[rheos]

The last app in the fleet walk (rheos/growoperative-api#55). foaf-auth, railsbackend and onloan-api are all on Rails 8.1.4 / Ruby 3.4.11 in production; orchardly-rails is merged.

Three commits, ordered so any failure has one candidate cause.

1. Pin Rails to ~> 7.2.4 + load_defaults 7.2

This repo was already resolving to 7.2.3.2 without anyone bumping it, because the Gemfile carried a floating gem "rails", "~> 7.1" rather than a pin. That is why it looked a stage ahead of the fleet — it was never deliberately moved, it drifted. Now pinned.

Three of five 7.2 defaults adopted. active_job.* and active_storage.* are excluded: config/application.rb picks railties individually (active_model, active_record, action_controller, action_view) and omits both, so assigning either raises NoMethodError on boot.

Which namespaces are missing was confirmed by asking the running app, not by reading the require list — the method that caught a mistake on onloan-api, where action_view turns out to be available despite never being required, because action_controller/railtie pulls it in:

active_job        MISSING -> unsettable
active_storage    MISSING -> unsettable
action_view       available   <- not in the require list

2. Pin Ruby to 3.4.11

Same floating-constraint problem: ruby "~> 3.2" would have kept resolving to an EOL line indefinitely without ever looking out of date. Ruby 3.2 went EOL 2026-03-31. Three pins move (Gemfile, Dockerfile, CI); there is no .ruby-version here.

No new gem declarations needed — none of the stdlib gems that left Ruby 3.4's defaults are required anywhere. Zero gem deltas; only RUBY VERSION moved.

3. Rails 8.1.4 + load_defaults 8.1

All NINE defaults walked one at a time, suite green after each. Nine, not eight — this is the first app walked with the corrected 8.0 list, which has three defaults rather than the two the Rails configuring guide documents:

8.0  Regexp.timeout = 1
8.0  action_dispatch.strict_freshness = true
8.0  active_support.to_time_preserves_timezone = :zone   <- the missed one
8.1  action_controller.escape_json_responses = false
8.1  active_support.escape_js_separators_in_json = false
8.1  active_record.raise_on_missing_required_finder_order_columns = true
8.1  action_controller.action_on_path_relative_redirect = :raise
8.1  action_view.render_tracker = :ruby
8.1  action_view.remove_hidden_field_autocomplete = true

The third 8.0 default was adopted silently on the three apps that went 7.2 → 8.1 directly, because it was hand-added from the published list. It surfaced on orchardly-rails, the one app that kept the separate 8.0 stop and therefore generated the real file. Here it was walked deliberately, and .to_time usage was checked first (none in this repo, so it is a no-op either way).

Also ran a baseline suite immediately after the version bump, before any flag, so a gem-resolution break could not masquerade as a framework default.

Incidental: local dev has been broken since the Postgres migration

Not a repo change, but worth recording because the symptom looks like a broken compose file and is not. The foaf_db_data volume still held MySQL data (auto.cnf, ib_buffer_pool, ca-key.pem) from before 2026-08-22. docker-compose.yml had moved to postgres:16, but the named volume was never removed, so Postgres refused to initdb on every start — "directory exists but is not empty" — and the db container exited immediately. Anyone running docker compose up here since the migration has hit a dead database. Removing the volume fixes it.

Verification

• Full suite: 75 examples, 0 failures, zero deprecation warnings
• Production boot with eager_load=true: rails=8.1.4 ruby=3.4.11 rack=3.2.7 regexp_timeout=1.0

Merging deploys demo after CI; prod needs confirm=deploy-prod-protocol.

Refs rheos/growoperative-api#55

Summary by CodeRabbit

• Chores
  • Updated the application runtime to Ruby 3.4.11 and Rails 8.1.4.
  • Updated the deployment image and continuous integration environment to use Ruby 3.4.11, keeping development and deployment environments aligned.
  • Updated the application’s framework defaults to Rails 8.1.4.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: a9fea8e0-b427-439b-a1fd-c4a0949a330f

📥 Commits

Reviewing files that changed from the base of the PR and between 8fa2b58 and 34d8b70.

⛔ Files ignored due to path filters (1)

• Gemfile.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• .github/workflows/ci.yml
• Dockerfile
• Gemfile
• config/application.rb

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The project now uses Ruby 3.4.11 in CI, Docker, and the Gemfile. The Gemfile requires Rails ~> 8.1.4, and the application loads Rails 8.1 defaults.

Changes

Runtime and Rails Upgrade

Layer / File(s)	Summary
Ruby and Rails version settings .github/workflows/ci.yml, Dockerfile, Gemfile, config/application.rb	CI and Docker now use Ruby 3.4.11. The Gemfile requires Ruby 3.4.11 and Rails ~> 8.1.4. The application loads Rails 8.1 defaults.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 34d8b

The upgrade aligns the application, CI, and container builds on the new Ruby and Rails versions. No concrete merge-blocking issue is established in the supplied evidence.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to 34d8b

The upgrade affects both deployed API environments. The reviewed code shows no new public route or demonstrated authorization bypass, but the effect of the newer framework defaults on production request and transaction behavior remains unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — Framework-default changes can affect requests to the existing public API in both production-configured environments. The available evidence does not establish a newly reachable endpoint or a specific weakened control.

Trust Boundaries and Controls

• observed — Pending-transfer and trustline write requests cross from caller-supplied addresses into signature checks and state-changing services. Signature enforcement is conditional in the existing API controller, while the application change selects framework defaults rather than changing those checks.

Resilience and Maintainability Implications

• observed — The existing pending-transfer flow checks repeated terminal actions and locks the record; the transfer service uses a transaction and locks trustlines before changing balances and recording events. No observed change to those handlers establishes a regression, but their behavior under the upgraded framework was not verified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the primary changes: upgrading Rails to 8.1.4 and Ruby to 3.4.11.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}