Update railties requirement from ~> 6.0 to >= 6, < 8

[dependabot]

Updates the requirements on railties to permit the latest version.

Release notes

Sourced from railties's releases.

7.0.0

Action Cable

• The Action Cable client now ensures successful channel subscriptions:

  • The client maintains a set of pending subscriptions until either the server confirms the subscription or the channel is torn down.
  • Rectifies the race condition where an unsubscribe is rapidly followed by a subscribe (on the same channel identifier) and the requests are handled out of order by the ActionCable server, thereby ignoring the subscribe command.

  Daniel Spinosa

• Compile ESM package that can be used directly in the browser as actioncable.esm.js.

  DHH

• Move action_cable.js to actioncable.js to match naming convention used for other Rails frameworks, and use JS console to communicate the deprecation.

  DHH

• Stop transpiling the UMD package generated as actioncable.js and drop the IE11 testing that relied on that.

  DHH

• Truncate broadcast logging messages.

  J Smith

• OpenSSL constants are now used for Digest computations.

  Dirkjan Bussink

• The Action Cable client now includes safeguards to prevent a "thundering herd" of client reconnects after server connectivity loss:

  • The client will wait a random amount between 1x and 3x of the stale threshold after the server's last ping before making the first reconnection attempt.
  • Subsequent reconnection attempts now use exponential backoff instead of logarithmic backoff. To allow the delay between reconnection attempts to increase slowly at first, the default exponentiation base is < 2.
  • Random jitter is applied to each delay between reconnection attempts.

  Jonathan Hefner

Action Mailbox

• Removed deprecated environment variable MAILGUN_INGRESS_API_KEY.

... (truncated)

Changelog

Sourced from railties's changelog.

Rails 7.0.0 (December 15, 2021)

• No changes.

Rails 7.0.0.rc3 (December 14, 2021)

• Allow localhost with a port by default in development

  [Fixes: #43864]

Rails 7.0.0.rc2 (December 14, 2021)

• No changes

Rails 7.0.0.rc1 (December 06, 2021)

• Remove deprecated config in dbconsole.

  Rafael Mendonça França

• Change default X-XSS-Protection header to disable XSS auditor

  This header has been deprecated and the XSS auditor it triggered has been removed from all major modern browsers (in favour of Content Security Policy) that implemented this header to begin with (Firefox never did).

  OWASP suggests setting this header to '0' to disable the default behaviour on old browsers as it can introduce additional security issues.

  Added the new behaviour as a framework default from Rails 7.0.

  Christian Sutter

• Scaffolds now use date_field, time_field and datetime_field instead of date_select, time_select and datetime_select; thus providing native date/time pickers.

  Martijn Lafeber

• Fix a regression in which autoload paths were initialized too late.

  Xavier Noria

Rails 7.0.0.alpha2 (September 15, 2021)

• Fix activestorage dependency in the npm package.

  Rafael Mendonça França

... (truncated)

Commits

• 984c3ef Preparing for 7.0.0 release
• 6c85f3b Merge pull request #43871 from rails/rm-fix-hosts-with-port
• 07a502e Make sure test pass with minitest 5.15
• 7d924ab Merge pull request #43877 from eileencodes/dont-use-schema-cache-on-schema-mi...
• d0737d0 Merge pull request #43880 from jonathanhefner/fix-scaffold-index_html_erb-var...
• c615bd8 Fix scaffold test
• 51e6542 Merge pull request #43817 from etiennebarrie/deprecate-non-url-safe-csrf-tokens
• 20c694b Merge pull request #43850 from hachi8833/fix_favicon_link_tag
• 49a602c Merge PR #43611
• 70b5753 Merge pull request #43846 from fig/fix-scaffold-self-referential-link
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Dependabot tried to add @fabianrbz as a reviewer to this PR, but received the following error from GitHub:

POST https://api.github.com/repos/Nexmo/station/pulls/1207/requested_reviewers: 422 - Reviews may only be requested from collaborators. One or more of the users or teams you specified is not a collaborator of the Nexmo/station repository. // See: https://docs.github.com/rest/reference/pulls#request-reviewers-for-a-pull-request