build(deps): bump railties, actionpack, actionview and activemodel

[dependabot]

Bumps railties, actionpack, actionview and activemodel. These dependencies needed to be updated together.
Updates railties from 8.0.3 to 8.1.0

Release notes

Sourced from railties's releases.

8.1.0

Active Support

• Remove deprecated passing a Time object to Time#since.

  Rafael Mendonça França

• Remove deprecated Benchmark.ms method. It is now defined in the benchmark gem.

  Rafael Mendonça França

• Remove deprecated addition for Time instances with ActiveSupport::TimeWithZone.

  Rafael Mendonça França

• Remove deprecated support for to_time to preserve the system local time. It will now always preserve the receiver timezone.

  Rafael Mendonça França

• Deprecate config.active_support.to_time_preserves_timezone.

  Rafael Mendonça França

• Standardize event name formatting in assert_event_reported error messages.

  The event name in failure messages now uses .inspect (e.g., name: "user.created") to match assert_events_reported and provide type clarity between strings and symbols. This only affects tests that assert on the failure message format itself.

  George Ma

• Fix Enumerable#sole to return the full tuple instead of just the first element of the tuple.

  Olivier Bellone

• Fix parallel tests hanging when worker processes die abruptly.

  Previously, if a worker process was killed (e.g., OOM killed, kill -9) during parallel test execution, the test suite would hang forever waiting for the dead worker.

  Joshua Young

• Add config.active_support.escape_js_separators_in_json.

  Introduce a new framework default to skip escaping LINE SEPARATOR (U+2028) and PARAGRAPH SEPARATOR (U+2029) in JSON.

  Historically these characters were not valid inside JavaScript literal strings but that changed in ECMAScript 2019. As such it's no longer a concern in modern browsers: https://caniuse.com/mdn-javascript_builtins_json_json_superset.

... (truncated)

Changelog

Sourced from railties's changelog.

Rails 8.1.0 (October 22, 2025)

• Suggest bin/rails action_text:install from Action Dispatch error page

  Sean Doyle

• Remove deprecated STATS_DIRECTORIES.

  Rafael Mendonça França

• Remove deprecated bin/rake stats command.

  Rafael Mendonça França

• Remove deprecated rails/console/methods.rb file.

  Rafael Mendonça França

• Don't generate system tests by default.

  Rails scaffold generator will no longer generate system tests by default. To enable this pass --system-tests=true or generate them with bin/rails generate system_test name_of_test.

  Eileen M. Uchitelle

• Optionally skip bundler-audit.

  Skips adding the bin/bundler-audit & config/bundler-audit.yml if the gem is not installed when bin/rails app:update runs.

  Passes an option to --skip-bundler-audit when new apps are generated & adds that same option to the --minimal generator flag.

  Jill Klang

• Show engine routes in /rails/info/routes as well.

  Petrik de Heus

• Exclude asset_path configuration from Kamal deploy.yml for API applications.

  API applications don't serve assets, so the asset_path configuration in deploy.yml is not needed and can cause 404 errors on in-flight requests. The asset_path is now only included for regular Rails applications that serve assets.

  Saiqul Haq

• Reverted the incorrect default config.public_file_server.headers config.

  If you created a new application using Rails 8.1.0.beta1, make sure to regenerate config/environments/production.rb, or to manually edit the config.public_file_server.headers configuration to just be:

... (truncated)

Commits

• 1cdd190 Preparing for 8.1.0 release
• 5e231ae Merge pull request #54914 from chaadow/fix_autoloaded_content_helper
• 1a8109e Actually turn this off by default too
• 25af925 Kamal localhost registry (#55934)
• f58a75a Merge pull request #55940 from jeromedalbert/fix-ci-yml-whitespace
• 38957e7 Remove action_on_open_redirects from NFD
• c5f5f6e Fix whitespace in new_framework_defaults
• c0a847a Fix error page indentation
• 26cf360 Adding dark mode to http error pages (#55671)
• 1ace683 Preparing for 8.1.0.rc1 release
• Additional commits viewable in compare view

Updates actionpack from 8.0.3 to 8.1.0

Release notes

Sourced from actionpack's releases.

8.1.0

Active Support

• Remove deprecated passing a Time object to Time#since.

  Rafael Mendonça França

• Remove deprecated Benchmark.ms method. It is now defined in the benchmark gem.

  Rafael Mendonça França

• Remove deprecated addition for Time instances with ActiveSupport::TimeWithZone.

  Rafael Mendonça França

• Remove deprecated support for to_time to preserve the system local time. It will now always preserve the receiver timezone.

  Rafael Mendonça França

• Deprecate config.active_support.to_time_preserves_timezone.

  Rafael Mendonça França

• Standardize event name formatting in assert_event_reported error messages.

  The event name in failure messages now uses .inspect (e.g., name: "user.created") to match assert_events_reported and provide type clarity between strings and symbols. This only affects tests that assert on the failure message format itself.

  George Ma

• Fix Enumerable#sole to return the full tuple instead of just the first element of the tuple.

  Olivier Bellone

• Fix parallel tests hanging when worker processes die abruptly.

  Previously, if a worker process was killed (e.g., OOM killed, kill -9) during parallel test execution, the test suite would hang forever waiting for the dead worker.

  Joshua Young

• Add config.active_support.escape_js_separators_in_json.

  Introduce a new framework default to skip escaping LINE SEPARATOR (U+2028) and PARAGRAPH SEPARATOR (U+2029) in JSON.

  Historically these characters were not valid inside JavaScript literal strings but that changed in ECMAScript 2019. As such it's no longer a concern in modern browsers: https://caniuse.com/mdn-javascript_builtins_json_json_superset.

... (truncated)

Changelog

Sourced from actionpack's changelog.

Rails 8.1.0 (October 22, 2025)

• Submit test requests using as: :html with Content-Type: x-www-form-urlencoded

  Sean Doyle

• Add link-local IP ranges to ActionDispatch::RemoteIp default proxies.

  Link-local addresses (169.254.0.0/16 for IPv4 and fe80::/10 for IPv6) are now included in the default trusted proxy list, similar to private IP ranges.

  Adam Daniels

• remote_ip will no longer ignore IPs in X-Forwarded-For headers if they are accompanied by port information.

  Duncan Brown, Prevenios Marinos, Masafumi Koba, Adam Daniels

• Add action_dispatch.verbose_redirect_logs setting that logs where redirects were called from.

  Similar to active_record.verbose_query_logs and active_job.verbose_enqueue_logs, this adds a line in your logs that shows where a redirect was called from.

  Example:

  Redirected to http://localhost:3000/posts/1
  ↳ app/controllers/posts_controller.rb:32:in `block (2 levels) in create'
  

  Dennis Paagman

• Add engine route filtering and better formatting in bin/rails routes.

  Allow engine routes to be filterable in the routing inspector, and improve formatting of engine routing output.

  Before:

  > bin/rails routes -e engine_only
  No routes were found for this grep pattern.
  For more information about routes, see the Rails guide: https://guides.rubyonrails.org/routing.html.
  

  After:

  > bin/rails routes -e engine_only
  Routes for application:
  No routes were found for this grep pattern.
  For more information about routes, see the Rails guide: https://guides.rubyonrails.org/routing.html.
  

... (truncated)

Commits

• 1cdd190 Preparing for 8.1.0 release
• 62a109a Merge pull request #55947 from c0nspiracy/patch-1
• 0777f23 Merge pull request #55921 from skipkayhil/hm-ykpyzlmxovpttksv
• 4663af7 Merge pull request #55922 from Shopify/event_subscriber_additionss
• ca45ef1 Remove mention of raise_on_open_redirects from doc
• aebfa8b Merge pull request #55916 from skipkayhil/hm-notxxwqnxqlzzpku
• c44b9ed Merge pull request #50390 from seanpdoyle/issue-50345
• b4c069b Merge pull request #55906 from yahonda/ruby350-source-location-55889
• 1ace683 Preparing for 8.1.0.rc1 release
• 3001e18 Merge pull request #55904 from rails/rm-event-subscriber
• Additional commits viewable in compare view

Updates actionview from 8.0.3 to 8.1.0

Release notes

Sourced from actionview's releases.

8.1.0

Active Support

• Remove deprecated passing a Time object to Time#since.

  Rafael Mendonça França

• Remove deprecated Benchmark.ms method. It is now defined in the benchmark gem.

  Rafael Mendonça França

• Remove deprecated addition for Time instances with ActiveSupport::TimeWithZone.

  Rafael Mendonça França

• Remove deprecated support for to_time to preserve the system local time. It will now always preserve the receiver timezone.

  Rafael Mendonça França

• Deprecate config.active_support.to_time_preserves_timezone.

  Rafael Mendonça França

• Standardize event name formatting in assert_event_reported error messages.

  The event name in failure messages now uses .inspect (e.g., name: "user.created") to match assert_events_reported and provide type clarity between strings and symbols. This only affects tests that assert on the failure message format itself.

  George Ma

• Fix Enumerable#sole to return the full tuple instead of just the first element of the tuple.

  Olivier Bellone

• Fix parallel tests hanging when worker processes die abruptly.

  Previously, if a worker process was killed (e.g., OOM killed, kill -9) during parallel test execution, the test suite would hang forever waiting for the dead worker.

  Joshua Young

• Add config.active_support.escape_js_separators_in_json.

  Introduce a new framework default to skip escaping LINE SEPARATOR (U+2028) and PARAGRAPH SEPARATOR (U+2029) in JSON.

  Historically these characters were not valid inside JavaScript literal strings but that changed in ECMAScript 2019. As such it's no longer a concern in modern browsers: https://caniuse.com/mdn-javascript_builtins_json_json_superset.

... (truncated)

Changelog

Sourced from actionview's changelog.

Rails 8.1.0 (October 22, 2025)

• The BEGIN template annotation/comment was previously printed on the same line as the following element. We now insert a newline inside the comment so it spans two lines without adding visible whitespace to the HTML output to enhance readability.

  Before:

  <!-- BEGIN /Users/siaw23/Desktop/rails/actionview/test/fixtures/actionpack/test/greeting.html.erb --><p>This is grand!</p>
  

  After:

  <!-- BEGIN /Users/siaw23/Desktop/rails/actionview/test/fixtures/actionpack/test/greeting.html.erb
  --><p>This is grand!</p>
  

  Emmanuel Hayford

• Add structured events for Action View:

  • action_view.render_template
  • action_view.render_partial
  • action_view.render_layout
  • action_view.render_collection
  • action_view.render_start

  Gannon McGibbon

• Fix label with for option not getting prefixed by form namespace value

  Abeid Ahmed, Hartley McGuire

• Add fetchpriority to Link headers to match HTML generated by preload_link_tag.

  Guillermo Iguaran

• Add CSP nonce to Link headers generated by preload_link_tag.

  Alexander Gitter

• Allow current_page? to match against specific HTTP method(s) with a method: option.

  Ben Sheldon

• Remove autocomplete="off" on hidden inputs generated by the following tags:

  • form_tag, token_tag, method_tag

  As well as the hidden parameter fields included in button_to, check_box, select (with multiple) and file_field forms.

  nkulway

... (truncated)

Commits

• 1cdd190 Preparing for 8.1.0 release
• 1ace683 Preparing for 8.1.0.rc1 release
• d6f9f62 Make the Structured Event Subscriber emit events in format that are useful fo...
• 4ae5bfc Place template annotation on a separate line
• 7d12071 Micro optimize ActiveRecord::RuntimeRegistry
• d2518fa Merge pull request #55748 from Shopify/event_with_debug_helper
• 1e77699 Make all framework log subscribers API private
• 78857a3 Introduce with_debug_event_reporting to enable event reporter debug mode
• ebb01c5 Emit only one structured event per notification event
• b8d8b55 Merge pull request #55738 from skipkayhil/hm-nkxzsnnrqqlyrotw
• Additional commits viewable in compare view

Updates activemodel from 8.0.3 to 8.1.0

Release notes

Sourced from activemodel's releases.

8.1.0

Active Support

• Remove deprecated passing a Time object to Time#since.

  Rafael Mendonça França

• Remove deprecated Benchmark.ms method. It is now defined in the benchmark gem.

  Rafael Mendonça França

• Remove deprecated addition for Time instances with ActiveSupport::TimeWithZone.

  Rafael Mendonça França

• Remove deprecated support for to_time to preserve the system local time. It will now always preserve the receiver timezone.

  Rafael Mendonça França

• Deprecate config.active_support.to_time_preserves_timezone.

  Rafael Mendonça França

• Standardize event name formatting in assert_event_reported error messages.

  The event name in failure messages now uses .inspect (e.g., name: "user.created") to match assert_events_reported and provide type clarity between strings and symbols. This only affects tests that assert on the failure message format itself.

  George Ma

• Fix Enumerable#sole to return the full tuple instead of just the first element of the tuple.

  Olivier Bellone

• Fix parallel tests hanging when worker processes die abruptly.

  Previously, if a worker process was killed (e.g., OOM killed, kill -9) during parallel test execution, the test suite would hang forever waiting for the dead worker.

  Joshua Young

• Add config.active_support.escape_js_separators_in_json.

  Introduce a new framework default to skip escaping LINE SEPARATOR (U+2028) and PARAGRAPH SEPARATOR (U+2029) in JSON.

  Historically these characters were not valid inside JavaScript literal strings but that changed in ECMAScript 2019. As such it's no longer a concern in modern browsers: https://caniuse.com/mdn-javascript_builtins_json_json_superset.

... (truncated)

Changelog

Sourced from activemodel's changelog.

Rails 8.1.0 (October 22, 2025)

• Add reset_token: { expires_in: ... } option to has_secure_password.

  Allows configuring the expiry duration of password reset tokens (default remains 15 minutes for backwards compatibility).

  has_secure_password reset_token: { expires_in: 1.hour }

  Jevin Sew, Abeid Ahmed

• Add except_on: option for validation callbacks.

  Ben Sheldon

• Backport ActiveRecord::Normalization to ActiveModel::Attributes::Normalization

  class User
    include ActiveModel::Attributes
    include ActiveModel::Attributes::Normalization
  attribute :email, :string
  normalizes :email, with: -> email { email.strip.downcase }
  end
  user = User.new
  user.email =    " CRUISE-CONTROL@EXAMPLE.COM\n"
  user.email # => "cruise-control@example.com"

  Sean Doyle

Please check 8-0-stable for previous changes.

Commits

• 1cdd190 Preparing for 8.1.0 release
• 1ace683 Preparing for 8.1.0.rc1 release
• b182bc6 Give credit to the first author of this feature
• d0486d0 Merge pull request #55574 from jevin/feature/reset-password-token-duration
• ee29930 ActiveModel::SecurePassword: configurable reset token expiry
• 2446a70 Removing the string option for validations
• 80827ca Preparing for 8.1.0.beta1 release
• 842200c Use comment for example return values [ci-skip]
• 9a10a82 Replace "mailing list" with "forum" [ci-skip]
• aa69684 Link using rdoc-ref instead of rdoc-label [ci-skip]
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)