[CVE-2020-8167]

[CVE-2020-8166]

The same value for the `raw` option should be provided for both reading and
writing to avoid Marshal.load being called on untrusted data.

[CVE-2020-8165]

Dalli is already being used for marshalling, so we should also rely
on it for unmarshalling. Since Dalli tags the cache value as marshalled
it can avoid unmarshalling a raw string which might have come from
an untrusted source.

[CVE-2020-8165]

[CVE-2020-8164]

[CVE-2020-8162]

Allow associations to be autosaved multiple times

Relying on the `Arel::Table.engine` is convenient if an app have only a
single kind of database, but if not so, the global state is not always
the same with the current connection.

Closes #37701.

Reject hexadecimal numbers with signs while validating numericality

Use __id__ to dedup records for transactional callbacks

Fix random CI fail due to cross-second time delay

https://buildkite.com/rails/rails/builds/67891#867b2766-7984-4280-90d6-7f0412e2d239/1015-1026

Follow up to 404e1a0a.

Skip insert all tests when features are unavailable

Don't gitignore tmp/pids/.keep

Fix unscoping association scope on joins not to raise an error

Followup to e7514dc6.

Ignore Errno::ENOTEMPTY when calling AS::Cache::FileStore#clear with race conditions

Load XML Builder if it is not available

Followup to b94efe9f.

activerecord: Allow comment prefix in queries when preventing writes

Allow extra scoping in callbacks when create on association relation

The database kwarg is deprecated in 6.1 and will be removed in 6.2. It
has caused a lot of confusion and is dangerous to use in requests. Even
though docs recommended against use in requests, the majority of bug
reports to Rails regarding `connected_to` are related to this feature.
Since it's not an adequate replacement for sharding support we're
removing it. If you need shard support please use Rails 6.1 and the
shard kwarg.

While using perform_enqueued_jobs enqueued jobs must be stored as well

Adding a route for Mandrill's url check.

Update the Rails mailing list URLs to new discuss discourse URL

Add support for partitioned indexes in PostgreSQL 11+

Restore the `lookup_store` compatibility to accept config as a single object

9845cd63 broke configuring a cache store like so:

    config.cache_store = :redis_cache_store, config_for("redis/cache")

Rails::Application#config_for returns an ActiveSupport::OrderedOptions. By default, the Array#extract_options! core extension won't extract instances of Hash subclasses. Add ActiveSupport::OrderedOptions#extractable_options? and have it return true to fix.

Update `open_ended?` to support new Ruby 2.6 endless and Ruby 2.7 beginless ranges

Support beginless ranges in hash conditions.

Fix escaping in OptimizedFileSystemResolver