Upgrading actionmailer 7 to 8

Removes deprecated support for passing a Time object to Time#since.

Removes the deprecated Benchmark.ms method, now defined in the benchmark gem.

Removes deprecated addition of Time instances with ActiveSupport::TimeWithZone.

Removes deprecated support for to_time preserving the system local time; it now always preserves the receiver timezone.

Removes deprecated :unsigned_float and :unsigned_decimal column methods for MySQL.

Removes the deprecated :retries option for the SQLite3 adapter.

Removes deprecated support to route to multiple paths.

Removes deprecated support for using semicolons as a query string separator.

Removes deprecated support for skipping over leading brackets in parameter names in the parameter parser.

Removes support for setting ActiveJob::Base.enqueue_after_transaction_commit to :never, :always and :default.

Removes the deprecated Rails.application.config.active_job.enqueue_after_transaction_commit config.

Removes the deprecated :azure storage service.

Removes deprecated STATS_DIRECTORIES.

Removes the deprecated bin/rake stats command.

Removes the deprecated rails/console/methods.rb file.

Rails no longer generates a bin/bundle binstub when creating new applications, since the mechanism is now part of Rubygem itself.

Remove deprecated passing a Time object to Time#since.

Remove deprecated Benchmark.ms method.

Remove deprecated addition for Time instances with ActiveSupport::TimeWithZone.

Remove deprecated support for to_time to preserve the system local time.

remote_ip will no longer ignore IPs in X-Forwarded-For headers if they are accompanied by port information.

Remove deprecated STATS_DIRECTORIES.

Remove deprecated bin/rake stats command.

Remove deprecated rails/console/methods.rb file.

Remove deprecated :unsigned_float and :unsigned_decimal column methods for MySQL.

Remove deprecated :retries option for the SQLite3 adapter.

Model generator no longer needs a database connection to validate column types.

PoolConfig no longer keeps a reference to the connection class.

Remove autocomplete="off" on hidden inputs generated by form_tag, token_tag, method_tag, and the hidden parameter fields included in button_to forms will omit the autocomplete="off" attribute.

Remove deprecated support to a route to multiple paths.

Remove deprecated support for using semicolons as a query string separator.

Remove deprecated support to skipping over leading brackets in parameter names in the parameter parser.

Remove support to set ActiveJob::Base.enqueue_after_transaction_commit to :never, :always and :default.

Remove deprecated Rails.application.config.active_job.enqueue_after_transaction_commit.

Remove deprecated :azure storage service.

Remove unnecessary calls to the GCP metadata server.

A Blob will no longer autosave associated Attachment.

Remove unnecessary ruby-version input from ruby/setup-ruby.

Rails no longer generates a bin/bundle binstub when creating new applications.

Removes deprecated support for passing an array of strings to ActiveSupport::Deprecation#warn.

Removes deprecated support for setting attr_internal_naming_format with a @ prefix.

Removes deprecated ActiveSupport::ProxyObject.

Removes deprecated support for setting ENV["SCHEMA_CACHE"].

Removes deprecated support for passing a database name to cache_dump_filename.

Removes deprecated ActiveRecord::ConnectionAdapters::ConnectionPool#connection.

Removes deprecated config.active_record.warn_on_records_fetched_greater_than.

Removes deprecated support for defining enum with keyword arguments.

Removes deprecated support for finding database adapters not registered to Active Record.

Removes deprecated config.active_record.allow_deprecated_singular_associations_name.

Removes deprecated config.active_record.commit_transaction_on_non_local_return.

Removes deprecated support for passing content to void tag elements on the tag builder.

Removes deprecated support for passing nil to the model: argument of form_with.

Removes Rails.application.config.action_controller.allow_deprecated_parameters_hash_equality.

Removes deprecated config.active_job.use_big_decimal_serializer.

Removes deprecated support for extending the Rails console through Rails::ConsoleMethods.

Removes the deprecated rails/console/helpers file.

Removes deprecated config.active_record.sqlite3_deprecated_warning.

Deletes the deprecated constant ActiveRecord::ImmutableRelation.

Removes the deprecated config.read_encrypted_secrets setting.

The db:prepare task no longer loads seeds when a non-primary database is created.

Remove deprecated config.active_record.sqlite3_deprecated_warning.

Remove deprecated config.read_encrypted_secrets.

Drop MySQL 5.5 support.

Delete the deprecated constant ActiveRecord::ImmutableRelation.

Rename text_area methods into textarea.

Rename check_box* methods into checkbox*.

Remove racc dependency by manually writing ActionDispatch::Journey::Scanner.

Remove require_* statements from application.css to align with the transition from Sprockets to Propshaft.

Use Solid Cable as the default Action Cable adapter in production, configured as a separate queue database in config/database.yml.

Makes :class_name invalid in polymorphic belongs_to associations.

Raises AbstractController::DoubleRenderError when head is called after rendering.

A route pointing to a non-existing controller now returns a 500 instead of a 404.

Removes the deprecated internal SuckerPunch adapter in favor of the adapter included with the sucker_punch gem.

Skip calling PG::Connection#cancel in cancel_any_running_query when using libpq >= 18 with pg < 1.6.0, due to incompatibility.

Remove deprecated internal SuckerPunch adapter in favor of the adapter included with the sucker_punch gem.

Prevents glob injection in DiskService#delete_prefixed by escaping glob metacharacters, breaking code that relied on glob expansion.

Fixes HashWithIndifferentAccess#stringify_keys to stringify all keys, not just symbols.

Limits the size of strings ActiveModel::Type::Integer coerces with to_i to prevent a DoS vector.

Filters the database password out of failed db: task command error messages.

Rejects malformed hosts with extra ports in ActionDispatch::HostAuthorization.

Fixes possible XSS in DebugExceptions middleware.

Attributes filtered by filter_attributes are now also filtered by filter_parameters to avoid leaking sensitive information.

Rate limits password resets in the authentication generator to mitigate abuse from attackers spamming the password reset form.

Disables libvips unfuzzed image loaders and savers via Vips.block_untrusted(true) at boot, raising Vips::Error for affected transformations.

Rejects scientific notation in NumberConverter.

Fixes SafeBuffer#% to preserve unsafe status.

Improves performance of NumberToDelimitedConverter.

Skips blank attribute names in tag helpers to avoid generating invalid HTML.

Filters user supplied metadata in DirectUploadController.

Adds a configurable maximum streaming chunk size, defaulting to 100mb for blob byte ranges.

Limits range requests to a single range.

Prevents path traversal in DiskService; path_for raises InvalidKeyError for dot segments or paths outside the storage root.

Calls inspect on ids in RecordNotFound errors, addressing CVE-2025-55193.

Removes dangerous transformations, addressing CVE-2025-24293.

Adds validation to content security policies to disallow spaces and semicolons.

Sets Regexp.timeout to 1 second by default to mitigate Regexp denial-of-service attacks.

Requires libvips 8.13 or newer and ruby-vips 2.2.1 or newer when ruby-vips is installed, raising RuntimeError at boot otherwise.

Deprecates config.active_support.to_time_preserves_timezone.

Deprecates String#mb_chars and ActiveSupport::Multibyte::Chars.

Deprecates ActiveSupport::Configurable.

Deprecates using insert_all/upsert_all with unpersisted records in associations, which are lost after the operation.

Deprecates using update_all with WITH, WITH RECURSIVE or DISTINCT, which were ignored; an error will be raised in a future release.

Deprecates Rails.application.config.action_dispatch.ignore_leading_brackets.

Deprecates the built-in sidekiq adapter; use the adapter from the sidekiq gem 7.3.3 or later.

Deprecate config.active_support.to_time_preserves_timezone.

Deprecate String#mb_chars and ActiveSupport::Multibyte::Chars.

Deprecate ActiveSupport::Configurable.

Deprecate using insert_all/upsert_all with unpersisted records in associations.

Deprecate usage of unsupported methods in conjunction with update_all.

Deprecate Rails.application.config.action_dispatch.ignore_leading_brackets.

Deprecate built-in sidekiq adapter.

Deprecates the Benchmark.ms core extension as the benchmark gem becomes bundled in Ruby 3.5.

Deprecates addition and since between two Time or ActiveSupport::TimeWithZone instances, to be removed in Rails 8.1.

Deprecates unsigned_float and unsigned_decimal short-hand column methods.

Deprecates drawing routes with multiple paths to make routing faster.

Deprecates sucker_punch as an adapter option.

Deprecates bin/rake stats in favor of bin/rails stats.

Deprecates ActiveStorage::Service::AzureStorageService.

Deprecates the ::STATS_DIRECTORIES constant in favor of Rails::CodeStatistics.register_directory.

Deprecate ActiveStorage::Service::AzureStorageService.

Deprecate ::STATS_DIRECTORIES.