This commit fixes the bug convering `false` to `locals[as]` when
`options[:object]` is `false` (close #22260).

According to the W3 spec[1] the value should use a 1-based index
and not a 0-based index for the week number.

[1]: http://www.w3.org/TR/html-markup/datatypes.html#form.data.week

According to the W3 spec[1] the value should use a 1-based index
and not a 0-based index for the week number.

[1]: http://www.w3.org/TR/html-markup/datatypes.html#form.data.week

Now both `javascript_include_tag` and `stylesheet_tag` can accept `host` option
to provide custom host for the asset

`link_to :back` creates a link to whatever was
passed in via the referer header. If an attacker
can alter the referer header, that would create
a cross-site scripting vulnerability on every
page that uses `link_to :back`

This commit restricts the back URL to valid
non-javascript URLs.

https://github.com/rails/rails/issues/14444

making selected value to accept Hash like the default option. E.g. selected: {day: params[:day].to_i, month: params[:month].to_id}

Adds in test test_date_select_with_selected_in_hash and change log

fixes typo in CHANGELOG

Stumbled upon this one while trying to deprecate the String/Symbol
passing to `form_for`.

This test passed on an accident, because the signature of `form_for`
currently accepts 2 positional arguments and a block. Calling it with
the wrong number of arguments caused:

```ruby
(byebug) form_for(:post, @post, html: { id: 'create-post' })
*** ArgumentError Exception: wrong number of arguments (3 for 1..2)
```

This made the test pass, because it was still an `ArgumentError`. :-)

It's already represented in the key name. Demonstrate with a test.

Also test that the default isn't output.

When `require 'active_support/rails'`, 'active_support/deprecation'
is automatically loaded.

Rails 4.x and earlier didn't support `Mime::Type[:FOO]`, so libraries
that support multiple Rails versions would've had to feature-detect
whether to use `Mime::Type[:FOO]` or `Mime::FOO`.

`Mime[:foo]` has been around for ages to look up registered MIME types
by symbol / extension, though, so libraries and plugins can safely
switch to that without breaking backward- or forward-compatibility.

Note: `Mime::ALL` isn't a real MIME type and isn't registered for lookup
by type or extension, so it's not available as `Mime[:all]`. We use it
internally as a wildcard for `respond_to` negotiation. If you use this
internal constant, continue to reference it with `Mime::ALL`.

Ref. efc6dd55

When this method was implemented
(https://github.com/rails/rails/pull/5016/files), `to_date` is called.
But this behavior was chagned refactoring
(https://github.com/rails/rails/pull/6452/files).
In the first commit, there were not test which asserts `to_date` is called.

I think trying `to_date` is more useful than trying `strftime`, because
we can write `"2015-01-01".to_date`. But first fix comments to match
actual behavior.

as string

This will avoid a error be raised when the only input on the form is the
`collection_radio_buttons`.

Here is correct output of `number_to_percentage(100, format: "%n  %”)`

The thread_safe gem is being deprecated and all its code has been merged
into the concurrent-ruby gem. The new class, Concurrent::Map, is exactly
the same as its predecessor except for fixes to two bugs discovered
during the merge.

This can still be added to the middleware stack, but is really not
necessary.  I'll follow up with a commit that deprecates the constant