Upgrading rails 7 to 8

Removes deprecated support for passing a Time object to Time#since.

Removes the deprecated Benchmark.ms method, now defined in the benchmark gem.

Removes deprecated addition of Time instances with ActiveSupport::TimeWithZone.

Removes deprecated support for to_time preserving the system local time; it now always preserves the receiver timezone.

Removes deprecated :unsigned_float and :unsigned_decimal column methods for MySQL.

Removes deprecated :retries option for the SQLite3 adapter.

Raises ActiveRecord::MissingRequiredOrderError for order dependent finders without order values, enabled by a new Rails 8.1 framework default.

Removes deprecated support to route to multiple paths.

Removes deprecated support for using semicolons as a query string separator.

Removes deprecated support for skipping over leading brackets in parameter names in the parameter parser.

Removes support for setting ActiveJob::Base.enqueue_after_transaction_commit to :never, :always and :default.

Removes the deprecated Rails.application.config.active_job.enqueue_after_transaction_commit config.

Removes the deprecated :azure storage service.

Removes deprecated STATS_DIRECTORIES.

Removes the deprecated bin/rake stats command.

Removes the deprecated rails/console/methods.rb file.

Rails no longer generates a bin/bundle binstub when creating new applications, since the mechanism is now part of Rubygem itself.

Removes deprecated support for passing an array of strings to ActiveSupport::Deprecation#warn.

Removes deprecated support for setting attr_internal_naming_format with a @ prefix.

Removes deprecated ActiveSupport::ProxyObject.

Removes deprecated support for setting ENV["SCHEMA_CACHE"].

Removes deprecated support for passing a database name to cache_dump_filename.

Removes deprecated ActiveRecord::ConnectionAdapters::ConnectionPool#connection.

Removes deprecated config.active_record.sqlite3_deprecated_warning.

Removes deprecated config.active_record.warn_on_records_fetched_greater_than.

Removes deprecated support for defining enum with keyword arguments.

Removes deprecated support for finding database adapters not registered to Active Record.

Removes deprecated config.active_record.allow_deprecated_singular_associations_name.

Removes deprecated config.active_record.commit_transaction_on_non_local_return.

Deletes the deprecated constant ActiveRecord::ImmutableRelation.

Removes deprecated support for passing content to void tag elements on the tag builder.

Removes deprecated support for passing nil to the model: argument of form_with.

Removes Rails.application.config.action_controller.allow_deprecated_parameters_hash_equality.

Removes deprecated config.active_job.use_big_decimal_serializer.

Removes deprecated support for extending the Rails console through Rails::ConsoleMethods.

Removes the deprecated file rails/console/helpers.

Removes the deprecated file rails/console/app.

Removes deprecated config.read_encrypted_secrets.

Always clears CurrentAttributes instances, abandoning them at request end and creating new ones per request.

Makes :class_name invalid in polymorphic belongs_to associations.

Raises AbstractController::DoubleRenderError if head is called after rendering.

A route pointing to a non-existing controller now returns a 500 instead of a 404.

Removes the deprecated internal SuckerPunch adapter in favor of the adapter included with the sucker_punch gem.

Makes :class_name invalid in polymorphic belongs_to associations.

Raises AbstractController::DoubleRenderError when head is called after rendering.

Removes the deprecated internal SuckerPunch adapter in favor of the adapter included with the sucker_punch gem.

Prevents glob injection in DiskService#delete_prefixed by escaping glob metacharacters, breaking code that relied on glob expansion.

Fixes HashWithIndifferentAccess#stringify_keys to stringify all keys, not just symbols.

Limits the size of strings ActiveModel::Type::Integer coerces with to_i to prevent a DoS vector.

Filters the database password out of failed db: task command error messages.

Fixes possible XSS in DebugExceptions middleware.

Rate limits password resets in the authentication generator to mitigate abuse from attackers spamming the password reset form.

Disables libvips unfuzzed image loaders and savers via Vips.block_untrusted(true) at boot, raising Vips::Error for affected transformations.

Rejects scientific notation in NumberConverter.

Fixes SafeBuffer#% to preserve unsafe status.

Improves performance of NumberToDelimitedConverter.

Skips blank attribute names in tag helpers to avoid generating invalid HTML.

Filters user supplied metadata in DirectUploadController.

Adds a configurable maximum streaming chunk size, defaulting to 100mb for blob byte ranges.

Limits range requests to a single range.

Prevents path traversal in DiskService; path_for raises InvalidKeyError for dot segments or paths outside the storage root.

Calls inspect on ids in RecordNotFound error messages, addressing CVE-2025-55193.

Removes dangerous transformations in Active Storage, addressing CVE-2025-24293.

Adds validation to content security policies to disallow spaces and semicolons.

Sets Regexp.timeout to 1 second by default to mitigate Regexp Denial-of-Service attacks.

Raises minimum supported libvips to 8.13 and ruby-vips to 2.2.1, raising RuntimeError at boot when ruby-vips is installed and unmet.

Raises minimum supported libvips to 8.13 and ruby-vips to 2.2.1, raising RuntimeError at boot when ruby-vips is installed and either minimum is unmet.

Deprecates config.active_support.to_time_preserves_timezone.

Deprecates String#mb_chars and ActiveSupport::Multibyte::Chars.

Deprecates ActiveSupport::Configurable.

Deprecates signed_id_verifier_secret on model classes.

Deprecates using insert_all/upsert_all with unpersisted records in associations, which are lost after the operation.

Deprecates update_all with WITH, WITH RECURSIVE or DISTINCT, which were ignored; an error will be raised in a future release.

Deprecates Rails.application.config.action_dispatch.ignore_leading_brackets.

Deprecates the built-in sidekiq adapter; use the sidekiq gem's adapter with sidekiq 7.3.3 or later.

Deprecates String#mb_chars and ActiveSupport::Multibyte::Chars.

Deprecates using insert_all/upsert_all with unpersisted records in associations.

Deprecates using WITH, WITH RECURSIVE or DISTINCT with update_all; an error will be raised in a future release.

Deprecates the built-in sidekiq adapter in favor of the adapter shipped with sidekiq 7.3.3 or later.

Deprecates the Benchmark.ms core extension as the benchmark gem becomes bundled in Ruby 3.5.

Deprecates addition and since between two Time and ActiveSupport::TimeWithZone instances, to be removed in Rails 8.1.

Deprecates unsigned_float and unsigned_decimal short-hand column methods.

Deprecates drawing routes with multiple paths to make routing faster.

Deprecates sucker_punch as an adapter option.

Deprecates ActiveStorage::Service::AzureStorageService.

Deprecates ::STATS_DIRECTORIES in favor of Rails::CodeStatistics.register_directory.

Deprecates bin/rake stats in favor of bin/rails stats.

Deprecates the Benchmark.ms core extension because the benchmark gem becomes bundled in Ruby 3.5.

Deprecates sucker_punch as an Active Job adapter option.

Deprecates the ::STATS_DIRECTORIES constant in favor of Rails::CodeStatistics.register_directory.