Upgrading rails 6 to 7

Removes deprecated support to call deprecation methods without passing a deprecator.

Removes deprecated ActiveSupport::Notifications::Event#children and Event#parent_of?.

Removes deprecated ActiveSupport::Deprecation delegation to instance.

Removes deprecated SafeBuffer#clone_empty.

Removes deprecated #to_default_s from Array, Date, DateTime and Time.

Removes deprecated support to passing Dalli::Client instances to MemCacheStore.

Removes deprecated config.active_support.use_rfc4122_namespaced_uuids.

Removes deprecated config.active_support.remove_deprecated_time_with_zone_name.

Removes deprecated config.active_support.disable_to_s_conversion.

Removes deprecated support to bold log text with positional boolean in ActiveSupport::LogSubscriber#color.

Removes deprecated constants ActiveSupport::LogSubscriber::CLEAR and ActiveSupport::LogSubscriber::BOLD.

Removes deprecated support for config.active_support.cache_format_version = 6.1.

Removes deprecated :pool_size and :pool_timeout options for the cache storage.

Removes deprecated behavior that rolled back a transaction block when exited using return, break or throw.

Removes deprecated support to pass rewhere to ActiveRecord::Relation#merge.

Removes deprecated support to pass deferrable: true to add_foreign_key.

Removes deprecated support to quote ActiveSupport::Duration.

Removes deprecated #quote_bound_value.

Removes deprecated ActiveRecord::ConnectionAdapters::ConnectionPool#connection_klass.

Removes deprecated support for applying connection pool list and clear/flush methods to current role pools without a role argument.

Removes deprecated #all_connection_pools.

Removes deprecated ActiveRecord::ConnectionAdapters::SchemaCache#data_sources.

Removes deprecated ActiveRecord::ConnectionAdapters::SchemaCache.load_from.

Removes deprecated #all_foreign_keys_valid? from database adapters.

Removes deprecated support for passing coder and class as the second argument to serialize.

Removes deprecated support for ActiveRecord::Base#read_attribute(:id) returning the custom primary key value.

Removes deprecated TestFixtures.fixture_path.

Removes deprecated behavior of referring to a singular association by its plural name.

Removes deprecated support for passing SchemaMigration and InternalMetadata classes to ActiveRecord::MigrationContext.

Removes deprecated ActiveRecord::Migration.check_pending! method.

Removes deprecated ActiveRecord::LogSubscriber.runtime method.

Removes deprecated ActiveRecord::LogSubscriber.reset_runtime method.

Removes deprecated support for defining explain in the connection adapter with 2 arguments.

Removes deprecated ActiveRecord::ActiveJobRequiredError.

Removes deprecated ActiveRecord::Base.clear_active_connections!.

Removes deprecated ActiveRecord::Base.clear_reloadable_connections!.

Removes deprecated ActiveRecord::Base.clear_all_connections!.

Removes deprecated ActiveRecord::Base.flush_idle_connections!.

Removes deprecated name argument from ActiveRecord::Base.remove_connection.

Removes deprecated support for calling alias_attribute with non-existent attribute names.

Removes deprecated Rails.application.config.active_record.suppress_multiple_database_warning.

Removes deprecated support for setting Rails.application.config.action_dispatch.show_exceptions to true and false.

Removes deprecated speaker, vibrate, and vr permissions policy directives.

Removes deprecated Rails.application.config.action_dispatch.return_only_request_media_type_on_content_type.

Removes deprecated comparison between ActionController::Parameters and Hash.

Removes deprecated constant AbstractController::Helpers::MissingHelperError.

Removes deprecated constant ActionDispatch::IllegalStateError.

Removes deprecated :exponentially_longer value for :wait in retry_on.

Removes deprecated support for setting numeric values to the scheduled_at attribute.

Removes deprecated primitive serializer for BigDecimal arguments.

Removes deprecated params via :args for assert_enqueued_email_with.

Removes deprecated config.action_mailer.preview_path.

Removes deprecated config.active_storage.silence_invalid_content_types_warning.

Removes deprecated config.active_storage.replace_on_assign_to_many.

Removes oracle, sqlserver and JRuby specific database adapters from rails new and rails db:system:change; supported options are sqlite3, mysql, postgresql and trilogy.

Removes the deprecated find_cmd_and_exec console helper.

Removes deprecated Rails.config.enable_dependency_loading.

Removes deprecated Rails.application.secrets.

Removes deprecated support for the pre-Ruby 2.4 behavior of to_time returning a Time with local timezone.

Renames ActionView::TestCase::Behavior::Content to ActionView::TestCase::Behavior::RenderedViewContent, which now inherits from String.

Renames ActionView::TestCase::Behavior::Content to RenderedViewContent, which now inherits from String and is marked nodoc.

Removes deprecated support for generating incorrect RFC 4122 UUIDs when the namespace ID is not a Digest::UUID constant.

Removes implicit conversion of objects into String by ActiveSupport::SafeBuffer.

Removes the deprecated active_support/core_ext/range/include_time_with_zone file.

Removes the deprecated override of ActiveSupport::TimeWithZone.name.

Removes the deprecated option to pass a format to #to_s in Array, Range, Date, DateTime, Time, BigDecimal, Float and Integer.

Removes deprecated ActiveSupport::PerThreadRegistry.

Removes the deprecated override of Enumerable#sum.

Renames add_unique_key and remove_unique_key to add_unique_constraint and remove_unique_constraint.

Removes deprecated Tasks::DatabaseTasks.schema_file_type.

Removes deprecated config.active_record.partial_writes.

Removes deprecated ActiveRecord::Base config accessors.

Removes the :include_replicas argument from configs_for; use :include_hidden instead.

Moves ActiveRecord::InternalMetadata to an independent object no longer inheriting from ActiveRecord::Base.

Removes ActiveRecord.legacy_connection_handling.

Removes the --no-comments flag in PostgreSQL structure dumps; set structure_dump_flags instead.

Renames add_unique_key and remove_unique_key to add_unique_constraint and remove_unique_constraint.

Removes deprecated Tasks::DatabaseTasks.schema_file_type.

Removes deprecated config.active_record.partial_writes.

Removes deprecated ActiveRecord::Base config accessors.

Removes the :include_replicas argument from configs_for in favor of :include_hidden.

Moves ActiveRecord::InternalMetadata to an independent object that no longer inherits from ActiveRecord::Base.

ActiveRecord::SchemaMigration no longer inherits from ActiveRecord::Base and must be instantiated with a connection.

Changes QueryMethods#in_order_of to drop records not listed in values, matching the Enumerable version.

Removes the deprecated MAILGUN_INGRESS_API_KEY environment variable.

Removes the deprecated Rails.application.credentials.action_mailbox.mailgun_api_key credential.

Removes deprecated ActionMailer::DeliveryJob and ActionMailer::Parameterized::DeliveryJob in favor of ActionMailer::MailDeliveryJob.

Removes deprecated Rails.config.action_view.raise_on_missing_translations.

Removes deprecated support for passing a path to fixture_file_upload relative to fixture_path.

Removes deprecated ActionDispatch::SystemTestCase#host!.

Removes deprecated Rails.config.action_dispatch.hosts_response_app.

Removes deprecated ActionDispatch::Response.return_only_media_type_on_content_type.

Drops support for the SERVER_ADDR header.

Removes the legacy default media=screen from stylesheet_link_tag.

Removes the deprecated :return_false_on_aborted_enqueue option.

Removes deprecated behavior that did not halt after_enqueue/after_perform callbacks when a previous callback was halted with throw :abort.

Removes support for Marshal loading the Rails 5.x ActiveModel::AttributeSet format.

Removes support for Marshal and YAML loading the Rails 5.x error format.

Removes deprecated support for using []= in ActiveModel::Errors#messages.

Removes deprecated support for delete on ActiveModel::Errors#messages.

Removes deprecated support for clear on ActiveModel::Errors#messages.

Removes deprecated support for concatenating errors to ActiveModel::Errors#messages.

Removes deprecated ActiveModel::Errors#to_xml.

Removes deprecated ActiveModel::Errors#keys.

Removes deprecated ActiveModel::Errors#values.

Removes deprecated ActiveModel::Errors#slice!.

Removes deprecated ActiveModel::Errors#to_h.

Removes deprecated enumeration of ActiveModel::Errors instances as a Hash.

Removes deprecated ActiveRecord::DatabaseConfigurations::DatabaseConfig#spec_name.

Removes deprecated ActiveRecord::Connection#in_clause_length.

Removes deprecated ActiveRecord::Connection#allowed_index_name_length.

Removes deprecated ActiveRecord::Base#remove_connection.

Removes deprecated ActiveRecord::Result#map! and ActiveRecord::Result#collect!.

Removes deprecated ActiveRecord::Base.configurations.to_h.

Removes deprecated ActiveRecord::Base.configurations.default_hash.

Removes deprecated ActiveRecord::Base.arel_attribute.

Removes deprecated ActiveRecord::Base.connection_config.

Removes deprecated Tasks::DatabaseTasks.spec.

Removes deprecated Tasks::DatabaseTasks.current_config.

Removes deprecated Tasks::DatabaseTasks.dump_filename.

Removes deprecated Tasks::DatabaseTasks.schema_file.

Removes deprecated environment and name arguments from Tasks::DatabaseTasks.schema_up_to_date?.

Removes deprecated support for Model.reorder(nil).first to search using non-deterministic order.

Removes the deprecated DatabaseConfig#config method.

Removes deprecated support to pass a column to type_cast.

Removes deprecated support to type cast ActiveRecord::Base objects to database values.

Removes deprecated support to quote ActiveRecord::Base objects.

Removes deprecated support to resolve connections using "primary" as the connection specification name.

Removes deprecated support to YAML load ActiveRecord::Base instances in the Rails 4.2 and 4.1 formats.

Removes the deprecated :spec_name option in the configs_for method.

Removes the deprecated ActiveRecord::Base.allow_unsafe_raw_sql setting.

ActiveRecord::Base.logger becomes a class_attribute, so it is no longer accessible via @@logger and subclass assignment no longer affects the parent.

Removes the deprecated database kwarg from connected_to.

Removes deprecated build_after_upload, create_after_upload! and service_url methods.

Removes the deprecated ActiveSupport::Multibyte::Unicode.default_normalization_form.

Removes deprecated support for using Range#include? to check inclusion of a value in a date time range.

Removes the deprecated URI.parser.

Removes the deprecated config.active_support.use_sha1_digests.

Removes the classic autoloader: ActiveSupport::Dependencies no longer installs a const_missing hook.

Deletes the private API of ActiveSupport::Dependencies, including hook!, unhook!, depend_on, require_or_load and mechanism.

Removes the rescue block from ActiveSupport::Cache::RedisCacheStore#handle_exception so errors raised by a custom error_handler are no longer swallowed.

Freezes ActiveSupport::Duration#parts and removes its writer methods, since durations are meant to be immutable value objects.

Removes deprecated config in dbconsole.

Deletes the config.autoloader= setter; zeitwerk is now the only autoloading mode.

Prevents glob injection in DiskService#delete_prefixed by escaping glob metacharacters, breaking code that relied on glob expansion.

Removes deprecated Rails::Generators::Testing::Behaviour.

Raises an error when foreign_key: is passed as an array in associations.

Raises ActiveSupport::MessageEncryptor::InvalidMessage from decrypt_and_verify regardless of cipher.

Raises ArgumentError when accepts_nested_attributes_for is declared more than once for an association in the same class.

ActiveRecord::Base.serialize now takes two distinct keyword arguments instead of one positional argument.

ActiveRecord::Base#signed_id now raises when called on a new record instead of returning an unusable ID.

Raises ActiveRecord::ReadonlyAttributeError on assignment to readonly attributes, configurable via raise_on_assign_to_attr_readonly.

Invalid options passed to migration methods like create_table and add_column now raise an error instead of being silently ignored.

change_column_null now raises when given a non-boolean argument instead of treating it as truthy.

MessageEncryptor#decrypt_and_verify now raises InvalidMessage for all ciphers, not InvalidSignature for non-AEAD ciphers.

ActiveSupport::Deprecation instances now use their own disallowed_warnings; global methods are deprecated.

Raises ArgumentError when accepts_nested_attributes_for is declared more than once for an association in the same class.

Changes ActiveRecord::Base.serialize to accept distinct coder: and type: keyword arguments instead of one positional argument.

ActiveRecord::Base#signed_id now raises if called on a new record instead of returning an unusable ID based on id = nil.

Moves ActiveRecord::SchemaMigration to an independent object.

Reverts the ability to pass a service_name param to DirectUploadsController, introduced in 7.0.0.

Stops transpiling the UMD package generated as actioncable.js and drops IE11 testing that relied on it.

Writing into a disabled session now raises an error instead of silently failing.

ActionDispatch::Request#content_type now returns the Content-Type header as-is including charset; use media_type for just the MIME type.

FormBuilder#button now transforms formmethod attributes into _method form data for varied same-form actions.

UrlHelper#button_to now always renders a button element, whether content is passed as an argument or a block.

Merging conditions on the same column now consistently replaces the earlier condition with the latter.

Removes deprecated rake tasks db:schema:load_if_ruby, db:structure:dump, db:structure:load, db:structure:load_if_sql, db:structure:dump:#{name}, db:structure:load:#{name}…

Deletes private internal classes of ActiveSupport::Dependencies such as Reference and Blamable.

Disallows autoloading reloadable classes or modules during initialization unless wrapped in a to_prepare block.

Fixture configurations (_fixture) are now strictly validated and raise an error on unknown keys instead of silently ignoring them.

Disables libvips unfuzzed image loaders and savers via Vips.block_untrusted(true) at boot, raising Vips::Error for affected transformations.

Rejects scientific notation in NumberConverter.

Fixes SafeBuffer#% to preserve unsafe status.

Improves performance of NumberToDelimitedConverter.

Skips blank attribute names in tag helpers to avoid generating invalid HTML.

Filters user supplied metadata in DirectUploadController.

Adds a configurable maximum streaming chunk size, defaulting to 100mb for blob byte ranges.

Limits range requests to a single range.

Prevents path traversal in DiskService; path_for raises InvalidKeyError for dot segments or paths outside the storage root.

Calls inspect on ids in RecordNotFound error messages.

Removes dangerous transformations in Active Storage.

Sanitizes ActionText HTML ContentAttachment in the Trix edit view.

Fixes ReDoS in Accept header parsing.

Stops ActiveSupport::KeyGenerator#inspect from displaying the secret.

Stops ActiveSupport::MessageEncryptor#inspect from displaying the secret.

Stops EncryptedConfiguration#inspect from displaying configuration contents and key file contents.

Stops showing secrets in ActiveRecord::Encryption::Cipher::Aes256Gcm#inspect output.

Stops ActiveRecord::Encryption::Cipher::Aes256Gcm#inspect from showing the secret.

Adds validation to content security policies to disallow spaces and semicolons.

Avoids regex backtracking in HTTP Token authentication.

Avoids regex backtracking in query parameter filtering.

Avoids regex backtracking in the block_format helper.

Avoids backtracking in plain_text_for_blockquote_node.

Includes the HTTP Permissions-Policy header on non-HTML content types.

Upgrades Trix to 1.3.2 to fix CVE-2024-34341.

Fixes a possible XSS vulnerability with the translate method in controllers (CVE-2024-26143).

Uses a temporary file for storing unencrypted files while editing, addressing CVE-2023-38037.

Raises an exception if illegal characters are provided to redirect_to.

Implements SafeBuffer#bytesplice to address CVE-2023-28120.

Ignores certain data-* attributes in rails-ujs when the element is contenteditable, addressing CVE-2023-23913.

Avoids regex backtracking in Inflector.underscore.

Makes sanitize_as_sql_comment more strict by escaping comment delimiters and stripping one surrounding comment.

Adds an integer width check to PostgreSQL::Quoting, configurable via ActiveRecord::Base.raise_int_wider_than_64bit (default true).

Fixes a security issue in _url_host_allowed? by disallowing certain strings to prevent redirects to malicious sites.

Avoids regex backtracking when parsing the If-None-Match header.

Uses string#split instead of regex for domain parts.

Changes ActiveRecord::Coders::YAMLColumn default to safe_load, addressing CVE-2022-32224.

Adds XSS protections in ActionView::Helpers and ERB::Util, including new ERB::Util.xml_name_escape for tag and attribute names.

Escapes dangerous characters in tag helper tag and attribute names per XML spec, and renames the :escape_attributes option to :escape.

Adds image transformation validation via a configurable allow-list for Active Storage variants, plus a deny-list for arguments.

Fixes a case where the middleware is not told the response body is fully closed, so request state is not fully reset before the next request.

Uses a static error message when raising ActionDispatch::Http::Parameters::ParseError to avoid logging malformed JSON request bodies.

Casts numbers and booleans bind parameters to string in the MySQL adapter to prevent implicit cast vulnerabilities.

Fixes X_FORWARDED_HOST protection in Action Pack.

Requires libvips 8.13 or later and ruby-vips 2.2.1 or later when ruby-vips is installed, raising RuntimeError at boot otherwise.

Deprecates ActiveSupport::ProxyObject in favor of Ruby's built-in BasicObject.

Deprecates ActiveRecord::ImmutableRelation in favor of ActiveRecord::UnmodifiableRelation.

Deprecates the association option query_constraints in favor of foreign_key.

Deprecates ActiveRecord::Base.connection in favor of .lease_connection as a soft deprecation.

Deprecates ActiveRecord::ConnectionAdapters::ConnectionPool#connection in favor of lease_connection.

Deprecates Rails.application.config.active_record.commit_transaction_on_non_local_return.

Deprecates Rails.application.config.active_record.allow_deprecated_singular_associations_name.

Deprecates ENV["SCHEMA_CACHE"] in favor of schema_cache_path in the database configuration.

Deprecates config.active_record.warn_on_records_fetched_greater_than since sql.active_record now includes :row_count.

Deprecates defining an enum with keyword arguments.

Deprecates passing strings to ActiveRecord::Tasks::DatabaseTasks.cache_dump_filename.

Deprecates passing nil as the value for the model: argument to form_with.

Deprecates passing content to void elements when using tag.br type tag builders.

Deprecates Rails.application.config.action_controller.allow_deprecated_parameters_hash_equality.

Deprecates Rails.application.config.active_job.use_big_decimal_serialize.

Deprecates config.active_support.to_time_preserves_timezone.

Deprecates DateAndTime::Compatibility.preserve_timezone.

Deprecates SafeBuffer#clone_empty, which has not been used internally since Rails 4.2.0.

Deprecates usage of the singleton ActiveSupport::Deprecation, including Module.deprecate and related proxies and test assertions without a deprecator argument.

Deprecates config.active_support.use_rfc4122_namespaced_uuids.

Deprecates config.active_support.remove_deprecated_time_with_zone_name.

Deprecates config.active_support.disable_to_s_conversion.

Deprecates initializing ActiveSupport::Cache::MemCacheStore with an instance of Dalli::Client.

Deprecates the :pool_size and :pool_timeout options for cache store connection pooling in favor of :pool.

Deprecates preserving the pre-Ruby 2.4 behavior of to_time; warning appears only when the setting is false.

Deprecates Notification::Event's #children and #parent_of? methods.

Deprecates the rewhere argument on merge, to be removed in Rails 7.2.

Deprecates read_attribute(:id) returning the primary key when the primary key is not :id.

Deprecates the name argument on #remove_connection without replacement.

Deprecates check_pending! in favor of check_all_pending!, which checks all database configurations in the environment.

Deprecates the deferrable: true option of add_foreign_key in favor of deferrable: :immediate, to be removed in Rails 7.2.

Deprecates delegation from Base to connection_handler for clear_all_connections!, clear_active_connections!, clear_reloadable_connections! and flush_idle_connections!.

Deprecates config.active_record.suppress_multiple_database_warning.

Deprecates quoting ActiveSupport::Duration as an integer in SQL string templates.

Deprecates all_connection_pools and makes connection_pool_list require an explicit role or :all.

Adds a configurable deprecation warning for using plural names of singular associations in where, with an opt-in faster behavior.

Sets scheduled_at as a Time object and deprecates assigning numeric/epoch values; enqueued_at deserializes as Time.

Deprecates SafeBuffer#clone_empty, which has not been used internally since Rails 4.2.0.

Deprecates usage of the singleton ActiveSupport::Deprecation and deprecator-less deprecation calls.

Deprecates :pool_size and :pool_timeout options for cache store connection pooling.

Deprecates the rewhere argument on #merge without replacement; it will be removed in Rails 7.2.

Deprecates read_attribute(:id) returning the primary key when the primary key is not :id.

Deprecates the name argument on #remove_connection without replacement; call it on the class that established the connection.

Deprecates check_pending! in favor of check_all_pending!.

Introduces TestFixtures#fixture_paths for multiple fixture paths and deprecates TestFixtures#fixture_path.

Deprecates delegation from Base to connection_handler for connection clearing and flushing methods.

Deprecates quoting ActiveSupport::Duration as an integer in SQL string templates.

Deprecates all_connection_pools and makes connection_pool_list require an explicit role or :all.

Adds a deprecation warning for using plural names of singular associations in where, with an opt-in config.

Renames action_cable.js to actioncable.js to match other Rails frameworks, with a JS console deprecation notice.

Deprecates Rails.application.config.action_controller.urlsafe_csrf_tokens, which is now always enabled.

Deprecates poltergeist and webkit driver registration for system testing, to be removed in Rails 7.1, and adds cuprite.

Deprecates assigning a single value to config.action_dispatch.trusted_proxies because RemoteIp middleware behaves inconsistently.

Deprecates assigning render locals to instance variables.

Deprecates Rails.config.active_job.skip_after_callbacks_if_terminated.

Deprecates Tasks::DatabaseTasks.schema_file_type.

Deprecates partial_writes in favor of partial_inserts and partial_updates.

Deprecates legacy_connection_handling.

Deprecates invalid default content types image/jpg, image/pjpeg, image/bmp and text/javascript, to be removed in Rails 7.1.

Deprecates ActiveStorage::Current.host in favor of ActiveStorage::Current.url_options.

Deprecates config.active_storage.replace_on_assign_to_many; future versions behave as when set to true.

Deprecates usage of purge and purge_later from the association extension.

Deprecates passing a format to #to_s in favor of #to_formatted_s on Array, Range, Date, DateTime, Time, BigDecimal, Float and Integer.

Deprecates ActiveSupport::DescendantsTracker.direct_descendants and #direct_descendants as it now mostly delegates to Class#descendants on Ruby 3.1.

Deprecates ActiveSupport::SafeBuffer's incorrect implicit conversion of objects into strings via #to_s instead of requiring #to_str.

Deprecates ActiveSupport::TimeWithZone.name so that from Rails 7.1 it will use the default implementation.

Deprecates Rails custom Enumerable#sum and Array#sum in favor of Ruby's native implementation, which requires an initializer for non-numeric types.

Removes Rack::Runtime from the default middleware stack and deprecates referencing it in middleware operations without adding it back.

Deprecates ActiveSupport::DescendantsTracker.direct_descendants and #direct_descendants as the tracker now mostly delegates to Class#descendants on Ruby 3.1.

Deprecates invalid default content types image/jpg, image/pjpeg, image/bmp and text/javascript, to be removed in Rails 7.1.