Upgrading activestorage 7 to 8

Removes deprecated support for passing a Time object to Time#since.

Removes the deprecated Benchmark.ms method, now defined in the benchmark gem.

Removes deprecated addition of Time instances with ActiveSupport::TimeWithZone.

Removes deprecated support for to_time preserving the system local time; it now always preserves the receiver timezone.

Removes deprecated :unsigned_float and :unsigned_decimal column methods for MySQL.

Removes deprecated :retries option for the SQLite3 adapter.

Removes deprecated support to route to multiple paths.

Removes deprecated support for using semicolons as a query string separator.

Removes deprecated support for skipping over leading brackets in parameter names in the parameter parser.

The JSON renderer no longer escapes HTML entities or Unicode line separators by default; use escape: true or config.action_controller.escape_json_responses to restore.

Removes support for setting ActiveJob::Base.enqueue_after_transaction_commit to :never, :always and :default.

Removes deprecated Rails.application.config.active_job.enqueue_after_transaction_commit.

Removes the deprecated :azure storage service.

Removes deprecated STATS_DIRECTORIES.

Removes the deprecated bin/rake stats command.

Removes the deprecated rails/console/methods.rb file.

Removes deprecated support for passing an array of strings to ActiveSupport::Deprecation#warn.

Removes deprecated support for setting attr_internal_naming_format with a @ prefix.

Removes the deprecated ActiveSupport::ProxyObject.

Removes deprecated support for setting ENV["SCHEMA_CACHE"].

Removes deprecated support for passing a database name to cache_dump_filename.

Removes deprecated ActiveRecord::ConnectionAdapters::ConnectionPool#connection.

Removes deprecated config.active_record.sqlite3_deprecated_warning.

Removes deprecated config.active_record.warn_on_records_fetched_greater_than.

Removes deprecated support for defining enum with keyword arguments.

Removes deprecated support for finding database adapters that are not registered to Active Record.

Removes deprecated config.active_record.allow_deprecated_singular_associations_name.

Removes deprecated config.active_record.commit_transaction_on_non_local_return.

Deletes the deprecated constant ActiveRecord::ImmutableRelation.

Removes deprecated support for passing content to void tag elements on the tag builder.

Removes deprecated support for passing nil to the model: argument of form_with.

Removes Rails.application.config.action_controller.allow_deprecated_parameters_hash_equality.

Removes deprecated config.active_job.use_big_decimal_serializer.

Removes deprecated support for extending the Rails console through Rails::ConsoleMethods.

Removes the deprecated file rails/console/helpers.

Removes the deprecated file rails/console/app.

Removes deprecated config.read_encrypted_secrets.

Always clears CurrentAttributes instances, abandoning them at request end and creating a new instance on the next request.

Makes :class_name invalid in polymorphic belongs_to associations.

Raises AbstractController::DoubleRenderError when head is called after rendering.

A route pointing to a non-existing controller now returns 500 instead of 404.

Removes the deprecated internal SuckerPunch adapter in favor of the adapter included with the sucker_punch gem.

Always clears CurrentAttributes instances by abandoning them at request end and creating a new instance at the next request start.

Makes :class_name invalid in polymorphic belongs_to associations.

Raises AbstractController::DoubleRenderError when head is called after rendering.

A route pointing to a non-existing controller now returns 500 instead of 404.

Removes the deprecated internal SuckerPunch adapter in favor of the adapter included with the sucker_punch gem.

Fixes ActiveSupport::HashWithIndifferentAccess#stringify_keys to stringify all keys, not just symbols.

Raises when EncryptedConfiguration is given a key that cannot respond to #to_sym, such as an Integer or Float.

Limits the size of strings ActiveModel::Type::Integer coerces with to_i to avoid a DoS vector from very long strings.

Filters the database password out of failed db: task command error messages.

Rejects malformed hosts with extra ports in ActionDispatch::HostAuthorization.

Fixes possible XSS in DebugExceptions middleware.

Filters attributes listed in filter_attributes also through filter_parameters to avoid leaking sensitive information.

Rate limits password resets in the authentication generator to mitigate abuse from attackers spamming the password reset form.

Rate limits password resets in the authentication generator to mitigate abuse from spamming the password reset form.

Disables libvips unfuzzed image loaders and savers via Vips.block_untrusted(true) at boot, and raises RuntimeError if libvips < 8.13 or ruby-vips < 2.2.1.

Rejects scientific notation in NumberConverter.

Fixes SafeBuffer#% to preserve unsafe status.

Improves performance of NumberToDelimitedConverter.

Skips blank attribute names in tag helpers to avoid generating invalid HTML.

Filters user supplied metadata in DirectUploadController.

Adds a configurable maximum streaming chunk size, defaulting to 100mb byte ranges for blobs.

Limits range requests to a single range.

Prevents path traversal in DiskService; path_for raises InvalidKeyError for dot segments or paths outside the storage root.

Prevents glob injection in DiskService#delete_prefixed by escaping glob metacharacters, breaking code that relied on glob expansion.

Calls inspect on ids in RecordNotFound error to address CVE-2025-55193.

Removes dangerous transformations to address CVE-2025-24293.

Adds validation to content security policies to disallow spaces and semicolons.

Sets Regexp.timeout to 1 second by default to improve security against Regexp Denial-of-Service attacks.

Raises minimum supported libvips to 8.13 and ruby-vips to 2.2.1, raising RuntimeError at boot when ruby-vips is installed and either minimum is unmet.

Deprecates config.active_support.to_time_preserves_timezone.

Deprecates String#mb_chars and ActiveSupport::Multibyte::Chars.

Deprecates ActiveSupport::Configurable.

Deprecates using insert_all/upsert_all with unpersisted records in associations.

Deprecates using update_all with WITH, WITH RECURSIVE or DISTINCT statements, which were ignored; an error will be raised in a future release.

Deprecates Rails.application.config.action_dispatch.ignore_leading_brackets.

Deprecates the built-in sidekiq adapter; use sidekiq 7.3.3 or later and the sidekiq gem's adapter.

Deprecates String#mb_chars and ActiveSupport::Multibyte::Chars.

Deprecates using insert_all/upsert_all with unpersisted records in associations.

Deprecates using update_all with WITH, WITH RECURSIVE or DISTINCT statements, which will raise in a future release.

Deprecates the built-in sidekiq adapter; use sidekiq 7.3.3 or later and the sidekiq gem's adapter.

Deprecates the Benchmark.ms core extension as the benchmark gem becomes bundled in Ruby 3.5.

Deprecates addition and since between two Time or ActiveSupport::TimeWithZone instances, to be removed in Rails 8.1.

Deprecates unsigned_float and unsigned_decimal short-hand column methods.

Deprecates drawing routes with multiple paths to make routing faster.

Deprecates sucker_punch as an adapter option.

Deprecates ActiveStorage::Service::AzureStorageService.

Deprecates ::STATS_DIRECTORIES in favor of Rails::CodeStatistics.register_directory.

Deprecates bin/rake stats in favor of bin/rails stats.

Deprecates the Benchmark.ms core extension, since the benchmark gem becomes bundled in Ruby 3.5.

Deprecates sucker_punch as an Active Job adapter option.

Deprecates the ::STATS_DIRECTORIES constant in favor of Rails::CodeStatistics.register_directory.