$ the-wire · showcase
Action Cable orders a connection's commands, log filtering matches decoded param names
By RepoJournal · Filed · About Rails · Composed from the cited sources · methodology
Action Cable's socket now serializes all of a connection's work instead of racing it across the worker pool, and Rails stopped logging URL-encoded sensitive query parameter names in cleartext.
Process each Action Cable connection's commands in order rails/rails
Server::Socket#receive used to hand each incoming WebSocket message to the worker pool as its own job, so with the default four threads two messages from one client could run concurrently and in either order (a page navigation's unsubscribe-then-subscribe pair is exactly that shape). Each connection's commands now execute in order.
Match URL-decoded query parameter names when filtering logs rails/rails
filtered_path and filtered redirect locations compared the raw query parameter name against filter_parameters, so a name sent as %70assword or access+token slipped past :password and "access token" and landed in the log while params was filtered. Names are now decoded once with URI.decode_www_form_component before matching, and the filtered URL keeps its original encoding and parameter order.
Serialize perform_work with a connection's commands rails/rails
Stream callbacks and periodic timers went through Socket#perform_work straight to the worker pool and could observe a channel half torn down alongside its own subscribe, unsubscribe or close. They now route through the socket's serial executor, completing the ordering work begun in the receive path; the SerializedExecutionDelegator is built in Socket rather than as Worker#serial_executor.
Remove Markdown directives in Action Mailbox rails/rails
Xavier Noria stripped Markdown directives out of the Action Mailbox docs, with the matching Action Pack cleanup following in the same pass. Documentation only: no runtime behavior changes.
Harden against rogue agents (safe git + jail cleanup + more verifier checks) rails/lemans
lemans hardened its agent harness: trials keep git state outside the app dir, --jail cleanup runs even when miniswen is killed, and the verifier now scores recorded failures and never-run tests as 0.0 and rejects results when Minitest's core methods are redefined outside its gems, so a run cannot pass by skipping or stubbing the suite.
