$ the-wire · showcase
CSP validation stops allocating, request header getters go bootsnap-cacheable
By RepoJournal · Filed · About Rails · Composed from the cited sources · methodology
Rails trimmed two per-request hot paths: ContentSecurityPolicy#validate no longer copies every source string to look for whitespace, and request header getters are now written out statically so bootsnap can cache them.
Unroll request header getters rails/rails
Request header getters were generated dynamically at load time; they are now written out statically, which makes them cacheable by bootsnap, following the same approach as an earlier PR in the same series. Applications running bootsnap get compiled method caches for those getters instead of re-evaluating the dynamic definitions on boot.
Check content security policy sources for whitespace without copying them rails/rails
ContentSecurityPolicy#validate runs every time the header is built and previously compared each source against a whitespace-stripped copy of itself; it now uses match? to check for whitespace and allocate nothing. This is the change merged in the accompanying pull request request, so any app that emits a CSP header pays less on every response.
Fix in-place mutation detection in Type::Serialized for immutable strings rails/rails
In-place mutation detection in ActiveRecord::Type::Serialized was broken when immutable_strings_by_default is enabled or the column uses ActiveModel::Type::ImmutableString, so mutations were not being detected as such. The fix lands after an earlier attempt broke test_mutation_detection_does_not_double_serialize, the test that guards against double serialization.
Fix a through association test that didn't exercise the guard it tested rails/rails
An existing through-association test passed even with the has_default_scope? check removed from skip_statement_cache?, because TenantMembership's default scope filtered on the same memberships.member_id column that Member#tenant_clubs keys on, and target_scope.merge! let the association's bind overwrite the default scope's value. The test now exercises the guard it claims to cover.
Update agenda.html (#749) rails/website
Elsewhere in rails/website, the agenda page was updated to reflect the two full days of keynotes, talks and workshops, with all sessions due on the YouTube channel in October; the same desk also added 2027 editions of Tropical on Rails and Blastoff Rails to events.yml and published a Donorbox podcast episode.
