Upgrading activejob 6 to 7
Breaking6.1.7.10 → 7.2.4Breaking56Security23Platform1Deprecated15New85Changed78Fixed264Other2
Fetching 66 releases from GitHub…23 / 66
SecurityDisables libvips unfuzzed image loaders and savers via Vips.block_untrusted(true) at boot, raising Vips::Error for affected formats.GHSA-xr9x-r78c-5hrm ↗
BreakingUpgrade verdict
55 breaking changes and a platform requirement change and 23 security fixes.
In plain terms
- Two deprecated notification event methods are gone.
- Several deprecation helpers now require an explicit deprecator argument.
- Calling deprecation methods through the class instead of an instance no longer works.
- The deprecated clone_empty method on SafeBuffer is removed.
Must act Top 5 of 94 that need code or config changes
Ruby requirement changed in 7.2.0.beta1: >= 2.5.0 → >= 3.1.0.
What you must change
Breaking55
Removes deprecated
ActiveSupport::Notifications::Event#children and #parent_of?.ActiveSupport::Notifications::Event#childrenActiveSupport::Notifications::Event#parent_of?Removes deprecated support to call deprecation methods without passing a deprecator.
deprecatedeprecate_constantActiveSupport::Deprecation::DeprecatedObjectProxy.newActiveSupport::Deprecation::DeprecatedInstanceVariableProxy.newActiveSupport::Deprecation::DeprecatedConstantProxy.newassert_deprecatedassert_not_deprecatedcollect_deprecationsRemoves deprecated
ActiveSupport::Deprecation delegation to instance.ActiveSupport::DeprecationRemoves deprecated
SafeBuffer#clone_empty.SafeBuffer#clone_emptyRemoves deprecated
#to_default_s from Array, Date, DateTime and Time.Array#to_default_sDate#to_default_sDateTime#to_default_sTime#to_default_sRemoves deprecated support to passing
Dalli::Client instances to MemCacheStore.Dalli::ClientMemCacheStoreRemoves deprecated
config.active_support.use_rfc4122_namespaced_uuids.config.active_support.use_rfc4122_namespaced_uuidsRemoves deprecated
config.active_support.remove_deprecated_time_with_zone_name.config.active_support.remove_deprecated_time_with_zone_nameRemoves deprecated
config.active_support.disable_to_s_conversion.config.active_support.disable_to_s_conversionRemoves deprecated support to bold log text with positional boolean in
ActiveSupport::LogSubscriber#color.ActiveSupport::LogSubscriber#colorRemoves deprecated constants
ActiveSupport::LogSubscriber::CLEAR and ActiveSupport::LogSubscriber::BOLD.ActiveSupport::LogSubscriber::CLEARActiveSupport::LogSubscriber::BOLDRemoves deprecated support for
config.active_support.cache_format_version = 6.1.config.active_support.cache_format_versionRemoves deprecated
:pool_size and :pool_timeout options for the cache storage.:pool_size:pool_timeoutRemoves deprecated behavior that rolled back a transaction block when exited using return, break or throw.
Removes deprecated support to pass rewhere to ActiveRecord::Relation#merge.
ActiveRecord::Relation#mergerewhereRemoves deprecated support to pass deferrable: true to add_foreign_key.
add_foreign_keydeferrableRemoves deprecated support to quote ActiveSupport::Duration.
ActiveSupport::DurationRemoves deprecated #quote_bound_value.
quote_bound_valueRemoves deprecated ActiveRecord::ConnectionAdapters::ConnectionPool#connection_klass.
ActiveRecord::ConnectionAdapters::ConnectionPool#connection_klassRemoves deprecated support for applying connection pool list and clearing methods to current-role pools without a role argument.
connection_pool_listactive_connections?clear_active_connections!clear_reloadable_connections!clear_all_connections!flush_idle_connections!Removes deprecated #all_connection_pools.
all_connection_poolsRemoves deprecated ActiveRecord::ConnectionAdapters::SchemaCache#data_sources.
ActiveRecord::ConnectionAdapters::SchemaCache#data_sourcesRemoves deprecated ActiveRecord::ConnectionAdapters::SchemaCache.load_from.
ActiveRecord::ConnectionAdapters::SchemaCache.load_fromRemoves deprecated #all_foreign_keys_valid? from database adapters.
#all_foreign_keys_valid?Removes deprecated support for passing coder and class as the second argument to serialize.
serializeRemoves deprecated support for ActiveRecord::Base#read_attribute(:id) returning the custom primary key value.
ActiveRecord::Base#read_attributeRemoves deprecated TestFixtures.fixture_path.
TestFixtures.fixture_pathRemoves deprecated behavior supporting referring to a singular association by its plural name.
Removes deprecated support for passing SchemaMigration and InternalMetadata classes to ActiveRecord::MigrationContext.
SchemaMigrationInternalMetadataActiveRecord::MigrationContextRemoves deprecated ActiveRecord::Migration.check_pending! method.
ActiveRecord::Migration.check_pending!Removes deprecated ActiveRecord::LogSubscriber.runtime method.
ActiveRecord::LogSubscriber.runtimeActiveRecord::LogSubscriber.runtime=Removes deprecated ActiveRecord::LogSubscriber.reset_runtime method.
ActiveRecord::LogSubscriber.reset_runtimeRemoves deprecated support for defining explain in the connection adapter with 2 arguments.
explainRemoves deprecated ActiveRecord::ActiveJobRequiredError.
ActiveRecord::ActiveJobRequiredErrorRemoves deprecated ActiveRecord::Base.clear_active_connections!.
ActiveRecord::Base.clear_active_connections!Removes deprecated ActiveRecord::Base.clear_reloadable_connections!.
ActiveRecord::Base.clear_reloadable_connections!Removes deprecated ActiveRecord::Base.clear_all_connections!.
ActiveRecord::Base.clear_all_connections!Removes deprecated ActiveRecord::Base.flush_idle_connections!.
ActiveRecord::Base.flush_idle_connections!Removes deprecated name argument from ActiveRecord::Base.remove_connection.
ActiveRecord::Base.remove_connectionRemoves deprecated support for calling alias_attribute with non-existent attribute names.
alias_attributeRemoves deprecated Rails.application.config.active_record.suppress_multiple_database_warning.
Rails.application.config.active_record.suppress_multiple_database_warningRenames ActionView::TestCase::Behavior::Content to RenderedViewContent, which now inherits from String and is nodoc private API.
ActionView::TestCase::Behavior::ContentActionView::TestCase::Behavior::RenderedViewContentRemoves deprecated support for setting
action_dispatch.show_exceptions to true and false.Rails.application.config.action_dispatch.show_exceptionsRemoves deprecated
speaker, vibrate, and vr permissions policy directives.speakervibratevrRemoves deprecated
action_dispatch.return_only_request_media_type_on_content_type config.Rails.application.config.action_dispatch.return_only_request_media_type_on_content_typeRemoves the deprecated :exponentially_longer value for :wait in retry_on.
retry_on:exponentially_longer:waitRemoves deprecated support for setting numeric values to the scheduled_at attribute.
scheduled_atRemoves the deprecated primitive serializer for BigDecimal arguments.
BigDecimalRemoves deprecated config.active_storage.replace_on_assign_to_many.
config.active_storage.replace_on_assign_to_manyRemoves oracle, sqlserver and JRuby specific database adapters from rails new and rails db:system:change; supported options are sqlite3, mysql, postgresql and trilogy.
rails newrails db:system:changeoraclesqlserversqlite3mysqlpostgresqltrilogyRemoves the deprecated find_cmd_and_exec console helper.
find_cmd_and_execRemoves deprecated Rails.config.enable_dependency_loading.
Rails.config.enable_dependency_loadingRemoves deprecated Rails.application.secrets.
Rails.application.secretsRenames ActionView::TestCase::Behavior::Content to RenderedViewContent, which now inherits from String and is marked nodoc.
ActionView::TestCase::Behavior::ContentActionView::TestCase::Behavior::RenderedViewContentRemoves deprecated Rails::Generators::Testing::Behaviour.
Rails::Generators::Testing::BehaviourSecurity23
Disables libvips unfuzzed image loaders and savers via Vips.block_untrusted(true) at boot, raising Vips::Error for affected formats.
Vips.block_untrusted(true)Vips::Errorconfig.active_storage.variable_content_types:mini_magickRejects scientific notation in NumberConverter.
NumberConverterFixes SafeBuffer#% to preserve unsafe status.
SafeBuffer#%Improves performance of NumberToDelimitedConverter.
NumberToDelimitedConverterSkips blank attribute names in tag helpers to avoid generating invalid HTML.
Filters user supplied metadata in DirectUploadController.
DirectUploadControllerAdds a configurable maximum streaming chunk size, defaulting to 100mb for blob byte ranges.
Limits range requests to a single range.
Prevents path traversal in DiskService; path_for raises InvalidKeyError for dot segments or paths outside the storage root.
DiskServiceDiskService#path_forInvalidKeyErrorDiskControllerPrevents glob injection in DiskService#delete_prefixed by escaping glob metacharacters before Dir.glob.
DiskService#delete_prefixedDir.globUpdates
@rails/ujs files to ignore certain data-* attributes when the element is contenteditable.@rails/ujsCalls inspect on ids in RecordNotFound error to address CVE-2025-55193.
RecordNotFoundRemoves dangerous transformations in Active Storage to address CVE-2025-24293.
Adds validation to content security policies to disallow spaces and semicolons.
Avoids regex backtracking in HTTP Token authentication in Action Pack.
Avoids regex backtracking in query parameter filtering in Action Pack.
Avoids regex backtracking in the block_format helper in Action Mailer.
block_formatAvoids backtracking in plain_text_for_blockquote_node in Action Text.
plain_text_for_blockquote_nodeIncludes the HTTP Permissions-Policy header on non-HTML Content-Types in Action Pack.
Sanitizes ActionText HTML ContentAttachment in the Trix edit view.
Upgrades Trix to 2.1.1 to fix CVE-2024-34341.
TrixFixes a possible XSS vulnerability with the translate method in controllers.
translateFixes ReDoS in Accept header parsing.
Platform1
Requires libvips 8.13 or newer and ruby-vips 2.2.1 or newer when ruby-vips is installed, raising RuntimeError at boot otherwise.
libvipsruby-vipsRuntimeErrorDeprecations to plan for
Deprecated15
Deprecates
ActiveSupport::ProxyObject in favor of Ruby's built-in BasicObject.ActiveSupport::ProxyObjectBasicObjectDeprecates
ActiveRecord::ImmutableRelation in favor of ActiveRecord::UnmodifiableRelation.ActiveRecord::ImmutableRelationActiveRecord::UnmodifiableRelationDeprecates the association option
query_constraints in favor of foreign_key.query_constraintsforeign_keyDeprecates ActiveRecord::Base.connection in favor of .lease_connection as a soft deprecation with no warnings.
ActiveRecord::Base.connectionlease_connectionDeprecates ActiveRecord::ConnectionAdapters::ConnectionPool#connection, renamed to lease_connection.
ActiveRecord::ConnectionAdapters::ConnectionPool#connectionlease_connectionDeprecates Rails.application.config.active_record.commit_transaction_on_non_local_return.
Rails.application.config.active_record.commit_transaction_on_non_local_returnDeprecates Rails.application.config.active_record.allow_deprecated_singular_associations_name.
Rails.application.config.active_record.allow_deprecated_singular_associations_nameDeprecates ENV["SCHEMA_CACHE"] in favor of schema_cache_path in the database configuration.
ENV["SCHEMA_CACHE"]schema_cache_pathDeprecates config.active_record.warn_on_records_fetched_greater_than now that sql.active_record notification includes :row_count.
config.active_record.warn_on_records_fetched_greater_thansql.active_recordrow_countDeprecates defining an enum with keyword arguments.
enumDeprecates passing strings to ActiveRecord::Tasks::DatabaseTasks.cache_dump_filename.
ActiveRecord::Tasks::DatabaseTasks.cache_dump_filenameActiveRecord::DatabaseConfigurations::DatabaseConfigDeprecates passing nil as the value for the model: argument to form_with.
form_withmodelDeprecates passing content to void elements when using tag.br type tag builders.
tag.brDeprecates
action_controller.allow_deprecated_parameters_hash_equality.Rails.application.config.action_controller.allow_deprecated_parameters_hash_equalityDeprecates Rails.application.config.active_job.use_big_decimal_serialize.
Rails.application.config.active_job.use_big_decimal_serialize