Ruby on Rails: v7.0.4.1 Release

Release date:
January 17, 2023
Previous version:
v7.0.4 (released September 9, 2022)
522 Diff Delta
4 total committers
Data confidence:

Top Contributors in v7.0.4.1


Directory Browser for v7.0.4.1

All files are compared to previous version, v7.0.4. Click here to browse diffs between other versions.

Loading File Browser...

Release Notes Published

This is a security release. More information is available in our security announcements forum:

Active Support

  • Avoid regex backtracking in Inflector.underscore


Active Model

  • No changes.

Active Record

  • Make sanitize_as_sql_comment more strict

    Though this method was likely never meant to take user input, it was attempting sanitization. That sanitization could be bypassed with carefully crafted input.

    This commit makes the sanitization more robust by replacing any occurrances of "/" or "/" with "/ " or " /". It also performs a first pass to remove one surrounding comment to avoid compatibility issues for users relying on the existing removal.

    This also clarifies in the documentation of annotate that it should not be provided user input.


  • Added integer width check to PostgreSQL::Quoting

    Given a value outside the range for a 64bit signed integer type PostgreSQL will treat the column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan.

    This behavior is configurable via ActiveRecord::Base.raise_int_wider_than_64bit which defaults to true.


Action View

  • No changes.

Action Pack

  • Fix sec issue with _url_host_allowed?

    Disallow certain strings from _url_host_allowed? to avoid a redirect to malicious sites.


  • Avoid regex backtracking on If-None-Match header


  • Use string#split instead of regex for domain parts


Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • No changes.

Action Mailbox

  • No changes.

Action Text

  • No changes.


  • No changes.