<story><title>Rails 4.1.0 released</title><url>http://weblog.rubyonrails.org/2014/4/8/Rails-4-1/</url></story><parent_chain><item><author>losvedir</author><text>My company is still on Rails 3.2. We had been waiting for the first minor release of Rails 4 to give folks a chance to work out issues, so maybe now it&amp;#x27;s time to look at upgrading.&lt;p&gt;Anyone have major issues going from 3.2 -&amp;gt; 4? I&amp;#x27;ve heard horror stories about 2 -&amp;gt; 3, but I didn&amp;#x27;t pick up Rails myself until 3.x so I don&amp;#x27;t have firsthand experience.&lt;p&gt;The biggest change I see is attr_accessible to strong_parameters. Does that mean I need to go through and rewrite all our models and controllers before we can update?</text></item></parent_chain><comment><author>awj</author><text>It went comparatively smooth for us. 2 to 3 was a nightmare, 3 to 4 wasn&amp;#x27;t too awful. Some of the things that bit us:&lt;p&gt;* Strong parameters means you&amp;#x27;re going to have to figure out what everything needs for params or break down and call permit! where acceptable. If anyone got crazy with attribute metaprogramming bullshittery, you&amp;#x27;re in for fun.&lt;p&gt;* The deep_munge part of strong parameters has some strong opinions about how it should do its job. The code is there to prevent attacks where unusual user input is handed directly to ActiveRecord and interpreted by it. One special case to look out for is that it will rewrite a (JSON-supplied) empty array into nil, which makes life fun if your API happens to put some semantic meaning on nil vs. empty arrays.&lt;p&gt;* The new restrictions on routing verbs are good stuff, but I can almost guarantee that something was getting away with using the wrong verb before.&lt;p&gt;* XML parameter parsing has been extracted to a plugin. For some reason XML generation wasn&amp;#x27;t, but if people are sending you XML data you&amp;#x27;ll need this: &lt;a href=&quot;https://github.com/rails/actionpack-xml_parser&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;rails&amp;#x2F;actionpack-xml_parser&lt;/a&gt;&lt;p&gt;That&amp;#x27;s all I can think of off the top of my head.&lt;p&gt;In response to this:&lt;p&gt;&amp;gt; Does that mean I need to go through and rewrite all our models and controllers before we can update?&lt;p&gt;Not really, no. As a first step we rewrote all of our attr_accessible usage into model class-level constants we could run through strong_parameters. Eventually those moved out of the model, but it was good enough to get going. Example:&lt;p&gt;# Rails 3.2&lt;p&gt;class Foo &amp;lt; ActiveRecord::Base&lt;p&gt;&lt;pre&gt;&lt;code&gt;  attr_accessible :name, :bar, :whatever

  attr_accessible :name, :bar, :whatever, :approved, :as =&amp;gt; :admin
&lt;/code&gt;&lt;/pre&gt;
end&lt;p&gt;# Rails 4.0&lt;p&gt;class Foo &amp;lt; ActiveRecord::Base&lt;p&gt;&lt;pre&gt;&lt;code&gt;  UPDATEABLE_ATTRIBUTES = [:name, :bar, :whatever]

  ADMIN_UPDATEABLE_ATTRIBUTES = UPDATEABLE_ATTRIBUTES + [:approved]
&lt;/code&gt;&lt;/pre&gt;
end</text></comment>
<story><title>Rails 4.1.0 released</title><url>http://weblog.rubyonrails.org/2014/4/8/Rails-4-1/</url></story><parent_chain><item><author>losvedir</author><text>My company is still on Rails 3.2. We had been waiting for the first minor release of Rails 4 to give folks a chance to work out issues, so maybe now it&amp;#x27;s time to look at upgrading.&lt;p&gt;Anyone have major issues going from 3.2 -&amp;gt; 4? I&amp;#x27;ve heard horror stories about 2 -&amp;gt; 3, but I didn&amp;#x27;t pick up Rails myself until 3.x so I don&amp;#x27;t have firsthand experience.&lt;p&gt;The biggest change I see is attr_accessible to strong_parameters. Does that mean I need to go through and rewrite all our models and controllers before we can update?</text></item></parent_chain><comment><author>kyleashipley</author><text>3.2 -&amp;gt; 4 is an order of magnitude easier than 2 -&amp;gt; 3.&lt;p&gt;The upgrade guide is pretty solid, and I imagine it mostly applies for Rails 4.1 as well: &lt;a href=&quot;http://guides.rubyonrails.org/upgrading_ruby_on_rails.html#upgrading-from-rails-3-2-to-rails-4-0&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;guides.rubyonrails.org&amp;#x2F;upgrading_ruby_on_rails.html#u...&lt;/a&gt;&lt;p&gt;I spent most of my time updating app config. For several of my 3.2 apps, I started using strong_parameters, so it wasn&amp;#x27;t a leap for me. Another app I have on 4.0 is using the &lt;a href=&quot;https://github.com/rails/protected_attributes&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;rails&amp;#x2F;protected_attributes&lt;/a&gt; to retain the existing attr_accessible behavior until I get time to update.&lt;p&gt;Hope that helps!</text></comment>