New version of all of rails (6.0.4) produced dependency conflicts

[depfu]

We've tested your project with an updated dependency and got errors while installing the dependencies.

This version is either within the version range you specified or you haven't specified a version/range. To be able to test your project with the new version, we've taken the liberty of pinning the version for this branch and pull request.

name	version specification	new version
rails		6.0.4

Unfortunately, the build failed while installing dependencies. This means that while the new version is within the specified range, a version conflict between two or more packages will prohibit this version from being installed.

As this breaks fresh installs of your package, we've left this pull request open for you to investigate.

What changed?

✳️ rails ( → 6.0.4) · Repo

Release Notes

6.0.4

Active Support

• Fixed issue in ActiveSupport::Cache::RedisCacheStore not passing options
  to read_multi causing fetch_multi to not work properly.

  Rajesh Sharma

• with_options copies its options hash again to avoid leaking mutations.

  Fixes #39343.

  Eugene Kenny

Active Model

• No changes.

Active Record

• Only warn about negative enums if a positive form that would cause conflicts exists.

  Fixes #39065.

  Alex Ghiculescu

• Allow the inverse of a has_one association that was previously autosaved to be loaded.

  Fixes #34255.

  Steven Weber

• Reset statement cache for association if table_name is changed.

  Fixes #36453.

  Ryuta Kamizono

• Type cast extra select for eager loading.

  Ryuta Kamizono

• Prevent collection associations from being autosaved multiple times.

  Fixes #39173.

  Eugene Kenny

• Resolve issue with insert_all unique_by option when used with expression index.

  When the :unique_by option of ActiveRecord::Persistence.insert_all and
  ActiveRecord::Persistence.upsert_all was used with the name of an expression index, an error
  was raised. Adding a guard around the formatting behavior for the :unique_by corrects this.

  Usage:

  create_table :books, id: :integer, force: true do |t|
    t.column :name, :string
    t.index "lower(name)", unique: true
  end
  Book.insert_all [{ name: "MyTest" }], unique_by: :index_books_on_lower_name

  Fixes #39516.

  Austen Madden

• Fix preloading for polymorphic association with custom scope.

  Ryuta Kamizono

• Allow relations with different SQL comments in the or method.

  Takumi Shotoku

• Resolve conflict between counter cache and optimistic locking.

  Bump an Active Record instance's lock version after updating its counter
  cache. This avoids raising an unnecessary ActiveRecord::StaleObjectError
  upon subsequent transactions by maintaining parity with the corresponding
  database record's lock_version column.

  Fixes #16449.

  Aaron Lipman

• Fix through association with source/through scope which has joins.

  Ryuta Kamizono

• Fix through association to respect source scope for includes/preload.

  Ryuta Kamizono

• Fix eager load with Arel joins to maintain the original joins order.

  Ryuta Kamizono

• Fix group by count with eager loading + order + limit/offset.

  Ryuta Kamizono

• Fix left joins order when merging multiple left joins from different associations.

  Ryuta Kamizono

• Fix index creation to preserve index comment in bulk change table on MySQL.

  Ryuta Kamizono

• Change remove_foreign_key to not check :validate option if database
  doesn't support the feature.

  Ryuta Kamizono

• Fix the result of aggregations to maintain duplicated "group by" fields.

  Ryuta Kamizono

• Do not return duplicated records when using preload.

  Bogdan Gusiev

Action View

• SanitizeHelper.sanitized_allowed_attributes and SanitizeHelper.sanitized_allowed_tags
  call safe_list_sanitizer's class method

  Fixes #39586

  Taufiq Muhammadi

Action Pack

• Accept base64_urlsafe CSRF tokens to make forward compatible.

  Base64 strict-encoded CSRF tokens are not inherently websafe, which makes
  them difficult to deal with. For example, the common practice of sending
  the CSRF token to a browser in a client-readable cookie does not work properly
  out of the box: the value has to be url-encoded and decoded to survive transport.

  In Rails 6.1, we generate Base64 urlsafe-encoded CSRF tokens, which are inherently
  safe to transport. Validation accepts both urlsafe tokens, and strict-encoded
  tokens for backwards compatibility.

  In Rails 5.2.5, the CSRF token format is accidentally changed to urlsafe-encoded.
  If you upgrade apps from 5.2.5, set the config urlsafe_csrf_tokens = true.

  Rails.application.config.action_controller.urlsafe_csrf_tokens = true

  Scott Blum, Étienne Barrié

• Signed and encrypted cookies can now store false as their value when
  action_dispatch.use_cookies_with_metadata is enabled.

  Rolandas Barysas

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• The Poppler PDF previewer renders a preview image using the original
  document's crop box rather than its media box, hiding print margins. This
  matches the behavior of the MuPDF previewer.

  Vincent Robert

Action Mailbox

• No changes.

Action Text

• No changes.

Railties

• Allow relative paths with trailing slashes to be passed to rails test.

  Eugene Kenny

• Return a 405 Method Not Allowed response when a request uses an unknown HTTP method.

  Fixes #38998.

  Loren Norman

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 7 commits:

• Preparing for 6.0.4 release
• Update CHANGELOG
• Merge pull request #42244 from hahmed/fix-invalid-statement-compile-error
• Merge pull request #41528 from yahonda/pg_where_with_set
• Merge pull request #42308 from Shopify/fix-ruby-head-builds
• Escape allow list hosts correctly
• Merge branch '6-0-sec' into 6-0-stable

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)