Active Support

• Fix JSONGemCoderEncoder to correctly serialize custom object hash keys.

  When hash keys are custom objects whose as_json returns a Hash,
  the encoder now calls to_s on the original key object instead of
  on the as_json result.

  Before:
  hash = {CustomKey.new(123) => "value"}
  hash.to_json # => {"{:id=>123}":"value"}

  After:
  hash.to_json # => {"custom_123":"value"}

  Dan Sharp

• Fix inflections to better handle overlapping acronyms.

  ActiveSupport::Inflector.inflections(:en) do |inflect|
    inflect.acronym "USD"
    inflect.acronym "USDC"
  end
  
  "USDC".underscore # => "usdc"

  Said Kaldybaev

• Silence Dalli 4.0+ warning when using ActiveSupport::Cache::MemCacheStore.

  zzak

Active Model

• Fix Ruby 4.0 delegator warning when calling inspect on attributes.

  Hammad Khan

• Fix NoMethodError when deserialising Type::Integer objects marshalled under Rails 8.0.

  The performance optimisation that replaced @range with @max/@min
  broke Marshal compatibility. Objects serialised under 8.0 (with @range)
  and deserialised under 8.1 (expecting @max/@min) would crash with
  undefined method '<=' for nil because Marshal.load restores instance
  variables without calling initialize.

  Edward Woodcock

Active Record

• Fix insert_all and upsert_all log message when called on anonymous classes.

  Gabriel Sobrinho

• Respect ActiveRecord::SchemaDumper.ignore_tables when dumping SQLite virtual tables.

  Hans Schnedlitz

• Restore previous instrumenter after execute_or_skip

  FutureResult#execute_or_skip replaces the thread's instrumenter with an
  EventBuffer to collect events published during async query execution.
  If the global async executor is saturated and the caller_runs fallback
  executes the task on the calling thread, we need to make sure the previous
  instrumenter is restored or the stale EventBuffer would stay in place and
  permanently swallow all subsequent sql.active_record notifications on
  that thread.

  Rosa Gutierrez

• Bump the minimum PostgreSQL version to 9.5, due to usage of array_position function.

  Ivan Kuchin

• Fix Ruby 4.0 delegator warning when calling inspect on ActiveRecord::Type::Serialized.

  Hammad Khan

• Fix support for table names containing hyphens.

  Evgeniy Demin

• Fix column deduplication for SQLite3 and PostgreSQL virtual (generated) columns.

  Column#== and Column#hash now account for virtual? so that the
  Deduplicable registry does not treat a generated column and a regular
  column with the same name and type as identical. Previously, if a
  generated column was registered first, a regular column on a different
  table could be deduplicated to the generated instance, silently
  excluding it from INSERT/UPDATE statements.

  Jay Huber

• Fix PostgreSQL schema dumping to handle schema-qualified table names in foreign_key references that span different schemas.

  # before
  add_foreign_key "hst.event_log_attributes", "hst.event_logs" # emits correctly because they're in the same schema (hst)
  add_foreign_key "hst.event_log_attributes", "hst.usr.user_profiles", column: "created_by_id" # emits hst.user.* when user.* is expected
  
  # after
  add_foreign_key "hst.event_log_attributes", "hst.event_logs"
  add_foreign_key "hst.event_log_attributes", "usr.user_profiles", column: "created_by_id"
  

  Chiperific

Action View

• Fix encoding errors for string locals containing non-ASCII characters.

  Kataoka Katsuki

• Fix collection caching to only forward expires_in argument if explicitly set.

  Pieter Visser

Action Pack

• No changes.

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• Fix ActiveStorage::Blob content type predicate methods to handle nil.

  Daichi KUDO

Action Mailbox

• No changes.

Action Text

• No changes.

Railties

• Add libvips to generated ci.yml

  Conditionally adds libvips to ci.yml.

  Steve Polito

Guides

• No changes.

Active Support

• Fix inflections to better handle overlapping acronyms.

  ActiveSupport::Inflector.inflections(:en) do |inflect|
    inflect.acronym "USD"
    inflect.acronym "USDC"
  end
  
  "USDC".underscore # => "usdc"

  Said Kaldybaev

• Silence Dalli 4.0+ warning when using ActiveSupport::Cache::MemCacheStore.

  zzak

• Make delegate and delegate_missing_to work in BasicObject subclasses.

  Rafael Mendonça França

• Fix ActiveSupport::Inflector.humanize with international characters.

  ActiveSupport::Inflector.humanize("áÉÍÓÚ")  # => "Áéíóú"
  ActiveSupport::Inflector.humanize("аБВГДЕ") # => "Абвгде"

  Jose Luis Duran

Active Model

• No changes.

Active Record

• Fix insert_all and upsert_all log message when called on anonymous classes.

  Gabriel Sobrinho

• Respect ActiveRecord::SchemaDumper.ignore_tables when dumping SQLite virtual tables.

  Hans Schnedlitz

• Restore previous instrumenter after execute_or_skip

  FutureResult#execute_or_skip replaces the thread's instrumenter with an
  EventBuffer to collect events published during async query execution.
  If the global async executor is saturated and the caller_runs fallback
  executes the task on the calling thread, we need to make sure the previous
  instrumenter is restored or the stale EventBuffer would stay in place and
  permanently swallow all subsequent sql.active_record notifications on
  that thread.

  Rosa Gutierrez

• Fix Ruby 4.0 delegator warning when calling inspect on ActiveRecord::Type::Serialized.

  Hammad Khan

• Fix support for table names containing hyphens.

  Evgeniy Demin

• Fix column deduplication for SQLite3 and PostgreSQL virtual (generated) columns.

  Column#== and Column#hash now account for virtual? so that the
  Deduplicable registry does not treat a generated column and a regular
  column with the same name and type as identical. Previously, if a
  generated column was registered first, a regular column on a different
  table could be deduplicated to the generated instance, silently
  excluding it from INSERT/UPDATE statements.

  Jay Huber

• Fix merging relations with arel equality predicates with null relations.

  fatkodima

• Fix SQLite3 schema dump for non-autoincrement integer primary keys.

  Previously, schema.rb should incorrectly restore that table with an auto incrementing
  primary key.

  Chris Hasiński

• Fix PostgreSQL schema_search_path not being reapplied after reset! or reconnect!.

  The schema_search_path configured in database.yml is now correctly
  reapplied instead of falling back to PostgreSQL defaults.

  Tobias Egli

• Ensure batched preloaded associations accounts for klass when grouping to avoid issues with STI.

  zzak, Stjepan Hadjic

• Fix ActiveRecord::SoleRecordExceeded#record to return the relation.

  This was the case until Rails 7.2, but starting from 8.0 it
  started mistakenly returning the model class.

  Jean Boussier

• Improve PostgreSQLAdapter resilience to Timeout.timeout.

  Better handle asynchronous exceptions being thrown inside
  the reconnect! method.

  This may fixes some deep errors such as:

  undefined method `key?' for nil:NilClass (NoMethodError)
            if !type_map.key?(oid)
  

  Jean Boussier

• Fix eager_load when loading has_many assocations with composite primary keys.

  This would result in some records being loaded multiple times.

  Martin-Alexander

Action View

• Fix encoding errors for string locals containing non-ASCII characters.

  Kataoka Katsuki

• Fix collection caching to only forward expires_in argument if explicitly set.

  Pieter Visser

• Fix file_field to join mime types with a comma when provided as Array

  file_field(:article, :image, accept: ['image/png', 'image/gif', 'image/jpeg'])

  Now behaves likes:

  file_field(:article, :image, accept: 'image/png,image/gif,image/jpeg')
  

  Bogdan Gusiev

• Fix strict locals parsing to handle multiline definitions.

  Said Kaldybaev

Action Pack

• Add config.action_controller.live_streaming_excluded_keys to control execution state sharing in ActionController::Live.

  When using ActionController::Live, actions are executed in a separate thread that shares
  state from the parent thread. This new configuration allows applications to opt-out specific
  state keys that should not be shared.

  This is useful when streaming inside a connected_to block, where you may want
  the streaming thread to use its own database connection context.

  # config/application.rb
  config.action_controller.live_streaming_excluded_keys = [:active_record_connected_to_stack]

  By default, all keys are shared.

  Eileen M. Uchitelle

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• Fix ActiveStorage::Blob content type predicate methods to handle nil.

  Daichi KUDO

Action Mailbox

• No changes.

Action Text

• No changes.

Railties

• Fixed the rails notes command to properly extract notes in CSS files.

  David White

• Fixed the default Dockerfile to properly include the vendor/ directory during bundle install.

  Zhong Sheng

Guides

• No changes.

Active Support

• Reject scientific notation in NumberConverter

  [CVE-2026-33176]

  Jean Boussier

• Fix SafeBuffer#% to preserve unsafe status

  [CVE-2026-33170]

  Jean Boussier

• Improve performance of NumberToDelimitedConverter

  [CVE-2026-33169]

  Jean Boussier

Active Model

• No changes.

Active Record

• No changes.

Action View

• Skip blank attribute names in tag helpers to avoid generating invalid HTML.

  [CVE-2026-33168]

  Mike Dalessio

Action Pack

• Fix possible XSS in DebugExceptions middleware

  [CVE-2026-33167]

  John Hawthorn

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• Filter user supplied metadata in DirectUploadController

  [CVE-2026-33173]

  Jean Boussier

• Configurable maxmimum streaming chunk size

  Makes sure that byte ranges for blobs don't exceed 100mb by default.
  Content ranges that are too big can result in denial of service.

  [CVE-2026-33174]

  Gannon McGibbon

• Limit range requests to a single range

  [CVE-2026-33658]

  Jean Boussier

• Prevent path traversal in DiskService.

  DiskService#path_for now raises an InvalidKeyError when passed keys with dot segments (".",
  ".."), or if the resolved path is outside the storage root directory.

  #path_for also now consistently raises InvalidKeyError if the key is invalid in any way, for
  example containing null bytes or having an incompatible encoding. Previously, the exception
  raised may have been ArgumentError or Encoding::CompatibilityError.

  DiskController now explicitly rescues InvalidKeyError with appropriate HTTP status codes.

  [CVE-2026-33195]

  Mike Dalessio

• Prevent glob injection in DiskService#delete_prefixed.

  Escape glob metacharacters in the resolved path before passing to Dir.glob.

  Note that this change breaks any existing code that is relying on delete_prefixed to expand
  glob metacharacters. This change presumes that is unintended behavior (as other storage services
  do not respect these metacharacters).

  [CVE-2026-33202]

  Mike Dalessio

Action Mailbox

• No changes.

Action Text

• No changes.

Railties

• No changes.

Guides

• No changes.

Active Support

• Reject scientific notation in NumberConverter

  [CVE-2026-33176]

  Jean Boussier

• Fix SafeBuffer#% to preserve unsafe status

  [CVE-2026-33170]

  Jean Boussier

• Improve performance of NumberToDelimitedConverter

  [CVE-2026-33169]

  Jean Boussier

Active Model

• No changes.

Active Record

• No changes.

Action View

• Skip blank attribute names in tag helpers to avoid generating invalid HTML.

  [CVE-2026-33168]

  Mike Dalessio

Action Pack

• No changes.

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• Filter user supplied metadata in DirectUploadController

  [CVE-2026-33173]

  Jean Boussier

• Configurable maxmimum streaming chunk size

  Makes sure that byte ranges for blobs don't exceed 100mb by default.
  Content ranges that are too big can result in denial of service.

  [CVE-2026-33174]

  Gannon McGibbon

• Limit range requests to a single range

  [CVE-2026-33658]

  Jean Boussier

• Prevent path traversal in DiskService.

  DiskService#path_for now raises an InvalidKeyError when passed keys with dot segments (".",
  ".."), or if the resolved path is outside the storage root directory.

  #path_for also now consistently raises InvalidKeyError if the key is invalid in any way, for
  example containing null bytes or having an incompatible encoding. Previously, the exception
  raised may have been ArgumentError or Encoding::CompatibilityError.

  DiskController now explicitly rescues InvalidKeyError with appropriate HTTP status codes.

  [CVE-2026-33195]

  Mike Dalessio

• Prevent glob injection in DiskService#delete_prefixed.

  Escape glob metacharacters in the resolved path before passing to Dir.glob.

  Note that this change breaks any existing code that is relying on delete_prefixed to expand
  glob metacharacters. This change presumes that is unintended behavior (as other storage services
  do not respect these metacharacters).

  [CVE-2026-33202]

  Mike Dalessio

Action Mailbox

• No changes.

Action Text

• No changes.

Railties

• No changes.

Guides

• No changes.

Active Support

• Reject scientific notation in NumberConverter

  [CVE-2026-33176]

  Jean Boussier

• Fix SafeBuffer#% to preserve unsafe status

  [CVE-2026-33170]

  Jean Boussier

• Improve performance of NumberToDelimitedConverter

  [CVE-2026-33169]

  Jean Boussier

Active Model

• No changes.

Active Record

• No changes.

Action View

• Skip blank attribute names in tag helpers to avoid generating invalid HTML.

  [CVE-2026-33168]

  Mike Dalessio

Action Pack

• No changes.

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• Filter user supplied metadata in DirectUploadController

  [CVE-2026-33173]

  Jean Boussier

• Configurable maxmimum streaming chunk size

  Makes sure that byte ranges for blobs don't exceed 100mb by default.
  Content ranges that are too big can result in denial of service.

  [CVE-2026-33174]

  Gannon McGibbon

• Limit range requests to a single range

  [CVE-2026-33658]

  Jean Boussier

• Prevent path traversal in DiskService.

  DiskService#path_for now raises an InvalidKeyError when passed keys with dot segments (".",
  ".."), or if the resolved path is outside the storage root directory.

  #path_for also now consistently raises InvalidKeyError if the key is invalid in any way, for
  example containing null bytes or having an incompatible encoding. Previously, the exception
  raised may have been ArgumentError or Encoding::CompatibilityError.

  DiskController now explicitly rescues InvalidKeyError with appropriate HTTP status codes.

  [CVE-2026-33195]

  Mike Dalessio

• Prevent glob injection in DiskService#delete_prefixed.

  Escape glob metacharacters in the resolved path before passing to Dir.glob.

  Note that this change breaks any existing code that is relying on delete_prefixed to expand
  glob metacharacters. This change presumes that is unintended behavior (as other storage services
  do not respect these metacharacters).

  [CVE-2026-33202]

  Mike Dalessio

Action Mailbox

• No changes.

Action Text

• No changes.

Railties

• No changes.

Guides

• No changes.

Active Support

• Make delegate and delegate_missing_to work in BasicObject subclasses.

  Rafael Mendonça França

• Fix Inflectors when using a locale that fallbacks to :en.

  Said Kaldybaev

• Fix ActiveSupport::TimeWithZone#as_json to consistently return UTF-8 strings.

  Previously the returned string would sometime be encoded in US-ASCII, which in
  some cases may be problematic.

  Now the method consistently always return UTF-8 strings.

  Jean Boussier

• Fix TimeWithZone#xmlschema when wrapping a DateTime instance in local time.

  Previously it would return an invalid time.

  Dmytro Rymar

• Implement LocalCache strategy on ActiveSupport::Cache::MemoryStore. The memory store
  needs to respond to the same interface as other cache stores (e.g. ActiveSupport::NullStore).

  Mikey Gough

• Fix ActiveSupport::Inflector.humanize with international characters.

  ActiveSupport::Inflector.humanize("áÉÍÓÚ")  # => "Áéíóú"
  ActiveSupport::Inflector.humanize("аБВГДЕ") # => "Абвгде"

  Jose Luis Duran

Active Model

• No changes.

Active Record

• Fix counting cached queries in ActiveRecord::RuntimeRegistry.

  fatkodima

• Fix merging relations with arel equality predicates with null relations.

  fatkodima

• Fix SQLite3 schema dump for non-autoincrement integer primary keys.

  Previously, schema.rb should incorrectly restore that table with an auto incrementing
  primary key.

  Chris Hasiński

• Fix PostgreSQL schema_search_path not being reapplied after reset! or reconnect!.

  The schema_search_path configured in database.yml is now correctly
  reapplied instead of falling back to PostgreSQL defaults.

  Tobias Egli

• Restore the ability of enum to be foats.

  enum :rating, { low: 0.0, medium: 0.5, high: 1.0 },

  In Rails 8.1.0, enum values are eagerly validated, and floats weren't expected.

  Said Kaldybaev

• Ensure batched preloaded associations accounts for klass when grouping to avoid issues with STI.

  zzak, Stjepan Hadjic

• Fix ActiveRecord::SoleRecordExceeded#record to return the relation.

  This was the case until Rails 7.2, but starting from 8.0 it
  started mistakenly returning the model class.

  Jean Boussier

• Improve PostgreSQLAdapter resilience to Timeout.timeout.

  Better handle asynchronous exceptions being thrown inside
  the reconnect! method.

  This may fixes some deep errors such as:

  undefined method `key?' for nil:NilClass (NoMethodError)
            if !type_map.key?(oid)
  

  Jean Boussier

• Fix structured events for Active Record was not being emitted.

  Yuji Yaginuma

• Fix eager_load when loading has_many assocations with composite primary keys.

  This would result in some records being loaded multiple times.

  Martin-Alexander

Action View

• Fix file_field to join mime types with a comma when provided as Array

  file_field(:article, :image, accept: ['image/png', 'image/gif', 'image/jpeg'])

  Now behaves likes:

  file_field(:article, :image, accept: 'image/png,image/gif,image/jpeg')
  

  Bogdan Gusiev

• Fix strict locals parsing to handle multiline definitions.

  Said Kaldybaev

• Fix content_security_policy_nonce error in mailers when using content_security_policy_nonce_auto setting.

  The content_security_policy_nonce helper is provided by ActionController::ContentSecurityPolicy, and it relies on request.content_security_policy_nonce. Mailers lack both the module and the request object.

  Jarrett Lusso

Action Pack

• Add config.action_controller.live_streaming_excluded_keys to control execution state sharing in ActionController::Live.

  When using ActionController::Live, actions are executed in a separate thread that shares
  state from the parent thread. This new configuration allows applications to opt-out specific
  state keys that should not be shared.

  This is useful when streaming inside a connected_to block, where you may want
  the streaming thread to use its own database connection context.

  # config/application.rb
  config.action_controller.live_streaming_excluded_keys = [:active_record_connected_to_stack]

  By default, all keys are shared.

  Eileen M. Uchitelle

• Fix IpSpoofAttackError message to include Forwarded header content.

  Without it, the error message may be misleading.

  zzak

Active Job

• Fix ActiveJob.perform_all_later to respect job_class.enqueue_after_transaction_commit.

  Previously, perform_all_later would enqueue all jobs immediately, even if
  they had enqueue_after_transaction_commit = true. Now it correctly defers
  jobs with this setting until after transaction commits, matching the behavior
  of perform_later.

  OuYangJinTing

• Fix using custom serializers with ActiveJob::Arguments.serialize when
  ActiveJob::Base hasn't been loaded.

  Hartley McGuire

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• Restore ADC when signing URLs with IAM for GCS

  ADC was previously used for automatic authorization when signing URLs with IAM.
  Now it is again, but the auth client is memoized so that new credentials are only
  requested when the current ones expire. Other auth methods can now be used
  instead by setting the authorization on ActiveStorage::Service::GCSService#iam_client.

  ActiveStorage::Blob.service.iam_client.authorization = Google::Auth::ImpersonatedServiceAccountCredentials.new(options)

  This is safer than setting Google::Apis::RequestOptions.default.authorization
  because it only applies to Active Storage and does not affect other Google API
  clients.

  Justin Malčić

Action Mailbox

• No changes.

Action Text

• No changes.

Railties

• Skip all system test files on app generation.

  Eileen M. Uchitelle

• Fix db:system:change to correctly update Dockerfile base packages.

  Josiah Smith

• Fix devcontainer volume mount when app name differs from folder name.

  Rafael Mendonça França

• Fixed the rails notes command to properly extract notes in CSS files.

  David White

• Fixed the default Dockerfile to properly include the vendor/ directory during bundle install.

  Zhong Sheng

Guides

• No changes.

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• Respect remove_hidden_field_autocomplete config in form builder hidden_field.

  Rafael Mendonça França

Action Pack

• Allow methods starting with underscore to be action methods.

  Disallowing methods starting with an underscore from being action methods
  was an unintended side effect of the performance optimization in
  207a254.

  Fixes #55985.

  Rafael Mendonça França

Active Job

• Only index new serializers.

  Jesse Sharps

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• No changes.

Action Mailbox

• No changes.

Action Text

• No changes.

Railties

• Do not assume and force SSL in production by default when using Kamal, to allow for out of the box Kamal deployments.

  It is still recommended to assume and force SSL in production as soon as you can.

  Jerome Dalbert

Guides

• No changes.

Active Support

• Fix Enumerable#sole to return the full tuple instead of just the first element of the tuple.

  Olivier Bellone

• Fix parallel tests hanging when worker processes die abruptly.

  Previously, if a worker process was killed (e.g., OOM killed, kill -9) during parallel
  test execution, the test suite would hang forever waiting for the dead worker.

  Joshua Young

• Fix NameError when class_attribute is defined on instance singleton classes.

  Previously, calling class_attribute on an instance's singleton class would raise
  a NameError when accessing the attribute through the instance.

  object = MyClass.new
  object.singleton_class.class_attribute :foo, default: "bar"
  object.foo # previously raised NameError, now returns "bar"

  Joshua Young

Active Model

• No changes.

Active Record

• Fix SQLite3 data loss during table alterations with CASCADE foreign keys.

  When altering a table in SQLite3 that is referenced by child tables with
  ON DELETE CASCADE foreign keys, ActiveRecord would silently delete all
  data from the child tables. This occurred because SQLite requires table
  recreation for schema changes, and during this process the original table
  is temporarily dropped, triggering CASCADE deletes on child tables.

  The root cause was incorrect ordering of operations. The original code
  wrapped disable_referential_integrity inside a transaction, but
  PRAGMA foreign_keys cannot be modified inside a transaction in SQLite -
  attempting to do so simply has no effect. This meant foreign keys remained
  enabled during table recreation, causing CASCADE deletes to fire.

  The fix reverses the order to follow the official SQLite 12-step ALTER TABLE
  procedure: disable_referential_integrity now wraps the transaction instead
  of being wrapped by it. This ensures foreign keys are properly disabled
  before the transaction starts and re-enabled after it commits, preventing
  CASCADE deletes while maintaining data integrity through atomic transactions.

  Ruy Rocha

• Add support for bound SQL literals in CTEs.

  Nicolas Bachschmidt

• Fix belongs_to associations not to clear the entire composite primary key.

  When clearing a belongs_to association that references a model with composite primary key,
  only the optional part of the key should be cleared.

  zzak

• Fix invalid records being autosaved when distantly associated records are marked for deletion.

  Ian Terrell, axlekb AB

Action View

• Restore add_default_name_and_id method.

  Hartley McGuire

Action Pack

• Submit test requests using as: :html with Content-Type: x-www-form-urlencoded

  Sean Doyle

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• No changes.

Action Mailbox

• No changes.

Action Text

• No changes.

Railties

• No changes.

Guides

• No changes.

Active Support

• Fix Enumerable#sole to return the full tuple instead of just the first element of the tuple.

  Olivier Bellone

• Fix parallel tests hanging when worker processes die abruptly.

  Previously, if a worker process was killed (e.g., OOM killed, kill -9) during parallel
  test execution, the test suite would hang forever waiting for the dead worker.

  Joshua Young

• ActiveSupport::FileUpdateChecker does not depend on Time.now to prevent unnecessary reloads with time travel test helpers

  Jan Grodowski

• Fix ActiveSupport::BroadcastLogger from executing a block argument for each logger (tagged, info, etc.).

  Jared Armstrong

• Fix ActiveSupport::HashWithIndifferentAccess#transform_keys! removing defaults.

  Hartley McGuire

• Fix ActiveSupport::HashWithIndifferentAccess#tranform_keys! to handle collisions.

  If the transformation would result in a key equal to another not yet transformed one,
  it would result in keys being lost.

  Before:

  >> {a: 1, b: 2}.with_indifferent_access.transform_keys!(&:succ)
  => {"c" => 1}

  After:

  >> {a: 1, b: 2}.with_indifferent_access.transform_keys!(&:succ)
  => {"c" => 1, "d" => 2}

  Jason T Johnson, Jean Boussier

• Fix ActiveSupport::Cache::MemCacheStore#read_multi to handle network errors.

  This method specifically wasn't handling network errors like other codepaths.

  Alessandro Dal Grande

• Fix Active Support Cache fetch_multi when local store is active.

  fetch_multi now properly yield to the provided block for missing entries
  that have been recorded as such in the local store.

  Jean Boussier

• Fix execution wrapping to report all exceptions, including Exception.

  If a more serious error like SystemStackError or NoMemoryError happens,
  the error reporter should be able to report these kinds of exceptions.

  Gannon McGibbon

• Fix RedisCacheStore and MemCacheStore to also handle connection pool related errors.

  These errors are rescued and reported to Rails.error.

  Jean Boussier

• Fix ActiveSupport::Cache#read_multi to respect version expiry when using local cache.

  zzak

• Fix ActiveSupport::MessageVerifier and ActiveSupport::MessageEncryptor configuration of on_rotation callback.

  verifier.rotate(old_secret).on_rotation { ... }

  Now both work as documented.

  Jean Boussier

• Fix ActiveSupport::MessageVerifier to always be able to verify both URL-safe and URL-unsafe payloads.

  This is to allow transitioning seemlessly from either configuration without immediately invalidating
  all previously generated signed messages.

  Jean Boussier, Florent Beaurain, Ali Sepehri

• Fix cache.fetch to honor the provided expiry when :race_condition_ttl is used.

  cache.fetch("key", expires_in: 1.hour, race_condition_ttl: 5.second) do
    "something"
  end

  In the above example, the final cache entry would have a 10 seconds TTL instead
  of the requested 1 hour.

  Dhia

• Better handle procs with splat arguments in set_callback.

  Radamés Roriz

• Fix String#mb_chars to not mutate the receiver.

  Previously it would call force_encoding on the receiver,
  now it dups the receiver first.

  Jean Boussier

• Improve ErrorSubscriber to also mark error causes as reported.

  This avoid some cases of errors being reported twice, notably in views because of how
  errors are wrapped in ActionView::Template::Error.

  Jean Boussier

• Fix Module#module_parent_name to return the correct name after the module has been named.

  When called on an anonymous module, the return value wouldn't change after the module was given a name
  later by being assigned to a constant.

  mod = Module.new
  mod.module_parent_name # => "Object"
  MyModule::Something = mod
  mod.module_parent_name # => "MyModule"

  Jean Boussier

• Fix a bug in ERB::Util.tokenize that causes incorrect tokenization when ERB tags are preceeded by multibyte characters.

  Martin Emde

Active Model

• Fix has_secure_password to perform confirmation validation of the password even when blank.

  The validation was incorrectly skipped when the password only contained whitespace characters.

  Fabio Sangiovanni

• Handle missing attributes for ActiveModel::Translation#human_attribute_name.

  zzak

• Fix ActiveModel::AttributeAssignment#assign_attributes to accept objects without each.

  Kouhei Yanagita

Active Record

• Fix SQLite3 data loss during table alterations with CASCADE foreign keys.

  When altering a table in SQLite3 that is referenced by child tables with
  ON DELETE CASCADE foreign keys, ActiveRecord would silently delete all
  data from the child tables. This occurred because SQLite requires table
  recreation for schema changes, and during this process the original table
  is temporarily dropped, triggering CASCADE deletes on child tables.

  The root cause was incorrect ordering of operations. The original code
  wrapped disable_referential_integrity inside a transaction, but
  PRAGMA foreign_keys cannot be modified inside a transaction in SQLite -
  attempting to do so simply has no effect. This meant foreign keys remained
  enabled during table recreation, causing CASCADE deletes to fire.

  The fix reverses the order to follow the official SQLite 12-step ALTER TABLE
  procedure: disable_referential_integrity now wraps the transaction instead
  of being wrapped by it. This ensures foreign keys are properly disabled
  before the transaction starts and re-enabled after it commits, preventing
  CASCADE deletes while maintaining data integrity through atomic transactions.

  Ruy Rocha

• Fix belongs_to associations not to clear the entire composite primary key.

  When clearing a belongs_to association that references a model with composite primary key,
  only the optional part of the key should be cleared.

  zzak

• Fix invalid records being autosaved when distantly associated records are marked for deletion.

  Ian Terrell, axlekb AB

• Prevent persisting invalid record.

  Edouard Chin

• Fix count with group by qualified name on loaded relation.

  Ryuta Kamizono

• Fix sum with qualified name on loaded relation.

  Chris Gunther

• Fix prepared statements on mysql2 adapter.

  Jean Boussier

• Fix query cache for pinned connections in multi threaded transactional tests.

  When a pinned connection is used across separate threads, they now use a separate cache store
  for each thread.

  This improve accuracy of system tests, and any test using multiple threads.

  Heinrich Lee Yu, Jean Boussier

• Don't add id_value attribute alias when attribute/column with that name already exists.

  Rob Lewis

• Fix false positive change detection involving STI and polymorhic has one relationships.

  Polymorphic has_one relationships would always be considered changed when defined in a STI child
  class, causing nedless extra autosaves.

  David Fritsch

• Fix stale associaton detection for polymophic belong_to.

  Florent Beaurain, Thomas Crambert

• Fix removal of PostgreSQL version comments in structure.sql for latest PostgreSQL versions which include \restrict.

  Brendan Weibrecht

• Fix #merge with #or or #and and a mixture of attributes and SQL strings resulting in an incorrect query.

  base = Comment.joins(:post).where(user_id: 1).where("recent = 1")
  puts base.merge(base.where(draft: true).or(Post.where(archived: true))).to_sql

  Before:

  SELECT "comments".* FROM "comments"
  INNER JOIN "posts" ON "posts"."id" = "comments"."post_id"
  WHERE (recent = 1)
  AND (
    "comments"."user_id" = 1
    AND (recent = 1)
    AND "comments"."draft" = 1
    OR "posts"."archived" = 1
  )

  After:

  SELECT "comments".* FROM "comments"
  INNER JOIN "posts" ON "posts"."id" = "comments"."post_id"
  WHERE "comments"."user_id" = 1
  AND (recent = 1)
  AND (
    "comments"."user_id" = 1
    AND (recent = 1)
    AND "comments"."draft" = 1
    OR "posts"."archived" = 1
  )

  Joshua Young

• Fix inline has_and_belongs_to_many fixtures for tables with composite primary keys.

  fatkodima

• Fix annotate comments to propagate to update_all/delete_all.

  fatkodima

• Fix checking whether an unpersisted record is include?d in a strictly
  loaded has_and_belongs_to_many association.

  Hartley McGuire

• Fix inline has_and_belongs_to_many fixtures for tables with composite primary keys.

  fatkodima

• create_or_find_by will now correctly rollback a transaction.

  When using create_or_find_by, raising a ActiveRecord::Rollback error
  in a after_save callback had no effect, the transaction was committed
  and a record created.

  Edouard Chin

• Gracefully handle Timeout.timeout firing during connection configuration.

  Use of Timeout.timeout could result in improperly initialized database connection.

  This could lead to a partially configured connection being used, resulting in various exceptions,
  the most common being with the PostgreSQLAdapter raising undefined method 'key?' for nil
  or TypeError: wrong argument type nil (expected PG::TypeMap).

...

Active Support

• No changes.

Active Model

• No changes.

Active Record

• Gracefully handle Timeout.timeout firing during connection configuration.

  Use of Timeout.timeout could result in improperly initialized database connection.

  This could lead to a partially configured connection being used, resulting in various exceptions,
  the most common being with the PostgreSQLAdapter raising undefined method key?' for nilorTypeError: wrong argument type nil (expected PG::TypeMap)`.

  Jean Boussier

• Fix error handling during connection configuration.

  Active Record wasn't properly handling errors during the connection configuration phase.
  This could lead to a partially configured connection being used, resulting in various exceptions,
  the most common being with the PostgreSQLAdapter raising undefined method key?' for nilorTypeError: wrong argument type nil (expected PG::TypeMap)`.

  Jean Boussier

• Fix prepared statements on mysql2 adapter.

  Jean Boussier

• Fix a race condition in ActiveRecord::Base#method_missing when lazily defining attributes.

  If multiple thread were concurrently triggering attribute definition on the same model,
  it could result in a NoMethodError being raised.

  Jean Boussier

Action View

• No changes.

Action Pack

• No changes.

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• Fixed compatibility with redis gem 5.4.1

  Jean Boussier

Active Storage

• No changes.

Action Mailbox

• No changes.

Action Text

• No changes.

Railties

• No changes.

Guides

• No changes.