Bump rails from 7.2.2 to 8.0.0 #999

dependabot · 2024-11-07T23:46:08Z

Bumps rails from 7.2.2 to 8.0.0.

Release notes

8.0.0

Active Support
Remove deprecated support to passing an array of strings to ActiveSupport::Deprecation#warn.

Rafael Mendonça França

Remove deprecated support to setting attr_internal_naming_format with a @ prefix.

Rafael Mendonça França

Remove deprecated ActiveSupport::ProxyObject.

Rafael Mendonça França

Don't execute i18n watcher on boot. It shouldn't catch any file changes initially, and unnecessarily slows down boot of applications with lots of translations.

Gannon McGibbon, David Stosik
Fix ActiveSupport::HashWithIndifferentAccess#stringify_keys to stringify all keys not just symbols.

Previously:
{ 1 => 2 }.with_indifferent_access.stringify_keys[1] # => 2
After this change:
{ 1 => 2 }.with_indifferent_access.stringify_keys["1"] # => 2
This change can be seen as a bug fix, but since it behaved like this for a very long time, we're deciding to not backport the fix and to make the change in a major release.

Jean Boussier
Include options when instrumenting ActiveSupport::Cache::Store#delete and ActiveSupport::Cache::Store#delete_multi.

Adam Renberg Tamm

Print test names when running rails test -v for parallel tests.

John Hawthorn, Abeid Ahmed

Deprecate Benchmark.ms core extension.

The benchmark gem will become bundled in Ruby 3.5

... (truncated)

Commits

dd8f718 Preparing for 8.0.0 release
f88e6ae Merge pull request #53550 from tysongach/devcontainer-links
43425c8 Bump deprecation message to 8.1
38bf52d Add yarn.lock to allowed dirty files
3de9afc Merge pull request #53546 from matthewd/dst_deprecation_fix
ebcb66e Merge pull request #53542 from Uaitt/remove-redundant-period-in-security-guides
4f042a8 Merge pull request #53520 from Earlopain/fix-backtrace-env-gem-paths
74608e5 Merge pull request #53533 from Earlopain/no-docs-for-rackup
8ee2d3e Merge pull request #53504 from SleeplessByte/fix/anchor-scroll-mobile
473f2b2 Merge pull request #53515 from k-tsuchiya-jp/fix-53467
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

github-actions · 2024-11-07T23:46:19Z

⚠️ This repo is Continuously Deployed: make sure you follow the guidance ⚠️

brucebolt · 2024-11-11T09:41:48Z

Trello card

dependabot · 2024-12-10T23:46:59Z

A newer version of rails exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

Bumps [rails](https://github.com/rails/rails) from 7.2.2 to 8.0.0. - [Release notes](https://github.com/rails/rails/releases) - [Commits](rails/rails@v7.2.2...v8.0.0) --- updated-dependencies: - dependency-name: rails dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>

This was introduced in the rails 8.0 upgrade because of deprecation warnings. Without the new default file we no longer get the warnings so i've removed the line from the application config.

mike3985

I've left some questions and comments. I haven't got very far into the review, but thought it might be more productive to leave the comments now and start another review when you've responded because I anticipated more of the same kind of "why is this being changed?" etc etc

mike3985 · 2025-01-16T11:06:51Z

Gemfile.lock

@@ -439,7 +439,7 @@ GEM
      nokogiri (>= 1.6)
    rails-html-sanitizer (1.6.2)
      loofah (~> 2.21)
-      nokogiri (~> 1.14)
+      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)


Did this change really result from running rails app:update?

mike3985 · 2025-01-16T11:18:13Z

config/environments/development.rb

  if Rails.root.join("tmp/caching-dev.txt").exist?
    config.action_controller.perform_caching = true
    config.action_controller.enable_fragment_cache_logging = true
-
-    config.cache_store = :memory_store


So are these conditional cache_store settings just old Rails default config? I wasn't sure when I was running my own updates

Yep: rails/rails@9c8716a

mike3985 · 2025-01-16T11:19:41Z

config/environments/development.rb

  # Print deprecation notices to the Rails logger.
  config.active_support.deprecation = :log

-  # Raise exceptions for disallowed deprecations.
-  config.active_support.disallowed_deprecation = :raise


Is this setting now the default in development or something?

I don't think the underlying default changed. It looks like the setting was just removed because DHH thought it wouldn't be useful for new apps: rails/rails@506d728

mike3985 · 2025-01-16T11:20:44Z

config/environments/development.rb

-
-  config.hosts += [
-    "authenticating-proxy.dev.gov.uk",
-  ]


What difference does this change make?

mike3985 · 2025-01-16T11:22:14Z

config/environments/production.rb


-  # Disable serving static files from `public/`, relying on NGINX/Apache to do so instead.
-  config.public_file_server.enabled = ENV["RAILS_SERVE_STATIC_FILES"].present?


What's the thinking behind removing this?

This is also a changed default that we skipped updating in 7.1/7.2:

rails/rails@e8f481b

rails/rails@dd428f1

rails/rails@6360b73

mike3985 · 2025-01-16T11:23:43Z

config/environments/production.rb


  # Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
-  # config.force_ssl = true
+  config.force_ssl = true


Is this correct? I thought our infrastructure resulted in our Rails apps only ever working with HTTP requests (because SSL is terminated at the edge of our network)?

(I'm less familiar with assume_ssl, so the same reasoning might not apply there)

mike3985 · 2025-01-16T11:25:49Z

config/environments/production.rb

  config.log_level = ENV.fetch("RAILS_LOG_LEVEL", "info")

-  # Use a different cache store in production.
+  # Prevent health checks from clogging up the logs.
+  config.silence_healthcheck_path = "/up"


We don't use /up..?

mike3985 · 2025-01-16T11:28:47Z

config/environments/production.rb

  # Do not dump schema after migrations.
  config.active_record.dump_schema_after_migration = false

+  # Only use :id for inspections in production.
+  config.active_record.attributes_for_inspect = [:id]


Is this a change to the existing production behaviour? If so, is it useful?

dependabot bot added dependencies ruby Pull requests that update Ruby code labels Nov 7, 2024

brucebolt marked this pull request as draft November 11, 2024 09:41

JonathanHallam force-pushed the dependabot/bundler/rails-8.0.0 branch 3 times, most recently from 377f03c to 5e000ce Compare January 16, 2025 10:00

dependabot bot and others added 5 commits January 16, 2025 10:00

Run app:update

837029d

Fix deprecation warnings

e544d0e

Bump defaults to 8.0

80fce2e

Remove time zone preservation

9229aa2

This was introduced in the rails 8.0 upgrade because of deprecation warnings. Without the new default file we no longer get the warnings so i've removed the line from the application config.

JonathanHallam force-pushed the dependabot/bundler/rails-8.0.0 branch from 5e000ce to 9229aa2 Compare January 16, 2025 10:00

JonathanHallam marked this pull request as ready for review January 16, 2025 10:01

mike3985 reviewed Jan 16, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump rails from 7.2.2 to 8.0.0 #999

Bump rails from 7.2.2 to 8.0.0 #999

dependabot bot commented on behalf of github Nov 7, 2024 •

edited

Loading

github-actions bot commented Nov 7, 2024

brucebolt commented Nov 11, 2024

dependabot bot commented on behalf of github Dec 10, 2024

mike3985 left a comment

mike3985 Jan 16, 2025

mike3985 Jan 16, 2025

yndajas Jan 16, 2025

mike3985 Jan 16, 2025

yndajas Jan 16, 2025 •

edited

Loading

mike3985 Jan 16, 2025

mike3985 Jan 16, 2025

yndajas Jan 16, 2025 •

edited

Loading

mike3985 Jan 16, 2025

mike3985 Jan 16, 2025

mike3985 Jan 16, 2025

mike3985 Jan 16, 2025


		# Disable serving static files from `public/`, relying on NGINX/Apache to do so instead.
		config.public_file_server.enabled = ENV["RAILS_SERVE_STATIC_FILES"].present?

Bump rails from 7.2.2 to 8.0.0 #999

Are you sure you want to change the base?

Bump rails from 7.2.2 to 8.0.0 #999

Conversation

dependabot bot commented on behalf of github Nov 7, 2024 • edited Loading

8.0.0

Active Support

github-actions bot commented Nov 7, 2024

brucebolt commented Nov 11, 2024

dependabot bot commented on behalf of github Dec 10, 2024

mike3985 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

yndajas Jan 16, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

yndajas Jan 16, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dependabot bot commented on behalf of github Nov 7, 2024 •

edited

Loading

yndajas Jan 16, 2025 •

edited

Loading

yndajas Jan 16, 2025 •

edited

Loading