Since https://github.com/puma/puma/pull/1700, the default host is
correctly used. So `localhost` is used instead of `0.0.0.0`.

As a result, the log output on restart is changed, and the restart test
fails on Puma 3.12.1.
https://travis-ci.org/rails/rails/jobs/509239592#L2303-L2305

Specify binding explicitly to avoid being affected by Puma changes.

Make application work without tmp directory

This was missed in the security fix for local dev. CI doesn't have a tmp
directory in the apps built for testing so these end up failing. This
adds the secret_key_base so we don't need to generate one.

This streamlines the lovely foundation Bogdan added. Mainly to add
guidance around encryption keys and remove some backticks.

Finally it adds some mention of how to access these files from Ruby
in apps.

[ Kasper Timm Hansen & bogdanvlviv ]

Improve output of `rails encrypted(:edit/:show) --help`

* Bump RAILS_VERSION
* Bundle
* rake update_versions
* rake changelog:header

If the secret_key_base is nil in dev or test generate a key from random
bytes and store it in a tmp file. This prevents the app developers from
having to share / checkin the secret key for dev / test but also
maintains a key between app restarts in dev/test.

[CVE-2019-5420]
Co-Authored-By: Neileencodes <eileencodes@gmail.com>
Co-Authored-By: NJohn Hawthorn <john@hawthorn.email>

[CVE-2019-5418]
[CVE-2019-5419]

Support other optional parameters and quoted-strings on Content-Type parser

Turbolinks replaces the CSP nonce <meta> tag on page change, but inline scripts inserted by UJS need the nonce from the initial page load. In general, it doesn't matter to UJS if the nonce changes after the page loads: only the initial value is relevant.

The 'listen' gem should also be included on other Ruby implementations

* This `if RUBY_ENGINE == 'ruby'` was meant to only skip `byebug` since
  its introduction in 059bdc34.
  Listen was added in de6ad566.
* Others gems already have appropriate checks for their inclusion.
* Test that the listen gem is included when RUBY_ENGINE is not 'ruby'.

Relax table name detection in `from` to allow any extension like INDEX hint

Fix different `count` calculation when using `size` with DISTINCT `select`

Caching `find_by` statements on STI subclasses is unsafe, since
`type IN (?,?,?,?)` part is dynamic, and we don't have SQL statements
cache invalidation when a STI subclass is created or removed for now.

Fix prepared statements caching to be enabled even when query caching is enabled

Merge pull request #35375 from y-yagi/fix_test_select_with_subquery_in_from_uses_original_table_name

Make `test_select_with_subquery_in_from_uses_original_table_name` work with old SQLite3

Fix `pluck` and `select` with `from` if `from` has original table name

Fix lint `ShadowingOuterLocalVariable`

Return correct date in ActiveModel for time to date conversions

`value_from_multiparameter_assignment` defined by
`AcceptsMultiparameterTime` helper requires `default_timezone` method
which is defined at `TimeValue` helper.
Since `Date` type doesn't include `TimeValue`, I've extracted `Timezone`
helper to be shared by `Date`, `DateTime`, and `Time` types.

Should use `value_for_database` like as master branch does.

This reverts commit 32a01417.

Don't allow `where` with invalid value matches to nil values

Since `serialize` is passed user input args (from `where`, schema
default, etc), a helper should provide `serialize` if the helper also
provide `cast`.

Related #32624, 34cc301f, a741208f.

This follows up 0ee96d13.

Fix the regex that extract mismatched foreign key information

Fix possible memory leak of ConnectionHandler

Follow up to #35154.

Properly handle cached queries with too many bind parameters

Fixes missing method `path_for` when using MirrorService with DiskService as the primary service

Currently custom attributes are always qualified by the table name in
the generated SQL wrongly even if the table doesn't have the named
column, it would cause an invalid SQL error.

Custom attributes should only be qualified if the table has the same
named column.

The implicit delegation in the migration class is to be logged. It is
not intended in the migration compatibility, so it should be avoided.

Fixes #35224.