Upgrading activesupport 6 to 7
Breaking6.1.7.10 → 7.2.4Breaking66Security22Platform1Deprecated17New108Changed93Fixed297Other3
Fetching 67 releases from GitHub…29 / 67
SecurityDisables libvips unfuzzed image loaders and savers via Vips.block_untrusted(true) at boot, raising Vips::Error for affected formats.GHSA-xr9x-r78c-5hrm ↗
BreakingUpgrade verdict
64 breaking changes and a platform requirement change and 22 security fixes.
In plain terms
- Removes the old way of calling deprecation helpers without specifying a deprecator; a deprecator argument is now required.
- Removes two deprecated event methods; callers using them must stop.
- Removes the deprecated behavior where deprecation calls were forwarded to an instance.
- Removes a deprecated method for cloning an empty safe buffer.
Must act Top 5 of 104 that need code or config changes
activesupport publishes an official migration guide for version 7. It covers more than the release notes do.
Upgrading from Rails 6.1 to Rails 7.0 ↗Ruby requirement changed in 7.2.0.beta1: >= 2.5.0 → >= 3.1.0.
What you must change
Breaking64
Removes deprecated support to call several deprecation methods without passing a deprecator.
deprecatedeprecate_constantActiveSupport::Deprecation::DeprecatedObjectProxy.newActiveSupport::Deprecation::DeprecatedInstanceVariableProxy.newActiveSupport::Deprecation::DeprecatedConstantProxy.newassert_deprecatedassert_not_deprecatedcollect_deprecationsRemoves deprecated
ActiveSupport::Notifications::Event#children and #parent_of?.ActiveSupport::Notifications::Event#childrenActiveSupport::Notifications::Event#parent_of?Removes deprecated
ActiveSupport::Deprecation delegation to instance.ActiveSupport::DeprecationRemoves deprecated
SafeBuffer#clone_empty.SafeBuffer#clone_emptyRemoves deprecated
#to_default_s from Array, Date, DateTime and Time.Array#to_default_sDate#to_default_sDateTime#to_default_sTime#to_default_sRemoves deprecated support for passing
Dalli::Client instances to MemCacheStore.Dalli::ClientMemCacheStoreRemoves deprecated
config.active_support.use_rfc4122_namespaced_uuids.config.active_support.use_rfc4122_namespaced_uuidsRemoves deprecated
config.active_support.remove_deprecated_time_with_zone_name.config.active_support.remove_deprecated_time_with_zone_nameRemoves deprecated
config.active_support.disable_to_s_conversion.config.active_support.disable_to_s_conversionRemoves deprecated support for bolding log text with a positional boolean in
ActiveSupport::LogSubscriber#color.ActiveSupport::LogSubscriber#colorRemoves deprecated constants
ActiveSupport::LogSubscriber::CLEAR and ActiveSupport::LogSubscriber::BOLD.ActiveSupport::LogSubscriber::CLEARActiveSupport::LogSubscriber::BOLDRemoves deprecated support for
config.active_support.cache_format_version = 6.1.config.active_support.cache_format_versionRemoves deprecated
:pool_size and :pool_timeout options for the cache storage.:pool_size:pool_timeoutRemoves deprecated behavior that rolled back a transaction block when exited using return, break or throw.
returnbreakthrowRemoves deprecated support to pass rewhere to ActiveRecord::Relation#merge.
ActiveRecord::Relation#mergerewhereRemoves deprecated support to pass deferrable: true to add_foreign_key.
add_foreign_keydeferrableRemoves deprecated support to quote ActiveSupport::Duration.
ActiveSupport::DurationRemoves deprecated #quote_bound_value.
quote_bound_valueRemoves deprecated ActiveRecord::ConnectionAdapters::ConnectionPool#connection_klass.
ActiveRecord::ConnectionAdapters::ConnectionPool#connection_klassRemoves deprecated support for applying connection pool methods to the current role when role is not provided.
connection_pool_listactive_connections?clear_active_connections!clear_reloadable_connections!clear_all_connections!flush_idle_connections!Removes deprecated #all_connection_pools.
all_connection_poolsRemoves deprecated ActiveRecord::ConnectionAdapters::SchemaCache#data_sources.
ActiveRecord::ConnectionAdapters::SchemaCache#data_sourcesRemoves deprecated ActiveRecord::ConnectionAdapters::SchemaCache.load_from.
ActiveRecord::ConnectionAdapters::SchemaCache.load_fromRemoves deprecated #all_foreign_keys_valid? from database adapters.
#all_foreign_keys_valid?Removes deprecated support for passing coder and class as the second argument to serialize.
serializeRemoves deprecated support for read_attribute(:id) returning the custom primary key value.
ActiveRecord::Base#read_attributeRemoves deprecated TestFixtures.fixture_path.
TestFixtures.fixture_pathRemoves deprecated behavior allowing a singular association to be referred to by its plural name.
Removes deprecated support for passing SchemaMigration and InternalMetadata classes to ActiveRecord::MigrationContext.
SchemaMigrationInternalMetadataActiveRecord::MigrationContextRemoves deprecated ActiveRecord::Migration.check_pending! method.
ActiveRecord::Migration.check_pending!Removes deprecated ActiveRecord::LogSubscriber.runtime method.
ActiveRecord::LogSubscriber.runtimeActiveRecord::LogSubscriber.runtime=Removes deprecated ActiveRecord::LogSubscriber.reset_runtime method.
ActiveRecord::LogSubscriber.reset_runtimeRemoves deprecated support for defining explain in the connection adapter with 2 arguments.
explainRemoves deprecated ActiveRecord::ActiveJobRequiredError.
ActiveRecord::ActiveJobRequiredErrorRemoves deprecated ActiveRecord::Base.clear_active_connections!.
ActiveRecord::Base.clear_active_connections!Removes deprecated ActiveRecord::Base.clear_reloadable_connections!.
ActiveRecord::Base.clear_reloadable_connections!Removes deprecated ActiveRecord::Base.clear_all_connections!.
ActiveRecord::Base.clear_all_connections!Removes deprecated ActiveRecord::Base.flush_idle_connections!.
ActiveRecord::Base.flush_idle_connections!Removes deprecated name argument from ActiveRecord::Base.remove_connection.
ActiveRecord::Base.remove_connectionRemoves deprecated support for calling alias_attribute with non-existent attribute names.
alias_attributeRemoves deprecated Rails.application.config.active_record.suppress_multiple_database_warning.
Rails.application.config.active_record.suppress_multiple_database_warningRenames ActionView::TestCase::Behavior::Content to RenderedViewContent, which now inherits from String and is marked :nodoc:.
ActionView::TestCase::Behavior::ContentActionView::TestCase::Behavior::RenderedViewContentRemoves deprecated support for setting
Rails.application.config.action_dispatch.show_exceptions to true and false.Rails.application.config.action_dispatch.show_exceptionsRemoves deprecated
speaker, vibrate, and vr permissions policy directives.speakervibratevrRemoves deprecated
Rails.application.config.action_dispatch.return_only_request_media_type_on_content_type.Rails.application.config.action_dispatch.return_only_request_media_type_on_content_typeRemoves deprecated comparison between ActionController::Parameters and Hash.
ActionController::ParametersHashRemoves deprecated constant AbstractController::Helpers::MissingHelperError.
AbstractController::Helpers::MissingHelperErrorRemoves deprecated constant ActionDispatch::IllegalStateError.
ActionDispatch::IllegalStateErrorRemoves deprecated :exponentially_longer value for :wait in retry_on.
retry_on:wait:exponentially_longerRemoves deprecated support for setting numeric values to the scheduled_at attribute.
scheduled_atRemoves deprecated primitive serializer for BigDecimal arguments.
BigDecimalRemoves deprecated params via :args for assert_enqueued_email_with.
assert_enqueued_email_with:argsRemoves deprecated config.action_mailer.preview_path.
config.action_mailer.preview_pathRemoves deprecated config.active_storage.silence_invalid_content_types_warning.
config.active_storage.silence_invalid_content_types_warningRemoves deprecated config.active_storage.replace_on_assign_to_many.
config.active_storage.replace_on_assign_to_manyRemoves oracle, sqlserver and JRuby specific database adapters from rails new and rails db:system:change.
rails newrails db:system:changeoraclesqlserversqlite3mysqlpostgresqltrilogyRemoves the deprecated find_cmd_and_exec console helper.
find_cmd_and_execRemoves deprecated Rails.config.enable_dependency_loading.
Rails.config.enable_dependency_loadingRemoves deprecated Rails.application.secrets.
Rails.application.secretsRemoves deprecated support for the pre-Ruby 2.4 behavior of to_time returning a Time with local timezone.
to_timeRenames ActionView::TestCase::Behavior::Content to RenderedViewContent, which now inherits from String and is marked nodoc.
ActionView::TestCase::Behavior::ContentActionView::TestCase::Behavior::RenderedViewContentPrevents glob injection in DiskService#delete_prefixed by escaping glob metacharacters before Dir.glob.
DiskService#delete_prefixedDir.globRemoves deprecated Rails::Generators::Testing::Behaviour.
Rails::Generators::Testing::BehaviourRaises an error when foreign_key: is passed as an array in associations.
foreign_key:Security22
Disables libvips unfuzzed image loaders and savers via Vips.block_untrusted(true) at boot, raising Vips::Error for affected formats.
Vips.block_untrusted(true)Vips::Errorconfig.active_storage.variable_content_types:mini_magickruby-vipslibvipsRejects scientific notation in NumberConverter.
NumberConverterModerateFixes SafeBuffer#% to preserve unsafe status.
SafeBuffer#%ModerateImproves performance of NumberToDelimitedConverter.
NumberToDelimitedConverterModerateSkips blank attribute names in tag helpers to avoid generating invalid HTML.
Filters user supplied metadata in DirectUploadController.
DirectUploadControllerAdds a configurable maximum streaming chunk size, defaulting to 100mb for blob byte ranges.
Limits range requests to a single range.
Prevents path traversal in DiskService; path_for raises InvalidKeyError for dot segments or paths outside the storage root.
DiskServiceDiskService#path_forInvalidKeyErrorDiskControllerCalls inspect on ids in RecordNotFound error messages, addressing CVE-2025-55193.
RecordNotFoundRemoves dangerous transformations in Active Storage, addressing CVE-2025-24293.
Adds validation to content security policies to disallow spaces and semicolons.
Avoids regex backtracking in HTTP Token authentication.
Avoids regex backtracking in query parameter filtering.
Avoids regex backtracking in the block_format helper.
block_formatAvoids backtracking in plain_text_for_blockquote_node.
plain_text_for_blockquote_nodeIncludes the HTTP Permissions-Policy header on non-HTML content types.
Sanitizes ActionText HTML ContentAttachment in the Trix edit view.
ActionText::ContentAttachmentUpgrades Trix to 2.1.1 to fix CVE-2024-34341.
TrixFixes a possible XSS vulnerability with the translate method in controllers.
translateFixes a ReDoS (regular expression denial of service) in Accept header parsing.
Updates @rails/ujs files to ignore certain data-* attributes when the element is contenteditable, addressing CVE-2023-23913.
@rails/ujsPlatform1
Raises minimum supported libvips to 8.13 and ruby-vips to 2.2.1, raising RuntimeError at boot when unmet.
libvipsruby-vipsRuntimeErrorDeprecations to plan for
Deprecated17
Deprecates
ActiveSupport::ProxyObject in favor of Ruby's built-in BasicObject.ActiveSupport::ProxyObjectBasicObjectDeprecates ActiveRecord::ImmutableRelation in favor of ActiveRecord::UnmodifiableRelation.
ActiveRecord::ImmutableRelationActiveRecord::UnmodifiableRelationDeprecates the association option
query_constraints in favor of foreign_key.query_constraintsforeign_keyDeprecates ActiveRecord::Base.connection in favor of .lease_connection as a soft deprecation with no warnings.
ActiveRecord::Base.connectionlease_connectionDeprecates ActiveRecord::ConnectionAdapters::ConnectionPool#connection, renamed to lease_connection.
ActiveRecord::ConnectionAdapters::ConnectionPool#connectionlease_connectionDeprecates Rails.application.config.active_record.commit_transaction_on_non_local_return.
Rails.application.config.active_record.commit_transaction_on_non_local_returnDeprecates Rails.application.config.active_record.allow_deprecated_singular_associations_name.
Rails.application.config.active_record.allow_deprecated_singular_associations_nameDeprecates ENV["SCHEMA_CACHE"] in favor of schema_cache_path in the database configuration.
ENV["SCHEMA_CACHE"]schema_cache_pathDeprecates config.active_record.warn_on_records_fetched_greater_than since sql.active_record now includes :row_count.
config.active_record.warn_on_records_fetched_greater_thansql.active_recordrow_countDeprecates defining an enum with keyword arguments.
enumDeprecates passing strings to ActiveRecord::Tasks::DatabaseTasks.cache_dump_filename.
ActiveRecord::Tasks::DatabaseTasks.cache_dump_filenameActiveRecord::DatabaseConfigurations::DatabaseConfigDeprecates passing nil as the value for the model: argument to form_with.
form_withmodelDeprecates passing content to void elements when using tag.br type tag builders.
tag.brDeprecates
Rails.application.config.action_controller.allow_deprecated_parameters_hash_equality.Rails.application.config.action_controller.allow_deprecated_parameters_hash_equalityDeprecates Rails.application.config.active_job.use_big_decimal_serialize.
Rails.application.config.active_job.use_big_decimal_serializeDeprecates config.active_support.to_time_preserves_timezone.
config.active_support.to_time_preserves_timezoneDeprecates DateAndTime::Compatibility.preserve_timezone.
DateAndTime::Compatibility.preserve_timezone