$ the-wire · showcase
Active Storage gets a direct-upload kill switch, Postgres covering indexes stop leaking into primary keys
By RepoJournal · Filed · About Rails · Composed from the cited sources · methodology
3 people shipped this
Rails gained two targeted knobs and bug fixes today: a config flag to drop the direct upload route without disabling Active Storage, and a PostgreSQL introspection fix that stops INCLUDE columns from being mistaken for primary key columns.
Introduce `config.active_storage.draw_direct_upload_route` rails/rails
Set config.active_storage.draw_direct_upload_route to false and the direct upload route is no longer drawn, while all other Active Storage routes stay in place. The point, per the PR, is to reduce attack surface without opting out of Active Storage's routes entirely, so you can retire the unauthenticated upload endpoint on apps that never use it.
Introduce `config.active_storage.draw_direct_upload_route` (#58377) rails/rails
Merged as b24658a9, the same flag lands on main, and the Action Text form helper tests were cleaned up in the process: they previously toggled ActiveStorage.draw_direct_upload_route by hand and reset it to true instead of its prior value. If you're on Rails main and run the test suite, that reset bug is gone.
Fix PostgreSQL primary key introspection for covering indexes rails/rails
Active Record read pg_index.indkey, which carries both key and INCLUDE columns, so PostgreSQL covering primary-key indexes reported included columns as part of the primary key. The visible effect: bulk upserts treated writable columns as read-only and silently skipped their updates. Aurora DSQL creates covering primary-key indexes by default, which makes the failure easy to hit there.
Enable `Layout/BlockAlignment` rails/rails
Rails turned on the Layout/BlockAlignment cop, following up on the indentation cleanup. Layout/IndentationWidth measures a block body against its end rather than the line opening the block, so a body shifted along with its end still passes; BlockAlignment catches it. Any fork or engine carrying the same misindentation will now fail lint.
Fix indentation in `actionpack/test/controller/parameters/mutators_test.rb` rails/rails
One quiet follow-up: kamipo also fixed indentation in actionpack/test/controller/parameters/mutators_test.rb, a leftover from the earlier test cleanup.
