Discuss Action Pack's new CSRF protection from remote script tags and what it means for your app. In short, update your tests if they don't already use the 'xhr :post' style.

CSRF protection from cross-origin <script> tags

Thanks to @homakov for sounding the alarm about JSONP-style data leaking

Create a blacklist to disallow mutator methods to be delegated to Array

Conflicts:
	guides/source/upgrading_ruby_on_rails.md

Release notes fixes [ci skip]

* Added release notes for secrets.yml and mentioned it in the highlights
* Added release notes for Mailer previews and mentioned it in the highlights
* Added release notes for Module#concerning
* Removed mention for AV extraction from the highlights
* Rearranged the major features to put highlighted features first
* Various improvements and typo fixes

[ci skip]

Default I18n.enforce_available_locales to true

We will default this option to true from now on to ensure users properly handle their list of available locales whenever necessary. This option was added as a security measure and thus Rails will follow it defaulting to secure option.

Also improve the handling of I18n config options in its railtie, taking the new enforce_available_locales option into account, by setting it as the last one in the process. This ensures no other configuration will trigger a deprecation warning due to that setting.

This change was necessary because the whitelist wouldn't work.
It would be painful for users trying to update their applications.

This blacklist intent to prevent odd bugs and confusion in code that call mutator
methods directely on the `Relation`.

[ci skip]

test case for #limit added - picking latest value from limit

As discussed with @fxn the release notes are a snapshot document.
The links going out to the API should represent that exact snapshot.
This means we always link to the full final release. For example
the 3.2 release notes link to http://api.rubyonrails.org/v3.2.0.

The option enforce_available_locales is only available on latest
versions, so require the last available one which has the option +
other related fixes and should not have backward compatibility issues.

We will default this option to true from now on to ensure users properly
handle their list of available locales whenever necessary. This option
was added as a security measure and thus Rails will follow it defaulting
to secure option.

Also improve the handling of I18n config options in its railtie, taking
the new enforce_available_locales option into account, by setting it as
the last one in the process. This ensures no other configuration will
trigger a deprecation warning due to that setting.

/cc @chancancode

Introduce Module#concerning

A natural, low-ceremony way to separate responsibilities within a class.

Imported from https://github.com/37signals/concerning#readme

Blast from the past, MySQL 4 era, when the password hashing style changed.

Follow up to: https://github.com/rails/rails/commit/828a8f214535e59d709fd4862605902d1cc21632#commitcomment-4879462

This will be available after https://github.com/jonleighton/spring/commit/c6e25804b3338959d87a29f40967a333c650c031
is released.

WIP: Integration of mail_view gem

Better support for AR:B.where(belongs_to_assoc: val) which previously generated invalid SQL

Using the name of an association in `where` previously worked only
if the value was a single `ActiveRecrd::Base` object. e.g.

    Post.where(author: Author.first)

Any other values, including `nil`, would cause invalid SQL to be
generated. This change supports arguments in the `where` query
conditions where the key is a `belongs_to` association name and the
value is `nil`, an `Array` of `ActiveRecord::Base` objects, or an
`ActiveRecord::Relation` object.

    # Given the Post model
    class Post < ActiveRecord::Base
      belongs_to :author
    end

    # nil value finds records where the association is not set
    Post.where(author: nil)
    # SELECT "posts".* FROM "posts" WHERE "posts"."author_id" IS NULL

    # Array values find records where the association foreign key
    # matches the ids of the passed ActiveRecord models, resulting
    # in the same query as Post.where(author_id: [1,2])
    authors_array = [Author.find(1), Author.find(2)]
    Post.where(author: authors_array)

    # ActiveRecord::Relation values find records using the same
    # query as Post.where(author_id: Author.where(last_name: "Emde"))
    Post.where(author: Author.where(last_name: "Emde"))

Polymorphic `belongs_to` associations will continue to be handled
appropriately, with the polymorphic `association_type` field added
to the query to match the base class of the value. This feature
previously only worked when the value was a single `ActveRecord::Base`.

    class Post < ActiveRecord::Base
      belongs_to :author, polymorphic: true
    end

    Post.where(author: Author.where(last_name: "Emde"))
    # Generates a query similar to:
    Post.where(author_id: Author.where(last_name: "Emde"), author_type: "Author")

This is not a valid URL.

[ci skip]

Fix url leak in application templates guide

Encapsulate url that was including the trailing quote and colon.

Fixes interpolation on SafeBuffer

Fixed rails dbconsole to support DATABASE_URL

Added `absence` parameter to pluralization table [ci skip]

Added `absence` parameter to table in section `5.1.2 Error Message Interpolation`.