/console/methods.rb` file.
 
-    *Christopher Özbek*
+    *Rafael Mendonça França*
 
-*   Remove `require_*` statements from application.css to align with the transition from Sprockets to Propshaft.
+*   Don't generate system tests by default.
 
-    With Propshaft as the default asset pipeline in Rails 8, the require_tree and require_self clauses in application.css are no longer necessary, as they were specific to Sprockets. Additionally, the comment has been updated to clarify that CSS precedence now follows standard cascading order without automatic prioritization by the asset pipeline.
+    Rails scaffold generator will no longer generate system tests by default. To enable this pass `--system-tests=true` or generate them with `bin/rails generate system_test name_of_test`.
 
-    *Eduardo Alencar*
+    *Eileen M. Uchitelle*
 
-*   Do not include redis by default in generated Dev Containers.
+*   Optionally skip bundler-audit.
 
-    Now that applications use the Solid Queue and Solid Cache gems by default, we do not need to include redis
-    in the Dev Container. We will only include redis if `--skip-solid` is used when generating an app that uses
-    Active Job or Action Cable.
+    Skips adding the `bin/bundler-audit` & `config/bundler-audit.yml` if the gem is not installed when `bin/rails app:update` runs.
 
-    When generating a Dev Container for an existing app, we will not include redis if either of the solid gems
-    are in use.
+    Passes an option to `--skip-bundler-audit` when new apps are generated & adds that same option to the `--minimal` generator flag.
 
-    *Andrew Novoselac*
+    *Jill Klang*
 
-*   Use [Solid Cable](https://github.com/rails/solid_cable) as the default Action Cable adapter in production, configured as a separate queue database in config/database.yml. It keeps messages in a table and continuously polls for updates. This makes it possible to drop the common dependency on Redis, if it isn't needed for any other purpose. Despite polling, the performance of Solid Cable is comparable to Redis in most situations. And in all circumstances, it makes it easier to deploy Rails when Redis is no longer a required dependency for Action Cable functionality.
+*   Show engine routes in `/rails/info/routes` as well.
 
-    *DHH*
+    *Petrik de Heus*
 
-*   Use [Solid Queue](https://github.com/rails/solid_queue) as the default Active Job backend in production, configured as a separate queue database in config/database.yml. In a single-server deployment, it'll run as a Puma plugin. This is configured in `config/deploy.yml` and can easily be changed to use a dedicated jobs machine.
+*   Exclude `asset_path` configuration from Kamal `deploy.yml` for API applications.
 
-    *DHH*
+    API applications don't serve assets, so the `asset_path` configuration in `deploy.yml`
+    is not needed and can cause 404 errors on in-flight requests. The asset_path is now
+    only included for regular Rails applications that serve assets.
 
-*   Use [Solid Cache](https://github.com/rails/solid_cache) as the default Rails.cache backend in production, configured as a separate cache database in config/database.yml.
+    *Saiqul Haq*
 
-    *DHH*
+*   Reverted the incorrect default `config.public_file_server.headers` config.
 
-*   Add Rails::Rack::SilenceRequest middleware and use it via `config.silence_healthcheck_path = path`
-    to silence requests to "/up". This prevents the Kamal-required health checks from clogging up
-    the production logs.
+    If you created a new application using Rails `8.1.0.beta1`, make sure to regenerate
+    `config/environments/production.rb`, or to manually edit the `config.public_file_server.headers`
+    configuration to just be:
 
-    *DHH*
+    ```ruby
+    # Cache assets for far-future expiry since they are all digest stamped.
+    config.public_file_server.headers = { "cache-control" => "public, max-age=#{1.year.to_i}" }
+    ```
 
-*   Introduce `mariadb-mysql` and `mariadb-trilogy` database options for `rails new`
+    *Jean Boussier*
 
-    When used with the `--devcontainer` flag, these options will use `mariadb` as the database for the
-    Dev Container. The original `mysql` and `trilogy` options will use `mysql`. Users who are not
-    generating a Dev Container do not need to use the new options.
+*   Add command `rails credentials:fetch PATH` to get the value of a credential from the credentials file.
 
-    *Andrew Novoselac*
+    ```bash
+    $ bin/rails credentials:fetch kamal_registry.password
+    ```
 
-*   Deprecate `::STATS_DIRECTORIES`.
+    *Matthew Nguyen*, *Jean Boussier*
 
-    The global constant `STATS_DIRECTORIES` has been deprecated in favor of
-    `Rails::CodeStatistics.register_directory`.
+*   Generate static BCrypt password digests in fixtures instead of dynamic ERB expressions.
 
-    Add extra directories with `Rails::CodeStatistics.register_directory(label, path)`:
+    Previously, fixtures with password digest attributes used `<%= BCrypt::Password.create("secret") %>`,
+    which regenerated the hash on each test run. Now generates a static hash with a comment
+    showing how to recreate it.
 
-    ```ruby
-    require "rails/code_statistics"
-    Rails::CodeStatistics.register_directory('My Directory', 'path/to/dir')
-    ```
+    *Nate Smith*, *Cassia Scheffer*
 
-    *Petrik de Heus*
+*   Broaden the `.gitignore` entry when adding a credentials key to ignore all key files.
 
-*   Enable query log tags by default on development env
+    *Greg Molnar*
 
-    This can be used to trace troublesome SQL statements back to the application
-    code that generated these statements. It is also useful when using multiple
-    databases because the query logs can identify which database is being used.
+*   Remove unnecessary `ruby-version` input from `ruby/setup-ruby`
 
-    *Matheus Richard*
+    *TangRufus*
 
-*   Defer route drawing to the first request, or when url_helpers are called
+*   Add --reset option to bin/setup which will call db:reset as part of the setup.
 
-    Executes the first routes reload in middleware, or when a route set's
-    url_helpers receives a route call / asked if it responds to a route.
-    Previously, this was executed unconditionally on boot, which can
-    slow down boot time unnecessarily for larger apps with lots of routes.
+    *DHH*
 
-    Environments like production that have `config.eager_load = true` will
-    continue to eagerly load routes on boot.
+*   Add RuboCop cache restoration to RuboCop job in GitHub Actions workflow templates.
 
-    *Gannon McGibbon*
+    *Lovro Bikić*
 
-*   Generate form helpers to use `textarea*` methods instead of `text_area*` methods
+*   Skip generating mailer-related files in authentication generator if the application does
+    not use ActionMailer
 
-    *Sean Doyle*
+    *Rami Massoud*
 
-*   Add authentication generator to give a basic start to an authentication system using database-tracked sessions and password reset.
+*   Introduce `bin/ci` for running your tests, style checks, and security audits locally or in the cloud.
 
-    Generate with...
+    The specific steps are defined by a new DSL in `config/ci.rb`.
 
-    ```
-    bin/rails generate authentication
+    ```ruby
+    ActiveSupport::ContinuousIntegration.run do
+      step "Setup", "bin/setup --skip-server"
+      step "Style: Ruby", "bin/rubocop"
+      step "Security: Gem audit", "bin/bundler-audit"
+      step "Tests: Rails", "bin/rails test test:system"
+    end
     ```
 
-    Generated files:
+    Optionally use [gh-signoff](https://github.com/basecamp/gh-signoff) to
+    set a green PR status - ready for merge.
 
-    ```
-    app/models/current.rb
-    app/models/user.rb
-    app/models/session.rb
-    app/controllers/sessions_controller.rb
-    app/controllers/passwords_controller.rb
-    app/mailers/passwords_mailer.rb
-    app/views/sessions/new.html.erb
-    app/views/passwords/new.html.erb
-    app/views/passwords/edit.html.erb
-    app/views/passwords_mailer/reset.html.erb
-    app/views/passwords_mailer/reset.text.erb
-    db/migrate/xxxxxxx_create_users.rb
-    db/migrate/xxxxxxx_create_sessions.rb
-    test/mailers/previews/passwords_mailer_preview.rb
-    ```
+    *Jeremy Daer*, *DHH*
+
+*   Generate session controller tests when running the authentication generator.
+
+    *Jerome Dalbert*
+
+*   Add bin/bundler-audit and config/bundler-audit.yml for discovering and managing known security problems with app gems.
 
     *DHH*
 
+*   Rails no longer generates a `bin/bundle` binstub when creating new applications.
 
-*   Add not-null type modifier to migration attributes.
+    The `bin/bundle` binstub used to help activate the right version of bundler.
+    This is no longer necessary as this mechanism is now part of Rubygem itself.
 
-    Generating with...
+    *Edouard Chin*
 
-    ```
-    bin/rails generate migration CreateUsers email_address:string!:uniq password_digest:string!
-    ```
+*   Add a `SessionTestHelper` module with `sign_in_as(user)` and `sign_out` test helpers when
+    running `rails g authentication`. Simplifies authentication in integration tests.
 
-    Produces:
+    *Bijan Rahnema*
 
-    ```ruby
-    class CreateUsers < ActiveRecord::Migration[8.0]
-      def change
-        create_table :users do |t|
-          t.string :email_address, null: false
-          t.string :password_digest, null: false
-
-          t.timestamps
-        end
-        add_index :users, :email_address, unique: true
-      end
-    end
-    ```
+*   Rate limit password resets in authentication generator
 
-    *DHH*
+    This helps mitigate abuse from attackers spamming the password reset form.
+
+    *Chris Oliver*
 
-*   Add a `script` folder to applications, and a scripts generator.
+*   Update `rails new --minimal` option
 
-    The new `script` folder is meant to hold one-off or general purpose scripts,
-    such as data migration scripts, cleanup scripts, etc.
+    Extend the `--minimal` flag to exclude recently added features:
+    `skip_brakeman`, `skip_ci`, `skip_docker`, `skip_kamal`, `skip_rubocop`, `skip_solid` and `skip_thruster`.
 
-    A new script generator allows you to create such scripts:
+    *eelcoj*
 
-    ```
-    bin/rails generate script my_script
-    bin/rails generate script data/backfill
-    ```
+*   Add `application-name` metadata to application layout
 
-    You can run the generated script using:
+    The following metatag will be added to `app/views/layouts/application.html.erb`
 
-    ```
-    bundle exec ruby script/my_script.rb
-    bundle exec ruby script/data/backfill.rb
+    ```html
+    <meta name="application-name" content="Name of Rails Application">
     ```
 
-    *Jerome Dalbert*, *Haroon Ahmed*
+    *Steve Polito*
 
-*   Deprecate `bin/rake stats` in favor of `bin/rails stats`.
+*   Use `secret_key_base` from ENV or credentials when present locally.
 
-    *Juan Vásquez*
+    When ENV["SECRET_KEY_BASE"] or
+    `Rails.application.credentials.secret_key_base` is set for test or
+    development, it is used for the `Rails.config.secret_key_base`,
+    instead of generating a `tmp/local_secret.txt` file.
 
-*   Add internal page `/rails/info/notes`, that displays the same information as `bin/rails notes`.
+    *Petrik de Heus*
 
-    *Deepak Mahakale*
+*   Introduce `RAILS_MASTER_KEY` placeholder in generated ci.yml files
 
-*   Add Rubocop and GitHub Actions to plugin generator.
-    This can be skipped using --skip-rubocop and --skip-ci.
+    *Steve Polito*
 
-    *Chris Oliver*
+*   Colorize the Rails console prompt even on non standard environments.
 
-*   Use Kamal for deployment by default, which includes generating a Rails-specific config/deploy.yml.
-    This can be skipped using --skip-kamal. See more: https://kamal-deploy.org/
+    *Lorenzo Zabot*
 
-    *DHH*
+*   Don't enable YJIT in development and test environments
+
+    Development and test environments tend to reload code and redefine methods (e.g. mocking),
+    hence YJIT isn't generally faster in these environments.
+
+    *Ali Ismayilov*, *Jean Boussier*
+
+*   Only include PermissionsPolicy::Middleware if policy is configured.
+
+    *Petrik de Heus*
 
-Please check [7-2-stable](https://github.com/rails/rails/blob/7-2-stable/railties/CHANGELOG.md) for previous changes.
+Please check [8-0-stable](https://github.com/rails/rails/blob/8-0-stable/railties/CHANGELOG.md) for previous changes.

data/README.rdoc

@@ -34,6 +34,6 @@ Bug reports can be filed for the Ruby on \Rails project here:
 
 * https://github.com/rails/rails/issues
 
-Feature requests should be discussed on the rails-core mailing list here:
+Feature requests should be discussed on the rubyonrails-core forum here:
 
 * https://discuss.rubyonrails.org/c/rubyonrails-core

data/lib/minitest/rails_plugin.rb

@@ -25,7 +25,9 @@ module Minitest
     end
   end
 
-  class ProfileReporter < StatisticsReporter
+  class ProfileReporter < Reporter
+    attr_accessor :results
+
     def initialize(io = $stdout, options = {})
       super
       @results = []
@@ -33,26 +35,49 @@ module Minitest
     end
 
     def record(result)
-      @results << result
+      if output_file = ENV["RAILTIES_OUTPUT_FILE"]
+        File.open(output_file, "a") do |f|
+          # Round-trip for re-serialization
+          data = JSON.parse(result.to_json)
+          data[:location] = result.location
+          f.puts(data.to_json)
+        end
+      else
+        @results << result
+      end
+    end
+
+    def passed?
+      true
     end
 
     def report
-      total_time = @results.sum(&:time)
+      # Skip if we're outputting to a file
+      return if ENV["RAILTIES_OUTPUT_FILE"]
+      print_summary
+    end
+
+    def summary
+      print_summary
+    end
+
+    private
+      def print_summary
+        total_time = @results.sum(&:time)
 
-      @results.sort! { |a, b| b.time <=> a.time }
-      slow_results = @results.take(@count)
-      slow_tests_total_time = slow_results.sum(&:time)
+        @results.sort! { |a, b| b.time <=> a.time }
+        slow_results = @results.take(@count)
+        slow_tests_total_time = slow_results.sum(&:time)
 
-      ratio = (total_time == 0) ? 0.0 : (slow_tests_total_time / total_time) * 100
+        ratio = (total_time == 0) ? 0.0 : (slow_tests_total_time / total_time) * 100
 
-      io.puts("\nTop %d slowest tests (%.2f seconds, %.1f%% of total time):\n" % [slow_results.size, slow_tests_total_time, ratio])
-      slow_results.each do |result|
-        io.puts("  %s\n    %.4f seconds %s\n" % [result.location, result.time, source_location(result)])
+        io.puts("\nTop %d slowest tests (%.2f seconds, %.1f%% of total time):\n" % [slow_results.size, slow_tests_total_time, ratio])
+        slow_results.each do |result|
+          io.puts("  %s\n    %.4f seconds %s\n" % [result.location, result.time, source_location(result)])
+        end
+        io.puts("\n")
       end
-      io.puts("\n")
-    end
 
-    private
       def source_location(result)
         filename, line = result.source_location
         return "" unless filename
@@ -80,6 +105,13 @@ module Minitest
       options[:fail_fast] = true
     end
 
+    if Minitest::VERSION > "6" then
+      opts.on "-n", "--name PATTERN", "Include /regexp/ or string for run." do |a|
+        warn "Please switch from -n/--name to -i/--include"
+        options[:include] = a
+      end
+    end
+
     opts.on("-c", "--[no-]color", "Enable color in the output") do |value|
       options[:color] = value
     end
@@ -102,8 +134,19 @@ module Minitest
       options[:profile] = count
     end
 
+    opts.on(/^[^-]/) do |test_file|
+      options[:test_files] ||= []
+      options[:test_files] << test_file
+    end
+
     options[:color] = true
     options[:output_inline] = true
+
+    opts.on do
+      if ::Rails::TestUnit::Runner.load_test_files
+        ::Rails::TestUnit::Runner.load_tests(options.fetch(:test_files, []))
+      end
+    end
   end
 
   # Owes great inspiration to test runner trailblazers like RSpec,

data/lib/rails/application/bootstrap.rb

@@ -59,9 +59,7 @@ module Rails
           end
         else
           Rails.logger.level = ActiveSupport::Logger.const_get(config.log_level.to_s.upcase)
-          broadcast_logger = ActiveSupport::BroadcastLogger.new(Rails.logger)
-          broadcast_logger.formatter = Rails.logger.formatter
-          Rails.logger = broadcast_logger
+          Rails.logger = ActiveSupport::BroadcastLogger.new(Rails.logger)
         end
       end
 
@@ -73,6 +71,11 @@ module Rails
         end
       end
 
+      initializer :initialize_event_reporter, group: :all do
+        Rails.event.raise_on_error = config.consider_all_requests_local
+        Rails.event.debug_mode = Rails.env.development?
+      end
+
       # Initialize cache early in the stack so railties can make use of it.
       initializer :initialize_cache, group: :all do
         cache_format_version = config.active_support.delete(:cache_format_version)

data/lib/rails/application/configuration.rb

@@ -21,6 +21,7 @@ module Rails
                     :beginning_of_week, :filter_redirect, :x,
                     :content_security_policy_report_only,
                     :content_security_policy_nonce_generator, :content_security_policy_nonce_directives,
+                    :content_security_policy_nonce_auto,
                     :require_master_key, :credentials, :disable_sandbox, :sandbox_by_default,
                     :add_autoload_paths_to_load_path, :rake_eager_load, :server_timing, :log_file_size,
                     :dom_testing_default_html_version, :yjit
@@ -72,6 +73,7 @@ module Rails
         @content_security_policy_report_only     = false
         @content_security_policy_nonce_generator = nil
         @content_security_policy_nonce_directives = nil
+        @content_security_policy_nonce_auto      = false
         @require_master_key                      = false
         @loaded_config_version                   = nil
         @credentials                             = ActiveSupport::InheritableOptions.new(credentials_defaults)
@@ -115,10 +117,6 @@ module Rails
             action_controller.forgery_protection_origin_check = true
           end
 
-          if respond_to?(:active_support)
-            active_support.to_time_preserves_timezone = :offset
-          end
-
           if respond_to?(:active_record)
             active_record.belongs_to_required_by_default = true
           end
@@ -265,7 +263,7 @@ module Rails
           end
 
           if respond_to?(:action_controller)
-            action_controller.raise_on_open_redirects = true
+            action_controller.action_on_open_redirect = :raise
             action_controller.wrap_parameters_by_default = true
           end
         when "7.1"
@@ -337,15 +335,39 @@ module Rails
         when "8.0"
           load_defaults "7.2"
 
+          if respond_to?(:action_dispatch)
+            action_dispatch.strict_freshness = true
+          end
+
+          Regexp.timeout ||= 1 if Regexp.respond_to?(:timeout=)
+        when "8.1"
+          load_defaults "8.0"
+
+          # Development and test environments tend to reload code and
+          # redefine methods (e.g. mocking), hence YJIT isn't generally
+          # faster in these environments.
+          self.yjit = !Rails.env.local?
+
+          if respond_to?(:action_controller)
+            action_controller.escape_json_responses = false
+            action_controller.action_on_path_relative_redirect = :raise
+          end
+
+          if respond_to?(:active_record)
+            active_record.raise_on_missing_required_finder_order_columns = true
+          end
+
           if respond_to?(:active_support)
-            active_support.to_time_preserves_timezone = :zone
+            active_support.escape_js_separators_in_json = false
           end
 
-          if respond_to?(:action_dispatch)
-            action_dispatch.strict_freshness = true
+          if respond_to?(:action_view)
+            action_view.render_tracker = :ruby
           end
 
-          Regexp.timeout ||= 1
+          if respond_to?(:action_view)
+            action_view.remove_hidden_field_autocomplete = true
+          end
         else
           raise "Unknown version #{target_version.to_s.inspect}"
         end
@@ -503,16 +525,18 @@ module Rails
 
       def secret_key_base
         @secret_key_base || begin
-          self.secret_key_base = if generate_local_secret?
+          self.secret_key_base = if ENV["SECRET_KEY_BASE_DUMMY"]
             generate_local_secret
           else
-            ENV["SECRET_KEY_BASE"] || Rails.application.credentials.secret_key_base
+            ENV["SECRET_KEY_BASE"] ||
+              Rails.application.credentials.secret_key_base ||
+              (Rails.env.local? && generate_local_secret)
           end
         end
       end
 
       def secret_key_base=(new_secret_key_base)
-        if new_secret_key_base.nil? && generate_local_secret?
+        if new_secret_key_base.nil? && Rails.env.local?
           @secret_key_base = generate_local_secret
         elsif new_secret_key_base.is_a?(String) && new_secret_key_base.present?
           @secret_key_base = new_secret_key_base
@@ -640,10 +664,6 @@ module Rails
 
           File.binread(key_file)
         end
-
-        def generate_local_secret?
-          Rails.env.local? || ENV["SECRET_KEY_BASE_DUMMY"]
-        end
     end
   end
 end

data/lib/rails/application/default_middleware_stack.rb

@@ -83,7 +83,7 @@ module Rails
           unless config.api_only
             middleware.use ::ActionDispatch::Flash
             middleware.use ::ActionDispatch::ContentSecurityPolicy::Middleware
-            middleware.use ::ActionDispatch::PermissionsPolicy::Middleware
+            middleware.use ::ActionDispatch::PermissionsPolicy::Middleware if config.permissions_policy
           end
 
           middleware.use ::Rack::Head

data/lib/rails/application/finisher.rb

@@ -229,7 +229,8 @@ module Rails
 
       initializer :enable_yjit do
         if config.yjit && defined?(RubyVM::YJIT.enable)
-          RubyVM::YJIT.enable
+          options = config.yjit.is_a?(Hash) ? config.yjit : {}
+          RubyVM::YJIT.enable(**options)
         end
       end
     end

data/lib/rails/application/routes_reloader.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require "active_support/core_ext/module/delegation"
 
 module Rails
   class Application
@@ -9,7 +8,7 @@ module Rails
 
       attr_reader :route_sets, :paths, :external_routes, :loaded
       attr_accessor :eager_load
-      attr_writer :run_after_load_paths # :nodoc:
+      attr_writer :run_after_load_paths, :loaded # :nodoc:
       delegate :execute_if_updated, :updated?, to: :updater
 
       def initialize