chore(deps): update dependency rails to v8

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
rails (source, changelog)	"~> 7.0.0" → "~> 8.1.0"

---

Release Notes

rails/rails (rails)

v8.1.3: 8.1.3

Compare Source

Active Support

• Fix JSONGemCoderEncoder to correctly serialize custom object hash keys.

  When hash keys are custom objects whose as_json returns a Hash,
  the encoder now calls to_s on the original key object instead of
  on the as_json result.

  Before:
  hash = {CustomKey.new(123) => "value"}
  hash.to_json # => {"{:id=>123}":"value"}

  After:
  hash.to_json # => {"custom_123":"value"}

  Dan Sharp

• Fix inflections to better handle overlapping acronyms.

  ActiveSupport::Inflector.inflections(:en) do |inflect|
    inflect.acronym "USD"
    inflect.acronym "USDC"
  end
  
  "USDC".underscore # => "usdc"

  Said Kaldybaev

• Silence Dalli 4.0+ warning when using ActiveSupport::Cache::MemCacheStore.

  zzak

Active Model

• Fix Ruby 4.0 delegator warning when calling inspect on attributes.

  Hammad Khan

• Fix NoMethodError when deserialising Type::Integer objects marshalled under Rails 8.0.

  The performance optimisation that replaced @range with @max/@min
  broke Marshal compatibility. Objects serialised under 8.0 (with @range)
  and deserialised under 8.1 (expecting @max/@min) would crash with
  undefined method '<=' for nil because Marshal.load restores instance
  variables without calling initialize.

  Edward Woodcock

Active Record

• Fix insert_all and upsert_all log message when called on anonymous classes.

  Gabriel Sobrinho

• Respect ActiveRecord::SchemaDumper.ignore_tables when dumping SQLite virtual tables.

  Hans Schnedlitz

• Restore previous instrumenter after execute_or_skip

  FutureResult#execute_or_skip replaces the thread's instrumenter with an
  EventBuffer to collect events published during async query execution.
  If the global async executor is saturated and the caller_runs fallback
  executes the task on the calling thread, we need to make sure the previous
  instrumenter is restored or the stale EventBuffer would stay in place and
  permanently swallow all subsequent sql.active_record notifications on
  that thread.

  Rosa Gutierrez

• Bump the minimum PostgreSQL version to 9.5, due to usage of array_position function.

  Ivan Kuchin

• Fix Ruby 4.0 delegator warning when calling inspect on ActiveRecord::Type::Serialized.

  Hammad Khan

• Fix support for table names containing hyphens.

  Evgeniy Demin

• Fix column deduplication for SQLite3 and PostgreSQL virtual (generated) columns.

  Column#== and Column#hash now account for virtual? so that the
  Deduplicable registry does not treat a generated column and a regular
  column with the same name and type as identical. Previously, if a
  generated column was registered first, a regular column on a different
  table could be deduplicated to the generated instance, silently
  excluding it from INSERT/UPDATE statements.

  Jay Huber

• Fix PostgreSQL schema dumping to handle schema-qualified table names in foreign_key references that span different schemas.

before

    add_foreign_key "hst.event_log_attributes", "hst.event_logs" # emits correctly because they're in the same schema (hst)
    add_foreign_key "hst.event_log_attributes", "hst.usr.user_profiles", column: "created_by_id" # emits hst.user.* when user.* is expected

after

    add_foreign_key "hst.event_log_attributes", "hst.event_logs"
    add_foreign_key "hst.event_log_attributes", "usr.user_profiles", column: "created_by_id"

*Chiperific*

Action View

• Fix encoding errors for string locals containing non-ASCII characters.

  Kataoka Katsuki

• Fix collection caching to only forward expires_in argument if explicitly set.

  Pieter Visser

Action Pack

• No changes.

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• Fix ActiveStorage::Blob content type predicate methods to handle nil.

  Daichi KUDO

Action Mailbox

• No changes.

Action Text

• No changes.

Railties

• Add libvips to generated ci.yml

  Conditionally adds libvips to ci.yml.

  Steve Polito

Guides

• No changes.

v8.1.2.1: 8.1.2.1

Compare Source

Active Support

• Reject scientific notation in NumberConverter

  [CVE-2026-33176]

  Jean Boussier

• Fix SafeBuffer#% to preserve unsafe status

  [CVE-2026-33170]

  Jean Boussier

• Improve performance of NumberToDelimitedConverter

  [CVE-2026-33169]

  Jean Boussier

Active Model

• No changes.

Active Record

• No changes.

Action View

• Skip blank attribute names in tag helpers to avoid generating invalid HTML.

  [CVE-2026-33168]

  Mike Dalessio

Action Pack

• Fix possible XSS in DebugExceptions middleware

  [CVE-2026-33167]

  John Hawthorn

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• Filter user supplied metadata in DirectUploadController

  [CVE-2026-33173]

  Jean Boussier

• Configurable maxmimum streaming chunk size

  Makes sure that byte ranges for blobs don't exceed 100mb by default.
  Content ranges that are too big can result in denial of service.

  [CVE-2026-33174]

  Gannon McGibbon

• Limit range requests to a single range

  [CVE-2026-33658]

  Jean Boussier

• Prevent path traversal in DiskService.

  DiskService#path_for now raises an InvalidKeyError when passed keys with dot segments (".",
  ".."), or if the resolved path is outside the storage root directory.

  #path_for also now consistently raises InvalidKeyError if the key is invalid in any way, for
  example containing null bytes or having an incompatible encoding. Previously, the exception
  raised may have been ArgumentError or Encoding::CompatibilityError.

  DiskController now explicitly rescues InvalidKeyError with appropriate HTTP status codes.

  [CVE-2026-33195]

  Mike Dalessio

• Prevent glob injection in DiskService#delete_prefixed.

  Escape glob metacharacters in the resolved path before passing to Dir.glob.

  Note that this change breaks any existing code that is relying on delete_prefixed to expand
  glob metacharacters. This change presumes that is unintended behavior (as other storage services
  do not respect these metacharacters).

  [CVE-2026-33202]

  Mike Dalessio

Action Mailbox

• No changes.

Action Text

• No changes.

Railties

• No changes.

Guides

• No changes.

v8.1.2: 8.1.2

Compare Source

Active Support

• Make delegate and delegate_missing_to work in BasicObject subclasses.

  Rafael Mendonça França

• Fix Inflectors when using a locale that fallbacks to :en.

  Said Kaldybaev

• Fix ActiveSupport::TimeWithZone#as_json to consistently return UTF-8 strings.

  Previously the returned string would sometime be encoded in US-ASCII, which in
  some cases may be problematic.

  Now the method consistently always return UTF-8 strings.

  Jean Boussier

• Fix TimeWithZone#xmlschema when wrapping a DateTime instance in local time.

  Previously it would return an invalid time.

  Dmytro Rymar

• Implement LocalCache strategy on ActiveSupport::Cache::MemoryStore. The memory store
  needs to respond to the same interface as other cache stores (e.g. ActiveSupport::NullStore).

  Mikey Gough

• Fix ActiveSupport::Inflector.humanize with international characters.

  ActiveSupport::Inflector.humanize("áÉÍÓÚ")  # => "Áéíóú"
  ActiveSupport::Inflector.humanize("аБВГДЕ") # => "Абвгде"

  Jose Luis Duran

Active Model

• No changes.

Active Record

• Fix counting cached queries in ActiveRecord::RuntimeRegistry.

  fatkodima

• Fix merging relations with arel equality predicates with null relations.

  fatkodima

• Fix SQLite3 schema dump for non-autoincrement integer primary keys.

  Previously, schema.rb should incorrectly restore that table with an auto incrementing
  primary key.

  Chris Hasiński

• Fix PostgreSQL schema_search_path not being reapplied after reset! or reconnect!.

  The schema_search_path configured in database.yml is now correctly
  reapplied instead of falling back to PostgreSQL defaults.

  Tobias Egli

• Restore the ability of enum to be foats.

  enum :rating, { low: 0.0, medium: 0.5, high: 1.0 },

  In Rails 8.1.0, enum values are eagerly validated, and floats weren't expected.

  Said Kaldybaev

• Ensure batched preloaded associations accounts for klass when grouping to avoid issues with STI.

  zzak, Stjepan Hadjic

• Fix ActiveRecord::SoleRecordExceeded#record to return the relation.

  This was the case until Rails 7.2, but starting from 8.0 it
  started mistakenly returning the model class.

  Jean Boussier

• Improve PostgreSQLAdapter resilience to Timeout.timeout.

  Better handle asynchronous exceptions being thrown inside
  the reconnect! method.

  This may fixes some deep errors such as:

  undefined method `key?' for nil:NilClass (NoMethodError)
            if !type_map.key?(oid)
  

  Jean Boussier

• Fix structured events for Active Record was not being emitted.

  Yuji Yaginuma

• Fix eager_load when loading has_many assocations with composite primary keys.

  This would result in some records being loaded multiple times.

  Martin-Alexander

Action View

• Fix file_field to join mime types with a comma when provided as Array

  file_field(:article, :image, accept: ['image/png', 'image/gif', 'image/jpeg'])

  Now behaves likes:

  file_field(:article, :image, accept: 'image/png,image/gif,image/jpeg')
  

  Bogdan Gusiev

• Fix strict locals parsing to handle multiline definitions.

  Said Kaldybaev

• Fix content_security_policy_nonce error in mailers when using content_security_policy_nonce_auto setting.

  The content_security_policy_nonce helper is provided by ActionController::ContentSecurityPolicy, and it relies on request.content_security_policy_nonce. Mailers lack both the module and the request object.

  Jarrett Lusso

Action Pack

• Add config.action_controller.live_streaming_excluded_keys to control execution state sharing in ActionController::Live.

  When using ActionController::Live, actions are executed in a separate thread that shares
  state from the parent thread. This new configuration allows applications to opt-out specific
  state keys that should not be shared.

  This is useful when streaming inside a connected_to block, where you may want
  the streaming thread to use its own database connection context.

  # config/application.rb
  config.action_controller.live_streaming_excluded_keys = [:active_record_connected_to_stack]

  By default, all keys are shared.

  Eileen M. Uchitelle

• Fix IpSpoofAttackError message to include Forwarded header content.

  Without it, the error message may be misleading.

  zzak

Active Job

• Fix ActiveJob.perform_all_later to respect job_class.enqueue_after_transaction_commit.

  Previously, perform_all_later would enqueue all jobs immediately, even if
  they had enqueue_after_transaction_commit = true. Now it correctly defers
  jobs with this setting until after transaction commits, matching the behavior
  of perform_later.

  OuYangJinTing

• Fix using custom serializers with ActiveJob::Arguments.serialize when
  ActiveJob::Base hasn't been loaded.

  Hartley McGuire

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• Restore ADC when signing URLs with IAM for GCS

  ADC was previously used for automatic authorization when signing URLs with IAM.
  Now it is again, but the auth client is memoized so that new credentials are only
  requested when the current ones expire. Other auth methods can now be used
  instead by setting the authorization on ActiveStorage::Service::GCSService#iam_client.

  ActiveStorage::Blob.service.iam_client.authorization = Google::Auth::ImpersonatedServiceAccountCredentials.new(options)

  This is safer than setting Google::Apis::RequestOptions.default.authorization
  because it only applies to Active Storage and does not affect other Google API
  clients.

  Justin Malčić

Action Mailbox

• No changes.

Action Text

• No changes.

Railties

• Skip all system test files on app generation.

  Eileen M. Uchitelle

• Fix db:system:change to correctly update Dockerfile base packages.

  Josiah Smith

• Fix devcontainer volume mount when app name differs from folder name.

  Rafael Mendonça França

• Fixed the rails notes command to properly extract notes in CSS files.

  David White

• Fixed the default Dockerfile to properly include the vendor/ directory during bundle install.

  Zhong Sheng

Guides

• No changes.

v8.1.1: 8.1.1

Compare Source

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• Respect remove_hidden_field_autocomplete config in form builder hidden_field.

  Rafael Mendonça França

Action Pack

• Allow methods starting with underscore to be action methods.

  Disallowing methods starting with an underscore from being action methods
  was an unintended side effect of the performance optimization in
  207a254.

  Fixes #​55985.

  Rafael Mendonça França

Active Job

• Only index new serializers.

  Jesse Sharps

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• No changes.

Action Mailbox

• No changes.

Action Text

• No changes.

Railties

• Do not assume and force SSL in production by default when using Kamal, to allow for out of the box Kamal deployments.

  It is still recommended to assume and force SSL in production as soon as you can.

  Jerome Dalbert

Guides

• No changes.

v8.1.0: 8.1.0

Compare Source

Active Support

• Remove deprecated passing a Time object to Time#since.

  Rafael Mendonça França

• Remove deprecated Benchmark.ms method. It is now defined in the benchmark gem.

  Rafael Mendonça França

• Remove deprecated addition for Time instances with ActiveSupport::TimeWithZone.

  Rafael Mendonça França

• Remove deprecated support for to_time to preserve the system local time. It will now always preserve the receiver
  timezone.

  Rafael Mendonça França

• Deprecate config.active_support.to_time_preserves_timezone.

  Rafael Mendonça França

• Standardize event name formatting in assert_event_reported error messages.

  The event name in failure messages now uses .inspect (e.g., name: "user.created")
  to match assert_events_reported and provide type clarity between strings and symbols.
  This only affects tests that assert on the failure message format itself.

  George Ma

• Fix Enumerable#sole to return the full tuple instead of just the first element of the tuple.

  Olivier Bellone

• Fix parallel tests hanging when worker processes die abruptly.

  Previously, if a worker process was killed (e.g., OOM killed, kill -9) during parallel
  test execution, the test suite would hang forever waiting for the dead worker.

  Joshua Young

• Add config.active_support.escape_js_separators_in_json.

  Introduce a new framework default to skip escaping LINE SEPARATOR (U+2028) and PARAGRAPH SEPARATOR (U+2029) in JSON.

  Historically these characters were not valid inside JavaScript literal strings but that changed in ECMAScript 2019.
  As such it's no longer a concern in modern browsers: https://caniuse.com/mdn-javascript_builtins_json_json_superset.

  Étienne Barrié, Jean Boussier

• Fix NameError when class_attribute is defined on instance singleton classes.

  Previously, calling class_attribute on an instance's singleton class would raise
  a NameError when accessing the attribute through the instance.

  object = MyClass.new
  object.singleton_class.class_attribute :foo, default: "bar"
  object.foo # previously raised NameError, now returns "bar"

  Joshua Young

• Introduce ActiveSupport::Testing::EventReporterAssertions#with_debug_event_reporting
  to enable event reporter debug mode in tests.

  The previous way to enable debug mode is by using #with_debug on the
  event reporter itself, which is too verbose. This new helper will help
  clear up any confusion on how to test debug events.

  Gannon McGibbon

• Add ActiveSupport::StructuredEventSubscriber for consuming notifications and
  emitting structured event logs. Events may be emitted with the #emit_event
  or #emit_debug_event methods.

  class MyStructuredEventSubscriber < ActiveSupport::StructuredEventSubscriber
    def notification(event)
      emit_event("my.notification", data: 1)
    end
  end

  Adrianna Chang

• ActiveSupport::FileUpdateChecker does not depend on Time.now to prevent unecessary reloads with time travel test helpers

  Jan Grodowski

• Add ActiveSupport::Cache::Store#namespace= and #namespace.

  Can be used as an alternative to Store#clear in some situations such as parallel
  testing.

  Nick Schwaderer

• Create parallel_worker_id helper for running parallel tests. This allows users to
  know which worker they are currently running in.

  Nick Schwaderer

• Make the cache of ActiveSupport::Cache::Strategy::LocalCache::Middleware updatable.

  If the cache client at Rails.cache of a booted application changes, the corresponding
  mounted middleware needs to update in order for request-local caches to be setup properly.
  Otherwise, redundant cache operations will erroneously hit the datastore.

  Gannon McGibbon

• Add assert_events_reported test helper for ActiveSupport::EventReporter.

  This new assertion allows testing multiple events in a single block, regardless of order:

  assert_events_reported([
    { name: "user.created", payload: { id: 123 } },
    { name: "email.sent", payload: { to: "user@example.com" } }
  ]) do
    create_user_and_send_welcome_email
  end

  George Ma

• Add ActiveSupport::TimeZone#standard_name method.

  zone = ActiveSupport::TimeZone['Hawaii']

Old way

ActiveSupport::TimeZone::MAPPING[zone.name]

New way

zone.standard_name # => 'Pacific/Honolulu'
```

*Bogdan Gusiev*

• Add Structured Event Reporter, accessible via Rails.event.

  The Event Reporter provides a unified interface for producing structured events in Rails
  applications:

  Rails.event.notify("user.signup", user_id: 123, email: "user@example.com")

  It supports adding tags to events:

  Rails.event.tagged("graphql") do

Event includes tags: { graphql: true }

  Rails.event.notify("user.signup", user_id: 123, email: "user@example.com")
end
```

As well as context:
```ruby

All events will contain context: {request_id: "abc123", shop_id: 456}

Rails.event.set_context(request_id: "abc123", shop_id: 456)
```

Events are emitted to subscribers. Applications register subscribers to
control how events are serialized and emitted. Subscribers must implement
an `#emit` method, which receives the event hash:

```ruby
class LogSubscriber
  def emit(event)
    payload = event[:payload].map { |key, value| "#{key}=#{value}" }.join(" ")
    source_location = event[:source_location]
    log = "[#{event[:name]}] #{payload} at #{source_location[:filepath]}:#{source_location[:lineno]}"
    Rails.logger.info(log)
  end
end
```

*Adrianna Chang*

• Make ActiveSupport::Logger #freeze-friendly.

  Joshua Young

• Make ActiveSupport::Gzip.compress deterministic based on input.

  ActiveSupport::Gzip.compress used to include a timestamp in the output,
  causing consecutive calls with the same input data to have different output
  if called during different seconds. It now always sets the timestamp to 0
  so that the output is identical for any given input.

  Rob Brackett

• Given an array of Thread::Backtrace::Location objects, the new method
  ActiveSupport::BacktraceCleaner#clean_locations returns an array with the
  clean ones:

  clean_locations = backtrace_cleaner.clean_locations(caller_locations)

  Filters and silencers receive strings as usual. However, the path
  attributes of the locations in the returned array are the original,
  unfiltered ones, since locations are immutable.

  Xavier Noria

• Improve CurrentAttributes and ExecutionContext state managment in test cases.

  Previously these two global state would be entirely cleared out whenever calling
  into code that is wrapped by the Rails executor, typically Action Controller or
  Active Job helpers:

  test "#index works" do
    CurrentUser.id = 42
    get :index
    CurrentUser.id == nil
  end

  Now re-entering the executor properly save and restore that state.

  Jean Boussier

• The new method ActiveSupport::BacktraceCleaner#first_clean_location
  returns the first clean location of the caller's call stack, or nil.
  Locations are Thread::Backtrace::Location objects. Useful when you want to
  report the application-level location where something happened as an object.

  Xavier Noria

• FileUpdateChecker and EventedFileUpdateChecker ignore changes in Gem.path now.

  Ermolaev Andrey, zzak

• The new method ActiveSupport::BacktraceCleaner#first_clean_frame returns
  the first clean frame of the caller's backtrace, or nil. Useful when you
  want to report the application-level frame where something happened as a
  string.

  Xavier Noria

• Always clear CurrentAttributes instances.

  Previously CurrentAttributes instance would be reset at the end of requests.
  Meaning its attributes would be re-initialized.

  This is problematic because it assume these objects don't hold any state
  other than their declared attribute, which isn't always the case, and
  can lead to state leak across request.

  Now CurrentAttributes instances are abandoned at the end of a request,
  and a new instance is created at the start of the next request.

  Jean Boussier, Janko Marohnić

• Add public API for before_fork_hook in parallel testing.

  Introduces a public API for calling the before fork hooks implemented by parallel testing.

  parallelize_before_fork do

perform an action before test processes are forked

end
```

*Eileen M. Uchitelle*

• Implement ability to skip creating parallel testing databases.

  With parallel testing, Rails will create a database per process. If this isn't
  desirable or you would like to implement databases handling on your own, you can
  now turn off this default behavior.

  To skip creating a database per process, you can change it via the
  parallelize method:

  parallelize(workers: 10, parallelize_databases: false)

  or via the application configuration:

  config.active_support.parallelize_databases = false

  Eileen M. Uchitelle

• Allow to configure maximum cache key sizes

  When the key exceeds the configured limit (250 bytes by default), it will be truncated and
  the digest of the rest of the key appended to it.

  Note that previously ActiveSupport::Cache::RedisCacheStore allowed up to 1kb cache keys before
  truncation, which is now reduced to 250 bytes.

  config.cache_store = :redis_cache_store, { max_key_size: 64 }

  fatkodima

• Use UNLINK command instead of DEL in ActiveSupport::Cache::RedisCacheStore for non-blocking deletion.

  Aron Roh

• Add Cache#read_counter and Cache#write_counter

  Rails.cache.write_counter("foo", 1)
  Rails.cache.read_counter("foo") # => 1
  Rails.cache.increment("foo")
  Rails.cache.read_counter("foo") # => 2

  Alex Ghiculescu

• Introduce ActiveSupport::Testing::ErrorReporterAssertions#capture_error_reports

  Captures all reported errors from within the block that match the given
  error class.

  reports = capture_error_reports(IOError) do
    Rails.error.report(IOError.new("Oops"))
    Rails.error.report(IOError.new("Oh no"))
    Rails.error.report(StandardError.new)
  end
  
  assert_equal 2, reports.size
  assert_equal "Oops", reports.first.error.message
  assert_equal "Oh no", reports.last.error.message

  Andrew Novoselac

• Introduce ActiveSupport::ErrorReporter#add_middleware

  When reporting an error, the error context middleware will be called with the reported error
  and base execution context. The stack may mutate the context hash. The mutated context will
  then be passed to error subscribers. Middleware receives the same parameters as ErrorReporter#report.

  Andrew Novoselac, Sam Schmidt

• Change execution wrapping to report all exceptions, including Exception.

  If a more serious error like SystemStackError or NoMemoryError happens,
  the error reporter should be able to report these kinds of exceptions.

  Gannon McGibbon

• ActiveSupport::Testing::Parallelization.before_fork_hook allows declaration of callbacks that
  are invoked immediately before forking test workers.

  Mike Dalessio

• Allow the #freeze_time testing helper to accept a date or time argument.

  Time.current # => Sun, 09 Jul 2024 15:34:49 EST -05:00
  freeze_time Time.current + 1.day
  sleep 1
  Time.current # => Mon, 10 Jul 2024 15:34:49 EST -05:00

  Joshua Young

• ActiveSupport::JSON now accepts options

  It is now possible to pass options to ActiveSupport::JSON:

  ActiveSupport::JSON.decode('{"key": "value"}', symbolize_names: true) # => { key: "value" }

  matthaigh27

• ActiveSupport::Testing::NotificationAssertions's assert_notification now matches against payload subsets by default.

  Previously the following assertion would fail due to excess key vals in the notification payload. Now with payload subset matching, it will pass.

  assert_notification("post.submitted", title: "Cool Post") do
    ActiveSupport::Notifications.instrument("post.submitted", title: "Cool Post", body: "Cool Body")
  end

  Additionally, you can now persist a matched notification for more customized assertions.

  notification = assert_notification("post.submitted", title: "Cool Post") do
    ActiveSupport::Notifications.instrument("post.submitted", title: "Cool Post", body: Body.new("Cool Body"))
  end
  
  assert_instance_of(Body, notification.payload[:body])

  Nicholas La Roux

• Deprecate String#mb_chars and ActiveSupport::Multibyte::Chars.

  These APIs are a relic of the Ruby 1.8 days when Ruby strings weren't encoding
  aware. There is no legitimate reasons to need these APIs today.

  Jean Boussier

• Deprecate ActiveSupport::Configurable

  Sean Doyle

• nil.to_query("key") now returns key.

  Previously it would return key=, preventing round tripping with Rack::Utils.parse_nested_query.

  Erol Fornoles

• Avoid wrapping redis in a ConnectionPool when using ActiveSupport::Cache::RedisCacheStore if the :redis
  option is already a ConnectionPool.

  Joshua Young

• Alter ERB::Util.tokenize to return :PLAIN token with full input string when string doesn't contain ERB tags.

  Martin Emde

• Fix a bug in ERB::Util.tokenize that causes incorrect tokenization when ERB tags are preceded by multibyte characters.

  Martin Emde

• Add ActiveSupport::Testing::NotificationAssertions module to help with testing ActiveSupport::Notifications.

  Nicholas La Roux, Yishu See, Sean Doyle

• ActiveSupport::CurrentAttributes#attributes now will return a new hash object on each call.

  Previously, the same hash object was returned each time that method was called.

  fatkodima

• ActiveSupport::JSON.encode supports CIDR notation.

  Previously:

  ActiveSupport::JSON.encode(IPAddr.new("172.16.0.0/24")) # => "\"172.16.0.0\""

  After this change:

  ActiveSupport::JSON.encode(IPAddr.new("172.16.0.0/24")) # => "\"172.16.0.0/24\""

  Taketo Takashima

• Make ActiveSupport::FileUpdateChecker faster when checking many file-extensions.

  Jonathan del Strother

Active Model

• Add reset_token: { expires_in: ... } option to has_secure_password.

  Allows configuring the expiry duration of password reset tokens (default remains 15 minutes for backwards compatibility).

  has_secure_password reset_token: { expires_in: 1.hour }

  Jevin Sew, Abeid Ahmed

• Add except_on: option for validation callbacks.

  Ben Sheldon

• Backport ActiveRecord::Normalization to ActiveModel::Attributes::Normalization

  class User
    include ActiveModel::Attributes
    include ActiveModel::Attributes::Normalization
  
    attribute :email, :string
  
    normalizes :email, with: -> email { email.strip.downcase }
  end
  
  user = User.new
  user.email =    " CRUISE-CONTROL@EXAMPLE.COM\n"
  user.email # => "cruise-control@example.com"

  Sean Doyle

Active Record

• Fix SQLite3 data loss during table alterations with CASCADE foreign keys.

  When altering a table in SQLite3 that is referenced by child tables with
  ON DELETE CASCADE foreign keys, ActiveRecord would silently delete all
  data from the child tables. This occurred because SQLite requires table
  recreation for schema changes, and during this process the original table
  is temporarily dropped, triggering CASCADE deletes on child tables.

  The root cause was incorrect ordering of operations. The original code
  wrapped disable_referential_integrity inside a transaction, but
  PRAGMA foreign_keys cannot be modified inside a transaction in SQLite -
  attempting to do so simply has no effect. This meant foreign keys remained
  enabled during table recreation, causing CASCADE deletes to fire.

  The fix reverses the order to follow the official SQLite 12-step ALTER TABLE
  procedure: disable_referential_integrity now wraps the transaction instead
  of being wrapped by it. This ensures foreign keys are properly disabled
  before the transaction starts and re-enabled after it commits, preventing
  CASCADE deletes while maintaining data integrity through atomic transactions.

  Ruy Rocha

• Add replicas to test database parallelization setup.

  Setup and configuration of databases for parallel testing now includes replicas.

  This fixes an issue when using a replica database, database selector middleware,
  and non-transactional tests, where integration tests running in parallel would select
  the base test database, i.e. db_test, instead of the numbered parallel worker database,
  i.e. db_test_{n}.

  Adam Maas

• Support virtual (not persisted) generated columns on PostgreSQL 18+

  PostgreSQL 18 introduces virtual (not persisted) generated columns,
  which are now the default unless the stored: true option is explicitly specified on PostgreSQL 18+.

  create_table :users do |t|
    t.string :name
    t.virtual :lower_name,  type: :string,  as: "LOWER(name)", stored: false
    t.virtual :name_length, type: :integer, as: "LENGTH(name)"
  end

  Yasuo Honda

• Optimize schema dumping to prevent duplicate file generation.

  ActiveRecord::Tasks::DatabaseTasks.dump_all now tracks which schema files
  have already been dumped and skips dumping the same file multiple times.
  This improves performance when multiple database configurations share the
  same schema dump path.

  Mikey Gough, Hartley McGuire

• Add structured events for Active Record:

  • active_record.strict_loading_violation
  • active_record.sql

  Gannon McGibbon

• Add support for integer shard keys.

Now accepts symbols as shard keys.

ActiveRecord::Base.connects_to(shards: {
  1: { writing: :primary_shard_one, reading: :primary_shard_one },
  2: { writing: :primary_shard_two, reading: :primary_shard_two},
})

ActiveRecord::Base.connected_to(shard: 1) do

..

end
```

*Nony Dutton*

• Add ActiveRecord::Base.only_columns

  Similar in use case to ignored_columns but listing columns to consider rather than the ones
  to ignore.

  Can be useful when working with a legacy or shared database schema, or to make safe schema change
  in two deploys rather than three.

  Anton Kandratski

• Use PG::Connection#close_prepared (protocol level Close) to deallocate
  prepared statements when available.

  To enable its use, you must have pg >= 1.6.0, libpq >= 17, and a PostgreSQL
  database version >= 17.

  Hartley McGuire, Andrew Jackson

• Fix query cache for pinned connections in multi threaded transactional tests

  When a pinned connection is used across separate threads, they now use a separate cache store
  for each thread.

  This improve accuracy of system tests, and any test using multiple threads.

  Heinrich Lee Yu, Jean Boussier

• Fix time attribute dirty tracking with timezone conversions.

  Time-only attributes now maintain a fixed date of 2000-01-01 during timezone conversions,
  preventing them from being incorrectly marked as changed due to date shifts.

  This fixes an issue where time attributes would be marked as changed when setting the same time value
  due to timezone conversion causing internal date shifts.

  Prateek Choudhary

• Skip calling PG::Connection#cancel in cancel_any_running_query
  when using libpq >= 18 with pg < 1.6.0, due to incompatibility.
  Rollback still runs, but may take longer.

  Yasuo Honda, Lars Kanis

• Don't add id_value attribute alias when attribute/column with that name already exists.

  Rob Lewis

• Remove deprecated :unsigned_float and :unsigned_decimal column methods for MySQL.

  Rafael Mendonça França

• Remove deprecated :retries option for the SQLite3 adapter.

  Rafael Mendonça França

• Introduce new database configuration options keepalive, max_age, and
  min_connections -- and rename pool to max_connections to match.

  There are no changes to default behavior, but these allow for more specific
  control over pool behavior.

  Matthew Draper, Chris AtLee, Rachael Wright-Munn

• Move LIMIT validation from query generation to when limit() is called.

  Hartley McGuire, Shuyang

• Add ActiveRecord::CheckViolation error class for check constraint violations.

  Ryuta Kamizono

• Add ActiveRecord::ExclusionViolation error class for exclusion constraint violations.

  When an exclusion constraint is violated in PostgreSQL, the error will now be raised
  as ActiveRecord::ExclusionViolation instead of the generic ActiveRecord::StatementInvalid,
  making it easier to handle these specific constraint violations in application code.

  This follows the same pattern as other constraint violation error classes like
  RecordNotUnique for unique constraint violations and InvalidForeignKey for
  foreign key constraint violations.

  Ryuta Kamizono

• Attributes filtered by filter_attributes will now also be filtered by filter_parameters
  so sensitive information is not leaked.

  Jill Klang

• Add connection.current_transaction.isolation API to check current transaction's isolation level.

  Returns the isolation level if it was explicitly set via the isolation: parameter
  or through ActiveRecord.with_transaction_isolation_level, otherwise returns nil.
  Nested transactions return the parent transaction's isolation level.

Returns nil when no transaction

User.connection.current_transaction.isolation # => nil

Returns explicitly set isolation level

User.transaction(isolation: :serializable) do
  User.connection.current_transaction.isolation # => :serializable
end

Returns nil when isolation not explicitly set

User.transaction do
  User.connection.current_transaction.isolation # => nil
end

Nested transactions inherit parent's isolation

User.transaction(isolation: :read_committed) do
  User.transaction do
    User.connection.current_transaction.isolation # => :read_committed
  end
end
```

*Kir Shatrov*

• Fix #merge with #or or #and and a mixture of attributes and SQL strings resulting in an incorrect query.

  base = Comment.joins(:post).where(user_id: 1).where("recent = 1")
  puts base.merge(base.where(draft: true).or(Post.where(archived: true))).to_sql

  Before:

  SELECT "comments".* FROM "comments"
  INNER JOIN "posts" ON "posts"."id" = "comments"."post_id"
  WHERE (recent = 1)
  AND (
    "comments"."user_id" = 1
    AND (recent = 1)
    AND "comments"."draft" = 1
    OR "posts"."archived" = 1
  )

  After:

  SELECT "comments".* FROM "comments"
  INNER JOIN "posts" ON "posts"."id" = "comments"."post_id"
  WHERE "comments"."user_id" = 1
  AND (recent = 1)
  AND (
    "comments"."user_id" = 1
    AND (recent = 1)
    AND "comments"."draft" = 1
    OR "posts"."archived" = 1
  )

  Joshua Young

• Make schema dumper to account for ActiveRecord.dump_schemas when dumping in :ruby format.

  fatkodima

• Add :touch option to update_column/update_columns methods.

Will update :updated_at/:updated_on alongside :nice column.

user.update_column(:nice, true, touch: true)

Will update :updated_at/:updated_on alongside :last_ip column

user.update_columns(last_ip: request.remote_ip, touch: true)
```

*Dmitrii Ivliev*

• Optimize Active Record batching further when using ranges.

  Tested on a PostgreSQL table with 10M records and batches of 10k records, the generation
  of relations for the 1000 batches was 4.8x faster (6.8s vs. 1.4s), used 900x
  less bandwidth (180MB vs. 0.2MB) and allocated 45x less memory (490MB vs. 11MB).

  Maxime Réty, fatkodima

• Include current character length in error messages for index and table name length validations.

  Joshua Young

• Add rename_schema method for PostgreSQL.

  T S Vallender

• Implement support for deprecating associations:

  has_many :posts, deprecated: true

  With that, Active Record will report any usage of the posts association.

  Three reporting modes are supported (:warn, :raise, and :notify), and
  backtraces can be enabled or disabled. Defaults are :warn mode and
  disabled backtraces.

  Please, check the docs for further details.

  Xavier Noria

• PostgreSQL adapter create DB now supports locale_provider and locale.

  Bengt-Ove Hollaender

• Use ntuples to populate row_count instead of count for Postgres

  Jonathan Calvert

• Fix checking whether an unpersisted record is include?d in a strictly
  loaded has_and_belongs_to_many association.

  Hartley McGuire

• Add ability to change transaction isolation for all pools within a block.

  This functionality is useful if your application needs to change the database
  transaction isolation for a request or action.

  Calling ActiveRecord.with_transaction_isolation_level(level) {} in an around filter or
  middleware will set the transaction isolation for all pools accessed within the block,
  but not for the pools that aren't.

  This works with explicit and implicit transactions:

  ActiveRecord.with_transaction_isolation_level(:read_committed) do
    Tag.transaction do # opens a transaction explicitly
      Tag.create!
    end
  end

  ActiveRecord.with_transaction_isolation_level(:read_committed) do
    Tag.create! # opens a transaction implicitly
  end

  Eileen M. Uchitelle

• Raise ActiveRecord::MissingRequiredOrderError when order dependent finder methods (e.g. #first, #last) are
  called without order values on the relation, and the model does not have any order columns (implicit_order_column,
  query_constraints, or primary_key) to fall back on.

  This change will be introduced with a new framework default for Rails 8.1, and the current behavior of not raising
  an error has been deprecated with the aim of removing the configuration option in Rails 8.2.

  config.active_record.raise_on_missing_required_finder_order_columns = true

  Joshua Young

• :class_name is now invalid in polymorphic belongs_to associations.

  Reason is :class_name does not make sense in those associations because
  the class name of target records is dynamic and stored in the type column.

  Existing polymorphic associations setting this option can just delete it.
  While it did not raise, it had no effect anyway.

  Xavier Noria

• Add support for multiple databases to db:migrate:reset.

  Joé Dupuis

• Add affected_rows to ActiveRecord::Result.

  Jenny Shen

• Enable passing retryable SqlLiterals to #where.

  Hartley McGuire

• Set default for primary keys in insert_all/upsert_all.

  Previously in Postgres, updating and inserting new records in one upsert wasn't possible
  due to null primary key values. nil primary key values passed into insert_all/upsert_all
  are now implicitly set to the default insert value specified by adapter.

  Jenny Shen

• Add a load hook active_record_database_configurations for ActiveRecord::DatabaseConfigurations

  Mike Dalessio

• Use TRUE and FALSE for SQLite queries with boolean columns.

  Hartley McGuire

• Bump minimum supported SQLite to 3.23.0.

  Hartley McGuire

• Allow allocated Active Records to lookup associations.

  Previously, the association cache isn't setup on allocated record objects, so association
  lookups will crash. Test frameworks like mocha use allocate to check for stubbable instance
  methods, which can trigger an association lookup.

  Gannon McGibbon

• Encryption now supports support_unencrypted_data: true being set per-attribute.

  Previously this only worked if ActiveRecord::Encryption.config.support_unencrypted_data == true.
  Now, if the global config is turned off, you can still opt in for a specific attribute.

ActiveRecord::Encryption.config.support_unencrypted_data = true

class User < ActiveRecord::Base
  encrypts :name, support_unencrypted_data: false # only supports encrypted data
  encrypts :email # supports encrypted or unencrypted data
end
```

```ruby

ActiveRecord::Encryption.config.support_unencrypted_data = false

class User < ActiveRecord::Base
  encrypts :name, support_unencrypted_data: true # supports encrypted or unencrypted data
  encrypts :email  # only supports encrypted data
end
```

*Alex Ghiculescu*

• Model generator no longer needs a database connection to validate column types.

  Mike Dalessio

• Allow signed ID verifiers to be configurable via Rails.application.message_verifiers

  Prior to this change, the primary way to configure signed ID verifiers was
  to set signed_id_verifier on each model class:

  Post.signed_id_verifier = ActiveSupport::MessageVerifier.new(...)
  Comment.signed_id_verifier = ActiveSupport::MessageVerifier.new(...)

  And if the developer did not set signed_id_verifier, a verifier would be
  instantiated with a secret derived from secret_key_base and the following
  options:

  { digest: "SHA256", serializer: JSON, url_safe: true }

  Thus it was cumbersome to rotate configuration for all verifiers.

  This change defines a new Rails config: [config.active_record.use_legacy_signed_id_verifier][].
  The default value is :generate_and_verify, which preserves the previous
  behavior. However, when set to :verify, signed ID verifiers will use
  configuration from Rails.application.message_verifiers (specifically,
  Rails.application.message_verifiers["active_record/signed_id"]) to
  generate and verify signed IDs, but will also verify signed IDs using the
  older configuration.

  To avoid complication, the new behavior only applies when signed_id_verifier_secret
  is not set on a model class or any of its ancestors. Additionally,
  signed_id_verifier_secret is now deprecated. If you are currently setting
  signed_id_verifier_secret on a model class, you can set signed_id_verifier
  instead:

BEFORE

  Post.signed_id_verifier_secret = "my secret"

AFTER

  Post.signed_id_verifier = ActiveSupport::MessageVerifier.new("my secret", digest: "SHA256", serializer: JSON, url_safe: true)
  ```

To ease migration, `signed_id_verifier` has also been changed to behave as a
`class_attribute` (i.e. inheritable), but _only when `signed_id_verifier_secret`
is not set_:

  ```ruby

BEFORE

  ActiveRecord::Base.signed_id_verifier = ActiveSupport::MessageVerifier.new(...)
  Post.signed_id_verifier == ActiveRecord::Base.signed_id_verifier # => false

AFTER

  ActiveRecord::Base.signed_id_verifier = ActiveSupport::MessageVerifier.new(...)
  Post.signed_id_verifier == ActiveRecord::Base.signed_id_verifier # => true

  Post.signed_id_verifier_secret = "my secret" # => deprecation warning
  Post.signed_id_verifier == ActiveRecord::Base.signed_id_verifier # => false
  ```

Note, however, that it is recommended to eventually migrate from
model-specific verifiers to a unified configuration managed by
`Rails.application.message_verifiers`. `ActiveSupport::MessageVerifier#rotate`
can facilitate that transition. For example:

  ```ruby

BEFORE

Generate and verify signed Post IDs using Post-specific configuration

  Post.signed_id_verifier = ActiveSupport::MessageVerifier.new("post secret", ...)

AFTER

Generate and verify signed Post IDs using the unified configuration

  Post.signed_id_verifier = Post.signed_id_verifier.dup

Fall back to Post-specific configuration when verifying signed IDs

  Post.signed_id_verifier.rotate("post secret", ...)
  ```

[`config.active_record.use_legacy_signed_id_verifier`]: https://guides.rubyonrails.org/v8.1/configuring.html#config-active-record-use-legacy-signed-id-verifier

*Ali Sepehri*, *Jonathan Hefner*

• Prepend extra_flags in postgres' structure_load

  When specifying structure_load_flags with a postgres adapter, the flags
  were appended to the default flags, instead of prepended.
  This caused issues with flags not being taken into account by postgres.

  Alice Loeser

• Allow bypassing primary key/constraint addition in implicit_order_column

  When specifying multiple columns in an array for implicit_order_column, adding
  nil as the last element will prevent appending the primary key to order
  conditions. This allows more precise control of indexes used by
  generated queries. It should be noted that this feature does introduce the risk
  of API misbehavior if the specified columns are not fully unique.

  Issy Long

• Allow setting the schema_format via database configuration.

  primary:
    schema_format: ruby
  

  Useful for multi-database setups when apps require different formats per-database.

  T S Vallender

• Support disabling indexes for MySQL v8.0.0+ and MariaDB v10.6.0+

  MySQL 8.0.0 added an option to disable indexes from being used by the query
  optimizer by making them "invisible". This allows the index to still be maintained
  and updated but no queries will be permitted to use it. This can be useful for adding
  new invisible indexes or making existing indexes invisible before dropping them
  to ensure queries are not negatively affected.
  See https://dev.mysql.com/blog-archive/mysql-8-0-invisible-indexes/ for more details.

  MariaDB 10.6.0 also added support for this feature by allowing indexes to be "ignored"
  in queries. See https://mariadb.com/kb/en/ignored-indexes/ for more details.

  Active Record now supports this option for MySQL 8.0.0+ and MariaDB 10.6.0+ for
  index creation and alteration where the new index option enabled: true/false can be
  passed to column and index methods as below:

  add_index :users, :email, enabled: false
  enable_index :users, :email
  add_column :users, :dob, :string, index: { enabled: false }
  
  change_table :users do |t|
    t.index :name, enabled: false
    t.index :dob
    t.disable_index :dob
    t.column :username, :string, index: { enabled: false }
    t.references :account, index: { enabled: false }
  end
  
  create_table :users do |t|
    t.string :name, index: { enabled: false }
    t.string :email
    t.index :email, enabled: false
  end

  Merve Taner

• Respect implicit_order_column in ActiveRecord::Relation#reverse_order.

  Joshua Young

• Add column types to ActiveRecord::Result for SQLite3.

  Andrew Kane

• Raise ActiveRecord::ReadOnlyError when pessimistically locking with a readonly role.

  Joshua Young

• Fix using the SQLite3Adapter's dbconsole method outside of a Rails application.

  Hartley McGuire

• Fix migrating multiple databases with ActiveRecord::PendingMigration action.

  Gannon McGibbon

• Enable automatically retrying idempotent association queries on connection
  errors.

  Hartley McGuire

• Add allow_retry to sql.active_record instrumentation.

  This enables identifying queries which queries are automatically retryable on connection errors.

  Hartley McGuire

• Better support UPDATE with JOIN for Postgresql and SQLite3

  Previously when generating update queries with one or more JOIN clauses,
  Active Record would use a sub query which would prevent to reference the joined
  tables in the SET clause, for instance:

  Comment.joins(:post).update_all("title = posts.title")

  This is now supported as long as the relation doesn't also use a LIMIT, ORDER or
  GROUP BY clause. This was supported by the MySQL adapter for a long time.

  Jean Boussier

• Introduce a before-fork hook in ActiveSupport::Testing::Parallelization to clear existing
  connections, to avoid fork-safety issues with the mysql2 adapter.

  Fixes #​41776

  Mike Dalessio, Donal McBreen

• PoolConfig no longer keeps a reference to the connection class.

  Keeping a reference to the class caused subtle issues when combined with reloading in
  development. Fixes #​54343.

  Mike Dalessio

• Fix SQL notifications sometimes not sent when using async queries.

  Post.async_count
  ActiveSupport::Notifications.subscribed(->(*) { "Will never reach here" }) do
    Post.count
  end

  In rare circumstances and under the right race condition, Active Support notifications
  would no longer be dispatched after using an asynchronous query.
  This is now fixed.

  Edouard Chin

• Eliminate queries loading dumped schema cache on Postgres

  Improve resiliency by avoiding needing to open a database connection to load the
  type map while defining attribute methods at boot when a schema cache file is
  configured on PostgreSQL databases.

  James Coleman

• ActiveRecord::Coder::JSON can be instantiated

  Options can now be passed to ActiveRecord::Coder::JSON when instantiating the coder. This allows:

  serialize :config, coder: ActiveRecord::Coder::JSON.new(symbolize_names: true)

  matthaigh27

• Deprecate using insert_all/upsert_all with unpersisted records in associations.

  Using these methods on associations containing unpersisted records will now
  show a deprecation warning, as the unpersisted records will be lost after
  the operation.

  Nick Schwaderer

• Make column name optional for index_exists?.

  This aligns well with remove_index signature as well, where
  index name doesn't need to be derived from the column names.

  Ali Ismayiliov

• Change the payload name of sql.active_record notification for eager
  loading from "SQL" to "#{model.name} Eager Load".

  zzak

• Enable automatically retrying idempotent #exists? queries on connection
  errors.

  Hartley McGuire, classidied

• Deprecate usage of unsupported methods in conjunction with update_all:

  update_all will now print a deprecation message if a query includes either WITH,
  WITH RECURSIVE or DISTINCT statements. Those were never supported and were ignored
  when generating the SQL query.

  An error will be raised in a future Rails release. This behavior will be consistent
  with delete_all which currently raises an error for unsupported statements.

  Edouard Chin

• The table columns inside schema.rb are now sorted alphabetically.

  Previously they'd be sorted by creation order, which can cause merge conflicts when two
  branches modify the same table concurrently.

  John Duff

• Introduce versions formatter for the schema dumper.

  It is now possible to override how schema dumper formats versions information inside the
  structure.sql file. Currently, the versions are simply sorted in the decreasing order.
  Within large teams, this can potentially cause many merge conflicts near the top of the list.

  Now, the custom formatter can be provided with a custom sorting logic (e.g. by hash values
  of the versions), which can greatly reduce the number of conflicts.

  fatkodima

• Serialized attributes can now be marked as comparable.

  A not rare issue when working with serialized attributes is that the serialized representation of an object
  can change over time. Either because you are migrating from one serializer to the other (e.g. YAML to JSON or to msgpack),
  or because the serializer used subtly changed its output.

  One example is libyaml that used to have some extra trailing whitespaces, and recently fixed that.
  When this sorts of thing happen, you end up with lots of records that report being changed even though
  they aren't, which in the best case leads to a lot more writes to the database and in the worst case lead to nasty bugs.

  The solution is to instead compare the deserialized representation of the object, however Active Record
  can't assume the deserialized object has a working == method. Hence why this new functionality is opt-in.

  serialize :config, type: Hash, coder: JSON, comparable: true

  Jean Boussier

• Fix MySQL default functions getting dropped when changing a column's nullability.

  Bastian Bartmann

• SQLite extensions can be configured in config/database.yml.

  The database configuration option extensions: allows an application to load SQLite extensions
  when using sqlite3 >= v2.4.0. The array members may be filesystem paths or the names of
  modules that respond to .to_path:

  development:
    adapter: sqlite3
    extensions:
      - SQLean::UUID                     # module name responding to `.to_path`
      - .sqlpkg/nalgeon/crypto/crypto.so # or a filesystem path
      - <%= AppExtensions.location %>    # or ruby code returning a path

  Mike Dalessio

• ActiveRecord::Middleware::ShardSelector supports granular database connection switching.

  A new configuration option, class_name:, is introduced to
  config.active_record.shard_selector to allow an application to specify the abstract connection
  class to be switched by the shard selection middleware. The default class is
  ActiveRecord::Base.

  For example, this configuration te

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	rails@​7.0.8.7 ⏵ 8.1.3

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: gem actionpack is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: Gemfile.lock → gem/rails@8.1.3 → gem/actionpack@8.1.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore gem/actionpack@8.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: gem activerecord is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: Gemfile.lock → gem/rails@8.1.3 → gem/activerecord@8.1.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore gem/activerecord@8.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: gem activerecord is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: Gemfile.lock → gem/rails@8.1.3 → gem/activerecord@8.1.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore gem/activerecord@8.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: gem activesupport is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: Gemfile.lock → gem/rails@8.1.3 → gem/activesupport@8.1.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore gem/activesupport@8.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: gem action_text-trix Location: Package overview From: Gemfile.lock → gem/rails@8.1.3 → gem/action_text-trix@2.1.19 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore gem/action_text-trix@2.1.19. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report