Rails 8.1.4.1 (November 03, 2026)¶ ↑

• Skip attribute names in tag helpers that are blank once converted to a string.

  A Symbol such as :" " is not blank, because Symbol#blank? is Symbol#empty?, so it reached the escaping step and produced an attribute with no name. The asset helpers symbolize their keys, so an ordinary String key reached the same place.

  [GHSA-68p9-83h6-5wpj]

  Mike Dalessio

• Fix strip_tags to encode " and ' in its output.

  strip_tags returns an html_safe string, but was not encoding quotation marks. The method now encodes all five HTML-significant characters (&, <, >, ", '), consistent with the existing html_safe convention.

  Output used outside HTML, such as in a text template or JSON, now contains " and ' where it contained " and '. CGI.unescapeHTML decodes them.

  [GHSA-rq8q-p985-fjq7]

  Mike Dalessio

• Escape the matched phrase before substituting it into highlight's :highlighter.

  A match was copied into each \1 of the highlighter as it appeared in the sanitized text, which keeps " and ' as they are, so a match containing a quote ended a quoted attribute value such as the documented '<a href="search?q=\1">\1</a>' and added attributes of its own. Each substituted group now goes through ERB::Util.html_escape_once, so quotes in a match render as " and '. Only the numbered placeholders \0 to \9 are expanded, and a match never replaces the > that closes a tag.

  [GHSA-v6rj-xm57-3p59]

  Jeremy Daer

• Require rails-html-sanitizer 1.7.2 or later.

  With the HTML5 sanitizer, Nokogiri before 1.19.5 left < and > unescaped in attribute values. highlight and simple_format, which edit the sanitized HTML as a string, could then turn markup inside an attribute value into live elements. rails-html-sanitizer 1.7.2 requires Loofah 2.25.3, which requires Nokogiri 1.19.5.

  [GHSA-2p2f-4rq4-gjwc]

  Mike Dalessio

Rails 8.1.4 (September 24, 2026)¶ ↑

• Fix non-ASCII strict locals defaults rendering as mojibake.

  When a template declared a non-ASCII default in its locals: magic comment and its body was ASCII-only, the handler returned ASCII-8BIT code and the compiled method definition was retagged with it, corrupting the default.

  Carlos Daniel Pohlod

• Fix the :ruby render tracker not being registered for ERB templates when eager_load is enabled.

  Gabriel Quaresma

• Fix Encoding::CompatibilityError when digesting templates with non-ASCII content via DependencyTracker::RubyTracker.

  File-backed templates are loaded as ASCII-8BIT. RubyTracker now passes template.encode! to the handler (matching Template#compiled_source) so handlers such as Haml/Temple can concatenate static UTF-8 strings without raising. Fixes #58203.

  Edil Talantbek uulu

• Fix week_field to not emit invalid week strings at ISO year boundaries.

  Kenta Ishizaki

• Fix ActionView::TestCase#render to reset rendered. The behavior was changed when memoization was added in #51093. Now it once again conforms to the documentation.

  Jeroen Versteeg

• Fix FormBuilder#to_partial_path returning nil for subclasses whose name does not end in Builder.

  Kenta Ishizaki

• Fix collection_radio_buttons and collection_check_boxes generating a label for attribute that does not match the input id when a collection value is nil.

  Kenta Ishizaki

Rails 8.1.3.1 (July 29, 2026)¶ ↑

• No changes.

Rails 8.1.3 (March 24, 2026)¶ ↑

• Fix encoding errors for string locals containing non-ASCII characters.

  Kataoka Katsuki

• Fix collection caching to only forward expires_in argument if explicitly set.

  Pieter Visser

Rails 8.1.2.1 (March 23, 2026)¶ ↑

• Fix possible XSS in DebugExceptions middleware

  [CVE-2026-33167]

  John Hawthorn

• Skip blank attribute names in tag helpers to avoid generating invalid HTML.

  [CVE-2026-33168]

  Mike Dalessio

Rails 8.1.2 (January 08, 2026)¶ ↑

• Fix file_field to join mime types with a comma when provided as Array

  file_field(:article, :image, accept: ['image/png', 'image/gif', 'image/jpeg'])
  

  Now behaves likes:

  file_field(:article, :image, accept: 'image/png,image/gif,image/jpeg')
  

  Bogdan Gusiev

• Fix strict locals parsing to handle multiline definitions.

  Said Kaldybaev

• Fix content_security_policy_nonce error in mailers when using content_security_policy_nonce_auto setting.

  The content_security_policy_nonce helper is provided by ActionController::ContentSecurityPolicy, and it relies on request.content_security_policy_nonce. Mailers lack both the module and the request object.

  Jarrett Lusso

Rails 8.1.1 (October 28, 2025)¶ ↑

• Respect remove_hidden_field_autocomplete config in form builder hidden_field.

  Rafael Mendonça França

Rails 8.1.0 (October 22, 2025)¶ ↑

• The BEGIN template annotation/comment was previously printed on the same line as the following element. We now insert a newline inside the comment so it spans two lines without adding visible whitespace to the HTML output to enhance readability.

  Before:

  <!-- BEGIN /Users/siaw23/Desktop/rails/actionview/test/fixtures/actionpack/test/greeting.html.erb --><p>This is grand!</p>

  After:

  <!-- BEGIN /Users/siaw23/Desktop/rails/actionview/test/fixtures/actionpack/test/greeting.html.erb
  --><p>This is grand!</p>

  Emmanuel Hayford

• Add structured events for Action View:

  • action_view.render_template

  • action_view.render_partial

  • action_view.render_layout

  • action_view.render_collection

  • action_view.render_start

  Gannon McGibbon

• Fix label with for option not getting prefixed by form namespace value

  Abeid Ahmed, Hartley McGuire

• Add fetchpriority to Link headers to match HTML generated by preload_link_tag.

  Guillermo Iguaran

• Add CSP nonce to Link headers generated by preload_link_tag.

  Alexander Gitter

• Allow current_page? to match against specific HTTP method(s) with a method: option.

  Ben Sheldon

• Remove autocomplete="off" on hidden inputs generated by the following tags:

  • form_tag, token_tag, method_tag

  As well as the hidden parameter fields included in button_to, check_box, select (with multiple) and file_field forms.

  nkulway

• Enable configuring the strategy for tracking dependencies between Action View templates.

  The existing :regex strategy is kept as the default, but with load_defaults 8.1 the strategy will be :ruby (using a real Ruby parser).

  Hartley McGuire

• Introduce relative_time_in_words helper

  relative_time_in_words(3.minutes.from_now) # => "in 3 minutes"
  relative_time_in_words(3.minutes.ago) # => "3 minutes ago"
  relative_time_in_words(10.seconds.ago, include_seconds: true) # => "less than 10 seconds ago"
  

  Matheus Richard

• Make nonce: false remove the nonce attribute from javascript_tag, javascript_include_tag, and stylesheet_link_tag.

  francktrouillez

• Add dom_target helper to create dom_id-like strings from an unlimited number of objects.

  Ben Sheldon

• Respect html_options[:form] when collection_checkboxes generates the hidden <input>.

  Riccardo Odone

• Layouts have access to local variables passed to render.

  This fixes #31680 which was a regression in Rails 5.1.

  Mike Dalessio

• Argument errors related to strict locals in templates now raise an ActionView::StrictLocalsError, and all other argument errors are reraised as-is.

  Previously, any ArgumentError raised during template rendering was swallowed during strict local error handling, so that an ArgumentError unrelated to strict locals (e.g., a helper method invoked with incorrect arguments) would be replaced by a similar ArgumentError with an unrelated backtrace, making it difficult to debug templates.

  Now, any ArgumentError unrelated to strict locals is reraised, preserving the original backtrace for developers.

  Also note that ActionView::StrictLocalsError is a subclass of ArgumentError, so any existing code that rescues ArgumentError will continue to work.

  Fixes #52227.

  Mike Dalessio

• Improve error highlighting of multi-line methods in ERB templates or templates where the error occurs within a do-end block.

  Martin Emde

• Fix a crash in ERB template error highlighting when the error occurs on a line in the compiled template that is past the end of the source template.

  Martin Emde

• Improve reliability of ERB template error highlighting. Fix infinite loops and crashes in highlighting and improve tolerance for alternate ERB handlers.

  Martin Emde

• Allow hidden_field and hidden_field_tag to accept a custom autocomplete value.

  brendon

• Add a new configuration content_security_policy_nonce_auto for automatically adding a nonce to the tags affected by the directives specified by the content_security_policy_nonce_directives configuration option.

  francktrouillez

Please check 8-0-stable for previous changes.