Upgrading rails 5 to 6

Removes deprecated ActiveSupport::Notifications::Instrumenter#end=.

Removes deprecated ActiveSupport::Multibyte::Unicode methods pack_graphemes, unpack_graphemes, normalize, downcase, upcase and swapcase.

Removes deprecated ActiveSupport::Multibyte::Chars#consumes? and ActiveSupport::Multibyte::Chars#normalize.

Removes deprecated file active_support/core_ext/range/include_range.

Removes deprecated file active_support/core_ext/hash/transform_values.

Removes deprecated file active_support/core_ext/hash/compact.

Removes deprecated file active_support/core_ext/array/prepend_and_append.

Removes deprecated file active_support/core_ext/numeric/inquiry.

Removes deprecated file active_support/core_ext/module/reachable.

Removes deprecated Module#parent_name, Module#parent and Module#parents.

Removes deprecated ActiveSupport::LoggerThreadSafeLevel#after_initialize.

Removes deprecated LoggerSilence constant.

Removes deprecated fallback to I18n.default_local when config.i18n.fallbacks is empty.

Removes deprecated methods from ActiveRecord::ConnectionAdapters::DatabaseLimits.

Removes deprecated ActiveRecord::ConnectionAdapters::AbstractAdapter#supports_multi_insert?.

Removes deprecated ActiveRecord::ConnectionAdapters::AbstractAdapter#supports_foreign_keys_in_create?.

Removes deprecated ActiveRecord::ConnectionAdapters::PostgreSQLAdapter#supports_ranges?.

Removes deprecated ActiveRecord::Base#update_attributes and ActiveRecord::Base#update_attributes!.

Removes the deprecated migrations_path argument from ActiveRecord::ConnectionAdapter::SchemaStatements#assume_migrated_upto_version.

Removes deprecated config.active_record.sqlite3.represent_boolean_as_integer.

relation.create no longer leaks scope to class level querying methods in initialization blocks and callbacks.

Named scope chains no longer leak scope to class level querying methods.

Removes deprecated methods from ActiveRecord::DatabaseConfigurations.

Removes the deprecated ActiveRecord::Result#to_hash method.

Removes deprecated support for using unsafe raw SQL in ActiveRecord::Relation methods.

Removes ibm_db, informix, mssql, oracle, and oracle12 Arel visitors which are not used in the code base.

Removes :connection_id from the sql.active_record notification.

The :name key is no longer returned in DatabaseConfig#configuration_hash; use DatabaseConfig#owner_name instead.

Changes form_with to generate non-remote forms by default.

Removes deprecated escape_whitelist from ActionView::Template::Handlers::ERB.

Removes deprecated find_all_anywhere from ActionView::Resolver.

Removes deprecated formats from ActionView::Template::HTML.

Removes deprecated formats from ActionView::Template::RawFile.

Removes deprecated formats from ActionView::Template::Text.

Removes deprecated find_file from ActionView::PathSet.

Removes deprecated rendered_format from ActionView::LookupContext.

Removes deprecated find_file from ActionView::ViewPaths.

Removes deprecated support for passing a non-ActionView::LookupContext object as the first argument to ActionView::Base#initialize.

Removes deprecated format argument from ActionView::Base#initialize.

Removes deprecated ActionView::Template#refresh.

Removes deprecated ActionView::Template#original_encoding.

Removes deprecated ActionView::Template#variants.

Removes deprecated ActionView::Template#formats.

Removes deprecated ActionView::Template#virtual_path=.

Removes deprecated ActionView::Template#updated_at.

Removes the deprecated updated_at argument required on ActionView::Template#initialize.

Removes deprecated ActionView::Template.finalize_compiled_template_methods.

Removes deprecated config.action_view.finalize_compiled_template_methods.

Removes deprecated support for calling ActionView::ViewPaths#with_fallback with a block.

Removes deprecated support for passing absolute paths to render template:.

Removes deprecated support for passing relative paths to render file:.

Removes support for template handlers that do not accept two arguments.

Removes the deprecated pattern argument in ActionView::Template::PathResolver.

Removes deprecated support for calling private methods from objects in some view helpers.

Removes deprecated ActionDispatch::Http::ParameterFilter.

Removes deprecated force_ssl at the controller level.

Removes deprecated ActionMailer::Base.receive in favor of Action Mailbox.

Removes deprecated support for passing :combine_options operations to ActiveStorage::Transformers::ImageProcessing.

Removes the deprecated ActiveStorage::Transformers::MiniMagickTransformer.

Removes the deprecated config.active_storage.queue setting.

Removes the deprecated ActiveStorage::Downloading module.

Replaces Blob.create_after_upload! with Blob.create_and_upload! and removes the former.

Removes deprecated rake dev:cache tasks.

Removes deprecated rake routes tasks.

Removes deprecated rake initializers tasks.

Removes deprecated support for the HOST environment variable to specify the server IP.

Removes the deprecated server argument from the rails server command.

Removes deprecated SOURCE_ANNOTATION_DIRECTORIES environment variable support from rails notes.

Removes the deprecated connection option from the rails dbconsole command.

Removes deprecated rake notes tasks.

Removes access to values in nested hashes returned by Rails.application.config_for via String keys.

Changes form_with to generate non-remote forms by default.

Environment config files can now modify autoload_paths, autoload_once_paths, and eager_load_paths, so autoloading within those files no longer works.

Removes the deprecated Module#reachable? method.

Removes the deprecated #acronym_regex method from Inflections.

Renames Module#parent, #parents and #parent_name to module_parent, module_parents and module_parent_name.

Removes deprecated #set_state from the transaction object.

Removes deprecated #supports_statement_cache? from the database adapters.

Removes deprecated #insert_fixtures from the database adapters.

Removes deprecated ActiveRecord::ConnectionAdapters::SQLite3Adapter#valid_alter_table_type?.

Removes delegation of missing methods in a relation to arel.

Removes delegation of missing methods in a relation to private methods of the class.

Removes the ability to specify a timestamp name for #cache_key.

Removes deprecated ActiveRecord::Migrator.migrations_path=.

Removes deprecated expand_hash_conditions_for_aggregates.

Removes the deprecated image_alt helper.

Removes ActionView::Helpers::RecordTagHelper.

Removes the deprecated fragment_cache_key helper in favor of combined_fragment_cache_key.

Removes deprecated ActionDispatch::TestResponse methods #success?, missing? and error?.

Remove support for the Qu gem, which has been incompatible since Rails 5.1 and is no longer maintained.

Removes the deprecated after_bundle helper inside plugin templates.

Removes deprecated support for old config.ru files that pass the application class as an argument to run.

Removes the deprecated environment argument from the rails commands.

Removes the deprecated capify! method.

Removes the deprecated config.secret_token setting.

ActiveSupport::Callbacks#halted_callback_hook now receives the halted callback name as a second argument.

ActiveSupport::Duration.build now raises TypeError unless value is Numeric.

Encapsulates each validation error as an Error object, changing the errors collection from a messages/details hash.

where.not now generates NAND predicates instead of NOR.

connects_to can now only be called on ActiveRecord::Base or abstract classes.

All connection adapters' execute now raises ActiveRecord::ConnectionNotEstablished instead of ActiveRecord::StatementInvalid on connection errors.

Mysql2Adapter#quote_string now raises ActiveRecord::ConnectionNotEstablished instead of ActiveRecord::StatementInvalid when it cannot connect.

Calling connected_to on subclasses of ActiveRecord::Base is now disallowed.

Freezes the database configurations hash to disallow mutations; use the DatabaseConfig object directly instead.

Requires ActionView::Base subclasses to implement #compiled_method_container.

Makes the locals argument required on ActionView::Template#initialize.

Changes ActionDispatch::Response#content_type to return the full Content-Type header.

fixture_file_upload now uses paths relative to file_fixture_path instead of fixture_path.

Stops running after_enqueue and after_perform callbacks when the callback chain is halted, opt-in until Rails 6.2.

ActiveSupport::Callbacks#halted_callback_hook now receives the halted callback name as a second argument.

ActiveSupport::Duration.build now raises TypeError unless value is Numeric, instead of building durations from Strings.

Encapsulates each validation error as an ActiveModel::Error object, changing the errors collection from a messages/details hash.

Rails raises ActiveRecord::ReadOnlyError if any connection on the reading handler attempts a write.

Ensures :reading connections always raise ActiveRecord::ReadOnlyError if a write is attempted.

Does not allow passing the column name to sum when a block is passed.

Moves ActiveRecord::StatementInvalid SQL to an error property and includes binds as a separate error property.

Defining an enum as a Hash with a blank key or an Array with a blank value now raises an ArgumentError.

Enum raises an ArgumentError on invalid definition values; only a Hash, array of Symbols or array of Strings are allowed.

Changes ActiveRecord::Base.configurations to return an object instead of a hash, with hash-like methods deprecated and a new configs_for method.

ActionCable JavaScript package is converted to ES2015 with breaking changes to adapter configuration and debugging methods.

Avoids regex backtracking in HTTP Token authentication in Action Pack.

Avoids regex backtracking in query parameter filtering in Action Pack.

Avoids regex backtracking in the block_format helper in Action Mailer.

Avoids regex backtracking in plain_text_for_blockquote_node in Action Text.

Includes the HTTP Permissions-Policy header on non-HTML Content-Types.

Uses a temporary file for storing unencrypted files while editing, addressing CVE-2023-38037.

Raises an exception if illegal characters are provided to redirect_to.

Implements SafeBuffer#bytesplice to address CVE-2023-28120.

Ignores certain data-* attributes in rails-ujs when the element is contenteditable, addressing CVE-2023-23913.

Avoids regex backtracking in Inflector.underscore.

Adds an integer width check to PostgreSQL::Quoting, configurable via ActiveRecord::Base.raise_int_wider_than_64bit which defaults to true.

Avoids regex backtracking on the If-None-Match header.

Uses string#split instead of regex for domain parts.

Prevents open redirects by correctly escaping the host allow list.

Makes sanitize_as_sql_comment more strict to prevent sanitization bypass with crafted input (CVE-2023-22794).

Changes ActiveRecord::Coders::YAMLColumn default to safe_load, addressing CVE-2022-32224.

Fixes and adds XSS protections in ActionView::Helpers and ERB::Util, adding ERB::Util.xml_name_escape to escape dangerous characters in tag and attribute names per the XML spec.

Fixes and adds XSS protections in Action View tag helpers by escaping dangerous characters in tag and attribute names per XML, and renames the :escape_attributes option to :escape.

Adds configurable allow-list validation for Active Storage image transformation methods, alongside the existing deny-list for arguments.

Fixes a case where middleware is not told the response body is fully closed, so request state is not fully reset before the next request.

Fixes X_FORWARDED_HOST protection in Action Pack.

Prevents catastrophic backtracking during mime parsing.

Prevents regex denial of service in HTTP token authentication.

Prevents string polymorphic route arguments in url_for to avoid unwanted route helper calls.

Fixes a possible DoS vector in the PostgreSQL money type by correcting the regexp used to validate money format.

Prevents an open redirect when the allowed host starts with a dot.

Prevents XSS in Actionable Exceptions (CVE-2020-8264).

Only allows ActionableErrors when show_detailed_exceptions is enabled, addressing CVE-2020-8185.

Deprecates Marshal.load on raw cache reads in RedisCacheStore due to CVE-2020-8165.

Avoids Marshal.load on raw cache values in MemCacheStore due to CVE-2020-8165.

Checks that requests are same-origin before including the CSRF token in XHRs due to CVE-2020-8167.

HMACs the raw CSRF token before masking it so it cannot reconstruct a per-form token, per CVE-2020-8166.

Returns self from #each, #each_pair, and #each_value instead of the raw @parameters hash, per CVE-2020-8164.

Includes Content-Length in the signature for ActiveStorage direct uploads due to CVE-2020-8162.

Fixes a possible XSS vector in the escape_javascript helper (CVE-2020-5267).

Fixes a possible information leak and session hijacking vulnerability, tracked as CVE-2019-16782.

Introduces ActionDispatch::HostAuthorization middleware to guard against DNS rebinding and Host header attacks.

Rails 6 requires Ruby 2.5.0 or newer.

Deprecates ActiveSupport::Multibyte::Unicode.default_normalization_form.

Deprecates config.active_support.use_sha1_digests in favour of config.active_support.hash_digest_class = ::Digest::SHA1.

Deprecates URI.parser, to be removed in Rails 6.2; use URI::DEFAULT_PARSER instead.

Documents require_dependency as obsolete in :zeitwerk mode and encourages not using it.

Deprecates using Range#include? to check inclusion in a date time range; recommends Range#cover? instead.

Deprecates marshalling load from the legacy attributes format.

Deprecates ActiveRecord::Base.allow_unsafe_raw_sql.

Deprecates rails db:structure:{load, dump} tasks and extends db:schema:{load, dump} to handle :ruby or :sql formats.

Deprecates YAML loading from legacy format older than Rails 5.0.

Deprecates map! and collect! on ActiveRecord::Result.

Deprecates passing an Active Record object to quote/type_cast directly.

Deprecates aggregations with group by duplicated fields; use uniq!(:group) to deduplicate group fields.

Deprecates duplicated query annotations; use uniq!(:annotate) to deduplicate query annotations.

Deprecates passing a column to type_cast.

Deprecates in_clause_length and allowed_index_name_length in DatabaseLimits.

Deprecates using return, break or throw to exit a transaction block after writes.

Deprecates spec_name in favor of name on database configurations.

Deprecates #remove_connection on the handler in favor of #remove_connection_pool; #remove_connection will be removed in 6.2.

Deprecates #default_hash and its alias #[] on database configurations; use configs_for instead, removal in 6.2.

Deprecates "primary" as the connection_specification_name for ActiveRecord::Base in favor of "ActiveRecord::Base".

Deprecates connection_config in favor of connection_db_config, which returns a DatabaseConfig instead of a Hash.

Deprecates the database kwarg without replacement; use connects_to for new connections.

Deprecates DatabaseConfigurations#to_h; connection hashes remain available via ActiveRecord::Base.configurations.configs_for.

Adds DatabaseConfig#configuration_hash with symbol keys and deprecates DatabaseConfig#config.

Deprecates .reorder(nil) with .first / .first! taking non-deterministic results; use .take / .take! instead.

Deprecates config.action_view.raise_on_missing_translations in favor of config.i18n.raise_on_missing_translations.

Deprecates config.action_dispatch.return_only_media_type_on_content_type.

Deprecates config.active_job.return_false_on_aborted_enqueue.

Deprecates Variant#service_url and Preview#service_url in favour of #url.

Deprecates action_mailbox api_key and MAILGUN_INGRESS_API_KEY in favor of signing_key and MAILGUN_INGRESS_SIGNING_KEY.

The classic autoloader starts its deprecation cycle; new projects should use zeitwerk and existing ones should switch.

Deprecates Rails::DBConsole#config without replacement; use Rails::DBConsole.db_config.configuration_hash instead.

Documents require_dependency as obsolete in :zeitwerk mode and encourages not using it.

Deprecates spec_name in favor of name on database configurations, including accessors on configs_for and DatabaseConfig.

Deprecates #remove_connection in favor of #remove_connection_pool when called on the handler; removal planned for 6.2.

Deprecates #default_hash and its alias #[] on database configurations; use configs_for instead, removal planned for 6.2.

Deprecates .reorder(nil) with .first / .first! taking a non-deterministic result; use .take / .take! instead.

Deprecates Variant#service_url and Preview#service_url in favour of #url.

Starts the deprecation cycle for the classic autoloader, recommending zeitwerk mode instead.

Deprecates Rails::DBConsole#config without replacement, pointing to Rails::DBConsole.db_config.configuration_hash.

Soft deprecates the database kwarg in connected_to by removing its documentation.

Correctly deprecates where.not working as NOR for relations.

Deprecates Unicode#pack_graphemes and Unicode#unpack_graphemes in favor of native String methods.

Deprecates ActiveSupport::Multibyte::Chars.consumes? in favor of String#is_utf8?.

Deprecates Unicode#normalize and Chars#normalize in favor of String#unicode_normalize.

Deprecates Unicode#downcase, #upcase and #swapcase in favor of the String equivalents.

Deprecates the use of LoggerSilence in favor of ActiveSupport::LoggerSilence.

Deprecates using negative limits in String#first and String#last.

Deprecates config.activerecord.sqlite3.represent_boolean_as_integer.

Deprecates passing migrations_paths to connection.assume_migrated_upto_version.

Deprecates ActiveRecord::Result#to_hash in favor of ActiveRecord::Result#to_a.

Deprecates DatabaseLimits methods column_name_length, table_name_length, columns_per_table, indexes_per_table, columns_per_multicolumn_index, sql_query_length and joins_per_query.

Deprecates update_attributes/update_attributes! in favor of update/update!.

Deprecates calling private model methods from view helpers such as options_from_collection_for_select and collection_select.

Deprecates ActionDispatch::Http::ParameterFilter in favor of ActiveSupport::ParameterFilter.

Deprecates controller level force_ssl in favor of config.force_ssl.

Deprecate ActionMailer::Base.receive in favor of Action Mailbox.

Add MailDeliveryJob for regular and parameterized mail, deprecating DeliveryJob and Parameterized::DeliveryJob.

Replaces config.active_storage.queue with config.active_storage.queues.analysis and config.active_storage.queues.purge; the old option is deprecated.

Deprecates rake routes in favor of rails routes.

Deprecates rake initializers in favor of rails initializers.

Deprecates rake dev:cache in favor of rails dev:cache.

Deprecates rails notes subcommands in favor of passing an annotations argument to rails notes.

Deprecates the SOURCE_ANNOTATION_DIRECTORIES environment variable in favor of config.annotations.register_directories.

Deprecates rake notes in favor of rails notes.

Deprecates using the HOST environment variable to specify the server IP in favor of BINDING.

Deprecates passing the Rack server name as a regular argument to rails server in favor of the --using/-u option.