Active Support No changes. Active Model No changes. Active Record No changes. Action View No changes. Action Pack No changes. Active Job No changes. Action Mailer No changes. Action Cable No changes. Active Storage Disable libvips's unfuzzed image loaders and savers. libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active St…
Active Support No changes. Active Model No changes. Active Record No changes. Action View No changes. Action Pack No changes. Active Job No changes. Action Mailer No changes. Action Cable No changes. Active Storage Disable libvips's unfuzzed image loaders and savers. libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active St…
Active Support No changes. Active Model No changes. Active Record No changes. Action View No changes. Action Pack No changes. Active Job No changes. Action Mailer No changes. Action Cable No changes. Active Storage Disable libvips's unfuzzed image loaders and savers. libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active St…
Active Support Fix JSONGemCoderEncoder to correctly serialize custom object hash keys. When hash keys are custom objects whose as_json returns a Hash, the encoder now calls to_s on the original key object instead of on the as_json result. Before: hash = {CustomKey.new(123) => "value"} hash.to_json # => {"{:id=>123}":"value"} After: hash.to_json # => {"custom_123":"value"} Dan Sharp Fix inflections…
Active Support Fix inflections to better handle overlapping acronyms. ActiveSupport::Inflector.inflections(:en) do |inflect| inflect.acronym "USD" inflect.acronym "USDC" end "USDC".underscore # => "usdc" Said Kaldybaev Silence Dalli 4.0+ warning when using ActiveSupport::Cache::MemCacheStore. zzak Make delegate and delegate_missing_to work in BasicObject subclasses. Rafael Mendonça França Fix Acti…
Active Support Reject scientific notation in NumberConverter [CVE-2026-33176] Jean Boussier Fix SafeBuffer#% to preserve unsafe status [CVE-2026-33170] Jean Boussier Improve performance of NumberToDelimitedConverter [CVE-2026-33169] Jean Boussier Active Model No changes. Active Record No changes. Action View Skip blank attribute names in tag helpers to avoid generating invalid HTML. [CVE-2026-3316…
Active Support Reject scientific notation in NumberConverter [CVE-2026-33176] Jean Boussier Fix SafeBuffer#% to preserve unsafe status [CVE-2026-33170] Jean Boussier Improve performance of NumberToDelimitedConverter [CVE-2026-33169] Jean Boussier Active Model No changes. Active Record No changes. Action View Skip blank attribute names in tag helpers to avoid generating invalid HTML. [CVE-2026-3316…
Active Support Reject scientific notation in NumberConverter [CVE-2026-33176] Jean Boussier Fix SafeBuffer#% to preserve unsafe status [CVE-2026-33170] Jean Boussier Improve performance of NumberToDelimitedConverter [CVE-2026-33169] Jean Boussier Active Model No changes. Active Record No changes. Action View Skip blank attribute names in tag helpers to avoid generating invalid HTML. [CVE-2026-3316…
Active Support Make delegate and delegate_missing_to work in BasicObject subclasses. Rafael Mendonça França Fix Inflectors when using a locale that fallbacks to :en. Said Kaldybaev Fix ActiveSupport::TimeWithZone#as_json to consistently return UTF-8 strings. Previously the returned string would sometime be encoded in US-ASCII, which in some cases may be problematic. Now the method consistently alw…
Active Support No changes. Active Model No changes. Active Record No changes. Action View Respect remove_hidden_field_autocomplete config in form builder hidden_field. Rafael Mendonça França Action Pack Allow methods starting with underscore to be action methods. Disallowing methods starting with an underscore from being action methods was an unintended side effect of the performance optimization…
Active Support Fix Enumerable#sole to return the full tuple instead of just the first element of the tuple. Olivier Bellone Fix parallel tests hanging when worker processes die abruptly. Previously, if a worker process was killed (e.g., OOM killed, kill -9) during parallel test execution, the test suite would hang forever waiting for the dead worker. Joshua Young Fix NameError when class_attribute…
Active Support Fix Enumerable#sole to return the full tuple instead of just the first element of the tuple. Olivier Bellone Fix parallel tests hanging when worker processes die abruptly. Previously, if a worker process was killed (e.g., OOM killed, kill -9) during parallel test execution, the test suite would hang forever waiting for the dead worker. Joshua Young ActiveSupport::FileUpdateChecker d…
Active Support No changes. Active Model No changes. Active Record Gracefully handle Timeout.timeout firing during connection configuration. Use of Timeout.timeout could result in improperly initialized database connection. This could lead to a partially configured connection being used, resulting in various exceptions, the most common being with the PostgreSQLAdapter raising undefined method key?'…