Upgrading activerecord 6 to 7
Breaking6.1.7.10 → 7.2.4Breaking64Security22Platform1Deprecated15New85Changed80Fixed269Other2
Fetching 67 releases from GitHub…23 / 67
SecurityDisables libvips unfuzzed image loaders and savers via Vips.block_untrusted(true) at boot, addressing GHSA-xr9x-r78c-5hrm and CVE-2026-66066.GHSA-xr9x-r78c-5hrm ↗
BreakingUpgrade verdict
63 breaking changes and a platform requirement change and 22 security fixes.
In plain terms
- Removes two deprecated event methods; code calling them will break.
- Several deprecation helpers now require an explicit deprecator argument.
- Calling deprecation methods through the class no longer delegates to an instance.
- The deprecated clone_empty method on SafeBuffer is gone.
Must act Top 5 of 101 that need code or config changes
Ruby requirement changed in 7.2.0.beta1: >= 2.5.0 → >= 3.1.0.
What you must change
Breaking63
Removes deprecated
ActiveSupport::Notifications::Event#children and Event#parent_of?.ActiveSupport::Notifications::Event#childrenActiveSupport::Notifications::Event#parent_of?Removes deprecated support for calling deprecation methods without passing a deprecator.
deprecatedeprecate_constantActiveSupport::Deprecation::DeprecatedObjectProxy.newActiveSupport::Deprecation::DeprecatedInstanceVariableProxy.newActiveSupport::Deprecation::DeprecatedConstantProxy.newassert_deprecatedassert_not_deprecatedcollect_deprecationsRemoves deprecated
ActiveSupport::Deprecation delegation to instance.ActiveSupport::DeprecationRemoves deprecated
SafeBuffer#clone_empty.SafeBuffer#clone_emptyRemoves deprecated
#to_default_s from Array, Date, DateTime and Time.Array#to_default_sDate#to_default_sDateTime#to_default_sTime#to_default_sRemoves deprecated support for passing
Dalli::Client instances to MemCacheStore.Dalli::ClientMemCacheStoreRemoves deprecated
config.active_support.use_rfc4122_namespaced_uuids.config.active_support.use_rfc4122_namespaced_uuidsRemoves deprecated
config.active_support.remove_deprecated_time_with_zone_name.config.active_support.remove_deprecated_time_with_zone_nameRemoves deprecated
config.active_support.disable_to_s_conversion.config.active_support.disable_to_s_conversionRemoves deprecated support for bolding log text with a positional boolean in
ActiveSupport::LogSubscriber#color.ActiveSupport::LogSubscriber#colorRemoves deprecated constants
ActiveSupport::LogSubscriber::CLEAR and ActiveSupport::LogSubscriber::BOLD.ActiveSupport::LogSubscriber::CLEARActiveSupport::LogSubscriber::BOLDRemoves deprecated support for
config.active_support.cache_format_version = 6.1.config.active_support.cache_format_versionRemoves deprecated
:pool_size and :pool_timeout options for the cache storage.:pool_size:pool_timeoutRemoves deprecated behavior that rolled back a transaction block when exited via return, break or throw.
Removes deprecated support to pass rewhere to ActiveRecord::Relation#merge.
ActiveRecord::Relation#mergerewhereRemoves deprecated support to pass deferrable: true to add_foreign_key.
add_foreign_keydeferrableRemoves deprecated support to quote ActiveSupport::Duration.
ActiveSupport::DurationRemoves deprecated #quote_bound_value.
#quote_bound_valueRemoves deprecated ActiveRecord::ConnectionAdapters::ConnectionPool#connection_klass.
ActiveRecord::ConnectionAdapters::ConnectionPool#connection_klassRemoves deprecated implicit current-role behavior for connection pool list and connection clearing methods.
#connection_pool_list#active_connections?#clear_active_connections!#clear_reloadable_connections!#clear_all_connections!#flush_idle_connections!Removes deprecated #all_connection_pools.
#all_connection_poolsRemoves deprecated ActiveRecord::ConnectionAdapters::SchemaCache#data_sources.
ActiveRecord::ConnectionAdapters::SchemaCache#data_sourcesRemoves deprecated ActiveRecord::ConnectionAdapters::SchemaCache.load_from.
ActiveRecord::ConnectionAdapters::SchemaCache.load_fromRemoves deprecated #all_foreign_keys_valid? from database adapters.
#all_foreign_keys_valid?Removes deprecated support for passing coder and class as the second argument to serialize.
serializeRemoves deprecated support for ActiveRecord::Base#read_attribute(:id) returning the custom primary key value.
ActiveRecord::Base#read_attributeRemoves deprecated TestFixtures.fixture_path.
TestFixtures.fixture_pathRemoves deprecated behavior allowing a singular association to be referred to by its plural name.
Removes deprecated support for passing SchemaMigration and InternalMetadata classes to ActiveRecord::MigrationContext.
SchemaMigrationInternalMetadataActiveRecord::MigrationContextRemoves deprecated ActiveRecord::Migration.check_pending! method.
ActiveRecord::Migration.check_pending!Removes deprecated ActiveRecord::LogSubscriber.runtime method.
ActiveRecord::LogSubscriber.runtimeActiveRecord::LogSubscriber.runtime=Removes deprecated ActiveRecord::LogSubscriber.reset_runtime method.
ActiveRecord::LogSubscriber.reset_runtimeRemoves deprecated support for defining explain in the connection adapter with 2 arguments.
explainRemoves deprecated ActiveRecord::ActiveJobRequiredError.
ActiveRecord::ActiveJobRequiredErrorRemoves deprecated ActiveRecord::Base.clear_active_connections!.
ActiveRecord::Base.clear_active_connections!Removes deprecated ActiveRecord::Base.clear_reloadable_connections!.
ActiveRecord::Base.clear_reloadable_connections!Removes deprecated ActiveRecord::Base.clear_all_connections!.
ActiveRecord::Base.clear_all_connections!Removes deprecated ActiveRecord::Base.flush_idle_connections!.
ActiveRecord::Base.flush_idle_connections!Removes deprecated name argument from ActiveRecord::Base.remove_connection.
ActiveRecord::Base.remove_connectionRemoves deprecated support for calling alias_attribute with non-existent attribute names.
alias_attributeRemoves deprecated Rails.application.config.active_record.suppress_multiple_database_warning.
Rails.application.config.active_record.suppress_multiple_database_warningRenames ActionView::TestCase::Behavior::Content to RenderedViewContent, which now inherits from String and is marked nodoc.
ActionView::TestCase::Behavior::ContentActionView::TestCase::Behavior::RenderedViewContentRemoves deprecated support for setting
Rails.application.config.action_dispatch.show_exceptions to true and false.Rails.application.config.action_dispatch.show_exceptionsRemoves deprecated
speaker, vibrate, and vr permissions policy directives.speakervibratevrRemoves deprecated
Rails.application.config.action_dispatch.return_only_request_media_type_on_content_type.Rails.application.config.action_dispatch.return_only_request_media_type_on_content_typeRemoves deprecated comparison between ActionController::Parameters and Hash.
ActionController::ParametersHashRemoves deprecated constant AbstractController::Helpers::MissingHelperError.
AbstractController::Helpers::MissingHelperErrorRemoves deprecated constant ActionDispatch::IllegalStateError.
ActionDispatch::IllegalStateErrorRemoves deprecated :exponentially_longer value for :wait in retry_on.
retry_on:wait:exponentially_longerRemoves deprecated support for setting numeric values to the scheduled_at attribute.
scheduled_atRemoves deprecated primitive serializer for BigDecimal arguments.
BigDecimalRemoves deprecated params via :args for assert_enqueued_email_with.
assert_enqueued_email_with:argsRemoves deprecated config.action_mailer.preview_path.
config.action_mailer.preview_pathRemoves deprecated config.active_storage.silence_invalid_content_types_warning.
config.active_storage.silence_invalid_content_types_warningRemoves deprecated config.active_storage.replace_on_assign_to_many.
config.active_storage.replace_on_assign_to_manyRemoves oracle, sqlserver and JRuby specific database adapters from rails new and rails db:system:change.
rails newrails db:system:changesqlite3mysqlpostgresqltrilogyRemoves the deprecated find_cmd_and_exec console helper.
find_cmd_and_execRemoves deprecated Rails.config.enable_dependency_loading.
Rails.config.enable_dependency_loadingRemoves deprecated Rails.application.secrets.
Rails.application.secretsRenames ActionView::TestCase::Behavior::Content to RenderedViewContent, which now inherits from String and is marked nodoc.
ActionView::TestCase::Behavior::ContentActionView::TestCase::Behavior::RenderedViewContentStringPrevents glob injection in DiskService#delete_prefixed by escaping glob metacharacters, breaking code that relied on glob expansion.
DiskService#delete_prefixedDir.globRemoves deprecated Rails::Generators::Testing::Behaviour.
Rails::Generators::Testing::BehaviourRaises ArgumentError when reading config.x.something with arguments.
config.xSecurity22
Disables libvips unfuzzed image loaders and savers via Vips.block_untrusted(true) at boot, addressing GHSA-xr9x-r78c-5hrm and CVE-2026-66066.
Vips.block_untrusted(true)Vips::Errorconfig.active_storage.variable_content_types:mini_magickRejects scientific notation in NumberConverter.
NumberConverterFixes SafeBuffer#% to preserve unsafe status.
SafeBuffer#%Improves performance of NumberToDelimitedConverter.
NumberToDelimitedConverterSkips blank attribute names in tag helpers to avoid generating invalid HTML.
Filters user supplied metadata in DirectUploadController.
DirectUploadControllerAdds a configurable maximum streaming chunk size, defaulting to 100mb byte ranges for blobs.
Limits range requests to a single range.
Prevents path traversal in DiskService; path_for raises InvalidKeyError for dot segments or paths outside the storage root.
DiskServiceDiskService#path_forInvalidKeyErrorDiskControllerUpdates
@rails/ujs files to ignore certain data-* attributes when the element is contenteditable (CVE-2023-23913).@rails/ujsCalls inspect on ids in RecordNotFound error messages.
RecordNotFoundModerateRemoves dangerous transformations in Active Storage.
Adds validation to content security policies to disallow spaces and semicolons.
Avoids regex backtracking in HTTP Token authentication.
Avoids regex backtracking in query parameter filtering.
Avoids regex backtracking in the
block_format helper.block_formatAvoids backtracking in plain_text_for_blockquote_node.
plain_text_for_blockquote_nodeIncludes the HTTP Permissions-Policy header on non-HTML Content-Types.
Sanitizes ActionText HTML ContentAttachment in the Trix edit view.
ActionText::ContentAttachmentUpgrades Trix to 2.1.1 to fix CVE-2024-34341.
TrixFixes a possible XSS vulnerability with the translate method in controllers.
translateFixes ReDoS in Accept header parsing.
Platform1
Raises the minimum supported libvips to 8.13 and ruby-vips to 2.2.1, raising RuntimeError at boot when ruby-vips is installed and either minimum is unmet.
libvipsruby-vipsRuntimeErrorDeprecations to plan for
Deprecated15
Deprecates
ActiveSupport::ProxyObject in favor of Ruby's built-in BasicObject.ActiveSupport::ProxyObjectBasicObjectDeprecates ActiveRecord::ImmutableRelation in favor of ActiveRecord::UnmodifiableRelation.
ActiveRecord::ImmutableRelationActiveRecord::UnmodifiableRelationDeprecates the association option
query_constraints in favor of foreign_key.query_constraintsforeign_keySoft-deprecates ActiveRecord::Base.connection in favor of .lease_connection, with no warnings.
ActiveRecord::Base.connectionActiveRecord::Base.lease_connectionDeprecates ActiveRecord::ConnectionAdapters::ConnectionPool#connection in favor of lease_connection.
ActiveRecord::ConnectionAdapters::ConnectionPool#connectionActiveRecord::ConnectionAdapters::ConnectionPool#lease_connectionDeprecates Rails.application.config.active_record.commit_transaction_on_non_local_return.
Rails.application.config.active_record.commit_transaction_on_non_local_returnDeprecates Rails.application.config.active_record.allow_deprecated_singular_associations_name.
Rails.application.config.active_record.allow_deprecated_singular_associations_nameDeprecates ENV["SCHEMA_CACHE"] in favor of schema_cache_path in the database configuration.
ENV["SCHEMA_CACHE"]schema_cache_pathDeprecates config.active_record.warn_on_records_fetched_greater_than since sql.active_record now includes :row_count.
config.active_record.warn_on_records_fetched_greater_thansql.active_recordrow_countDeprecates defining an enum with keyword arguments.
enumDeprecates passing strings to ActiveRecord::Tasks::DatabaseTasks.cache_dump_filename.
ActiveRecord::Tasks::DatabaseTasks.cache_dump_filenameActiveRecord::DatabaseConfigurations::DatabaseConfigDeprecates passing nil as the value for the model: argument to form_with.
form_withmodelDeprecates passing content to void elements when using tag.br type tag builders.
tag.brDeprecates
Rails.application.config.action_controller.allow_deprecated_parameters_hash_equality.Rails.application.config.action_controller.allow_deprecated_parameters_hash_equalityDeprecates Rails.application.config.active_job.use_big_decimal_serialize.
Rails.application.config.active_job.use_big_decimal_serialize