Repository navigation
Update Rails to 7.0.8.7 - #1535
Open
benrfairless wants to merge 3 commits into
Open
benrfairless wants to merge 3 commits into
benrfairless wants to merge 3 commits into
Conversation
benrfairless
added this pull request to stack #1531
September 11, 2026 09:25
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
4 tasks done
benrfairless
marked this pull request as ready for review
September 11, 2026 10:10
Br3nda
force-pushed
the
chore/1355-rails-7-0-bump
branch
from
September 15, 2026 06:32
5e03247 to
fdbf1d1
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| activerecord (= 6.1.7.10) | ||
| activestorage (= 6.1.7.10) | ||
| activesupport (= 6.1.7.10) | ||
| rails (7.0.8.7) |
Br3nda
force-pushed
the
chore/1355-rails-7-0-bump
branch
from
September 15, 2026 07:12
fdbf1d1 to
aed7f36
Compare
Br3nda
force-pushed
the
chore/1355-rails-7-0-bump
branch
from
September 15, 2026 07:35
aed7f36 to
26ccbb9
Compare
The Phase 2 Rails hop of doc/UPGRADE_PATH.md (#1355), mined from the stale chore/rails_70_and_ruby_30 branch (PR #1424) rather than rebasing it. 7.0.8.7 is the final 7.0.x release. Alongside the framework bump: - Add sprockets-rails explicitly: Rails 7.0 no longer depends on it, and we are keeping the Sprockets asset pipeline (no Propshaft migration in this hop). - ActiveAdmin resolves to 3.5.2 (2.x does not support Rails 7.0), which also lifts the floor past the CVE-2023-51763/CVE-2024-37031 fixes the old Gemfile comment tracked separately. Its Ransack 4 dependency requires models to allowlist searchable attributes, so ApplicationRecord restores the previous allow-everything behaviour; Ransack is only reachable through the admin-only ActiveAdmin UI. - db_backup_utils: to_s(:human_size) is deprecated in 7.0; use ActiveSupport::NumberHelper.number_to_human_size. - owners/scrapers controllers: redirect_back(fallback_location:) is soft-deprecated; RuboCop's Rails/RedirectBackOrTo autocorrects to redirect_back_or_to. - Regenerate Sorbet gem RBIs (bundle exec tapioca gem). srb tc reports 101 errors against 100 on the previous commit; the new error is in regenerated gem RBIs, not app code, and srb tc is not enforced by CI today. - AGENTS.md: record the new Rails version. Part of #1355 Assisted-by: OpenCode:anthropic.claude-fable-5 Signed-off-by: Ben Fairless <[email protected]>
Ran bin/rails app:update fresh and kept our customisations where the generator clobbered them: application.rb (selective framework requires and load_defaults 6.1, which a follow-up PR raises), the three environment files (SMTP settings and the #1498 deprecation-raise guard), and the assets and inflections initializers. Adopted: 7.0 binstub and bin/setup boilerplate, the rewritten content_security_policy.rb template (still all commented), the filter_parameter_logging comment, and new_framework_defaults_7_0.rb with every flag still commented out. Follow-up commits enable one flag each. The generator's Active Storage artefacts (storage.yml, three migrations, config.active_storage.service lines) are dropped: #1497 removed Active Storage and config/application.rb does not load its engine. config/boot.rb keeps require "logger" with the comment updated to name Rails 7.0; ActiveSupport below 7.1 still relies on it being loaded. Part of #1355 Assisted-by: OpenCode:anthropic.claude-fable-5 Signed-off-by: Ben Fairless <[email protected]>
Rails 7.0 dumps a versioned schema header (ActiveRecord::Schema[7.0]) and makes datetime precision explicit: 7.0's default for new datetime columns is microsecond precision, so existing columns dump as precision: nil. Running db:migrate rewrites the whole file accordingly. No schema change, only dump format. Part of #1355 Assisted-by: OpenCode:anthropic.claude-fable-5 Signed-off-by: Ben Fairless <[email protected]>
ianheggie-oaf
force-pushed
the
chore/1355-rails-7-0-bump
branch
from
September 22, 2026 01:57
26ccbb9 to
25ae33d
Compare
ianheggie-oaf
approved these changes
Sep 22, 2026
ianheggie-oaf
left a comment
ianheggie-oaf
left a comment
Member
There was a problem hiding this comment.
Approved - LGTM at a glance, too long to read thoroughly, trusting it was tested
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
Phase 2 Rails hop from doc/UPGRADE_PATH.md: Rails 6.1.7.10 to 7.0.8.7 (the final 7.0.x release), keeping the Sprockets asset pipeline by adding
sprockets-railsexplicitly now Rails no longer depends on it. Framework defaults stay at 6.1 here; #1536 adopts the 7.0 defaults one flag at a time.ActiveAdmin moves 2.12.0 → 3.5.2 because 2.x does not support Rails 7.0, which also lifts the floor past the CVE-2023-51763/CVE-2024-37031 fixes the old Gemfile comment tracked separately; its Ransack 4 dependency now requires searchable-attribute allowlists, so
ApplicationRecordrestores the previous allow-everything behaviour (Ransack is only reachable through the admin-only ActiveAdmin UI).rails app:updateoutput is adopted selectively, keeping the selective framework requires, SMTP settings, the #1498 deprecation-raise guard and the assets/inflections customisations, and dropping the generator's Active Storage artefacts (#1497 removed Active Storage).chore/rails_70_and_ruby_30branch (PR upgrade morph from rails 6.1 to rails 7.0 and ruby 3.0 [Plan Q2 2026] #1424) rather than rebasing it.to_s(:human_size)→ActiveSupport::NumberHelperin the DB backup tasks;redirect_back(fallback_location:)→redirect_back_or_tovia RuboCop's Rails/RedirectBackOrTo.Type of change
How this was checked
In the containerised dev environment: CI profile 854 examples / 0 failures (coverage 81.46% against the 80.05 threshold),
rubocopandhaml-lintclean,srb tcat 101 errors with the one new error in regenerated gem RBIs rather than app code (not CI-enforced), zero Rails deprecation warnings under the #1498 guard.CodeRabbit review of the full #1534-#1537 stack diff: 0 findings.
/code-review(or equivalent): fixed any concerns (and rechecked), linked follow-up issues above, or noted why they are not important aboveAssisted-by: OpenCode:anthropic.claude-fable-5