Ruby on Rails 5.2: What's New, Release History & Support Lifecycle

What Is New in Ruby on Rails 5.2

How does Active Storage simplify file uploads in Rails 5.2?

Active Storage gives you a unified API to attach files to any Active Record model and store them on cloud services or the local disk.

• Declare attachments with has_one_attached or has_many_attached.
• Supported services: Amazon S3, Google Cloud Storage, Microsoft Azure, and a built-in local disk service for dev/test.
• Mirroring lets you write to multiple services for backup or migration.

# app/models/user.rb
class User < ApplicationRecord
  has_one_attached :avatar
end

# In a form
<%= form.file_field :avatar %>

# Attach from console
user.avatar.attach(io: File.open('/path/to/file.jpg'), filename: 'file.jpg')

In practice this removes the need for carrierwave or paperclip gems and centralises file handling in the Rails stack.

What is the new Credentials system and how does it replace secrets?

Rails 5.2 introduces config/credentials.yml.enc, an encrypted file that stores all production secrets.

• The file is encrypted with a master key stored in config/master.key or the RAILS_MASTER_KEY env var.
• It can hold API keys, third-party tokens, and even arbitrary encrypted configuration files.
• Rails.application.credentials replaces Rails.application.secrets and the older encrypted secrets feature.

# Edit credentials
EDITOR="vim" bin/rails credentials:edit

# Access in code
Rails.application.credentials.dig(:aws, :access_key_id)

This matters if you want a single source of truth for secrets that lives safely in version control.

How have caching and fragment keys changed in Rails 5.2?

Rails 5.2 separates the cache key from a version component, enabling recyclable fragment caching.

• ActiveRecord::Base#cache_version provides a stable version number for a record.
• #cache_key now returns a deterministic key without a timestamp, reducing cache churn.
• Fragment caches can now use cache_version to invalidate groups of fragments efficiently.

# In a view
<%= cache(@post) do %>
  <%= render @post %>
<% end %>

# The underlying key looks like:
posts/123-202309150001

Most teams will see fewer cache misses after a deployment because unchanged fragments keep their keys.

What security defaults are added in Rails 5.2?

Rails 5.2 ships with a built-in Content Security Policy DSL and stronger default headers.

• Define a global CSP in config/initializers/content_security_policy.rb and override per-controller if needed.
• AEAD encrypted cookies use AES-256-GCM, providing authenticated encryption.
• Default response headers now include Referrer-Policy, X-Download-Options, X-Permitted-Cross-Domain-Policies, and an HSTS max-age of one year.

# config/initializers/content_security_policy.rb
Rails.application.config.content_security_policy do |policy|
  policy.default_src :self, :https
  policy.img_src     :self, :data, "https://images.example.com"
  policy.object_src  :none
end

These defaults help you meet modern browser security expectations without extra configuration.