[Snyk] Upgrade @rails/activestorage from 7.1.3 to 7.2.0 #393

INexizI · 2024-08-31T10:00:50Z

Snyk has created this PR to upgrade @rails/activestorage from 7.1.3 to 7.2.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 6 versions ahead of your current version.
The recommended version was released on 21 days ago.

Release notes

Package name: @rails/activestorage

7.2.0 - 2024-08-09
Active Support
- Fix delegate_missing_to allow_nil: true when called with implict self
  
  class Person
  delegate_missing_to :address, allow_nil: true
  
  def address
  nil
  end
  
  def berliner?
  city == "Berlin"
  end
  end
  
  Person.new.city # => nil
  Person.new.berliner? # undefined local variable or method `city' for an instance of Person (NameError)
  
  Jean Boussier
- Add logger as a dependency since it is a bundled gem candidate for Ruby 3.5
  
  Earlopain
- Define Digest::UUID.nil_uuid, which returns the so-called nil UUID.
  
  Xavier Noria
- Support duration type in ActiveSupport::XmlMini.
  
  heka1024
- Remove deprecated ActiveSupport::Notifications::Event#children and ActiveSupport::Notifications::Event#parent_of?.
  
  Rafael Mendonça França
- Remove deprecated support to call the following methods without passing a deprecator:
  - deprecate
  - deprecate_constant
  - ActiveSupport::Deprecation::DeprecatedObjectProxy.new
  - ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy.new
  - ActiveSupport::Deprecation::DeprecatedConstantProxy.new
  - assert_deprecated
  - assert_not_deprecated
  - collect_deprecations
  Rafael Mendonça França
- Remove deprecated ActiveSupport::Deprecation delegation to instance.
  
  Rafael Mendonça França
- Remove deprecated SafeBuffer#clone_empty.
  
  Rafael Mendonça França
- Remove deprecated #to_default_s from Array, Date, DateTime and Time.
  
  Rafael Mendonça França
- Remove deprecated support to passing Dalli::Client instances to MemCacheStore.
  
  Rafael Mendonça França
- Remove deprecated config.active_support.use_rfc4122_namespaced_uuids.
  
  Rafael Mendonça França
- Remove deprecated config.active_support.remove_deprecated_time_with_zone_name.
  
  Rafael Mendonça França
- Remove deprecated config.active_support.disable_to_s_conversion.
  
  Rafael Mendonça França
- Remove deprecated support to bolding log text with positional boolean in ActiveSupport::LogSubscriber#color.
  
  Rafael Mendonça França
- Remove deprecated constants ActiveSupport::LogSubscriber::CLEAR and ActiveSupport::LogSubscriber::BOLD.
  
  Rafael Mendonça França
- Remove deprecated support for config.active_support.cache_format_version = 6.1.
  
  Rafael Mendonça França
- Remove deprecated :pool_size and :pool_timeout options for the cache storage.
  
  Rafael Mendonça França
- Warn on tests without assertions.
  
  ActiveSupport::TestCase now warns when tests do not run any assertions.
  This is helpful in detecting broken tests that do not perform intended assertions.
  
  fatkodima
- Support hexBinary type in ActiveSupport::XmlMini.
  
  heka1024
- Deprecate ActiveSupport::ProxyObject in favor of Ruby's built-in BasicObject.
  
  Earlopain
- stub_const now accepts a exists: false parameter to allow stubbing missing constants.
  
  Jean Boussier
- Make ActiveSupport::BacktraceCleaner copy filters and silencers on dup and clone.
  
  Previously the copy would still share the internal silencers and filters array,
  causing state to leak.
  
  Jean Boussier
- Updating Astana with Western Kazakhstan TZInfo identifier.
  
  Damian Nelson
- Add filename support for ActiveSupport::Logger.logger_outputs_to?.
```
logger = Logger.new('/var/log/rails.log')
ActiveSupport::Logger.logger_outputs_to?(logger, '/var/log/rails.log')
```
  Christian Schmidt
- Include IPAddr#prefix when serializing an IPAddr using the
  ActiveSupport::MessagePack serializer.
  
  This change is backward and forward compatible — old payloads can
  still be read, and new payloads will be readable by older versions of Rails.
  
  Taiki Komaba
- Add default: support for ActiveSupport::CurrentAttributes.attribute.
```
class Current < ActiveSupport::CurrentAttributes
  attribute :counter, default: 0
end
```
  Sean Doyle
- Yield instance to Object#with block.
```
client.with(timeout: 5_000) do |c|
  c.get("/commits")
end
```
  Sean Doyle
- Use logical core count instead of physical core count to determine the
  default number of workers when parallelizing tests.
  
  Jonathan Hefner
- Fix Time.now/DateTime.now/Date.today to return results in a system timezone after #travel_to.
  
  There is a bug in the current implementation of #travel_to:
  it remembers a timezone of its argument, and all stubbed methods start
  returning results in that remembered timezone. However, the expected
  behavior is to return results in a system timezone.
  
  Aleksei Chernenkov
- Add ErrorReported#unexpected to report precondition violations.
  
  For example:
```
def edit
  if published?
    Rails.error.unexpected("[BUG] Attempting to edit a published article, that shouldn't be possible")
    return false
  end
  # ...
end
```
  The above will raise an error in development and test, but only report the error in production.
  
  Jean Boussier
- Make the order of read_multi and write_multi notifications for Cache::Store#fetch_multi operations match the order they are executed in.
  
  Adam Renberg Tamm
- Make return values of Cache::Store#write consistent.
  
  The return value was not specified before. Now it returns true on a successful write,
  nil if there was an error talking to the cache backend, and false if the write failed
  for another reason (e.g. the key already exists and unless_exist: true was passed).
  
  Sander Verdonschot
- Fix logged cache keys not always matching actual key used by cache action.
  
  Hartley McGuire
- Improve error messages of assert_changes and assert_no_changes.
  
  assert_changes error messages now display objects with .inspect to make it easier
  to differentiate nil from empty strings, strings from symbols, etc.
  assert_no_changes error messages now surface the actual value.
  
  pcreux
- Fix #to_fs(:human_size) to correctly work with negative numbers.
  
  Earlopain
- Fix BroadcastLogger#dup so that it duplicates the logger's broadcasts.
  
  Andrew Novoselac
- Fix issue where bootstrap.rb overwrites the level of a BroadcastLogger's broadcasts.
  
  Andrew Novoselac
- Fix compatibility with the semantic_logger gem.
  
  The semantic_logger gem doesn't behave exactly like stdlib logger in that
  SemanticLogger#level returns a Symbol while stdlib Logger#level returns an Integer.
  
  This caused the various LogSubscriber classes in Rails to break when assigned a
  SemanticLogger instance.
  
  Jean Boussier, ojab
- Fix MemoryStore to prevent race conditions when incrementing or decrementing.
  
  Pierre Jambet
- Implement HashWithIndifferentAccess#to_proc.
  
  Previously, calling #to_proc on HashWithIndifferentAccess object used inherited #to_proc
  method from the Hash class, which was not able to access values using indifferent keys.
  
  fatkodima
Active Model
- Fix a bug where type casting of string to Time and DateTime doesn't
  calculate minus minute value in TZ offset correctly.
  
  Akira Matsuda
- Port the type_for_attribute method to Active Model. Classes that include
  ActiveModel::Attributes will now provide this method. This method behaves
  the same for Active Model as it does for Active Record.
  
  class MyModel
  include ActiveModel::Attributes
  
  attribute :my_attribute, :integer
  end
  
  MyModel.type_for_attribute(:my_attribute) # => #<ActiveModel::Type::Integer ...>
  
  Jonathan Hefner
Active Record
- Handle commas in Sqlite3 default function definitions.
  
  Stephen Margheim
- Fixes validates_associated raising an exception when configured with a
  singular association and having index_nested_attribute_errors enabled.
  
  Martin Spickermann
- The constant ActiveRecord::ImmutableRelation has been deprecated because
  we want to reserve that name for a stronger sense of "immutable relation".
  Please use ActiveRecord::UnmodifiableRelation instead.
  
  Xavier Noria
- Add condensed #inspect for ConnectionPool, AbstractAdapter, and
  DatabaseConfig.
  
  Hartley McGuire
- Fixed a memory performance issue in Active Record attribute methods definition.
  
  Jean Boussier
- Define the new Active Support notification event start_transaction.active_record.
  
  This event is fired when database transactions or savepoints start, and
  complements transaction.active_record, which is emitted when they finish.
  
  The payload has the transaction (:transaction) and the connection (:connection).
  
  Xavier Noria
- Fix an issue where the IDs reader method did not return expected results
  for preloaded associations in models using composite primary keys.
  
  Jay Ang
- The payload of sql.active_record Active Support notifications now has the current transaction in the :transaction key.
  
  Xavier Noria
- The payload of transaction.active_record Active Support notifications now has the transaction the event is related to in the :transaction key.
  
  Xavier Noria
- Define ActiveRecord::Transaction#uuid, which returns a UUID for the database transaction. This may be helpful when tracing database activity. These UUIDs are generated only on demand.
  
  Xavier Noria
- Fix inference of association model on nested models with the same demodularized name.
  
  E.g. with the following setup:
```
class Nested::Post < ApplicationRecord
  has_one :post, through: :other
end
```
  Before, #post would infer the model as Nested::Post, but now it correctly infers Post.
  
  Joshua Young
- PostgreSQL Cidr#change? detects the address prefix change.
  
  Taketo Takashima
- Change BatchEnumerator#destroy_all to return the total number of affected rows.
  
  Previously, it always returned nil.
  
  fatkodima
- Support touch_all in batches.
```
Post.in_batches.touch_all
```
  fatkodima
- Add support for :if_not_exists and :force options to create_schema.
  
  fatkodima
- Fix index_errors having incorrect index in association validation errors.
  
  lulalala
- Add index_errors: :nested_attributes_order mode.
  
  This indexes the association validation errors based on the order received by nested attributes setter, and respects the reject_if configuration. This enables API to provide enough information to the frontend to map the validation errors back to their respective form fields.
  
  lulalala
- Add Rails.application.config.active_record.postgresql_adapter_decode_dates to opt out of decoding dates automatically with the postgresql adapter. Defaults to true.
  
  Joé Dupuis
- Association option query_constraints is deprecated in favor of foreign_key.
  
  Nikita Vasilevsky
- Add ENV["SKIP_TEST_DATABASE_TRUNCATE"] flag to speed up multi-process test runs on large DBs when all tests run within default transaction.
  
  This cuts ~10s from the test run of HEY when run by 24 processes against the 178 tables, since ~4,000 table truncates can then be skipped.
  
  DHH
- Added support for recursive common table expressions.
```
Post.with_recursive(
  post_and_replies: [
    Post.where(id: 42),
    Post.joins('JOIN post_and_replies ON posts.in_reply_to_id = post_and_replies.id'),
  ]
)
```
  Generates the following SQL:
```
WITH RECURSIVE "post_and_replies" AS (
  (SELECT "posts".* FROM "posts" WHERE "posts"."id" = 42)
  UNION ALL
  (SELECT "posts".* FROM "posts" JOIN post_and_replies ON posts.in_reply_to_id = post_and_replies.id)
)
SELECT "posts".* FROM "posts"
```
  ClearlyClaire
- validate_constraint can be called in a change_table block.
  
  ex:
```
change_table :products do |t|
  t.check_constraint "price > discounted_price", name: "price_check", validate: false
  t.validate_check_constraint "price_check"
end
```
  Cody Cutrer
- PostgreSQLAdapter now decodes columns of type date to Date instead of string.
  
  Ex:
```
ActiveRecord::Base.connection
     .select_value("select '2024-01-01'::date").class #=> Date
```
  Joé Dupuis
- Strict loading using :n_plus_one_only does not eagerly load child associations.
  
  With this change, child associations are no longer eagerly loaded, to
  match intended behavior and to prevent non-deterministic order issues caused
  by calling methods like first or last. As first and last don't cause
  an N+1 by themselves, calling child associations will no longer raise.
  Fixes #49473.
  
  Before:
```
person = Person.find(1)
person.strict_loading!(mode: :n_plus_one_only)
person.posts.first
# SELECT * FROM posts WHERE person_id = 1; -- non-deterministic order
person.posts.first.firm # raises ActiveRecord::StrictLoadingViolationError
```
  After:
```
person = Person.find(1)
person.strict_loading!(mode: :n_plus_one_only)
person.posts.first # this is 1+1, not N+1
# SELECT * FROM posts WHERE person_id = 1 ORDER BY id LIMIT 1;
person.posts.first.firm # no longer raises
```
  Reid Lynch
- Allow Sqlite3Adapter to use sqlite3 gem version 2.x.
  
  Mike Dalessio
- Allow ActiveRecord::Base#pluck to accept hash values.
  
  # Before
  Post.joins(:comments).pluck("posts.id", "comments.id", "comments.body")
  
  # After
  Post.joins(:comments).pluck(posts: [:id], comments: [:id, :body])
  
  fatkodima
- Raise an ActiveRecord::ActiveRecordError error when the MySQL database returns an invalid version string.
  
  Kevin McPhillips
- ActiveRecord::Base.transaction now yields an ActiveRecord::Transaction object.
  
  This allows to register callbacks on it.
```
Article.transaction do |transaction|
  article.update(published: true)
  transaction.after_commit do
    PublishNotificationMailer.with(article: article).deliver_later
  end
end
```
  Jean Boussier
- Add ActiveRecord::Base.current_transaction.
  
  Returns the current transaction, to allow registering callbacks on it.
```
Article.current_transaction.after_commit do
  PublishNotificationMailer.with(article: article).deliver_later
end
```
  Jean Boussier
- Add ActiveRecord.after_all_transactions_commit callback.
  
  Useful for code that may run either inside or outside a transaction and needs
  to perform work after the state changes have been properly persisted.
```
def publish_article(article)
  article.update(published: true)
  ActiveRecord.after_all_transactions_commit do
    PublishNotificationMailer.with(article: article).deliver_later
  end
end
```
  In the above example, the block is either executed immediately if called outside
  of a transaction, or called after the open transaction is committed.
  
  If the transaction is rolled back, the block isn't called.
  
  Jean Boussier
- Add the ability to ignore counter cache columns until they are backfilled.
  
  Starting to use counter caches on existing large tables can be troublesome, because the column
  values must be backfilled separately of the column addition (to not lock the table for too long)
  and before the use of :counter_cache (otherwise methods like size/any?/etc, which use
  counter caches internally, can produce incorrect results). People usually use database triggers
  or callbacks on child associations while backfilling before introducing a counter cache
  configuration to the association.
  
  Now, to safely backfill the column, while keeping the column updated with child records added/removed, use:
```
class Comment < ApplicationRecord
  belongs_to :post, counter_cache: { active: false }
end
```
  While the counter cache is not "active", the methods like size/any?/etc will not use it,
  but get the results directly from the database. After the counter cache column is backfilled, simply
  remove the { active: false } part from the counter cache definition, and it will now be used by the
  mentioned methods.
  
  fatkodima
- Retry known idempotent SELECT queries on connection-related exceptions.
  
  SELECT queries we construct by walking the Arel tree and / or with known model attributes
  are idempotent and can safely be retried in the case of a connection error. Previously,
  adapters such as TrilogyAdapter would raise ActiveRecord::ConnectionFailed: Trilogy::EOFError
  when encountering a connection error mid-request.
  
  Adrianna Chang
- Allow association's foreign_key to be composite.
  
  query_constraints option was the only way to configure a composite foreign key by passing an Array.
  Now it's possible to pass an Array value as foreign_key to achieve the same behavior of an association.
  
  Nikita Vasilevsky
- Allow association's primary_key to be composite.
  
  Association's primary_key can be composite when derived from associated model primary_key or query_constraints.
  Now it's possible to explicitly set it as composite on the association.
  
  Nikita Vasilevsky
- Add config.active_record.permanent_connection_checkout setting.
  
  Controls whether ActiveRecord::Base.connection raises an error, emits a deprecation warning, or neither.
  
  ActiveRecord::Base.connection checkouts a database connection from the pool and keeps it leased until the end of
  the request or job. This behavior can be undesirable in environments that use many more threads or fibers than there
  is available connections.
  
  This configuration can be used to track down and eliminate code that calls ActiveRecord::Base.connection and
  migrate it to use ActiveRecord::Base.with_connection instead.
  
  The default behavior remains unchanged, and there is currently no plans to change the default.
  
  Jean Boussier
- Add dirties option to uncached.
  
  This adds a dirties option to ActiveRecord::Base.uncached and
  ActiveRecord::ConnectionAdapters::ConnectionPool#uncached.
  
  When set to true (the default), writes will clear all query caches belonging to the current thread.
  When set to false, writes to the affected connection pool will not clear any query cache.
  
  This is needed by Solid Cache so that cache writes do not clear query caches.
  
  Donal McBreen
- Deprecate ActiveRecord::Base.connection in favor of .lease_connection.
  
  The method has been renamed as lease_connection to better reflect that the returned
  connection will be held for the duration of the request or job.
  
  This deprecation is a soft deprecation, no warnings will be issued and there is no
  current plan to remove the method.
  
  Jean Boussier
- Deprecate ActiveRecord::ConnectionAdapters::ConnectionPool#connection.
  
  The method has been renamed as lease_connection to better reflect that the returned
  connection will be held for the duration of the request or job.
  
  Jean Boussier
- Expose a generic fixture accessor for fixture names that may conflict with Minitest.
```
assert_equal "Ruby on Rails", web_sites(:rubyonrails).name
assert_equal "Ruby on Rails", fixture(:web_sites, :rubyonrails).name
```
  Jean Boussier
- Using Model.query_constraints with a single non-primary-key column used to raise as expected, but with an
  incorrect error message.
  
  This has been fixed to raise with a more appropriate error message.
  
  Joshua Young
- Fix has_one association autosave setting the foreign key attribute when it is unchanged.
  
  This behavior is also inconsistent with autosaving belongs_to and can have unintended side effects like raising
  an ActiveRecord::ReadonlyAttributeError when the foreign key attribute is marked as read-only.
  
  Joshua Young
- Remove deprecated behavior that would rollback a transaction block when exited using return, break or throw.
  
  Rafael Mendonça França
- Deprecate Rails.application.config.active_record.commit_transaction_on_non_local_return.
  
  Rafael Mendonça França
- Remove deprecated support to pass rewhere to ActiveRecord::Relation#merge.
  
  Rafael Mendonça França
- Remove deprecated support to pass deferrable: true to add_foreign_key.
  
  Rafael Mendonça França
- Remove deprecated support to quote ActiveSupport::Duration.
  
  Rafael Mendonça França
- Remove deprecated #quote_bound_value.
  
  Rafael Mendonça França
- Remove deprecated ActiveRecord::ConnectionAdapters::ConnectionPool#connection_klass.
  
  Rafael Mendonça França
- Remove deprecated support to apply #connection_pool_list, #active_connections?, #clear_active_connections!,
  #clear_reloadable_connections!, #clear_all_connections! and #flush_idle_connections! to the connections pools
  for the current role when the role argument isn't provided.
  
  Rafael Mendonça França
- Remove deprecated #all_connection_pools.
  
  Rafael Mendonça França
- Remove deprecated ActiveRecord::ConnectionAdapters::SchemaCache#data_sources.
  
  Rafael Mendonça França
- Remove deprecated ActiveRecord::ConnectionAdapters::SchemaCache.load_from.
  
  Rafael Mendonça França
- Remove deprecated #all_foreign_keys_valid? from database adapters.
  
  Rafael Mendonça França
- Remove deprecated support to passing coder and class as second argument to serialize.
  
  Rafael Mendonça França
- Remove deprecated support to ActiveRecord::Base#read_attribute(:id) to return the custom primary key value.
  
  Rafael Mendonça França
- Remove deprecated TestFixtures.fixture_path.
  
  Rafael Mendonça França
- Remove deprecated behavior to support referring to a singular association by its plural name.
  
  Rafael Mendonça França
- Deprecate Rails.application.config.active_record.allow_deprecated_singular_associations_name.
  
  Rafael Mendonça França
- Remove deprecated support to passing SchemaMigration and InternalMetadata classes as arguments to
  ActiveRecord::MigrationContext.
  
  Rafael Mendonça França
- Remove deprecated ActiveRecord::Migration.check_pending! method.
  
  Rafael Mendonça França
- Remove deprecated ActiveRecord::LogSubscriber.runtime method.
  
  Rafael Mendonça França
- Remove deprecated ActiveRecord::LogSubscriber.runtime= method.
  
  Rafael Mendonça França
- Remove deprecated ActiveRecord::LogSubscriber.reset_runtime method.
  
  Rafael Mendonça França
- Remove deprecated support to define explain in the connection adapter with 2 arguments.
  
  Rafael Mendonça França
- Remove deprecated ActiveRecord::ActiveJobRequiredError.
  
  Rafael Mendonça França
- Remove deprecated ActiveRecord::Base.clear_active_connections!.
  
  Rafael Mendonça França
- Remove deprecated ActiveRecord::Base.clear_reloadable_connections!.
  
  Rafael Mendonça França
- Remove deprecated ActiveRecord::Base.clear_all_connections!.
  
  Rafael Mendonça França
- Remove deprecated ActiveRecord::Base.flush_idle_connections!.
  
  Rafael Mendonça França
- Remove deprecated name argument from ActiveRecord::Base.remove_connection.
  
  Rafael Mendonça França
- Remove deprecated support to call alias_attribute with non-existent attribute names.
  
  Rafael Mendonça França
- Remove deprecated Rails.application.config.active_record.suppress_multiple_database_warning.
  
  Rafael Mendonça França
- Add ActiveRecord::Encryption::MessagePackMessageSerializer.
  
  Serialize data to the MessagePack format, for efficient storage in binary columns.
  
  The binary encoding requires around 30% less space than the base64 encoding
  used by the default serializer.
  
  Donal McBreen
- Add support for encrypting binary columns.
  
  Ensure encryption and decryption pass Type::Binary::Data around for binary data.
  
  Previously encrypting binary columns with the ActiveRecord::Encryption::MessageSerializer
  incidentally worked for MySQL and SQLite, but not PostgreSQL.
  
  Donal McBreen
- Deprecated ENV["SCHEMA_CACHE"] in favor of schema_cache_path in the database configuration.
  
  Rafael Mendonça França
- Add ActiveRecord::Base.with_connection as a shortcut for leasing a connection for a short duration.
  
  The leased connection is yielded, and for the duration of the block, any call to ActiveRecord::Base.connection
  will yield that same connection.
  
  This is useful to perform a few database operations without causing a connection to be leased for the
  entire duration of the request or job.
  
  Jean Boussier
- Deprecate config.active_record.warn_on_records_fetched_greater_than now that sql.active_record
  notification includes :row_count field.
  
  Jason Nochlin
- The fix ensures that the association is joined using the appropriate join type
  (either inner join or left outer join) based on the existing joins in the scope.
  
  This prevents unintentional overrides of existing join types and ensures consistency in the generated SQL queries.
  
  Example:
```
# `associated` will use `LEFT JOIN` instead of using `JOIN`
Post.left_joins(:author).where.associated(:author)
```
  Saleh Alhaddad
- Fix an issue where ActiveRecord::Encryption configurations are not ready before the loading
  of Active Record models, when an application is eager loaded. As a result, encrypted attributes
  could be misconfigured in some cases.
  
  Maxime Réty
- Deprecate defining an enum with keyword arguments.
  
  class Function > ApplicationRecord
  # BAD
  enum color: [:red, :blue],
  type: [:instance, :class]
  
  # GOOD
  enum :color, [:red, :blue]
  enum :type, [:instance, :class]
  end
  
  Hartley McGuire
- Add config.active_record.validate_migration_timestamps option for validating migration timestamps.
  
  When set, validates that the timestamp prefix for a migration is no more than a day ahead of
  the timestamp associated with the current time. This is designed to prevent migrations prefixes
  from being hand-edited to future timestamps, which impacts migration generation and other
  migration commands.
  
  Adrianna Chang
- Properly synchronize Mysql2Adapter#active? and TrilogyAdapter#active?.
  
  As well as disconnect! and verify!.
  
  This generally isn't a big problem as connections must not be shared between
  threads, but is required when running transactional tests or system tests
  and could lead to a SEGV.
  
  Jean Boussier
- Support :source_location tag option for query log tags.
```
config.active_record.query_log_tags << :source_location
```
  Calculating the caller location is a costly operation and should be used primarily in development
  (note, there is also a config.active_record.verbose_query_logs that serves the same purpose)
  or occasionally on production for debugging purposes.
  
  fatkodima
- Add an option to ActiveRecord::Encryption::Encryptor to disable compression.
  
  Allow compression to be disabled by setting compress: false
```
  class User
    encrypts :name, encryptor: ActiveRecord::Encryption::Encryptor.new(compress: false)
  end
```
  Donal McBreen
- Deprecate passing strings to ActiveRecord::Tasks::DatabaseTasks.cache_dump_filename.
  
  A ActiveRecord::DatabaseConfigurations::DatabaseConfig object should be passed instead.
  
  Rafael Mendonça França
- Add row_count field to sql.active_record notification.
  
  This field returns the amount of rows returned by the query that emitted the notification.
  
  This metric is useful in cases where one wants to detect queries with big result sets.
  
  Marvin Bitterlich
- Consistently raise an ArgumentError when passing an invalid argument to a nested attributes association writer.
  
  Previously, this would only raise on collection associations and produce a generic error on singular associations.
  
  Now, it will raise on both collection and singular associations.
  
  Joshua Young
- Fix single quote escapes on default generated MySQL columns.
  
  MySQL 5.7.5+ supports generated columns, which can be used to create a column that is computed from an expression.
  
  Previously, the schema dump would output a string with double escapes for generated columns with single quotes in the default expression.
  
  This would result in issues when importing the schema on a fresh instance of a MySQL database.
  
  Now, the string will not be escaped and will be valid Ruby upon importing of the schema.
  
  Yash Kapadia
- Fix Migrations with versions older than 7.1 validating options given to
  add_reference and t.references.
  
  Hartley McGuire
- Add <role>_types class method to ActiveRecord::DelegatedType so that the delegated types can be introspected.
  
  JP Rosevear
- Make schema_dump, query_cache, replica and database_tasks configurable via DATABASE_URL.
  
  This wouldn't always work previously because boolean values would be interpreted as strings.
  
  e.g. DATABASE_URL=postgres://localhost/foo?schema_dump=false now properly disable dumping the schema
  cache.
  
  Mike Coutermarsh, Jean Boussier
- Introduce ActiveRecord::Transactions::ClassMethods#set_callback.
  
  It is identical to ActiveSupport::Callbacks::ClassMethods#set_callback
  but with support for after_commit and after_rollback callback options.
  
  Joshua Young
- Make ActiveRecord::Encryption::Encryptor agnostic of the serialization format used for encrypted data.
  
  Previously, the encryptor instance only allowed an encrypted value serialized as a String to be passed to the message serializer.
  
  Now, the encryptor lets the configured message_serializer decide which types of serialized encrypted values are supported. A custom serialiser is therefore allowed to serialize ActiveRecord::Encryption::Message objects using a type other than String.
  
  The default ActiveRecord::Encryption::MessageSerializer already ensures that only String objects are passed for deserialization.
  
  Maxime Réty
- Fix encrypted_attribute? to take into account context properties passed to encrypts.
  
  Maxime Réty
- The object returned by explain now responds to pluck, first,
  last, average, count, maximum, minimum, and sum. Those
  new methods run EXPLAIN on the corresponding queries:
  
  User.all.explain.count
  # EXPLAIN SELECT COUNT(*) FROM users
  # ...
  
  User.all.explain.maximum(:id)
  # EXPLAIN SELECT MAX(users.id) FROM users
  # ...
  
  Petrik de Heus
- Fixes an issue where validates_associated :on option wasn't respected
  when validating associated records.
  
  Austen Madden, Alex Ghiculescu, Rafał Brize
- Allow overriding SQLite defaults from database.yml.
  
  Any PRAGMA configuration set under the pragmas key in the configuration
  file takes precedence over Rails' defaults, and additional PRAGMAs can be
  set as well.
```
database: storage/development.sqlite3
timeout: 5000
pragmas:
  journal_mode: off
  temp_store: memory
```
  Stephen Margheim
- Remove warning message when running SQLite in production, but leave it unconfigured.
  
  There are valid use cases for running SQLite in production. However, it must be done
  with care, so instead of a warning most users won't see anyway, it's preferable to
  leave the configuration commented out to force them to think about having the database
  on a persistent volume etc.
  
  Jacopo Beschi, Jean Boussier
- Add support for generated columns to the SQLite3 adapter.
  
  Generated columns (both stored and dynamic) are supported since version 3.31.0 of SQLite.
  This adds support for those to the SQLite3 adapter.
```
create_table :users do |t|
  t.string :name
  t.virtual :name_upper, type: :string, as: 'UPPER(name)'
  t.virtual :name_lower, type: :string, as: 'LOWER(name)', stored: true
end
```
  Stephen Margheim
- TrilogyAdapter: ignore host if socket parameter is set.
  
  This allows to configure a connection on a UNIX socket via DATABASE_URL:
```
DATABASE_URL=trilogy://does-not-matter/my_db_production?socket=/var/run/mysql.sock
```
  Jean Boussier
- Make assert_queries_count, assert_no_queries, assert_queries_match, and
  assert_no_queries_match assertions public.
  
  To assert the expected number of queries are made, Rails internally uses assert_queries_count and
  assert_no_queries. To assert that specific SQL queries are made, assert_queries_match and
  assert_no_queries_match are used. These assertions can now be used in applications as well.
  
  class ArticleTest < ActiveSupport::TestCase
  test "queries are made" do
  assert_queries_count(1) { Article.first }
  end
  
  test "creates a foreign key" do
  assert_queries_match(/ADD FOREIGN KEY/i, include_schema: true) do
  @ connection.add_foreign_key(:comments, :posts)
  end</...

Snyk has created this PR to upgrade @rails/activestorage from 7.1.3 to 7.2.0. See this package in npm: @rails/activestorage See this project in Snyk: https://app.snyk.io/org/inexizi/project/79d905c4-8511-417b-b57c-d0a1b4cf8fcc?utm_source=github&utm_medium=referral&page=upgrade-pr

INexizI self-assigned this Aug 31, 2024

Merge branch 'master' into snyk-upgrade-207c70261acfd3859defe7ed18505b44

0d243c0

INexizI merged commit 456ab9a into master Sep 2, 2024
1 check passed

INexizI deleted the snyk-upgrade-207c70261acfd3859defe7ed18505b44 branch September 2, 2024 21:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade @rails/activestorage from 7.1.3 to 7.2.0 #393

[Snyk] Upgrade @rails/activestorage from 7.1.3 to 7.2.0 #393

INexizI commented Aug 31, 2024

Active Support

Active Model

Active Record

[Snyk] Upgrade @rails/activestorage from 7.1.3 to 7.2.0 #393

[Snyk] Upgrade @rails/activestorage from 7.1.3 to 7.2.0 #393

Conversation

INexizI commented Aug 31, 2024

Snyk has created this PR to upgrade @rails/activestorage from 7.1.3 to 7.2.0.

Active Support

Active Model

Active Record