[dependabot]

Bumps the dependencies group with 15 updates in the / directory:

Package	From	To
rails	8.1.3.1	8.1.4
sqlite3	2.9.6	2.10.1
listen	3.10.0	3.10.1
simplecov	1.3.0	1.3.2
tzinfo-data	1.2026.4	1.2026.5
omniauth	2.1.4	2.3.1
omniauth-oauth2	1.9.0	1.10.0
cancancan	3.6.1	3.7.0
github-markup	6.0.0	6.1.1
kaminari	1.2.2	1.3.0
whenever	1.1.3	1.1.4
lograge	0.15.0	0.15.1
honeybadger	6.9.2	6.10.0
pg	1.6.3	1.7.0
faraday	2.14.4	2.15.0

Updates rails from 8.1.3.1 to 8.1.4

Release notes

Sourced from rails's releases.

8.1.4

Active Support

• Fix the debug error page rendering for SyntaxErrors with multi-line messages.

  Marco Roth

• Make ActiveSupport::JSON.decode compatible with the upcoming json 3.0 gem.

  Earlopain

• Fix number_to_human_size crashing for sizes above a terabyte by supporting petabyte, exabyte, and zettabyte storage units.

  Kenta Ishizaki

• Fix Range#sole raising NoMethodError when the enumerable core extension isn't already loaded.

  Kenta Ishizaki

• Fix ActiveSupport::Cache::FileStore raising NameError for FileUtils when fileutils isn't already loaded.

  Kenta Ishizaki

• Fix Enumerable#in_order_of with filter: true dropping nil elements explicitly named in the series.

  Kenta Ishizaki

• Keep HashWithIndifferentAccess#filter returning a HashWithIndifferentAccess instead of a plain Hash.

  Kenta Ishizaki

• Fix number_to_human and number_to_human_size crashing when :precision is nil.

  Kenta Ishizaki

• Fix ActiveSupport::InheritableOptions#to_h to recursively flatten nested InheritableOptions parents.

  Andrew Novoselac

• Fix ActiveSupport::StructuredEventSubscriber.debug_only leaking debug-only methods across subscriber subclasses.

  Kenta Ishizaki

... (truncated)

Commits

• c3466ea Preparing for 8.1.4 release
• 334dc3e Merge pull request #58854 from carlosdanielpohlod/strict-locals-ascii-only-body
• 8df6693 Merge pull request #58827 from rails/backport-alias-fallback-8-1-stable
• 2ed2c88 Define read_attribute_for_validation instead of aliasing send
• 2616145 Merge pull request #56705 from p8/activemodel/fix-read-attr-for-serialization...
• 20abac3 Merge pull request #58817 from yahonda/fix-alias-fallback-to-object-in-attrib...
• 2670772 Merge pull request #58733 from kwestein/create-or-find-by-deadlock
• 8236300 Merge pull request #58806 from Shopify/hm-wnqzpryypymkrxtn
• e6288a8 Update CHANGELOGs for 8-1-stable backports
• 44a7fd4 Merge pull request #58799 from e-akashsaini/fix-tuple-where-key-corrupting-at...
• Additional commits viewable in compare view

Updates sqlite3 from 2.9.6 to 2.10.1

Release notes

Sourced from sqlite3's releases.

2.10.1 / 2026-10-19

Dependencies

• Vendored sqlite is updated to v3.54.1 (from v3.54.0). This release contains a fix for a possible heap buffer overflow on 32-bit builds, including the precompiled x86-linux-gnu and x86-linux-musl gems. #756 @​flavorjones

Improved

• Database#define_aggregator no longer creates an anonymous class for each aggregate function it defines. Each invocation of the function still runs on a clone of the template object. #752 @​jhawthorn

48390cc2b809acd1280f5c9daaf3c2013833adb8a5ece9b0634f708651080ccd  gems/sqlite3-2.10.1-aarch64-linux-gnu.gem
db1bcddf98e4eeea80ca896f56aa3f9468364fa1ee8e042ddc6b628b5092fabb  gems/sqlite3-2.10.1-aarch64-linux-musl.gem
34a67a3fe84f705a0fad6f7aa4541579300644b9acdf414797e59929a6e3528b  gems/sqlite3-2.10.1-arm-linux-gnu.gem
e317adb8979b57dafd999b54410b4050296aa5d00caa664e3f75d876e2ae90e8  gems/sqlite3-2.10.1-arm-linux-musl.gem
45f74dad0a8ee57ae5fadfac39bf160d1f09fb0484a442223310d869cd957d92  gems/sqlite3-2.10.1-arm64-darwin.gem
bf5c7d7e8ce0253456777432c826a6f8f2c06e891686f1157f44548a53416a87  gems/sqlite3-2.10.1-x64-mingw-ucrt.gem
7b3f9eff7c5c26551800649312796203ded8a505bcdaf30cd915dd9ae5e9575c  gems/sqlite3-2.10.1-x86-linux-gnu.gem
8f193eb1b4a66156baaaedafac0de091533cf840f4b78cf3fa2019cde0388f10  gems/sqlite3-2.10.1-x86-linux-musl.gem
00d1cd2e8ecff5ad9fffa0c97de59d4f85c5fc54eada2587d53ca0bd933b7a5d  gems/sqlite3-2.10.1-x86_64-darwin.gem
661ecede31e23a412059cd8c684ed84e332f64f167e4a90902cf99e8ea2c8718  gems/sqlite3-2.10.1-x86_64-linux-gnu.gem
67c7c5443a930157b4e148f0f4cb9ab998ee7ecfa8ce56879a6b56d1d742b2be  gems/sqlite3-2.10.1-x86_64-linux-musl.gem
7ae52c91f5b766882cf44d2dbd26d2dbbb841606f0ec78df3be019bd07b13ff4  gems/sqlite3-2.10.1.gem

2.10.0 / 2026-10-13

Dependencies

• Vendored sqlite is updated to v3.54.0 (from v3.53.2). #750 @​flavorjones

  Notable changes in this version include:

  • ALTER TABLE now raises an error when adding, renaming, or dropping a column named ROWID, _ROWID_, or OID.
  • The authorizer callback is now invoked for SQL functions in the DEFAULT clauses of CREATE TABLE statements.
  • SQLite no longer supports Windows XP or earlier. On Windows, the precompiled gem and any installation that compiles the vendored sqlite now require Windows Vista or later.

Added

• ResultSet#each and #each_hash return an Enumerator when called without a block. Previously they raised LocalJumpError. #656 @​kch
• Introduce Database#serialize, which returns a database as a binary string, and Database#deserialize, which replaces a database with the contents of such a string. These wrap sqlite3_serialize() and sqlite3_deserialize(). Both methods are defined only when SQLite was compiled without SQLITE_OMIT_DESERIALIZE, and Database#deserialize also requires that the loaded SQLite is v3.54.0 or later. An image of a database in WAL mode cannot be queried after deserializing; see the Database#deserialize documentation. #685 @​Maaarcocr

Fixed

... (truncated)

Changelog

Sourced from sqlite3's changelog.

2.10.1 / 2026-10-19

Dependencies

• Vendored sqlite is updated to v3.54.1 (from v3.54.0). This release contains a fix for a possible heap buffer overflow on 32-bit builds, including the precompiled x86-linux-gnu and x86-linux-musl gems. #756 @​flavorjones

Improved

• Database#define_aggregator no longer creates an anonymous class for each aggregate function it defines. Each invocation of the function still runs on a clone of the template object. #752 @​jhawthorn

2.10.0 / 2026-10-13

Dependencies

• Vendored sqlite is updated to v3.54.0 (from v3.53.2). #750 @​flavorjones

  Notable changes in this version include:

  • ALTER TABLE now raises an error when adding, renaming, or dropping a column named ROWID, _ROWID_, or OID.
  • The authorizer callback is now invoked for SQL functions in the DEFAULT clauses of CREATE TABLE statements.
  • SQLite no longer supports Windows XP or earlier. On Windows, the precompiled gem and any installation that compiles the vendored sqlite now require Windows Vista or later.

Added

• ResultSet#each and #each_hash return an Enumerator when called without a block. Previously they raised LocalJumpError. #656 @​kch
• Introduce Database#serialize, which returns a database as a binary string, and Database#deserialize, which replaces a database with the contents of such a string. These wrap sqlite3_serialize() and sqlite3_deserialize(). Both methods are defined only when SQLite was compiled without SQLITE_OMIT_DESERIALIZE, and Database#deserialize also requires that the loaded SQLite is v3.54.0 or later. An image of a database in WAL mode cannot be queried after deserializing; see the Database#deserialize documentation. #685 @​Maaarcocr

Fixed

• Fix Database#statement_timeout= interrupting statements almost immediately instead of after the timeout elapsed, including re-executed prepared statements and calls to Database#execute_batch2. #737 @​palkan @​flavorjones

Improved

• On CRuby, Statement#types allocates fewer strings. Each declared type is downcased and interned in C, instead of allocating two strings per column. #743 @​jhawthorn

Changed

• ResultSet#each and #each_hash return the result set when called with a block. As a consequence, Database#execute and #execute2 called with a block return the closed ResultSet instead of nil. #656 @​kch
• Statement#columns and Statement#types return frozen arrays, and the strings in Statement#types are frozen. Code that mutates them now raises FrozenError. #743 @​jhawthorn
• Statement#column_decltype and Statement#types return UTF-8 strings. Previously they returned ASCII-8BIT strings. #743 @​jhawthorn

Commits

• f465056 version bump to v2.10.1
• 3fdb2d0 build(deps): bump ruby/setup-ruby (#755)
• eac117b build(deps-dev): update rubocop-minitest requirement (#754)
• 1102a6f build(deps-dev): update rake-compiler requirement from 1.3.1 to 1.3.2 (#753)
• 90d52d5 dep: update vendored sqlite to 3.54.1 (#756)
• 03af202 Merge pull request #752 from jhawthorn/aggregator-factories
• 5e65275 Replace define_aggregator's generated proxy class with a factory object
• 07186c3 version bump to v2.10.0
• 7ad6fc0 feat: Add Database#serialize and Database#deserialize methods (#685)
• c35ae35 Fix statement_timeout interrupting most queries (#737)
• Additional commits viewable in compare view

Updates listen from 3.10.0 to 3.10.1

Release notes

Sourced from listen's releases.

v3.10.1

What's Changed

• Fix flaky specs on TruffleRuby by @​andrykonchin in guard/listen#597
• CI: Run all tests on Windows in addition by @​larskanis in guard/listen#585
• Preserve independent listener filters across updates by @​OskarEichler in guard/listen#599
• Revert "Fix flaky specs on TruffleRuby" by @​rymai in guard/listen#603
• Remove outdated note about performance by @​quadule in guard/listen#586
• Avoid selecting the filesystem adapter twice by @​OskarEichler in guard/listen#600
• Fix flaky specs on TruffleRuby by @​andrykonchin in guard/listen#605
• [LOW] Bound directory scanning under filesystem churn by @​OskarEichler in guard/listen#601
• [LOW] Pin workflow actions and token permissions by @​OskarEichler in guard/listen#602

New Contributors

• @​andrykonchin made their first contribution in guard/listen#597
• @​OskarEichler made their first contribution in guard/listen#599
• @​quadule made their first contribution in guard/listen#586

Full Changelog: guard/listen@v3.10.0...v3.10.1

Commits

• 6fbde9f Bump VERSION to 3.10.1
• d53f6d9 Merge pull request #602 from OskarEichler/codex/security-pin-workflow-actions
• d6bb203 Merge pull request #601 from OskarEichler/codex/security-bound-directory-scans
• fa07357 Merge pull request #605 from andrykonchin/ak/fix-flaky-specs-on-truffleruby
• b8360fd Refactor and simplify adapter/polling_spec.rb test because now stopping is sy...
• e2173ed Prevent spawning background threads in the Linux adapter unit tests
• a63463f Stop threads synchronously
• c5413b7 Merge pull request #600 from OskarEichler/audit/select-adapter-once
• 751b3f8 Merge pull request #586 from quadule/patch-1
• 309cf5f Merge pull request #603 from guard/revert-597-ak/fix-flaky-specs-on-truffleruby
• Additional commits viewable in compare view

Updates simplecov from 1.3.0 to 1.3.2

Release notes

Sourced from simplecov's releases.

v1.3.2

Bugfixes

• The HTML report is generated again on Rails 8.1.4 when a parallelize_teardown hook calls SimpleCov.result. Rails 8.1.4 runs those hooks in the parent process as well as in each worker, and collecting the result there stops Coverage, which the exit handler took as a sign that nothing was left to report. The exit handler now formats a result that was already collected. See simplecov-ruby/simplecov#1308.

v1.3.1

Bugfixes

• cover_views compiles templates on Rails main again. Rails removed ActionView::Template.registered_template_handler; the lookup reads ActionView::Template::Handlers.template_handlers and still skips an extension with no handler. See simplecov-ruby/simplecov#1300.
• require "simplecov" works again on JRuby on Windows, where 1.3.0 raised LoadError: Could not open library '.../libprism.dll'. Prism's FFI backend cannot open its native library there, and 1.3.0 required Prism as soon as SimpleCov loaded. Prism now loads only when branch or method coverage needs the static extractor, which a line-only run never does. Where it cannot load at all, the extractor falls back to empty branch and method tables for never-loaded files, as it did before 1.3.0. See simplecov-ruby/simplecov#1299.
• simplecov affected --run works on JRuby on Windows, where it crashed with NoMethodError because Process.wait2 answers no status there. On that platform the runner starts through Kernel#system instead.
• simplecov serve refuses a symlink that points outside the report on JRuby on Windows too. JRuby's File.realpath follows no symlinks there, so serve would have served the file the link pointed to, and simplecov clean and the coverage.json lookup compared paths that were never resolved. On JRuby the CLI now resolves paths through the JDK.

Changelog

Sourced from simplecov's changelog.

[1.3.2] - 2026-09-30

Fixed

• The HTML report is generated again on Rails 8.1.4 when a parallelize_teardown hook calls SimpleCov.result. Rails 8.1.4 runs those hooks in the parent process as well as in each worker, and collecting the result there stops Coverage, which the exit handler took as a sign that nothing was left to report. The exit handler now formats a result that was already collected. See #1308.

[1.3.1] - 2026-09-24

Fixed

• cover_views compiles templates on Rails main again. Rails removed ActionView::Template.registered_template_handler; the lookup reads ActionView::Template::Handlers.template_handlers and still skips an extension with no handler. See #1300.
• require "simplecov" works again on JRuby on Windows, where 1.3.0 raised LoadError: Could not open library '.../libprism.dll'. Prism's FFI backend cannot open its native library there, and 1.3.0 required Prism as soon as SimpleCov loaded. Prism now loads only when branch or method coverage needs the static extractor, which a line-only run never does. Where it cannot load at all, the extractor falls back to empty branch and method tables for never-loaded files, as it did before 1.3.0. See #1299.
• simplecov affected --run works on JRuby on Windows, where it crashed with NoMethodError because Process.wait2 answers no status there. On that platform the runner starts through Kernel#system instead.
• simplecov serve refuses a symlink that points outside the report on JRuby on Windows too. JRuby's File.realpath follows no symlinks there, so serve would have served the file the link pointed to, and simplecov clean and the coverage.json lookup compared paths that were never resolved. On JRuby the CLI now resolves paths through the JDK.

Commits

• 52a8754 Bump version to 1.3.2
• 4fb4ae1 Format a result collected before exit on Rails 8.1.4
• 1476741 bundle update
• 343a933 Stop leaking a flush thread in the forked-child production specs
• e64fcaa Bump ruby/setup-ruby from 1.323.0 to 1.325.0
• cb8bd83 Bump oxlint from 1.83.0 to 1.85.0 in /html_frontend
• 4ee7894 Bump version to 1.3.1
• 486e55e bundle update
• d2a62a8 Resolve paths and wait on runners correctly on JRuby on Windows
• 3a2e08e Load Prism only when the static extractor runs
• Additional commits viewable in compare view

Updates tzinfo-data from 1.2026.4 to 1.2026.5

Release notes

Sourced from tzinfo-data's releases.

v1.2026.5

Based on version 2026e of the IANA Time Zone Database (https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/message/VXIA4AU73OQL3OZ3ZBZHWIASIIVBGUJV/).

Commits

• 8df8bad Update to tzdata version 2026e.
• See full diff in compare view

Updates omniauth from 2.1.4 to 2.3.1

Changelog

Sourced from omniauth's changelog.

[2.3.1] - 2026-10-22

Fixed

• remember_sign_in no longer raises KeyError when called outside the request phase, before omniauth.params is stored, as when a provider gem's specs call authorize_params directly.

[2.3.0] - 2026-10-22

Added

• Let strategies keep the origin and params of several sign-ins in progress at once, for example in several tabs, so each callback gets its own instead of the latest sign-in's. A strategy opts in by calling remember_sign_in in its request phase with a value the provider sends back, such as OAuth 2.0's state, and overriding callback_sign_in_key. The latest 5 are stored in session['omniauth.sign_ins'], and omniauth.origin and omniauth.params still hold the latest one. See the README. (omniauth-oauth2#195)

Changed

• The gem no longer includes CHANGELOG.md, which was about half its size. Its changelog_uri links to the changelog on GitHub.

[2.2.0] - 2026-10-22

Added

• Add a full_host option for each strategy, as a string or a proc that takes the Rack env. It takes precedence over OmniAuth.config.full_host. (#835)
• Ship RBS type signatures for OmniAuth in sig/.
• Document the Rack env keys OmniAuth sets, CSRF protection, sending origin as a form field, and how SameSite session cookies affect the callback in the README. (#909, #1075, #1048, #1149)
• Add this changelog.

Changed

• omniauth.params now includes params posted to the request phase's form, not just its query string, so they survive the POST-only request phase introduced in 2.0. The authenticity_token param is never included (see CVE-2017-18076 under 1.3.2). If your request form posts other fields, they now appear in omniauth.params and are stored in the session until the callback. (#975)
• OmniAuth::Builder builds its middleware stack on the first request and reuses it, instead of rebuilding every strategy on every request. Providers added after the first request are ignored. (#1083, #970)
• Strategy#call sends a request that isn't on the strategy's request or callback path straight to the app, instead of duplicating the strategy for it. It still duplicates it in test mode, with an other_phase, with path lambdas, or when the strategy overrides how #call! dispatches. Methods patched directly onto OmniAuth::Strategy, rather than overridden in a subclass, aren't detected, so a patched #call! no longer runs for requests outside the strategy's paths. (#1172)
• Require Ruby 2.5 or later (was 2.2). (#1167)
• Require Rack 2.2.8 or later (was 2.2.3), rack-protection 2.2.0 or later, and hashie 3.5.2 or later (was 3.4.6).
• The gem now contains only lib, sig, the license, the README, the changelog, and the security policy.

Fixed

• Run the before_callback_phase hook for mocked failures in test mode, as for real callbacks. (#1043, #1171)
• Recognize callback paths with a format suffix, such as /auth/:provider/callback.json. (#618, #1170)
• Don't fail callbacks when the app defines a method named uid, info, credentials, or extra on Object. (#898, #1169)
• Don't add a calculated name to the info hash subsets returned by slice, except, select, and reject. (#892, #1168)
• Collapse repeated slashes in the request path, as Rails routing does, so //auth/:provider from a misconfigured proxy reaches the strategy. (#1079)
• Avoid "instance variable not initialized" warnings on Ruby before 3.0.

Security

• Guard against forged hosts in callback URLs. Unless a full_host is set, OmniAuth builds the callback URL it sends to the provider from the request's Host, X-Forwarded-Host, or Forwarded header, which a client can forge. The new OmniAuth.config.allowed_hosts, a list of strings and regexps, makes the request and callback phases fail with invalid_host unless the request's host matches one of them. Until full_host or allowed_hosts is set, the request phase logs a warning. The README's full_host example, which copied the Host header, is fixed. (GHSA-m27g-v28p-f9fx, CVE-2026-63183)
• Run request_validation_phase before writing omniauth.params to the session, so a cross-site POST rejected by the authenticity check can no longer store attacker-controlled params. (#1162)

Commits

• 5813803 Release 2.3.1
• dde1f86 Let remember_sign_in run before omniauth.params is stored
• 9db25e1 Release 2.3.0
• d9f73a0 Require json in the sign-ins spec
• 4905b90 Let strategies keep several sign-ins' origins apart
• 8dc4b1e Stop shipping CHANGELOG.md in the gem
• 474bc91 Make rake release tag and push without pushing the gem
• 0d38078 Release 2.2.0
• 943b44f Add allowed_hosts to guard against forged hosts
• a241c94 Make the shipped signatures loadable from other gems
• Additional commits viewable in compare view

Updates omniauth-oauth2 from 1.9.0 to 1.10.0

Changelog

Sourced from omniauth-oauth2's changelog.

[1.10.0] - 2026-10-22

Added

• RBS type signatures for the strategy, in sig/, checked with Steep.
• Support up to 5 sign-ins in progress at once, for example in several tabs, instead of failing all but the latest with csrf_detected. Each one's redirect URI and PKCE verifier are stored by state in session["omniauth.oauth2"]. The omniauth.state, omniauth.redirect_uri, and omniauth.pkce.verifier keys still hold the latest sign-in, and the callback falls back to them, so provider gems and tests that set them keep working. The strategy also passes the state to OmniAuth's remember_sign_in, so each callback gets its own sign-in's omniauth.origin and omniauth.params. (#195)

Changed

• Require Ruby 2.5 or later.
• Require omniauth 2.3.1 or later, so apps can set OmniAuth.config.allowed_hosts to reject forged hosts in callback URLs (see GHSA-m27g-v28p-f9fx), and so each sign-in gets its own omniauth.origin and omniauth.params.
• Include the refresh token in the credentials whenever the provider returns one, not only when the access token expires. Some providers, like Twitch, issue expiring tokens without saying when they expire. (#122)
• Fail the request phase with missing_client_id when no client ID is configured, instead of redirecting to the provider with an authorize request it can only reject. (#65)
• The gem includes only lib, sig, the license, the README, and the security policy, not the specs, changelog, CI workflows, or tool configs. (#179)

Removed

• The pkce_verifier option. Setting it never had any effect, since the strategy overwrote it with a fresh verifier on every request, and the verifier is no longer kept in options at all. (#184)

Fixed

• Send the token request the same redirect_uri as the authorize request, instead of the callback URL with code and state appended, as RFC 6749 requires. (#93, #142)
• Send the token request a redirect_uri set in client_options, which oauth2 already sends in the authorize request. (#161)
• Fail with invalid_credentials instead of raising NoMethodError when oauth2's raise_errors is off and the token response has no token. (#138)
• Fail with csrf_detected instead of raising NoMethodError when the

... (truncated)

Commits

• 21eac69 Release 1.10.0
• c39f6b4 Give each sign-in its own origin and params
• 48ed1d5 Support several sign-ins in progress at once
• 825ebd5 Require omniauth 2.2
• 45a0cee Test on Ruby 2.5, 2.6, and 2.7
• 0e171e0 Require Ruby 2.5 or later in the gemspec
• e7f9163 Ship only lib, sig, the license, the README, and SECURITY.md
• 6470009 Push the gem from GitHub Actions with trusted publishing
• 6fff736 Fail the request phase when there's no client ID
• 75ccebf Include the refresh token even when the token doesn't expire
• Additional commits viewable in compare view

Updates cancancan from 3.6.1 to 3.7.0

Release notes

Sourced from cancancan's releases.

3.7.0

The one below is a list of all the PRs merged. For a more detailed update, read the blog post about this release.

• Merge the ControllerResourceLoader, ControllerResourceBuilder, ControllerResourceFinder, ControllerResourceNameFinder and ControllerResourceSanitizer modules into CanCan::ControllerResource, and call the params method of the controller only once per request: it was called once more for every attribute set by the conditions of the ability. WARNING: the five modules no longer exist; override their methods in a subclass of CanCan::ControllerResource instead. (@​coorasse)
• Expand the actions again after alias_action, clear_aliased_actions and merge: can? kept using the aliases expanded by a previous check, so clear_aliased_actions did not remove can :read from can?(:index, Model). (@​coorasse)
• Raise an error when an action is aliased to :manage, which granted every action, or to itself, which looped forever. (@​coorasse)
• Do not include the primary key in permitted_attributes for a rule without attributes, remove every attribute with a cannot rule without attributes, including those that are not columns, and accept a hash subject instead of raising a TypeError. WARNING: permitted_attributes no longer returns :id, and with a composite primary key none of its columns are returned. (@​coorasse)
• Convert a String resource name to a symbol in load_and_authorize_resource and the skip_* methods: load_and_authorize_resource 'article' treated the resource as a parent and authorized :show on the class instead of the action on the record. (@​coorasse)
• #927: Look up the unauthorized message of a String action through its aliases: authorize!('index', post) did not use the message defined for read. (@​coorasse)
• #913: Match a symbol in a condition with the string that has the same name in can?, as accessible_by already did: cannot :read, Post, state: :draft on a string column no longer allows can?(:read, draft). WARNING: a can rule with a symbol now also allows records whose string attribute has the same name. (@​bruno-costanzo)
• #905: Match String actions like Symbol actions: can?('destroy', user) ignored cannot :destroy, User when can :manage was defined, and skip_authorize_resource except: 'destroy' also skipped the authorization of destroy. WARNING: a String action now goes through the aliases like a Symbol action, so can?('show', order) and authorize!(action_name, order) are allowed by can :read, Order and may grant access that 3.6 denied. A rule defined with a String action now matches the same Symbol action, permissions returns symbols, and a block rule without a subject receives the action as a symbol. (@​bruno-costanzo)
• #848: Do not deny can?(:index, parent => Model) because of a cannot rule with conditions on the model, as can?(:index, Model) already did: load_and_authorize_resource failed on the index of a nested resource. (@​coorasse)
• #861, #846, #690: Give the conditions of accessible_by the table aliases that Active Record gives to the joined associations, and build them with the model of each table. A rule with a has_many :through association, or with an association without conditions, used the alias of another table: the query failed or returned the wrong records. On an aliased table, a model was not converted to its foreign key and the values were not cast with the attribute types of the model. (@​coorasse)
• #911: Load the resource when the id is only whitespace: a request like /books/%20 ran the action with a nil resource, authorized only against the class, instead of raising ActiveRecord::RecordNotFound. (@​bruno-costanzo)
• #833: Match nil in an array of enum values in can?, as accessible_by already did: can :read, Post, status: [nil, :published] now allows a post without a status. (@​jtagle2, @​coorasse)
• #910: Accept a subclass of CanCan::ModelAdapters::Strategies::Base as accessible_by_strategy, so the SQL generated by accessible_by can be customized with your own strategy. (@​cb341, @​coorasse)
• #909: Make can? and accessible_by consistent for cannot rules and single table inheritance: a cannot rule on a subclass keeps its precedence in accessible_by, records with NULL in a column of a cannot condition are no longer excluded, rules on subclasses of subclasses reach the base class, and a class check passes when the class or any of its subclasses is allowed. WARNING: accessible_by returns more records when a cannot rule has conditions on a nullable column, and can? on an STI base class no longer fails because a subclass is forbidden. (@​coorasse, @​0llirocks, @​kevinluo201)
• #880: Fix accessible_by with rules on STI subclasses: a rule on a subclass without conditions no longer discards the rules defined before it, and rules with the same conditions on different subjects are no longer compressed into one. (@​takayamaki, @​sjoulbak)
• #890: Support an Active Record relation as the value of a condition in can?: the selected column, or the primary key, is checked with a query, as accessible_by already did. (@​olistik)
• #908: Join consecutive can rules in a flat chain of ORs in the SQL conditions, so that many rules on the same model no longer overflow the parser of SQLite. (@​coorasse)
• #907: Make with_accessible_by_strategy thread safe: the strategy chosen in the block no longer leaks into concurrent requests. (@​NikosVlagoidis, @​coorasse)
• #906: Keep the conditions of an association when a rule is a scope: group.posts.accessible_by(ability) returned the posts of every group matched by the scope. WARNING: accessible_by called on an association now returns fewer records when the scope of a rule constrains the same column as the association. Only the conditions dropped by merge are applied again, so a condition on a subquery like where(category: Category.where(...)) is not turned into IS NULL, and the conditions of a default scope removed by unscope in the rule stay removed. (@​coorasse)
• #694: Document that cannot supports the :all subject. (@​jaredbeck)
• #852: Add changelog_uri to the gemspec, so rubygems.org links to the changelog. (@​mark-young-atg)
• #842: Add disallowed_attributes to retrieve the attributes forbidden by cannot rules. (@​mswiszcz)
• #904: Assign the parent of a singleton resource through the inverse of the association when the resource has no setter named after the through option. (@​coorasse)
• #878: Support through_association together with singleton when loading a resource. (@​cgunther)
• #786: Fix the table aliases generated by accessible_by when the same association is joined more than twice: the WHERE clause referenced an alias that was never joined. (@​daveallie)
• #902: Do not change the rules of the ability in accessible_by: a rule shared by several models kept the conditions normalized for the first queried model. (@​bruno-costanzo)
• #901: Keep the scope of a has_many :through association in accessible_by: the association was rewritten into its through and source associations and its scope was dropped, so accessible_by returned records that can? denies. WARNING: accessible_by returns fewer records for a rule on a has_many :through association with a scope. (@​bruno-costanzo)
• Remove the VitePress documentation website: the documentation lives in the docs folder as plain Markdown. (@​coorasse)

3.6.2

• #898: Do not share cancan_skipper between controller subclasses: skip_authorize_resource and skip_load_resource in a subclass no longer apply to the superclass or sibling controllers. (@​bruno-costanzo)
• #894: Use lease_connection instead of the deprecated connection on Rails 7.2+. (@​benaitcheson)

Changelog

Sourced from cancancan's changelog.

3.7.0

• Merge the ControllerResourceLoader, ControllerResourceBuilder, ControllerResourceFinder, ControllerResourceNameFinder and ControllerResourceSanitizer modules into CanCan::ControllerResource, and call the params method of the controller only once per request: it was called once more for every attribute set by the conditions of the ability. WARNING: the five modules no longer exist; override their methods in a subclass of CanCan::ControllerResource instead. ([@​coorasse][])
• Expand the actions again after alias_action, clear_aliased_actions and merge: can? kept using the aliases expanded by a previous check, so clear_aliased_actions did not remove can :read from can?(:index, Model). ([@​coorasse][])
• Raise an error when an action is aliased to :manage, which granted every action, or to itself, which looped forever. ([@​coorasse][])
• Do not include the primary key in permitted_attributes for a rule without attributes, remove every attribute with a cannot rule without attributes, including those that are not columns, and accept a hash subject instead of raising a TypeError. WARNING: permitted_attributes no longer returns :id, and with a composite primary key none of its columns are returned. ([@​coorasse][])
• Convert a String resource name to a symbol in load_and_authorize_resource and the skip_* methods: load_and_authorize_resource 'article' treated the resource as a parent and authorized :show on the class instead of the action on the record. ([@​coorasse][])
• #927: Look up the unauthorized message of a String action through its aliases: authorize!('index', post) did not use the message defined for read. ([@​coorasse][])
• #913: Match a symbol in a condition with the string that has the same name in can?, as accessible_by already did: cannot :read, Post, state: :draft on a string column no longer allows can?(:read, draft). WARNING: a can rule with a symbol now also allows records whose string attribute has the same name. ([@​bruno-costanzo][])
• #905: Match String actions like Symbol actions: can?('destroy', user) ignored cannot :destroy, User when can :manage was defined, and skip_authorize_resource except: 'destroy' also skipped the authorization of destroy. WARNING: a String action now goes through the aliases like a Symbol action, so can?('show', order) and authorize!(action_name, order) are allowed by can :read, Order and may grant access that 3.6 denied. A rule defined with a String action now matches the same Symbol action, permissions returns symbols, and a block rule without a subject receives the action as a symbol. ([@​bruno-costanzo][])
• #848: Do not deny can?(:index, parent => Model) because of a cannot rule with conditions on the model, as can?(:index, Model) already did: load_and_authorize_resource failed on the index of a nested resource. ([@​coorasse][])
• #861, #846, #690: Give the conditions of accessible_by the table aliases that Active Record gives to the joined associations, and build them with the model of each table. A rule with a has_many :through association, or with an association without conditions, used the alias of another table: the query failed or returned the wrong records. On an aliased table, a model was not converted to its foreign key and the values were not cast with the attribute types of the model. ([@​coorasse][])