Friday, July 25, 2025

PostgreSQL 18 warnings, secure password improvements and more!

Posted by vipulnsward

Hi, it’s Vipul. Let’s explore this week’s changes in the Rails codebase.

Avoid dynamic encrypting in generated fixtures
Fixtures for passwords now generate a static hash. Previously, fixtures with password digest attributes regenerated the hash on each test run.

Don’t add bundler platforms for JRuby
Fixes Rails Apps on JRuby by not adding extra platforms that cause problems when installing gems.

Make ActiveSupport::Gzip.compress deterministic
ActiveSupport::Gzip.compress now produces consistent output by always setting the gzip timestamp to zero, which eliminates flaky tests while comparing compressed data.

Fix HashWithIndifferentAccess#transform_keys! to avoid collisions
Fixes a bug where changing keys in a hash could accidentally lose some keys if they clashed.

Emit a warning when pg gem < 1.6.0 is used with PostgreSQL 18+
Adds a warning if a Rails project uses PostgreSQL 18+ with an outdated pg gem(< 1.6.0) to prevent compatibility issues of PG::Connection#cancel.

Fix Action Cable compatibility with redis-rb 5.4.1
Makes Action Cable compatible with redis-rb 5.4.1, as an incompatibility bug in redis-rb is now resolved.

Remove unnecessary calls to the GCP metadata server
Cuts out redundant calls to GCP’s metadata server within auth logic, reducing potential latency and server load.

Add load-hooks for Active Model autoloaded constants referenced in initializers
This change added load hooks for active_model_error and active_model_secure_password, making it easier for initializers to reference Active Model constants that should be autoloaded.

has_secure_password: fix password validation.
Ensures password confirmation is validated even if the original password contains only whitespace, making has_secure_password behavior more consistent.

Add render json to health
Enables Rails health controller to respond in JSON, improving support for API-only applications.

Add ActiveRecord::Tasks::AbstractTasks for subclassing per adapter behavior
Introduces a base class that allows database adapters to customize task behavior, thereby improving adapter-specific handling.

Avoid purging the test database when loading a schema
Prevents purging of the test database while loading a database schema, improving test suite reliability.

gitignore all key files in config/credentials
Configures .gitignore to exclude all files in config/credentials, protecting key files from accidental commits.

Make nonce: false remove the nonce attribute for javascript_tag, javascript_include_tag and stylesheet_link_tag
Setting nonce: false now removes the nonce attribute for javascript_tag, javascript_include_tag, and stylesheet_link_tag.

Allow custom domain extractor class on ActionDispatch::Http::URL
Allows the use of a custom class for domain and subdomain extraction. If no custom extractor is set, a new default extractor, ActionDispatch::Http::URL::DomainExtractor, processes domains.

Read ActionText::Attachment.tag_name in Action Text Fixtures
Updates Action Text fixture to use the right tag name for Action Text attachments if config.action_text.attachment_tag_name is set.

Action View: Reduce public API of tag helper
Cleans up the public API surface of the tag helper for maintainability and clarity.


You can view the whole list of changes here. We had 29 contributors to the Rails codebase this past week!

Until next time!

Subscribe to get these updates mailed to you.