Upgrading rails 4 to 5
Breaking4.2.11.3 → 5.2.8.1Breaking2Security18Platform1New13Changed9Fixed57Other18
Fetching 76 releases from GitHub…36 / 76
SecurityChanges ActiveRecord::Coders::YAMLColumn default to safe_load, addressing CVE-2022-32224.CVE-2022-32224 ↗
BreakingUpgrade verdict
2 breaking changes and a platform requirement change and 18 security fixes.
In plain terms
- If the same block is included multiple times for a Concern, an exception is no longer raised.
- Reset scope after delete on collection association to clear stale offsets of removed records.
- This version works again on the older Ruby 2.2 runtime.
- Serialized YAML columns are now loaded safely by default, which closes a security hole but may block some classes from being deserialized unless you allow them.
Must act Top 5 of 21 that need code or config changes
rails publishes an official migration guide for version 5. It covers more than the release notes do.
Upgrading from Rails 4.2 to Rails 5.0 ↗Ruby requirement changed in 5.0.0.beta1: >= 1.9.3 → >= 2.2.2.
What you must change
Breaking2
If the same block is included multiple times for a Concern, an exception is no longer raised.
includedConcernReset scope after delete on collection association to clear stale offsets of removed records.
Security18
Changes ActiveRecord::Coders::YAMLColumn default to safe_load, addressing CVE-2022-32224.
ActiveRecord::Coders::YAMLColumnconfig.active_storage.use_yaml_unsafe_loadconfig.active_record.yaml_column_permitted_classesFixes and adds protections for XSS in ActionView::Helpers and ERB::Util, adding ERB::Util.xml_name_escape to escape dangerous characters in tag and attribute names per the XML specification.
ActionView::HelpersERB::UtilERB::Util.xml_name_escapeFixes and adds XSS protections in Action View tag helpers by escaping dangerous characters in tag and attribute names per the XML specification, and renames the :escape_attributes option to :escape.
ActionView::HelpersERB::Util:escape_attributes:escapeAdds configurable allow-list validation for Active Storage image transformation methods, alongside the existing deny-list for arguments.
VariantFixes a case where middleware is not told the response body is fully closed, so request state may not reset before the next request.
Prevents regex denial of service in HTTP token authentication.
Prevents string polymorphic route arguments from triggering unwanted route helper calls in url_for.
url_forFixes a possible DoS vector in the PostgreSQL money type by correcting the validation regexp.
Fixes a potential XSS vulnerability in the translate/t helper (CVE-2020-15169).
translatetDeprecates Marshal.load on raw cache reads in RedisCacheStore due to CVE-2020-8165.
RedisCacheStoreMarshal.loadAvoids Marshal.load on raw cache values in MemCacheStore due to CVE-2020-8165.
MemCacheStoreMarshal.loadChecks that requests are same-origin before including the CSRF token in XHRs (CVE-2020-8167).
HMACs the raw CSRF token before masking so it cannot reconstruct a per-form token (CVE-2020-8166).
Returns self from #each, #each_pair, and #each_value instead of the raw @parameters hash (CVE-2020-8164).
#each#each_pair#each_value@parametersIncludes Content-Length in the signature for ActiveStorage direct uploads (CVE-2020-8162).
Content-LengthFixes a possible XSS vector in the escape_javascript helper (CVE-2020-5267).
escape_javascriptFixes a possible information leak and session hijacking vulnerability, tracked as CVE-2019-16782.
Notes that ActionDispatch::Session::MemcacheStore remains vulnerable until the dalli gem is updated as well.
ActionDispatch::Session::MemcacheStorePlatform1
Restores support for Ruby 2.2 in Active Support.