Active Support ActiveSupport::MessagePack no longer deserializes an unsafe ActiveSupport::SafeBuffer as html_safe. A SafeBuffer that was no longer html_safe?, for example after an in-place gsub!, was deserialized as an html_safe SafeBuffer. It is now serialized with an unsafe marker and deserialized as a String. Earlier versions of Rails cannot read an unsafe buffer serialized this way. [GHSA-2w9f…
Active Support ActiveSupport::Inflector#safe_constantize matches the constant name in a LoadError message as a literal string instead of building a Regexp from it. The name's segments were interpolated unescaped into the pattern, so input that reaches safe_constantize, such as the channel identifier in an Action Cable subscribe command, chose the source passed to the regexp compiler. [GHSA-8474-xr…
Active Support Improve number_to_delimited performance when delimiter_pattern is not specified. Shinichi Maeshima Silence Dalli 4.0+ warning when using ActiveSupport::Cache::MemCacheStore. zzak Fix ActiveSupport::Inflector.humanize with international characters. ActiveSupport::Inflector.humanize("áÉÍÓÚ") # => "Áéíóú" ActiveSupport::Inflector.humanize("аБВГДЕ") # => "Абвгде" Jose Luis Duran Active…
Active Support Fix the debug error page rendering for SyntaxErrors with multi-line messages. Marco Roth Make ActiveSupport::JSON.decode compatible with the upcoming json 3.0 gem. Earlopain Fix number_to_human_size crashing for sizes above a terabyte by supporting petabyte, exabyte, and zettabyte storage units. Kenta Ishizaki Fix Range#sole raising NoMethodError when the enumerable core extension i…
Active Support No changes. Active Model No changes. Active Record No changes. Action View No changes. Action Pack No changes. Active Job No changes. Action Mailer No changes. Action Cable No changes. Active Storage Disable libvips's unfuzzed image loaders and savers. libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active St…
Active Support No changes. Active Model No changes. Active Record No changes. Action View No changes. Action Pack No changes. Active Job No changes. Action Mailer No changes. Action Cable No changes. Active Storage Disable libvips's unfuzzed image loaders and savers. libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active St…
Active Support No changes. Active Model No changes. Active Record No changes. Action View No changes. Action Pack No changes. Active Job No changes. Action Mailer No changes. Action Cable No changes. Active Storage Disable libvips's unfuzzed image loaders and savers. libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active St…
Active Support Fix JSONGemCoderEncoder to correctly serialize custom object hash keys. When hash keys are custom objects whose as_json returns a Hash, the encoder now calls to_s on the original key object instead of on the as_json result. Before: hash = {CustomKey.new(123) => "value"} hash.to_json # => {"{:id=>123}":"value"} After: hash.to_json # => {"custom_123":"value"} Dan Sharp Fix inflections…
Active Support Fix inflections to better handle overlapping acronyms. ActiveSupport::Inflector.inflections(:en) do |inflect| inflect.acronym "USD" inflect.acronym "USDC" end "USDC".underscore # => "usdc" Said Kaldybaev Silence Dalli 4.0+ warning when using ActiveSupport::Cache::MemCacheStore. zzak Make delegate and delegate_missing_to work in BasicObject subclasses. Rafael Mendonça França Fix Acti…
Active Support Reject scientific notation in NumberConverter [CVE-2026-33176] Jean Boussier Fix SafeBuffer#% to preserve unsafe status [CVE-2026-33170] Jean Boussier Improve performance of NumberToDelimitedConverter [CVE-2026-33169] Jean Boussier Active Model No changes. Active Record No changes. Action View Skip blank attribute names in tag helpers to avoid generating invalid HTML. [CVE-2026-3316…
Active Support Reject scientific notation in NumberConverter [CVE-2026-33176] Jean Boussier Fix SafeBuffer#% to preserve unsafe status [CVE-2026-33170] Jean Boussier Improve performance of NumberToDelimitedConverter [CVE-2026-33169] Jean Boussier Active Model No changes. Active Record No changes. Action View Skip blank attribute names in tag helpers to avoid generating invalid HTML. [CVE-2026-3316…
Active Support Reject scientific notation in NumberConverter [CVE-2026-33176] Jean Boussier Fix SafeBuffer#% to preserve unsafe status [CVE-2026-33170] Jean Boussier Improve performance of NumberToDelimitedConverter [CVE-2026-33169] Jean Boussier Active Model No changes. Active Record No changes. Action View Skip blank attribute names in tag helpers to avoid generating invalid HTML. [CVE-2026-3316…
Active Support Make delegate and delegate_missing_to work in BasicObject subclasses. Rafael Mendonça França Fix Inflectors when using a locale that fallbacks to :en. Said Kaldybaev Fix ActiveSupport::TimeWithZone#as_json to consistently return UTF-8 strings. Previously the returned string would sometime be encoded in US-ASCII, which in some cases may be problematic. Now the method consistently alw…
Active Support No changes. Active Model No changes. Active Record No changes. Action View Respect remove_hidden_field_autocomplete config in form builder hidden_field. Rafael Mendonça França Action Pack Allow methods starting with underscore to be action methods. Disallowing methods starting with an underscore from being action methods was an unintended side effect of the performance optimization…
Active Support Fix Enumerable#sole to return the full tuple instead of just the first element of the tuple. Olivier Bellone Fix parallel tests hanging when worker processes die abruptly. Previously, if a worker process was killed (e.g., OOM killed, kill -9) during parallel test execution, the test suite would hang forever waiting for the dead worker. Joshua Young Fix NameError when class_attribute…
Active Support Fix Enumerable#sole to return the full tuple instead of just the first element of the tuple. Olivier Bellone Fix parallel tests hanging when worker processes die abruptly. Previously, if a worker process was killed (e.g., OOM killed, kill -9) during parallel test execution, the test suite would hang forever waiting for the dead worker. Joshua Young ActiveSupport::FileUpdateChecker d…
Active Support No changes. Active Model No changes. Active Record Gracefully handle Timeout.timeout firing during connection configuration. Use of Timeout.timeout could result in improperly initialized database connection. This could lead to a partially configured connection being used, resulting in various exceptions, the most common being with the PostgreSQLAdapter raising undefined method key?'…