* Update RAILS_VERSION
* Bundle
* rake update_versions
* rake changelog:header

If the secret_key_base is nil in dev or test generate a key from random
bytes and store it in a tmp file. This prevents the app developers from
having to share / checkin the secret key for dev / test but also
maintains a key between app restarts in dev/test.

[CVE-2019-5420]
Co-Authored-By: Neileencodes <eileencodes@gmail.com>
Co-Authored-By: NJohn Hawthorn <john@hawthorn.email>

[CVE-2019-5418]
[CVE-2019-5419]

* Don't call inspect from identifier_method_name

* Add locals Template#inspect

Handler, formats, and variant are usually obvious from looking at the
identifier. However it's not uncommon to have different locals for the
same template so we should make that obvious in inspect.

* Add tests for short_identifier and inspect

[John Hawthorn + Rafael Mendonça França]

Templates have one format

Allow custom cache-control header in AC::Live

Templates only have one format.  Before this commit, templates would be
constructed with a single element array that contained the format.  This
commit eliminates the single element array and just implements a
`format` method.  This saves one array allocation per template.

No nil format on templates

Co-Authored-By: Ntenderlove <tenderlove@github.com>

The format should always be exactly one symbol.  Now we don't need to
check whether or not the format is a `Type` in the constructor.

This means we can eliminate nil checks and remove some mutations from
the `decorate` method.

Support read queries with leading characters while preventing writes

This is needed to fix #35278.

https://github.com/rails/rails/issues/35312

Also, improving an argument error message for `limit`, extracting around
`type_to_sql` code into schema statements, and more exercise tests.

Fix prepared statements caching to be enabled even when query caching is enabled

Related cbcdecd2, 2a56b2d9.

This is a regression caused by cbcdecd2.

If query caching is enabled, prepared statement handles are never
re-used, since we missed that a query is preprocessed when query caching
is enabled, but doesn't keep the `preparable` flag.

We should care about that case.

  * The READ_QUERY regex would consider reads to be writes if they started with
    spaces or parens. For example, a UNION query might have parens around each
    SELECT - (SELECT ...) UNION (SELECT ...).
  * It will now correctly treat these queries as reads.

activemodel typo fixes.

Ensure `update_all` series doesn't care optimistic locking

Incrementing the lock version invalidates any other process's optimistic
lock, which is the desired outcome: the record no longer looks the same
as it did when they loaded it.

[ci skip] activejob typo fix.

Use "support/stubs/strong_parameters" instead.

How to use `select` is updated [ci skip]

Without this change, `store_translations` silently fails when available
locales already initialized.

Ref:
https://travis-ci.org/rails/rails/jobs/497615616#L6846
https://travis-ci.org/rails/rails/jobs/497605027#L6856

Restore ActionDispatch::Http::UploadedFile compatibility with IO.copy_stream

We test the inflections for both autoloaders, but we can
also autoload the constant as a sort of integration test.

[Harry Brundage & Xavier Noria]

In https://github.com/rails/rails/pull/28676 the `#to_path` method was
added to `ActionDispatch::Http::UploadedFile`. This broke usage with
`IO.copy_stream`:

  source = ActionDispatch::Http::UploadedFile.new(...)
  IO.copy_stream(source, destination)
  # ~> TypeError: can't convert ActionDispatch::Http::UploadedFile to IO (ActionDispatch::Http::UploadedFile#to_io gives Tempfile)

Normally `IO.copy_stream` just calls `#read` on the source object.
However, when `#to_path` is defined, `IO.copy_stream` calls `#to_io` in
order to retrieve the raw `File` object. In that case it trips up,
because `ActionDispatch::Http::UploadedFile#to_io` returned a `Tempfile`
object, which is not an `IO` subclass.

We fix this by having `#to_io` return an actual `File` object.