Merge branch 'master' into activestorage-guide

172 files changed, 2670 insertions, 676 deletions

diff --git a/.rubocop.yml b/.rubocop.yml
index 399fc66730..f6259fe432 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -76,6 +76,9 @@ Layout/SpaceAroundOperators:
 Layout/SpaceBeforeFirstArg:
     Enabled: true
 
+Style/DefWithParentheses:
+  Enabled: true
+
 # Defining a method with parameters needs parentheses.
 Style/MethodDefParentheses:
   Enabled: true
diff --git a/Gemfile b/Gemfile
index 4a7f5210d3..32ec87b501 100644
--- a/Gemfile
+++ b/Gemfile
@@ -37,6 +37,9 @@ gem "rubocop", ">= 0.47", require: false
 # https://github.com/guard/rb-inotify/pull/79
 gem "rb-inotify", github: "matthewd/rb-inotify", branch: "close-handling", require: false
 
+# https://github.com/puma/puma/pull/1345
+gem "stopgap_13632", platforms: :mri if RUBY_VERSION == "2.2.8"
+
 group :doc do
   gem "sdoc", github: "robin850/sdoc", branch: "upgrade"
   gem "redcarpet", "~> 3.2.3", platforms: :ruby
@@ -89,7 +92,7 @@ end
 # Active Storage
 group :storage do
   gem "aws-sdk-s3", require: false
-  gem "google-cloud-storage", "~> 1.3", require: false
+  gem "google-cloud-storage", "~> 1.8", require: false
   gem "azure-storage", require: false
 
   gem "mini_magick"
diff --git a/Gemfile.lock b/Gemfile.lock
index 075f8c2b0e..1453bddb34 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -44,62 +44,62 @@ GIT
 PATH
   remote: .
   specs:
-    actioncable (5.2.0.alpha)
-      actionpack (= 5.2.0.alpha)
+    actioncable (5.2.0.beta2)
+      actionpack (= 5.2.0.beta2)
       nio4r (~> 2.0)
       websocket-driver (~> 0.6.1)
-    actionmailer (5.2.0.alpha)
-      actionpack (= 5.2.0.alpha)
-      actionview (= 5.2.0.alpha)
-      activejob (= 5.2.0.alpha)
+    actionmailer (5.2.0.beta2)
+      actionpack (= 5.2.0.beta2)
+      actionview (= 5.2.0.beta2)
+      activejob (= 5.2.0.beta2)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 2.0)
-    actionpack (5.2.0.alpha)
-      actionview (= 5.2.0.alpha)
-      activesupport (= 5.2.0.alpha)
+    actionpack (5.2.0.beta2)
+      actionview (= 5.2.0.beta2)
+      activesupport (= 5.2.0.beta2)
       rack (~> 2.0)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (5.2.0.alpha)
-      activesupport (= 5.2.0.alpha)
+    actionview (5.2.0.beta2)
+      activesupport (= 5.2.0.beta2)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    activejob (5.2.0.alpha)
-      activesupport (= 5.2.0.alpha)
+    activejob (5.2.0.beta2)
+      activesupport (= 5.2.0.beta2)
       globalid (>= 0.3.6)
-    activemodel (5.2.0.alpha)
-      activesupport (= 5.2.0.alpha)
-    activerecord (5.2.0.alpha)
-      activemodel (= 5.2.0.alpha)
-      activesupport (= 5.2.0.alpha)
+    activemodel (5.2.0.beta2)
+      activesupport (= 5.2.0.beta2)
+    activerecord (5.2.0.beta2)
+      activemodel (= 5.2.0.beta2)
+      activesupport (= 5.2.0.beta2)
       arel (>= 9.0)
-    activestorage (5.2.0.alpha)
-      actionpack (= 5.2.0.alpha)
-      activerecord (= 5.2.0.alpha)
-    activesupport (5.2.0.alpha)
+    activestorage (5.2.0.beta2)
+      actionpack (= 5.2.0.beta2)
+      activerecord (= 5.2.0.beta2)
+    activesupport (5.2.0.beta2)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (~> 0.7)
       minitest (~> 5.1)
       tzinfo (~> 1.1)
-    rails (5.2.0.alpha)
-      actioncable (= 5.2.0.alpha)
-      actionmailer (= 5.2.0.alpha)
-      actionpack (= 5.2.0.alpha)
-      actionview (= 5.2.0.alpha)
-      activejob (= 5.2.0.alpha)
-      activemodel (= 5.2.0.alpha)
-      activerecord (= 5.2.0.alpha)
-      activestorage (= 5.2.0.alpha)
-      activesupport (= 5.2.0.alpha)
+    rails (5.2.0.beta2)
+      actioncable (= 5.2.0.beta2)
+      actionmailer (= 5.2.0.beta2)
+      actionpack (= 5.2.0.beta2)
+      actionview (= 5.2.0.beta2)
+      activejob (= 5.2.0.beta2)
+      activemodel (= 5.2.0.beta2)
+      activerecord (= 5.2.0.beta2)
+      activestorage (= 5.2.0.beta2)
+      activesupport (= 5.2.0.beta2)
       bundler (>= 1.3.0)
-      railties (= 5.2.0.alpha)
+      railties (= 5.2.0.beta2)
       sprockets-rails (>= 2.0.0)
-    railties (5.2.0.alpha)
-      actionpack (= 5.2.0.alpha)
-      activesupport (= 5.2.0.alpha)
+    railties (5.2.0.beta2)
+      actionpack (= 5.2.0.beta2)
+      activesupport (= 5.2.0.beta2)
       method_source
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
@@ -118,8 +118,8 @@ GEM
     activerecord-jdbcsqlite3-adapter (1.3.24)
       activerecord-jdbc-adapter (~> 1.3.24)
       jdbc-sqlite3 (>= 3.7.2, < 3.9)
-    addressable (2.5.1)
-      public_suffix (~> 2.0, >= 2.0.2)
+    addressable (2.5.2)
+      public_suffix (>= 2.0.2, < 4.0)
     amq-protocol (2.2.0)
     archive-zip (0.7.0)
       io-like (~> 0.3.0)
@@ -204,11 +204,12 @@ GEM
     concurrent-ruby (1.0.5-java)
     connection_pool (2.2.1)
     cookiejar (0.3.3)
+    crass (1.0.3)
     curses (1.0.2)
     daemons (1.2.4)
     dalli (2.7.6)
     dante (0.2.0)
-    declarative (0.0.9)
+    declarative (0.0.10)
     declarative-option (0.1.0)
     delayed_job (4.1.3)
       activesupport (>= 3.0, < 5.2)
@@ -224,7 +225,7 @@ GEM
       http_parser.rb (>= 0.6.0)
     em-socksify (0.3.1)
       eventmachine (>= 1.0.0.beta.4)
-    erubi (1.6.1)
+    erubi (1.7.0)
     et-orbi (1.0.8)
       tzinfo
     event_emitter (0.2.6)
@@ -249,27 +250,27 @@ GEM
     ffi (1.9.18-java)
     ffi (1.9.18-x64-mingw32)
     ffi (1.9.18-x86-mingw32)
-    globalid (0.4.0)
+    globalid (0.4.1)
       activesupport (>= 4.2.0)
-    google-api-client (0.13.1)
+    google-api-client (0.17.3)
       addressable (~> 2.5, >= 2.5.1)
-      googleauth (~> 0.5)
+      googleauth (>= 0.5, < 0.7.0)
       httpclient (>= 2.8.1, < 3.0)
       mime-types (~> 3.0)
       representable (~> 3.0)
       retriable (>= 2.0, < 4.0)
-    google-cloud-core (1.0.0)
+    google-cloud-core (1.1.0)
       google-cloud-env (~> 1.0)
-      googleauth (~> 0.5.1)
     google-cloud-env (1.0.1)
       faraday (~> 0.11)
-    google-cloud-storage (1.4.0)
+    google-cloud-storage (1.9.0)
       digest-crc (~> 0.4)
-      google-api-client (~> 0.13.0)
-      google-cloud-core (~> 1.0)
-    googleauth (0.5.3)
+      google-api-client (~> 0.17.0)
+      google-cloud-core (~> 1.1)
+      googleauth (~> 0.6.2)
+    googleauth (0.6.2)
       faraday (~> 0.12)
-      jwt (~> 1.4)
+      jwt (>= 1.4, < 3.0)
       logging (~> 2.0)
       memoist (~> 0.12)
       multi_json (~> 1.11)
@@ -279,7 +280,8 @@ GEM
     hiredis (0.6.1-java)
     http_parser.rb (0.6.0)
     httpclient (2.8.3)
-    i18n (0.8.6)
+    i18n (0.9.1)
+      concurrent-ruby (~> 1.0)
     io-like (0.3.0)
     jdbc-mysql (5.1.44)
     jdbc-postgres (9.4.1206)
@@ -287,7 +289,7 @@ GEM
     jmespath (1.3.1)
     json (2.1.0)
     json (2.1.0-java)
-    jwt (1.5.6)
+    jwt (2.1.0)
     kindlerb (1.2.0)
       mustache
       nokogiri
@@ -300,13 +302,14 @@ GEM
     logging (2.2.2)
       little-plugger (~> 1.1)
       multi_json (~> 1.10)
-    loofah (2.0.3)
+    loofah (2.1.1)
+      crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     mail (2.7.0)
       mini_mime (>= 0.1.1)
     memoist (0.16.0)
     metaclass (0.0.4)
-    method_source (0.8.2)
+    method_source (0.9.0)
     mime-types (3.1)
       mime-types-data (~> 3.2015)
     mime-types-data (3.2016.0521)
@@ -326,7 +329,7 @@ GEM
     msgpack (1.1.0-java)
     msgpack (1.1.0-x64-mingw32)
     msgpack (1.1.0-x86-mingw32)
-    multi_json (1.12.1)
+    multi_json (1.12.2)
     multipart-post (2.0.0)
     mustache (1.0.5)
     mustermann (1.0.0)
@@ -334,7 +337,6 @@ GEM
     mysql2 (0.4.9-x64-mingw32)
     mysql2 (0.4.9-x86-mingw32)
     nio4r (2.1.0)
-    nio4r (2.1.0-java)
     nokogiri (1.8.0)
       mini_portile2 (~> 2.2.0)
     nokogiri (1.8.0-java)
@@ -352,7 +354,7 @@ GEM
     pg (0.19.0-x86-mingw32)
     powerpack (0.1.1)
     psych (2.2.4)
-    public_suffix (2.0.5)
+    public_suffix (3.0.1)
     puma (3.9.1)
     puma (3.9.1-java)
     que (0.14.0)
@@ -427,10 +429,10 @@ GEM
       rack-protection (>= 1.5.0)
       redis (>= 3.3.4, < 5)
     sigdump (0.2.4)
-    signet (0.7.3)
+    signet (0.8.1)
       addressable (~> 2.3)
       faraday (~> 0.9)
-      jwt (~> 1.5)
+      jwt (>= 1.5, < 3.0)
       multi_json (~> 1.10)
     sinatra (2.0.0)
       mustermann (~> 1.0)
@@ -486,8 +488,6 @@ GEM
     websocket (1.2.4)
     websocket-driver (0.6.5)
       websocket-extensions (>= 0.1.0)
-    websocket-driver (0.6.5-java)
-      websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.2)
     xpath (2.1.0)
       nokogiri (~> 1.3)
@@ -517,7 +517,7 @@ DEPENDENCIES
   dalli (>= 2.2.1)
   delayed_job
   delayed_job_active_record
-  google-cloud-storage (~> 1.3)
+  google-cloud-storage (~> 1.8)
   hiredis
   json (>= 2.0.0)
   kindlerb (~> 1.2.0)
diff --git a/RAILS_VERSION b/RAILS_VERSION
index d5ebf861d3..5d41efd0ef 100644
--- a/RAILS_VERSION
+++ b/RAILS_VERSION
@@ -1 +1 @@
-5.2.0.alpha
+5.2.0.beta2
diff --git a/actioncable/CHANGELOG.md b/actioncable/CHANGELOG.md
index 5b9cc84c09..38bf842b14 100644
--- a/actioncable/CHANGELOG.md
+++ b/actioncable/CHANGELOG.md
@@ -1,3 +1,10 @@
+## Rails 5.2.0.beta2 (November 28, 2017) ##
+
+*   No changes.
+
+
+## Rails 5.2.0.beta1 (November 27, 2017) ##
+
 *   Removed deprecated evented redis adapter.
 
     *Rafael Mendonça França*
diff --git a/actioncable/README.md b/actioncable/README.md
index 44fb81478d..a05ef1dd20 100644
--- a/actioncable/README.md
+++ b/actioncable/README.md
@@ -558,7 +558,7 @@ API documentation is at:
 
 * http://api.rubyonrails.org
 
-Bug reports can be filed for the Ruby on Rails project here:
+Bug reports for the Ruby on Rails project can be filed here:
 
 * https://github.com/rails/rails/issues
 
diff --git a/actioncable/lib/action_cable/gem_version.rb b/actioncable/lib/action_cable/gem_version.rb
index af8277d06e..d72ba18acd 100644
--- a/actioncable/lib/action_cable/gem_version.rb
+++ b/actioncable/lib/action_cable/gem_version.rb
@@ -10,7 +10,7 @@ module ActionCable
     MAJOR = 5
     MINOR = 2
     TINY  = 0
-    PRE   = "alpha"
+    PRE   = "beta2"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end
diff --git a/actioncable/package.json b/actioncable/package.json
index acec1e2e9c..8d7f9ff302 100644
--- a/actioncable/package.json
+++ b/actioncable/package.json
@@ -1,6 +1,6 @@
 {
   "name": "actioncable",
-  "version": "5.2.0-alpha",
+  "version": "5.2.0-beta2",
   "description": "WebSocket framework for Ruby on Rails.",
   "main": "lib/assets/compiled/action_cable.js",
   "files": [
diff --git a/actioncable/test/connection/client_socket_test.rb b/actioncable/test/connection/client_socket_test.rb
index 2051216010..5c31690c8b 100644
--- a/actioncable/test/connection/client_socket_test.rb
+++ b/actioncable/test/connection/client_socket_test.rb
@@ -67,9 +67,9 @@ class ActionCable::Connection::ClientSocketTest < ActionCable::TestCase
       env = Rack::MockRequest.env_for "/test",
         "HTTP_CONNECTION" => "upgrade", "HTTP_UPGRADE" => "websocket",
         "HTTP_HOST" => "localhost", "HTTP_ORIGIN" => "http://rubyonrails.com"
-      io = \
+      io, client_io = \
         begin
-          Socket.pair(Socket::AF_UNIX, Socket::SOCK_STREAM, 0).first
+          Socket.pair(Socket::AF_UNIX, Socket::SOCK_STREAM, 0)
         rescue
           StringIO.new
         end
@@ -77,6 +77,14 @@ class ActionCable::Connection::ClientSocketTest < ActionCable::TestCase
 
       Connection.new(@server, env).tap do |connection|
         connection.process
+        if client_io
+          # Make sure server returns handshake response
+          Timeout.timeout(1) do
+            loop do
+              break if client_io.readline == "\r\n"
+            end
+          end
+        end
         connection.send :handle_open
         assert connection.connected
       end
diff --git a/actionmailer/CHANGELOG.md b/actionmailer/CHANGELOG.md
index 49afec9a12..2836f0cfbc 100644
--- a/actionmailer/CHANGELOG.md
+++ b/actionmailer/CHANGELOG.md
@@ -1,3 +1,10 @@
+## Rails 5.2.0.beta2 (November 28, 2017) ##
+
+*   No changes.
+
+
+## Rails 5.2.0.beta1 (November 27, 2017) ##
+
 *   Add `assert_enqueued_email_with` test helper.
 
         assert_enqueued_email_with ContactMailer, :welcome do
diff --git a/actionmailer/README.rdoc b/actionmailer/README.rdoc
index 9993d3777d..14dfb82234 100644
--- a/actionmailer/README.rdoc
+++ b/actionmailer/README.rdoc
@@ -148,7 +148,7 @@ The latest version of Action Mailer can be installed with RubyGems:
 
   $ gem install actionmailer
 
-Source code can be downloaded as part of the Rails project on GitHub
+Source code can be downloaded as part of the Rails project on GitHub:
 
 * https://github.com/rails/rails/tree/master/actionmailer
 
@@ -166,7 +166,7 @@ API documentation is at
 
 * http://api.rubyonrails.org
 
-Bug reports can be filed for the Ruby on Rails project here:
+Bug reports for the Ruby on Rails project can be filed here:
 
 * https://github.com/rails/rails/issues
 
diff --git a/actionmailer/lib/action_mailer/gem_version.rb b/actionmailer/lib/action_mailer/gem_version.rb
index 063d4580d8..6a7dd0a212 100644
--- a/actionmailer/lib/action_mailer/gem_version.rb
+++ b/actionmailer/lib/action_mailer/gem_version.rb
@@ -10,7 +10,7 @@ module ActionMailer
     MAJOR = 5
     MINOR = 2
     TINY  = 0
-    PRE   = "alpha"
+    PRE   = "beta2"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end
diff --git a/actionpack/CHANGELOG.md b/actionpack/CHANGELOG.md
index e01f88e902..c8fb34ed52 100644
--- a/actionpack/CHANGELOG.md
+++ b/actionpack/CHANGELOG.md
@@ -1,3 +1,81 @@
+*   Register most popular audio/video/font mime types supported by modern browsers.
+
+    *Guillermo Iguaran*
+
+*   Fix optimized url helpers when using relative url root
+
+    Fixes #31220.
+
+    *Andrew White*
+
+
+## Rails 5.2.0.beta2 (November 28, 2017) ##
+
+*   No changes.
+
+
+## Rails 5.2.0.beta1 (November 27, 2017) ##
+
+*   Add DSL for configuring Content-Security-Policy header
+
+    The DSL allows you to configure a global Content-Security-Policy
+    header and then override within a controller. For more information
+    about the Content-Security-Policy header see MDN:
+
+    https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
+
+    Example global policy:
+
+        # config/initializers/content_security_policy.rb
+        Rails.application.config.content_security_policy do |p|
+          p.default_src :self, :https
+          p.font_src    :self, :https, :data
+          p.img_src     :self, :https, :data
+          p.object_src  :none
+          p.script_src  :self, :https
+          p.style_src   :self, :https, :unsafe_inline
+        end
+
+    Example controller overrides:
+
+        # Override policy inline
+        class PostsController < ApplicationController
+          content_security_policy do |p|
+            p.upgrade_insecure_requests true
+          end
+        end
+
+        # Using literal values
+        class PostsController < ApplicationController
+          content_security_policy do |p|
+            p.base_uri "https://www.example.com"
+          end
+        end
+
+        # Using mixed static and dynamic values
+        class PostsController < ApplicationController
+          content_security_policy do |p|
+            p.base_uri :self, -> { "https://#{current_user.domain}.example.com" }
+          end
+        end
+
+    Allows you to also only report content violations for migrating
+    legacy content using the `content_security_policy_report_only`
+    configuration attribute, e.g;
+
+        # config/initializers/content_security_policy.rb
+        Rails.application.config.content_security_policy_report_only = true
+
+        # controller override
+        class PostsController < ApplicationController
+          self.content_security_policy_report_only = true
+        end
+
+    Note that this feature does not validate the header for performance
+    reasons since the header is calculated at runtime.
+
+    *Andrew White*
+
 *   Make `assert_recognizes` to traverse mounted engines
 
     *Yuichiro Kaneko*
diff --git a/actionpack/README.rdoc b/actionpack/README.rdoc
index 93b2a0932a..f56230ffa0 100644
--- a/actionpack/README.rdoc
+++ b/actionpack/README.rdoc
@@ -30,7 +30,7 @@ The latest version of Action Pack can be installed with RubyGems:
 
   $ gem install actionpack
 
-Source code can be downloaded as part of the Rails project on GitHub
+Source code can be downloaded as part of the Rails project on GitHub:
 
 * https://github.com/rails/rails/tree/master/actionpack
 
@@ -44,11 +44,11 @@ Action Pack is released under the MIT license:
 
 == Support
 
-API documentation is at
+API documentation is at:
 
 * http://api.rubyonrails.org
 
-Bug reports can be filed for the Ruby on Rails project here:
+Bug reports for the Ruby on Rails project can be filed here:
 
 * https://github.com/rails/rails/issues
 
diff --git a/actionpack/lib/action_controller.rb b/actionpack/lib/action_controller.rb
index bd19b8cd5d..f43784f9f2 100644
--- a/actionpack/lib/action_controller.rb
+++ b/actionpack/lib/action_controller.rb
@@ -22,6 +22,7 @@ module ActionController
 
   autoload_under "metal" do
     autoload :ConditionalGet
+    autoload :ContentSecurityPolicy
     autoload :Cookies
     autoload :DataStreaming
     autoload :EtagWithTemplateDigest
diff --git a/actionpack/lib/action_controller/base.rb b/actionpack/lib/action_controller/base.rb
index b73269871b..204a3d400c 100644
--- a/actionpack/lib/action_controller/base.rb
+++ b/actionpack/lib/action_controller/base.rb
@@ -225,6 +225,7 @@ module ActionController
       Flash,
       FormBuilder,
       RequestForgeryProtection,
+      ContentSecurityPolicy,
       ForceSSL,
       Streaming,
       DataStreaming,
diff --git a/actionpack/lib/action_controller/metal/content_security_policy.rb b/actionpack/lib/action_controller/metal/content_security_policy.rb
new file mode 100644
index 0000000000..48a7109bea
--- /dev/null
+++ b/actionpack/lib/action_controller/metal/content_security_policy.rb
@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module ActionController #:nodoc:
+  module ContentSecurityPolicy
+    # TODO: Documentation
+    extend ActiveSupport::Concern
+
+    module ClassMethods
+      def content_security_policy(**options, &block)
+        before_action(options) do
+          if block_given?
+            policy = request.content_security_policy.clone
+            yield policy
+            request.content_security_policy = policy
+          end
+        end
+      end
+
+      def content_security_policy_report_only(report_only = true, **options)
+        before_action(options) do
+          request.content_security_policy_report_only = report_only
+        end
+      end
+    end
+  end
+end
diff --git a/actionpack/lib/action_controller/metal/http_authentication.rb b/actionpack/lib/action_controller/metal/http_authentication.rb
index 0c8132684a..01676f3237 100644
--- a/actionpack/lib/action_controller/metal/http_authentication.rb
+++ b/actionpack/lib/action_controller/metal/http_authentication.rb
@@ -72,10 +72,10 @@ module ActionController
             before_action(options.except(:name, :password, :realm)) do
               authenticate_or_request_with_http_basic(options[:realm] || "Application") do |name, password|
                 # This comparison uses & so that it doesn't short circuit and
-                # uses `variable_size_secure_compare` so that length information
+                # uses `secure_compare` so that length information
                 # isn't leaked.
-                ActiveSupport::SecurityUtils.variable_size_secure_compare(name, options[:name]) &
-                  ActiveSupport::SecurityUtils.variable_size_secure_compare(password, options[:password])
+                ActiveSupport::SecurityUtils.secure_compare(name, options[:name]) &
+                  ActiveSupport::SecurityUtils.secure_compare(password, options[:password])
               end
             end
           end
@@ -350,10 +350,7 @@ module ActionController
     #         authenticate_or_request_with_http_token do |token, options|
     #           # Compare the tokens in a time-constant manner, to mitigate
     #           # timing attacks.
-    #           ActiveSupport::SecurityUtils.secure_compare(
-    #             ::Digest::SHA256.hexdigest(token),
-    #             ::Digest::SHA256.hexdigest(TOKEN)
-    #           )
+    #           ActiveSupport::SecurityUtils.secure_compare(token, TOKEN)
     #         end
     #       end
     #   end
diff --git a/actionpack/lib/action_controller/metal/redirecting.rb b/actionpack/lib/action_controller/metal/redirecting.rb
index 8de57f9199..87a2e29a3f 100644
--- a/actionpack/lib/action_controller/metal/redirecting.rb
+++ b/actionpack/lib/action_controller/metal/redirecting.rb
@@ -68,7 +68,7 @@ module ActionController
     # if possible, otherwise redirects to the provided default fallback
     # location.
     #
-    # The referrer information is pulled from the HTTP `Referer` (sic) header on
+    # The referrer information is pulled from the HTTP +Referer+ (sic) header on
     # the request. This is an optional header and its presence on the request is
     # subject to browser security settings and user preferences. If the request
     # is missing this header, the <tt>fallback_location</tt> will be used.
@@ -82,7 +82,7 @@ module ActionController
     #   redirect_back fallback_location: '/', allow_other_host: false
     #
     # ==== Options
-    # * <tt>:fallback_location</tt> - The default fallback location that will be used on missing `Referer` header.
+    # * <tt>:fallback_location</tt> - The default fallback location that will be used on missing +Referer+ header.
     # * <tt>:allow_other_host</tt> - Allows or disallow redirection to the host that is different to the current host
     #
     # All other options that can be passed to <tt>redirect_to</tt> are accepted as
diff --git a/actionpack/lib/action_controller/metal/request_forgery_protection.rb b/actionpack/lib/action_controller/metal/request_forgery_protection.rb
index bd133f24a1..04fadc90e2 100644
--- a/actionpack/lib/action_controller/metal/request_forgery_protection.rb
+++ b/actionpack/lib/action_controller/metal/request_forgery_protection.rb
@@ -216,7 +216,7 @@ module ActionController #:nodoc:
       # The actual before_action that is used to verify the CSRF token.
       # Don't override this directly. Provide your own forgery protection
       # strategy instead. If you override, you'll disable same-origin
-      # `<script>` verification.
+      # <tt><script></tt> verification.
       #
       # Lean on the protect_from_forgery declaration to mark which actions are
       # due for same-origin request verification. If protect_from_forgery is
@@ -250,7 +250,7 @@ module ActionController #:nodoc:
       private_constant :CROSS_ORIGIN_JAVASCRIPT_WARNING
       # :startdoc:
 
-      # If `verify_authenticity_token` was run (indicating that we have
+      # If +verify_authenticity_token+ was run (indicating that we have
       # forgery protection enabled for this request) then also verify that
       # we aren't serving an unauthorized cross-origin response.
       def verify_same_origin_request # :doc:
@@ -267,7 +267,7 @@ module ActionController #:nodoc:
         @marked_for_same_origin_verification = request.get?
       end
 
-      # If the `verify_authenticity_token` before_action ran, verify that
+      # If the +verify_authenticity_token+ before_action ran, verify that
       # JavaScript responses are only served to same-origin GET requests.
       def marked_for_same_origin_verification? # :doc:
         @marked_for_same_origin_verification ||= false
@@ -369,7 +369,7 @@ module ActionController #:nodoc:
       end
 
       def compare_with_real_token(token, session) # :doc:
-        ActiveSupport::SecurityUtils.secure_compare(token, real_csrf_token(session))
+        ActiveSupport::SecurityUtils.fixed_length_secure_compare(token, real_csrf_token(session))
       end
 
       def valid_per_form_csrf_token?(token, session) # :doc:
@@ -380,7 +380,7 @@ module ActionController #:nodoc:
             request.request_method
           )
 
-          ActiveSupport::SecurityUtils.secure_compare(token, correct_token)
+          ActiveSupport::SecurityUtils.fixed_length_secure_compare(token, correct_token)
         else
           false
         end
diff --git a/actionpack/lib/action_dispatch.rb b/actionpack/lib/action_dispatch.rb
index 34937f3229..6fed911d0a 100644
--- a/actionpack/lib/action_dispatch.rb
+++ b/actionpack/lib/action_dispatch.rb
@@ -42,6 +42,7 @@ module ActionDispatch
 
   eager_autoload do
     autoload_under "http" do
+      autoload :ContentSecurityPolicy
       autoload :Request
       autoload :Response
     end
diff --git a/actionpack/lib/action_dispatch/http/content_security_policy.rb b/actionpack/lib/action_dispatch/http/content_security_policy.rb
new file mode 100644
index 0000000000..d10d4faf3d
--- /dev/null
+++ b/actionpack/lib/action_dispatch/http/content_security_policy.rb
@@ -0,0 +1,233 @@
+# frozen_string_literal: true
+
+module ActionDispatch #:nodoc:
+  class ContentSecurityPolicy
+    class Middleware
+      CONTENT_TYPE = "Content-Type".freeze
+      POLICY = "Content-Security-Policy".freeze
+      POLICY_REPORT_ONLY = "Content-Security-Policy-Report-Only".freeze
+
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        request = ActionDispatch::Request.new env
+        _, headers, _ = response = @app.call(env)
+
+        return response unless html_response?(headers)
+        return response if policy_present?(headers)
+
+        if policy = request.content_security_policy
+          headers[header_name(request)] = policy.build(request.controller_instance)
+        end
+
+        response
+      end
+
+      private
+
+        def html_response?(headers)
+          if content_type = headers[CONTENT_TYPE]
+            content_type =~ /html/
+          end
+        end
+
+        def header_name(request)
+          if request.content_security_policy_report_only
+            POLICY_REPORT_ONLY
+          else
+            POLICY
+          end
+        end
+
+        def policy_present?(headers)
+          headers[POLICY] || headers[POLICY_REPORT_ONLY]
+        end
+    end
+
+    module Request
+      POLICY = "action_dispatch.content_security_policy".freeze
+      POLICY_REPORT_ONLY = "action_dispatch.content_security_policy_report_only".freeze
+
+      def content_security_policy
+        get_header(POLICY)
+      end
+
+      def content_security_policy=(policy)
+        set_header(POLICY, policy)
+      end
+
+      def content_security_policy_report_only
+        get_header(POLICY_REPORT_ONLY)
+      end
+
+      def content_security_policy_report_only=(value)
+        set_header(POLICY_REPORT_ONLY, value)
+      end
+    end
+
+    MAPPINGS = {
+      self:           "'self'",
+      unsafe_eval:    "'unsafe-eval'",
+      unsafe_inline:  "'unsafe-inline'",
+      none:           "'none'",
+      http:           "http:",
+      https:          "https:",
+      data:           "data:",
+      mediastream:    "mediastream:",
+      blob:           "blob:",
+      filesystem:     "filesystem:",
+      report_sample:  "'report-sample'",
+      strict_dynamic: "'strict-dynamic'"
+    }.freeze
+
+    DIRECTIVES = {
+      base_uri:        "base-uri",
+      child_src:       "child-src",
+      connect_src:     "connect-src",
+      default_src:     "default-src",
+      font_src:        "font-src",
+      form_action:     "form-action",
+      frame_ancestors: "frame-ancestors",
+      frame_src:       "frame-src",
+      img_src:         "img-src",
+      manifest_src:    "manifest-src",
+      media_src:       "media-src",
+      object_src:      "object-src",
+      script_src:      "script-src",
+      style_src:       "style-src",
+      worker_src:      "worker-src"
+    }.freeze
+
+    private_constant :MAPPINGS, :DIRECTIVES
+
+    attr_reader :directives
+
+    def initialize
+      @directives = {}
+      yield self if block_given?
+    end
+
+    def initialize_copy(other)
+      @directives = copy_directives(other.directives)
+    end
+
+    DIRECTIVES.each do |name, directive|
+      define_method(name) do |*sources|
+        if sources.first
+          @directives[directive] = apply_mappings(sources)
+        else
+          @directives.delete(directive)
+        end
+      end
+    end
+
+    def block_all_mixed_content(enabled = true)
+      if enabled
+        @directives["block-all-mixed-content"] = true
+      else
+        @directives.delete("block-all-mixed-content")
+      end
+    end
+
+    def plugin_types(*types)
+      if types.first
+        @directives["plugin-types"] = types
+      else
+        @directives.delete("plugin-types")
+      end
+    end
+
+    def report_uri(uri)
+      @directives["report-uri"] = [uri]
+    end
+
+    def require_sri_for(*types)
+      if types.first
+        @directives["require-sri-for"] = types
+      else
+        @directives.delete("require-sri-for")
+      end
+    end
+
+    def sandbox(*values)
+      if values.empty?
+        @directives["sandbox"] = true
+      elsif values.first
+        @directives["sandbox"] = values
+      else
+        @directives.delete("sandbox")
+      end
+    end
+
+    def upgrade_insecure_requests(enabled = true)
+      if enabled
+        @directives["upgrade-insecure-requests"] = true
+      else
+        @directives.delete("upgrade-insecure-requests")
+      end
+    end
+
+    def build(context = nil)
+      build_directives(context).compact.join("; ") + ";"
+    end
+
+    private
+      def copy_directives(directives)
+        directives.transform_values { |sources| sources.map(&:dup) }
+      end
+
+      def apply_mappings(sources)
+        sources.map do |source|
+          case source
+          when Symbol
+            apply_mapping(source)
+          when String, Proc
+            source
+          else
+            raise ArgumentError, "Invalid content security policy source: #{source.inspect}"
+          end
+        end
+      end
+
+      def apply_mapping(source)
+        MAPPINGS.fetch(source) do
+          raise ArgumentError, "Unknown content security policy source mapping: #{source.inspect}"
+        end
+      end
+
+      def build_directives(context)
+        @directives.map do |directive, sources|
+          if sources.is_a?(Array)
+            "#{directive} #{build_directive(sources, context).join(' ')}"
+          elsif sources
+            directive
+          else
+            nil
+          end
+        end
+      end
+
+      def build_directive(sources, context)
+        sources.map { |source| resolve_source(source, context) }
+      end
+
+      def resolve_source(source, context)
+        case source
+        when String
+          source
+        when Symbol
+          source.to_s
+        when Proc
+          if context.nil?
+            raise RuntimeError, "Missing context for the dynamic content security policy source: #{source.inspect}"
+          else
+            context.instance_exec(&source)
+          end
+        else
+          raise RuntimeError, "Unexpected content security policy source: #{source.inspect}"
+        end
+      end
+  end
+end
diff --git a/actionpack/lib/action_dispatch/http/mime_types.rb b/actionpack/lib/action_dispatch/http/mime_types.rb
index f8e6fca36d..342e6de312 100644
--- a/actionpack/lib/action_dispatch/http/mime_types.rb
+++ b/actionpack/lib/action_dispatch/http/mime_types.rb
@@ -10,6 +10,7 @@ Mime::Type.register "text/css", :css
 Mime::Type.register "text/calendar", :ics
 Mime::Type.register "text/csv", :csv
 Mime::Type.register "text/vcard", :vcf
+Mime::Type.register "text/vtt", :vtt, %w(vtt)
 
 Mime::Type.register "image/png", :png, [], %w(png)
 Mime::Type.register "image/jpeg", :jpeg, [], %w(jpg jpeg jpe pjpeg)
@@ -20,6 +21,18 @@ Mime::Type.register "image/svg+xml", :svg
 
 Mime::Type.register "video/mpeg", :mpeg, [], %w(mpg mpeg mpe)
 
+Mime::Type.register "audio/mpeg", :mp3, [], %w(mp1 mp2 mp3)
+Mime::Type.register "audio/ogg", :ogg, [], %w(oga ogg spx opus)
+Mime::Type.register "audio/aac", :m4a, %w( audio/mp4 ), %w(m4a mpg4 aac)
+
+Mime::Type.register "video/webm", :webm, [], %w(webm)
+Mime::Type.register "video/mp4", :mp4, [], %w(mp4 m4v)
+
+Mime::Type.register "font/otf", :otf, [], %w(otf)
+Mime::Type.register "font/ttf", :ttf, [], %w(ttf)
+Mime::Type.register "font/woff", :woff, [], %w(woff)
+Mime::Type.register "font/woff2", :woff2, [], %w(woff2)
+
 Mime::Type.register "application/xml", :xml, %w( text/xml application/x-xml )
 Mime::Type.register "application/rss+xml", :rss
 Mime::Type.register "application/atom+xml", :atom
diff --git a/actionpack/lib/action_dispatch/http/request.rb b/actionpack/lib/action_dispatch/http/request.rb
index d631281e4b..3838b84a7a 100644
--- a/actionpack/lib/action_dispatch/http/request.rb
+++ b/actionpack/lib/action_dispatch/http/request.rb
@@ -22,6 +22,7 @@ module ActionDispatch
     include ActionDispatch::Http::Parameters
     include ActionDispatch::Http::FilterParameters
     include ActionDispatch::Http::URL
+    include ActionDispatch::ContentSecurityPolicy::Request
     include Rack::Request::Env
 
     autoload :Session, "action_dispatch/request/session"
diff --git a/actionpack/lib/action_dispatch/middleware/cookies.rb b/actionpack/lib/action_dispatch/middleware/cookies.rb
index 86a070c6ad..ea4156c972 100644
--- a/actionpack/lib/action_dispatch/middleware/cookies.rb
+++ b/actionpack/lib/action_dispatch/middleware/cookies.rb
@@ -161,7 +161,7 @@ module ActionDispatch
   #
   # * <tt>:tld_length</tt> - When using <tt>:domain => :all</tt>, this option can be used to explicitly
   #   set the TLD length when using a short (<= 3 character) domain that is being interpreted as part of a TLD.
-  #   For example, to share cookies between user1.lvh.me and user2.lvh.me, set <tt>:tld_length</tt> to 1.
+  #   For example, to share cookies between user1.lvh.me and user2.lvh.me, set <tt>:tld_length</tt> to 2.
   # * <tt>:expires</tt> - The time at which this cookie expires, as a \Time or ActiveSupport::Duration object.
   # * <tt>:secure</tt> - Whether this cookie is only transmitted to HTTPS servers.
   #   Default is +false+.
diff --git a/actionpack/lib/action_dispatch/routing/mapper.rb b/actionpack/lib/action_dispatch/routing/mapper.rb
index ded42adee9..d87a23a58c 100644
--- a/actionpack/lib/action_dispatch/routing/mapper.rb
+++ b/actionpack/lib/action_dispatch/routing/mapper.rb
@@ -2046,7 +2046,7 @@ module ActionDispatch
       end
 
       module CustomUrls
-        # Define custom url helpers that will be added to the application's
+        # Define custom URL helpers that will be added to the application's
         # routes. This allows you to override and/or replace the default behavior
         # of routing helpers, e.g:
         #
@@ -2066,11 +2066,11 @@ module ActionDispatch
         # arguments for +url_for+ which will actually build the URL string. This can
         # be one of the following:
         #
-        #   * A string, which is treated as a generated URL
-        #   * A hash, e.g. { controller: "pages", action: "index" }
-        #   * An array, which is passed to `polymorphic_url`
-        #   * An Active Model instance
-        #   * An Active Model class
+        # * A string, which is treated as a generated URL
+        # * A hash, e.g. <tt>{ controller: "pages", action: "index" }</tt>
+        # * An array, which is passed to +polymorphic_url+
+        # * An Active Model instance
+        # * An Active Model class
         #
         # NOTE: Other URL helpers can be called in the block but be careful not to invoke
         # your custom URL helper again otherwise it will result in a stack overflow error.
diff --git a/actionpack/lib/action_dispatch/routing/route_set.rb b/actionpack/lib/action_dispatch/routing/route_set.rb
index 987e709f6f..9eff30fa53 100644
--- a/actionpack/lib/action_dispatch/routing/route_set.rb
+++ b/actionpack/lib/action_dispatch/routing/route_set.rb
@@ -199,6 +199,16 @@ module ActionDispatch
               if args.size == arg_size && !inner_options && optimize_routes_generation?(t)
                 options = t.url_options.merge @options
                 options[:path] = optimized_helper(args)
+
+                original_script_name = options.delete(:original_script_name)
+                script_name = t._routes.find_script_name(options)
+
+                if original_script_name
+                  script_name = original_script_name + script_name
+                end
+
+                options[:script_name] = script_name
+
                 url_strategy.call options
               else
                 super
diff --git a/actionpack/lib/action_dispatch/routing/url_for.rb b/actionpack/lib/action_dispatch/routing/url_for.rb
index 3ae533dd37..fa345dccdf 100644
--- a/actionpack/lib/action_dispatch/routing/url_for.rb
+++ b/actionpack/lib/action_dispatch/routing/url_for.rb
@@ -155,7 +155,7 @@ module ActionDispatch
       # Missing routes keys may be filled in from the current request's parameters
       # (e.g. +:controller+, +:action+, +:id+ and any other parameters that are
       # placed in the path). Given that the current action has been reached
-      # through `GET /users/1`:
+      # through <tt>GET /users/1</tt>:
       #
       #   url_for(only_path: true)                        # => '/users/1'
       #   url_for(only_path: true, action: 'edit')        # => '/users/1/edit'
diff --git a/actionpack/lib/action_dispatch/system_testing/test_helpers/screenshot_helper.rb b/actionpack/lib/action_dispatch/system_testing/test_helpers/screenshot_helper.rb
index 6c337cdc31..df0c5d3f0e 100644
--- a/actionpack/lib/action_dispatch/system_testing/test_helpers/screenshot_helper.rb
+++ b/actionpack/lib/action_dispatch/system_testing/test_helpers/screenshot_helper.rb
@@ -15,12 +15,11 @@ module ActionDispatch
         #
         # You can set the +RAILS_SYSTEM_TESTING_SCREENSHOT+ environment variable to
         # control the output. Possible values are:
-        # * [+inline+ (default)]    display the screenshot in the terminal using the
+        # * [+simple+ (default)]    Only displays the screenshot path.
+        #                           This is the default value.
+        # * [+inline+]              Display the screenshot in the terminal using the
         #                           iTerm image protocol (https://iterm2.com/documentation-images.html).
-        # * [+simple+]              only display the screenshot path.
-        #                           This is the default value if the +CI+ environment variables
-        #                           is defined.
-        # * [+artifact+]            display the screenshot in the terminal, using the terminal
+        # * [+artifact+]            Display the screenshot in the terminal, using the terminal
         #                           artifact format (https://buildkite.github.io/terminal/inline-images/).
         def take_screenshot
           save_image
@@ -59,11 +58,8 @@ module ActionDispatch
             # Environment variables have priority
             output_type = ENV["RAILS_SYSTEM_TESTING_SCREENSHOT"] || ENV["CAPYBARA_INLINE_SCREENSHOT"]
 
-            # If running in a CI environment, default to simple
-            output_type ||= "simple" if ENV["CI"]
-
-            # Default
-            output_type ||= "inline"
+            # Default to outputting a path to the screenshot
+            output_type ||= "simple"
 
             output_type
           end
diff --git a/actionpack/lib/action_pack/gem_version.rb b/actionpack/lib/action_pack/gem_version.rb
index 28bc153f4d..97f4934b58 100644
--- a/actionpack/lib/action_pack/gem_version.rb
+++ b/actionpack/lib/action_pack/gem_version.rb
@@ -10,7 +10,7 @@ module ActionPack
     MAJOR = 5
     MINOR = 2
     TINY  = 0
-    PRE   = "alpha"
+    PRE   = "beta2"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end
diff --git a/actionpack/test/controller/send_file_test.rb b/actionpack/test/controller/send_file_test.rb
index fd2399e433..7b1a52b277 100644
--- a/actionpack/test/controller/send_file_test.rb
+++ b/actionpack/test/controller/send_file_test.rb
@@ -178,7 +178,7 @@ class SendFileTest < ActionController::TestCase
       "image.jpg" => "image/jpeg",
       "image.tif" => "image/tiff",
       "image.gif" => "image/gif",
-      "movie.mpg" => "video/mpeg",
+      "movie.mp4" => "video/mp4",
       "file.zip" => "application/zip",
       "file.unk" => "application/octet-stream",
       "zip" => "application/octet-stream"
diff --git a/actionpack/test/dispatch/content_security_policy_test.rb b/actionpack/test/dispatch/content_security_policy_test.rb
new file mode 100644
index 0000000000..8a1ac066e8
--- /dev/null
+++ b/actionpack/test/dispatch/content_security_policy_test.rb
@@ -0,0 +1,359 @@
+# frozen_string_literal: true
+
+require "abstract_unit"
+
+class ContentSecurityPolicyTest < ActiveSupport::TestCase
+  def setup
+    @policy = ActionDispatch::ContentSecurityPolicy.new
+  end
+
+  def test_build
+    assert_equal ";", @policy.build
+
+    @policy.script_src :self
+    assert_equal "script-src 'self';", @policy.build
+  end
+
+  def test_mappings
+    @policy.script_src :data
+    assert_equal "script-src data:;", @policy.build
+
+    @policy.script_src :mediastream
+    assert_equal "script-src mediastream:;", @policy.build
+
+    @policy.script_src :blob
+    assert_equal "script-src blob:;", @policy.build
+
+    @policy.script_src :filesystem
+    assert_equal "script-src filesystem:;", @policy.build
+
+    @policy.script_src :self
+    assert_equal "script-src 'self';", @policy.build
+
+    @policy.script_src :unsafe_inline
+    assert_equal "script-src 'unsafe-inline';", @policy.build
+
+    @policy.script_src :unsafe_eval
+    assert_equal "script-src 'unsafe-eval';", @policy.build
+
+    @policy.script_src :none
+    assert_equal "script-src 'none';", @policy.build
+
+    @policy.script_src :strict_dynamic
+    assert_equal "script-src 'strict-dynamic';", @policy.build
+
+    @policy.script_src :none, :report_sample
+    assert_equal "script-src 'none' 'report-sample';", @policy.build
+  end
+
+  def test_fetch_directives
+    @policy.child_src :self
+    assert_match %r{child-src 'self'}, @policy.build
+
+    @policy.child_src false
+    assert_no_match %r{child-src}, @policy.build
+
+    @policy.connect_src :self
+    assert_match %r{connect-src 'self'}, @policy.build
+
+    @policy.connect_src false
+    assert_no_match %r{connect-src}, @policy.build
+
+    @policy.default_src :self
+    assert_match %r{default-src 'self'}, @policy.build
+
+    @policy.default_src false
+    assert_no_match %r{default-src}, @policy.build
+
+    @policy.font_src :self
+    assert_match %r{font-src 'self'}, @policy.build
+
+    @policy.font_src false
+    assert_no_match %r{font-src}, @policy.build
+
+    @policy.frame_src :self
+    assert_match %r{frame-src 'self'}, @policy.build
+
+    @policy.frame_src false
+    assert_no_match %r{frame-src}, @policy.build
+
+    @policy.img_src :self
+    assert_match %r{img-src 'self'}, @policy.build
+
+    @policy.img_src false
+    assert_no_match %r{img-src}, @policy.build
+
+    @policy.manifest_src :self
+    assert_match %r{manifest-src 'self'}, @policy.build
+
+    @policy.manifest_src false
+    assert_no_match %r{manifest-src}, @policy.build
+
+    @policy.media_src :self
+    assert_match %r{media-src 'self'}, @policy.build
+
+    @policy.media_src false
+    assert_no_match %r{media-src}, @policy.build
+
+    @policy.object_src :self
+    assert_match %r{object-src 'self'}, @policy.build
+
+    @policy.object_src false
+    assert_no_match %r{object-src}, @policy.build
+
+    @policy.script_src :self
+    assert_match %r{script-src 'self'}, @policy.build
+
+    @policy.script_src false
+    assert_no_match %r{script-src}, @policy.build
+
+    @policy.style_src :self
+    assert_match %r{style-src 'self'}, @policy.build
+
+    @policy.style_src false
+    assert_no_match %r{style-src}, @policy.build
+
+    @policy.worker_src :self
+    assert_match %r{worker-src 'self'}, @policy.build
+
+    @policy.worker_src false
+    assert_no_match %r{worker-src}, @policy.build
+  end
+
+  def test_document_directives
+    @policy.base_uri "https://example.com"
+    assert_match %r{base-uri https://example\.com;}, @policy.build
+
+    @policy.plugin_types "application/x-shockwave-flash"
+    assert_match %r{plugin-types application/x-shockwave-flash;}, @policy.build
+
+    @policy.sandbox
+    assert_match %r{sandbox;}, @policy.build
+
+    @policy.sandbox "allow-scripts", "allow-modals"
+    assert_match %r{sandbox allow-scripts allow-modals;}, @policy.build
+
+    @policy.sandbox false
+    assert_no_match %r{sandbox}, @policy.build
+  end
+
+  def test_navigation_directives
+    @policy.form_action :self
+    assert_match %r{form-action 'self';}, @policy.build
+
+    @policy.frame_ancestors :self
+    assert_match %r{frame-ancestors 'self';}, @policy.build
+  end
+
+  def test_reporting_directives
+    @policy.report_uri "/violations"
+    assert_match %r{report-uri /violations;}, @policy.build
+  end
+
+  def test_other_directives
+    @policy.block_all_mixed_content
+    assert_match %r{block-all-mixed-content;}, @policy.build
+
+    @policy.block_all_mixed_content false
+    assert_no_match %r{block-all-mixed-content}, @policy.build
+
+    @policy.require_sri_for :script, :style
+    assert_match %r{require-sri-for script style;}, @policy.build
+
+    @policy.require_sri_for "script", "style"
+    assert_match %r{require-sri-for script style;}, @policy.build
+
+    @policy.require_sri_for
+    assert_no_match %r{require-sri-for}, @policy.build
+
+    @policy.upgrade_insecure_requests
+    assert_match %r{upgrade-insecure-requests;}, @policy.build
+
+    @policy.upgrade_insecure_requests false
+    assert_no_match %r{upgrade-insecure-requests}, @policy.build
+  end
+
+  def test_multiple_sources
+    @policy.script_src :self, :https
+    assert_equal "script-src 'self' https:;", @policy.build
+  end
+
+  def test_multiple_directives
+    @policy.script_src :self, :https
+    @policy.style_src :self, :https
+    assert_equal "script-src 'self' https:; style-src 'self' https:;", @policy.build
+  end
+
+  def test_dynamic_directives
+    request = Struct.new(:host).new("www.example.com")
+    controller = Struct.new(:request).new(request)
+
+    @policy.script_src -> { request.host }
+    assert_equal "script-src www.example.com;", @policy.build(controller)
+  end
+
+  def test_mixed_static_and_dynamic_directives
+    @policy.script_src :self, -> { "foo.com" }, "bar.com"
+    assert_equal "script-src 'self' foo.com bar.com;", @policy.build(Object.new)
+  end
+
+  def test_invalid_directive_source
+    exception = assert_raises(ArgumentError) do
+      @policy.script_src [:self]
+    end
+
+    assert_equal "Invalid content security policy source: [:self]", exception.message
+  end
+
+  def test_missing_context_for_dynamic_source
+    @policy.script_src -> { request.host }
+
+    exception = assert_raises(RuntimeError) do
+      @policy.build
+    end
+
+    assert_match %r{\AMissing context for the dynamic content security policy source:}, exception.message
+  end
+
+  def test_raises_runtime_error_when_unexpected_source
+    @policy.plugin_types [:flash]
+
+    exception = assert_raises(RuntimeError) do
+      @policy.build
+    end
+
+    assert_match %r{\AUnexpected content security policy source:}, exception.message
+  end
+end
+
+class ContentSecurityPolicyIntegrationTest < ActionDispatch::IntegrationTest
+  class PolicyController < ActionController::Base
+    content_security_policy only: :inline do |p|
+      p.default_src "https://example.com"
+    end
+
+    content_security_policy only: :conditional, if: :condition? do |p|
+      p.default_src "https://true.example.com"
+    end
+
+    content_security_policy only: :conditional, unless: :condition? do |p|
+      p.default_src "https://false.example.com"
+    end
+
+    content_security_policy only: :report_only do |p|
+      p.report_uri "/violations"
+    end
+
+    content_security_policy_report_only only: :report_only
+
+    def index
+      head :ok
+    end
+
+    def inline
+      head :ok
+    end
+
+    def conditional
+      head :ok
+    end
+
+    def report_only
+      head :ok
+    end
+
+    private
+      def condition?
+        params[:condition] == "true"
+      end
+  end
+
+  ROUTES = ActionDispatch::Routing::RouteSet.new
+  ROUTES.draw do
+    scope module: "content_security_policy_integration_test" do
+      get "/", to: "policy#index"
+      get "/inline", to: "policy#inline"
+      get "/conditional", to: "policy#conditional"
+      get "/report-only", to: "policy#report_only"
+    end
+  end
+
+  POLICY = ActionDispatch::ContentSecurityPolicy.new do |p|
+    p.default_src :self
+  end
+
+  class PolicyConfigMiddleware
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      env["action_dispatch.content_security_policy"] = POLICY
+      env["action_dispatch.content_security_policy_report_only"] = false
+      env["action_dispatch.show_exceptions"] = false
+
+      @app.call(env)
+    end
+  end
+
+  APP = build_app(ROUTES) do |middleware|
+    middleware.use PolicyConfigMiddleware
+    middleware.use ActionDispatch::ContentSecurityPolicy::Middleware
+  end
+
+  def app
+    APP
+  end
+
+  def test_generates_content_security_policy_header
+    get "/"
+    assert_policy "default-src 'self';"
+  end
+
+  def test_generates_inline_content_security_policy
+    get "/inline"
+    assert_policy "default-src https://example.com;"
+  end
+
+  def test_generates_conditional_content_security_policy
+    get "/conditional", params: { condition: "true" }
+    assert_policy "default-src https://true.example.com;"
+
+    get "/conditional", params: { condition: "false" }
+    assert_policy "default-src https://false.example.com;"
+  end
+
+  def test_generates_report_only_content_security_policy
+    get "/report-only"
+    assert_policy "default-src 'self'; report-uri /violations;", report_only: true
+  end
+
+  private
+
+    def env_config
+      Rails.application.env_config
+    end
+
+    def content_security_policy
+      env_config["action_dispatch.content_security_policy"]
+    end
+
+    def content_security_policy=(policy)
+      env_config["action_dispatch.content_security_policy"] = policy
+    end
+
+    def assert_policy(expected, report_only: false)
+      assert_response :success
+
+      if report_only
+        expected_header = "Content-Security-Policy-Report-Only"
+        unexpected_header = "Content-Security-Policy"
+      else
+        expected_header = "Content-Security-Policy"
+        unexpected_header = "Content-Security-Policy-Report-Only"
+      end
+
+      assert_nil response.headers[unexpected_header]
+      assert_equal expected, response.headers[expected_header]
+    end
+end
diff --git a/actionpack/test/dispatch/mime_type_test.rb b/actionpack/test/dispatch/mime_type_test.rb
index 90e95e972d..6854783386 100644
--- a/actionpack/test/dispatch/mime_type_test.rb
+++ b/actionpack/test/dispatch/mime_type_test.rb
@@ -30,21 +30,21 @@ class MimeTypeTest < ActiveSupport::TestCase
 
   test "parse text with trailing star at the beginning" do
     accept = "text/*, text/html, application/json, multipart/form-data"
-    expect = [Mime[:html], Mime[:text], Mime[:js], Mime[:css], Mime[:ics], Mime[:csv], Mime[:vcf], Mime[:xml], Mime[:yaml], Mime[:json], Mime[:multipart_form]]
+    expect = [Mime[:html], Mime[:text], Mime[:js], Mime[:css], Mime[:ics], Mime[:csv], Mime[:vcf], Mime[:vtt], Mime[:xml], Mime[:yaml], Mime[:json], Mime[:multipart_form]]
     parsed = Mime::Type.parse(accept)
-    assert_equal expect, parsed
+    assert_equal expect.map(&:to_s), parsed.map(&:to_s)
   end
 
   test "parse text with trailing star in the end" do
     accept = "text/html, application/json, multipart/form-data, text/*"
-    expect = [Mime[:html], Mime[:json], Mime[:multipart_form], Mime[:text], Mime[:js], Mime[:css], Mime[:ics], Mime[:csv], Mime[:vcf], Mime[:xml], Mime[:yaml]]
+    expect = [Mime[:html], Mime[:json], Mime[:multipart_form], Mime[:text], Mime[:js], Mime[:css], Mime[:ics], Mime[:csv], Mime[:vcf], Mime[:vtt], Mime[:xml], Mime[:yaml]]
     parsed = Mime::Type.parse(accept)
-    assert_equal expect, parsed
+    assert_equal expect.map(&:to_s), parsed.map(&:to_s)
   end
 
   test "parse text with trailing star" do
     accept = "text/*"
-    expect = [Mime[:html], Mime[:text], Mime[:js], Mime[:css], Mime[:ics], Mime[:csv], Mime[:vcf], Mime[:xml], Mime[:yaml], Mime[:json]]
+    expect = [Mime[:html], Mime[:text], Mime[:js], Mime[:css], Mime[:ics], Mime[:csv], Mime[:vcf], Mime[:vtt], Mime[:xml], Mime[:yaml], Mime[:json]]
     parsed = Mime::Type.parse(accept)
     assert_equal expect.map(&:to_s).sort!, parsed.map(&:to_s).sort!
   end
diff --git a/actionpack/test/dispatch/routing_test.rb b/actionpack/test/dispatch/routing_test.rb
index 44f902c163..b2d2bf0416 100644
--- a/actionpack/test/dispatch/routing_test.rb
+++ b/actionpack/test/dispatch/routing_test.rb
@@ -5057,3 +5057,40 @@ class TestRecognizePath < ActionDispatch::IntegrationTest
       Routes.recognize_path(*args)
     end
 end
+
+class TestRelativeUrlRootGeneration < ActionDispatch::IntegrationTest
+  config = ActionDispatch::Routing::RouteSet::Config.new("/blog", false)
+
+  stub_controllers(config) do |routes|
+    Routes = routes
+
+    routes.draw do
+      get "/", to: "posts#index", as: :posts
+      get "/:id", to: "posts#show", as: :post
+    end
+  end
+
+  include Routes.url_helpers
+
+  APP = build_app Routes
+
+  def app
+    APP
+  end
+
+  def test_url_helpers
+    assert_equal "/blog/", posts_path({})
+    assert_equal "/blog/", Routes.url_helpers.posts_path({})
+
+    assert_equal "/blog/1", post_path(id: "1")
+    assert_equal "/blog/1", Routes.url_helpers.post_path(id: "1")
+  end
+
+  def test_optimized_url_helpers
+    assert_equal "/blog/", posts_path
+    assert_equal "/blog/", Routes.url_helpers.posts_path
+
+    assert_equal "/blog/1", post_path("1")
+    assert_equal "/blog/1", Routes.url_helpers.post_path("1")
+  end
+end
diff --git a/actionpack/test/dispatch/system_testing/screenshot_helper_test.rb b/actionpack/test/dispatch/system_testing/screenshot_helper_test.rb
index 2afda31cf5..264844fc7d 100644
--- a/actionpack/test/dispatch/system_testing/screenshot_helper_test.rb
+++ b/actionpack/test/dispatch/system_testing/screenshot_helper_test.rb
@@ -35,6 +35,11 @@ class ScreenshotHelperTest < ActiveSupport::TestCase
     end
   end
 
+  test "defaults to simple output for the screenshot" do
+    new_test = DrivenBySeleniumWithChrome.new("x")
+    assert_equal "simple", new_test.send(:output_type)
+  end
+
   test "display_image return artifact format when specify RAILS_SYSTEM_TESTING_SCREENSHOT environment" do
     begin
       original_output_type = ENV["RAILS_SYSTEM_TESTING_SCREENSHOT"]
@@ -42,6 +47,8 @@ class ScreenshotHelperTest < ActiveSupport::TestCase
 
       new_test = DrivenBySeleniumWithChrome.new("x")
 
+      assert_equal "artifact", new_test.send(:output_type)
+
       Rails.stub :root, Pathname.getwd do
         new_test.stub :passed?, false do
           assert_match %r|url=artifact://.+?tmp/screenshots/failures_x\.png|, new_test.send(:display_image)
diff --git a/actionview/CHANGELOG.md b/actionview/CHANGELOG.md
index c700cb72ec..566e30993b 100644
--- a/actionview/CHANGELOG.md
+++ b/actionview/CHANGELOG.md
@@ -1,3 +1,29 @@
+*   Add `preload_link_tag` helper
+
+    This helper that allows to the browser to initiate early fetch of resources
+    (different to the specified in javascript_include_tag and stylesheet_link_tag).
+    Additionally, this sends Early Hints if supported by browser.
+
+    *Guillermo Iguaran*
+
+## Rails 5.2.0.beta2 (November 28, 2017) ##
+
+*   No changes.
+
+
+## Rails 5.2.0.beta1 (November 27, 2017) ##
+
+*   Change `form_with` to generates ids by default.
+
+    When `form_with` was introduced we disabled the automatic generation of ids
+    that was enabled in `form_for`. This usually is not an good idea since labels don't work
+    when the input doesn't have an id and it made harder to test with Capybara.
+
+    You can still disable the automatic generation of ids setting `config.action_view.form_with_generates_ids`
+    to `false.`
+
+    *Nick Pezza*
+
 *   Fix issues with `field_error_proc` wrapping `optgroup` and select divider `option`.
 
     Fixes #31088
diff --git a/actionview/README.rdoc b/actionview/README.rdoc
index d5029599b7..03a0723564 100644
--- a/actionview/README.rdoc
+++ b/actionview/README.rdoc
@@ -11,7 +11,7 @@ The latest version of Action View can be installed with RubyGems:
 
   $ gem install actionview
 
-Source code can be downloaded as part of the Rails project on GitHub
+Source code can be downloaded as part of the Rails project on GitHub:
 
 * https://github.com/rails/rails/tree/master/actionview
 
@@ -29,7 +29,7 @@ API documentation is at
 
 * http://api.rubyonrails.org
 
-Bug reports can be filed for the Ruby on Rails project here:
+Bug reports for the Ruby on Rails project can be filed here:
 
 * https://github.com/rails/rails/issues
 
diff --git a/actionview/RUNNING_UJS_TESTS.rdoc b/actionview/RUNNING_UJS_TESTS.rdoc
index a575624a06..e30c2aee55 100644
--- a/actionview/RUNNING_UJS_TESTS.rdoc
+++ b/actionview/RUNNING_UJS_TESTS.rdoc
@@ -1,7 +1,8 @@
 == Running UJS tests
 
-Ensure that you can build the project and run tests.
-Run rake ujs:server first, and then run the web tests by
-visiting http://localhost:4567 in your browser.
+Ensure that you can build the project by running:
+   rake ujs:server
 
-rake ujs:server
+Then run the web tests by visiting the following URL in your browser:
+
+   http://localhost:4567
diff --git a/actionview/RUNNING_UNIT_TESTS.rdoc b/actionview/RUNNING_UNIT_TESTS.rdoc
index e99d5ca1df..4442dbdb9e 100644
--- a/actionview/RUNNING_UNIT_TESTS.rdoc
+++ b/actionview/RUNNING_UNIT_TESTS.rdoc
@@ -2,13 +2,13 @@
 
 The easiest way to run the unit tests is through Rake. The default task runs
 the entire test suite for all classes. For more information, checkout the
-full array of rake tasks with "rake -T"
+full array of rake tasks with <tt>rake -T</tt>
 
 Rake can be found at https://ruby.github.io/rake/.
 
 == Running by hand
 
-To run a single test suite
+Run a single test suite:
 
    rake test TEST=path/to/test.rb
 
@@ -18,10 +18,9 @@ which can be further narrowed down to one test:
 
 == Dependency on Active Record and database setup
 
-Test cases in the test/activerecord/ directory depend on having
-activerecord and sqlite3 installed. If Active Record is not in
-actionview/../activerecord directory, or the sqlite3 rubygem is not installed,
-these tests are skipped.
-
+Test cases in the +test/activerecord/+ directory depend on having
+activerecord+ and +sqlite3+ installed. If Active Record is not in
+actionview/../activerecord+ directory, or the +sqlite3+ Ruby gem is not installed,
+  these tests are skipped.
 Other tests are runnable from a fresh copy of actionview without any configuration.
 
diff --git a/actionview/lib/action_view/gem_version.rb b/actionview/lib/action_view/gem_version.rb
index ed92490be7..ff7f2bb853 100644
--- a/actionview/lib/action_view/gem_version.rb
+++ b/actionview/lib/action_view/gem_version.rb
@@ -10,7 +10,7 @@ module ActionView
     MAJOR = 5
     MINOR = 2
     TINY  = 0
-    PRE   = "alpha"
+    PRE   = "beta2"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end
diff --git a/actionview/lib/action_view/helpers/asset_tag_helper.rb b/actionview/lib/action_view/helpers/asset_tag_helper.rb
index e362f13798..da630129cb 100644
--- a/actionview/lib/action_view/helpers/asset_tag_helper.rb
+++ b/actionview/lib/action_view/helpers/asset_tag_helper.rb
@@ -2,6 +2,8 @@
 
 require "active_support/core_ext/array/extract_options"
 require "active_support/core_ext/hash/keys"
+require "active_support/core_ext/object/inclusion"
+require "active_support/core_ext/object/try"
 require "action_view/helpers/asset_url_helper"
 require "action_view/helpers/tag_helper"
 
@@ -91,7 +93,7 @@ module ActionView
           content_tag("script".freeze, "", tag_options)
         }.join("\n").html_safe
 
-        request.send_early_hints("Link" => early_hints_links.join("\n")) if respond_to?(:request)
+        request.send_early_hints("Link" => early_hints_links.join("\n")) if respond_to?(:request) && request
 
         sources_tags
       end
@@ -140,7 +142,7 @@ module ActionView
           tag(:link, tag_options)
         }.join("\n").html_safe
 
-        request.send_early_hints("Link" => early_hints_links.join("\n")) if respond_to?(:request)
+        request.send_early_hints("Link" => early_hints_links.join("\n")) if respond_to?(:request) && request
 
         sources_tags
       end
@@ -221,6 +223,67 @@ module ActionView
         }.merge!(options.symbolize_keys))
       end
 
+      # Returns a link tag that browsers can use to preload the +source+.
+      # The +source+ can be the path of an resource managed by asset pipeline,
+      # a full path or an URI.
+      #
+      # ==== Options
+      #
+      # * <tt>:type</tt>  - Override the auto-generated mime type, defaults to the mime type for +source+ extension.
+      # * <tt>:as</tt>  - Override the auto-generated value for as attribute, calculated using +source+ extension and mime type.
+      # * <tt>:crossorigin</tt>  - Specify the crossorigin attribute, required to load cross-origin resources.
+      # * <tt>:nopush</tt>  - Specify if the use of server push is not desired for the resource. Defaults to +false+.
+      #
+      # ==== Examples
+      #
+      #   preload_link_tag("custom_theme.css")
+      #   # => <link rel="preload" href="/assets/custom_theme.css" as="style" type="text/css" />
+      #
+      #   preload_link_tag("/videos/video.webm")
+      #   # => <link rel="preload" href="/videos/video.mp4" as="video" type="video/webm" />
+      #
+      #   preload_link_tag(post_path(format: :json), as: "fetch")
+      #   # => <link rel="preload" href="/posts.json" as="fetch" type="application/json" />
+      #
+      #   preload_link_tag("worker.js", as: "worker")
+      #   # => <link rel="preload" href="/assets/worker.js" as="worker" type="text/javascript" />
+      #
+      #   preload_link_tag("//example.com/font.woff2")
+      #   # => <link rel="preload" href="//example.com/font.woff2" as="font" type="font/woff2" crossorigin="anonymous"/>
+      #
+      #   preload_link_tag("//example.com/font.woff2", crossorigin: "use-credentials")
+      #   # => <link rel="preload" href="//example.com/font.woff2" as="font" type="font/woff2" crossorigin="use-credentials" />
+      #
+      #   preload_link_tag("/media/audio.ogg", nopush: true)
+      #   # => <link rel="preload" href="/media/audio.ogg" as="audio" type="audio/ogg" />
+      #
+      def preload_link_tag(source, options = {})
+        href = asset_path(source, skip_pipeline: options.delete(:skip_pipeline))
+        extname = File.extname(source).downcase.delete(".")
+        mime_type = options.delete(:type) || Template::Types[extname].try(:to_s)
+        as_type = options.delete(:as) || resolve_link_as(extname, mime_type)
+        crossorigin = options.delete(:crossorigin)
+        crossorigin = "anonymous" if crossorigin == true || (crossorigin.blank? && as_type == "font")
+        nopush = options.delete(:nopush) || false
+
+        link_tag = tag.link({
+          rel: "preload",
+          href: href,
+          as: as_type,
+          type: mime_type,
+          crossorigin: crossorigin
+        }.merge!(options.symbolize_keys))
+
+        early_hints_link = "<#{href}>; rel=preload; as=#{as_type}"
+        early_hints_link += "; type=#{mime_type}" if mime_type
+        early_hints_link += "; crossorigin=#{crossorigin}" if crossorigin
+        early_hints_link += "; nopush" if nopush
+
+        request.send_early_hints("Link" => early_hints_link) if respond_to?(:request) && request
+
+        link_tag
+      end
+
       # Returns an HTML image tag for the +source+. The +source+ can be a full
       # path, a file or an Active Storage attachment.
       #
@@ -417,6 +480,18 @@ module ActionView
             raise ArgumentError, "Cannot pass a :size option with a :height or :width option"
           end
         end
+
+        def resolve_link_as(extname, mime_type)
+          if extname == "js"
+            "script"
+          elsif extname == "css"
+            "style"
+          elsif extname == "vtt"
+            "track"
+          elsif (type = mime_type.to_s.split("/")[0]) && type.in?(%w(audio video font))
+            type
+          end
+        end
     end
   end
 end
diff --git a/actionview/lib/action_view/helpers/form_helper.rb b/actionview/lib/action_view/helpers/form_helper.rb
index 6d2ace8cf8..6185aa133f 100644
--- a/actionview/lib/action_view/helpers/form_helper.rb
+++ b/actionview/lib/action_view/helpers/form_helper.rb
@@ -478,6 +478,8 @@ module ActionView
 
       mattr_accessor :form_with_generates_remote_forms, default: true
 
+      mattr_accessor :form_with_generates_ids, default: false
+
       # Creates a form tag based on mixing URLs, scopes, or models.
       #
       #   # Using just a URL:
@@ -640,16 +642,6 @@ module ActionView
       #
       # Where <tt>@document = Document.find(params[:id])</tt>.
       #
-      # When using labels +form_with+ requires setting the id on the field being
-      # labelled:
-      #
-      #   <%= form_with(model: @post) do |form| %>
-      #     <%= form.label :title %>
-      #     <%= form.text_field :title, id: :post_title %>
-      #   <% end %>
-      #
-      # See +label+ for more on how the +for+ attribute is derived.
-      #
       # === Mixing with other form helpers
       #
       # While +form_with+ uses a FormBuilder object it's possible to mix and
@@ -746,7 +738,7 @@ module ActionView
       #   end
       def form_with(model: nil, scope: nil, url: nil, format: nil, **options)
         options[:allow_method_names_outside_object] = true
-        options[:skip_default_ids] = true
+        options[:skip_default_ids] = !form_with_generates_ids
 
         if model
           url ||= polymorphic_path(model, format: format)
@@ -1044,16 +1036,6 @@ module ActionView
       # or model is yielded, so any generated field names are prefixed with
       # either the passed scope or the scope inferred from the <tt>:model</tt>.
       #
-      # When using labels +fields+ requires setting the id on the field being
-      # labelled:
-      #
-      #   <%= fields :comment do |fields| %>
-      #     <%= fields.label :body %>
-      #     <%= fields.text_field :body, id: :comment_body %>
-      #   <% end %>
-      #
-      # See +label+ for more on how the +for+ attribute is derived.
-      #
       # === Mixing with other form helpers
       #
       # While +form_with+ uses a FormBuilder object it's possible to mix and
@@ -1072,7 +1054,7 @@ module ActionView
       # FormOptionsHelper#collection_select and DateHelper#datetime_select.
       def fields(scope = nil, model: nil, **options, &block)
         options[:allow_method_names_outside_object] = true
-        options[:skip_default_ids] = true
+        options[:skip_default_ids] = !form_with_generates_ids
 
         if model
           scope ||= model_name_from_record_or_class(model).param_key
@@ -1985,7 +1967,7 @@ module ActionView
       # See the docs for the <tt>ActionView::FormHelper.fields</tt> helper method.
       def fields(scope = nil, model: nil, **options, &block)
         options[:allow_method_names_outside_object] = true
-        options[:skip_default_ids] = true
+        options[:skip_default_ids] = !FormHelper.form_with_generates_ids
 
         convert_to_legacy_options(options)
 
diff --git a/actionview/lib/action_view/helpers/tags/base.rb b/actionview/lib/action_view/helpers/tags/base.rb
index 8934a9894c..fed908fcdb 100644
--- a/actionview/lib/action_view/helpers/tags/base.rb
+++ b/actionview/lib/action_view/helpers/tags/base.rb
@@ -97,7 +97,7 @@ module ActionView
             index = name_and_id_index(options)
             options["name"] = options.fetch("name") { tag_name(options["multiple"], index) }
 
-            unless skip_default_ids?
+            if generate_ids?
               options["id"] = options.fetch("id") { tag_id(index) }
               if namespace = options.delete("namespace")
                 options["id"] = options["id"] ? "#{namespace}_#{options['id']}" : namespace
@@ -183,8 +183,8 @@ module ActionView
             end
           end
 
-          def skip_default_ids?
-            @skip_default_ids
+          def generate_ids?
+            !@skip_default_ids
           end
       end
     end
diff --git a/actionview/lib/action_view/helpers/tags/label.rb b/actionview/lib/action_view/helpers/tags/label.rb
index 56b48bbd62..02bd099784 100644
--- a/actionview/lib/action_view/helpers/tags/label.rb
+++ b/actionview/lib/action_view/helpers/tags/label.rb
@@ -75,10 +75,6 @@ module ActionView
           def render_component(builder)
             builder.translation
           end
-
-          def skip_default_ids?
-            false # The id is used as the `for` attribute.
-          end
       end
     end
   end
diff --git a/actionview/lib/action_view/railtie.rb b/actionview/lib/action_view/railtie.rb
index b22347c55c..73dfb267bb 100644
--- a/actionview/lib/action_view/railtie.rb
+++ b/actionview/lib/action_view/railtie.rb
@@ -22,8 +22,15 @@ module ActionView
     initializer "action_view.form_with_generates_remote_forms" do |app|
       ActiveSupport.on_load(:action_view) do
         form_with_generates_remote_forms = app.config.action_view.delete(:form_with_generates_remote_forms)
-        unless form_with_generates_remote_forms.nil?
-          ActionView::Helpers::FormHelper.form_with_generates_remote_forms = form_with_generates_remote_forms
+        ActionView::Helpers::FormHelper.form_with_generates_remote_forms = form_with_generates_remote_forms
+      end
+    end
+
+    initializer "action_view.form_with_generates_ids" do |app|
+      ActiveSupport.on_load(:action_view) do
+        form_with_generates_ids = app.config.action_view.delete(:form_with_generates_ids)
+        unless form_with_generates_ids.nil?
+          ActionView::Helpers::FormHelper.form_with_generates_ids = form_with_generates_ids
         end
       end
     end
diff --git a/actionview/package.json b/actionview/package.json
index 4cbf0207e5..787ae06208 100644
--- a/actionview/package.json
+++ b/actionview/package.json
@@ -1,6 +1,6 @@
 {
   "name": "rails-ujs",
-  "version": "5.2.0-alpha",
+  "version": "5.2.0-beta2",
   "description": "Ruby on Rails unobtrusive scripting adapter",
   "main": "lib/assets/compiled/rails-ujs.js",
   "files": [
diff --git a/actionview/test/template/asset_tag_helper_test.rb b/actionview/test/template/asset_tag_helper_test.rb
index 7475f5cc3c..284dacf2d4 100644
--- a/actionview/test/template/asset_tag_helper_test.rb
+++ b/actionview/test/template/asset_tag_helper_test.rb
@@ -214,6 +214,17 @@ class AssetTagHelperTest < ActionView::TestCase
     %(favicon_link_tag 'mb-icon.png', :rel => 'apple-touch-icon', :type => 'image/png') => %(<link href="/images/mb-icon.png" rel="apple-touch-icon" type="image/png" />)
   }
 
+  PreloadLinkToTag = {
+    %(preload_link_tag '/styles/custom_theme.css') => %(<link rel="preload" href="/styles/custom_theme.css" as="style" type="text/css" />),
+    %(preload_link_tag '/videos/video.webm') => %(<link rel="preload" href="/videos/video.webm" as="video" type="video/webm" />),
+    %(preload_link_tag '/posts.json', as: 'fetch') => %(<link rel="preload" href="/posts.json" as="fetch" type="application/json" />),
+    %(preload_link_tag '/users', as: 'fetch', type: 'application/json') => %(<link rel="preload" href="/users" as="fetch" type="application/json" />),
+    %(preload_link_tag '//example.com/map?callback=initMap', as: 'fetch', type: 'application/javascript') => %(<link rel="preload" href="//example.com/map?callback=initMap" as="fetch" type="application/javascript" />),
+    %(preload_link_tag '//example.com/font.woff2') => %(<link rel="preload" href="//example.com/font.woff2" as="font" type="font/woff2" crossorigin="anonymous"/>),
+    %(preload_link_tag '//example.com/font.woff2', crossorigin: 'use-credentials') => %(<link rel="preload" href="//example.com/font.woff2" as="font" type="font/woff2" crossorigin="use-credentials" />),
+    %(preload_link_tag '/media/audio.ogg', nopush: true) => %(<link rel="preload" href="/media/audio.ogg" as="audio" type="audio/ogg" />)
+  }
+
   VideoPathToTag = {
     %(video_path("xml"))          => %(/videos/xml),
     %(video_path("xml.ogg"))      => %(/videos/xml.ogg),
@@ -440,6 +451,14 @@ class AssetTagHelperTest < ActionView::TestCase
     }
   end
 
+  def test_stylesheet_link_tag_without_request
+    @request = nil
+    assert_dom_equal(
+      %(<link rel="stylesheet" media="screen" href="/stylesheets/foo.css" />),
+      stylesheet_link_tag("foo.css")
+    )
+  end
+
   def test_stylesheet_link_tag_is_html_safe
     assert stylesheet_link_tag("dir/file").html_safe?
     assert stylesheet_link_tag("dir/other/file", "dir/file2").html_safe?
@@ -464,6 +483,11 @@ class AssetTagHelperTest < ActionView::TestCase
     assert_dom_equal %(<link href="//assets.example.com/stylesheets/wellington.css" media="screen" rel="stylesheet" />), stylesheet_link_tag("wellington")
   end
 
+  def test_javascript_include_tag_without_request
+    @request = nil
+    assert_dom_equal %(<script src="/javascripts/foo.js"></script>), javascript_include_tag("foo.js")
+  end
+
   def test_image_path
     ImagePathToTag.each { |method, tag| assert_dom_equal(tag, eval(method)) }
   end
@@ -522,6 +546,10 @@ class AssetTagHelperTest < ActionView::TestCase
     FaviconLinkToTag.each { |method, tag| assert_dom_equal(tag, eval(method)) }
   end
 
+  def test_preload_link_tag
+    PreloadLinkToTag.each { |method, tag| assert_dom_equal(tag, eval(method)) }
+  end
+
   def test_video_path
     VideoPathToTag.each { |method, tag| assert_dom_equal(tag, eval(method)) }
   end
@@ -778,6 +806,23 @@ class AssetTagHelperNonVhostTest < ActionView::TestCase
   end
 end
 
+class AssetTagHelperWithoutRequestTest < ActionView::TestCase
+  tests ActionView::Helpers::AssetTagHelper
+
+  undef :request
+
+  def test_stylesheet_link_tag_without_request
+    assert_dom_equal(
+      %(<link rel="stylesheet" media="screen" href="/stylesheets/foo.css" />),
+      stylesheet_link_tag("foo.css")
+    )
+  end
+
+  def test_javascript_include_tag_without_request
+    assert_dom_equal %(<script src="/javascripts/foo.js"></script>), javascript_include_tag("foo.js")
+  end
+end
+
 class AssetUrlHelperControllerTest < ActionView::TestCase
   tests ActionView::Helpers::AssetUrlHelper
 
diff --git a/actionview/test/template/form_helper/form_with_test.rb b/actionview/test/template/form_helper/form_with_test.rb
index c7d49070ce..0295ff627d 100644
--- a/actionview/test/template/form_helper/form_with_test.rb
+++ b/actionview/test/template/form_helper/form_with_test.rb
@@ -5,6 +5,15 @@ require "controller/fake_models"
 
 class FormWithTest < ActionView::TestCase
   include RenderERBUtils
+
+  setup do
+    @old_value = ActionView::Helpers::FormHelper.form_with_generates_ids
+    ActionView::Helpers::FormHelper.form_with_generates_ids = true
+  end
+
+  teardown do
+    ActionView::Helpers::FormHelper.form_with_generates_ids = @old_value
+  end
 end
 
 class FormWithActsLikeFormTagTest < FormWithTest
@@ -218,7 +227,7 @@ class FormWithActsLikeFormForTest < FormWithTest
 
     @post = Post.new
     @comment = Comment.new
-    def @post.errors()
+    def @post.errors
       Class.new {
         def [](field); field == "author_name" ? ["can't be empty"] : [] end
         def empty?() false end
@@ -314,17 +323,45 @@ class FormWithActsLikeFormForTest < FormWithTest
 
     expected = whole_form("/posts/123", "create-post", method: "patch") do
       "<label for='post_title'>The Title</label>" \
+      "<input name='post[title]' type='text' value='Hello World' id='post_title' />" \
+      "<textarea name='post[body]' id='post_body'>\nBack to the hill and over it again!</textarea>" \
+      "<input name='post[secret]' type='hidden' value='0' />" \
+      "<input name='post[secret]' checked='checked' type='checkbox' value='1' id='post_secret' />" \
+      "<select name='post[category]' id='post_category'><option value='animal'>animal</option>\n<option value='economy'>economy</option>\n<option value='sports'>sports</option></select>" \
+      "<input name='commit' data-disable-with='Create post' type='submit' value='Create post' />" \
+      "<button name='button' type='submit'>Create post</button>" \
+      "<button name='button' type='submit'><span>Create post</span></button>"
+    end
+
+    assert_dom_equal expected, output_buffer
+  end
+
+  def test_form_with_not_outputting_ids
+    old_value = ActionView::Helpers::FormHelper.form_with_generates_ids
+    ActionView::Helpers::FormHelper.form_with_generates_ids = false
+
+    form_with(model: @post, id: "create-post") do |f|
+      concat f.label(:title) { "The Title" }
+      concat f.text_field(:title)
+      concat f.text_area(:body)
+      concat f.check_box(:secret)
+      concat f.select(:category, %w( animal economy sports ))
+      concat f.submit("Create post")
+    end
+
+    expected = whole_form("/posts/123", "create-post", method: "patch") do
+      "<label>The Title</label>" \
       "<input name='post[title]' type='text' value='Hello World' />" \
       "<textarea name='post[body]'>\nBack to the hill and over it again!</textarea>" \
       "<input name='post[secret]' type='hidden' value='0' />" \
       "<input name='post[secret]' checked='checked' type='checkbox' value='1' />" \
       "<select name='post[category]'><option value='animal'>animal</option>\n<option value='economy'>economy</option>\n<option value='sports'>sports</option></select>" \
-      "<input name='commit' data-disable-with='Create post' type='submit' value='Create post' />" \
-      "<button name='button' type='submit'>Create post</button>" \
-      "<button name='button' type='submit'><span>Create post</span></button>"
+      "<input name='commit' data-disable-with='Create post' type='submit' value='Create post' />"
     end
 
     assert_dom_equal expected, output_buffer
+  ensure
+    ActionView::Helpers::FormHelper.form_with_generates_ids = old_value
   end
 
   def test_form_with_only_url_on_create
@@ -335,7 +372,7 @@ class FormWithActsLikeFormForTest < FormWithTest
 
     expected = whole_form("/posts") do
       '<label for="title">Label me</label>' \
-      '<input type="text" name="title">'
+      '<input type="text" name="title" id="title">'
     end
 
     assert_dom_equal expected, output_buffer
@@ -349,7 +386,7 @@ class FormWithActsLikeFormForTest < FormWithTest
 
     expected = whole_form("/posts/123") do
       '<label for="title">Label me</label>' \
-      '<input type="text" name="title">'
+      '<input type="text" name="title" id="title">'
     end
 
     assert_dom_equal expected, output_buffer
@@ -361,7 +398,7 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123") do
-      '<input type="text" name="no_model_to_back_this_badboy">'
+      '<input type="text" name="no_model_to_back_this_badboy" id="no_model_to_back_this_badboy" >'
     end
 
     assert_dom_equal expected, output_buffer
@@ -373,7 +410,7 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: :patch) do
-      '<input type="text" name="post[this_dont_exist_on_post]">'
+      '<input type="text" name="post[this_dont_exist_on_post]" id="post_this_dont_exist_on_post" >'
     end
 
     assert_dom_equal expected, output_buffer
@@ -391,8 +428,8 @@ class FormWithActsLikeFormForTest < FormWithTest
     end.new
 
     form_with(model: obj, scope: "other_name", url: "/", id: "edit-other-name") do |f|
-      assert_dom_equal '<input type="hidden" name="other_name[private_property]">', f.hidden_field(:private_property)
-      assert_dom_equal '<input type="hidden" name="other_name[protected_property]">', f.hidden_field(:protected_property)
+      assert_dom_equal '<input type="hidden" name="other_name[private_property]" id="other_name_private_property">', f.hidden_field(:private_property)
+      assert_dom_equal '<input type="hidden" name="other_name[protected_property]"  id="other_name_protected_property">', f.hidden_field(:protected_property)
     end
   end
 
@@ -459,7 +496,7 @@ class FormWithActsLikeFormForTest < FormWithTest
       "<label for='post_active_false'>" \
       "<input checked='checked' name='post[active]' type='radio' value='false' id='post_active_false' />" \
       "false</label>" \
-      "<input name='post[id]' type='hidden' value='1' />"
+      "<input name='post[id]' type='hidden' value='1' id='post_id' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -557,7 +594,7 @@ class FormWithActsLikeFormForTest < FormWithTest
       "<label for='post_tag_ids_3'>" \
       "<input checked='checked' name='post[tag_ids][]' type='checkbox' value='3' id='post_tag_ids_3' />" \
       "Tag 3</label>" \
-      "<input name='post[id]' type='hidden' value='1' />"
+      "<input name='post[id]' type='hidden' value='1' id='post_id' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -587,7 +624,7 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", "create-post", method: "patch", multipart: true) do
-      "<input name='post[file]' type='file' />"
+      "<input name='post[file]' type='file' id='post_file' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -601,7 +638,7 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch", multipart: true) do
-      "<input name='post[comment][file]' type='file' />"
+      "<input name='post[comment][file]' type='file' id='post_comment_file'/>"
     end
 
     assert_dom_equal expected, output_buffer
@@ -640,7 +677,7 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/44", method: "patch") do
-      "<input name='post[title]' type='text' value='And his name will be forty and four.' />" \
+      "<input name='post[title]' type='text' value='And his name will be forty and four.' id='post_title' />" \
       "<input name='commit' data-disable-with='Edit post' type='submit' value='Edit post' />"
     end
 
@@ -658,10 +695,10 @@ class FormWithActsLikeFormForTest < FormWithTest
 
     expected = whole_form("/posts/123", "create-post", method: "patch") do
       "<label for='other_name_title' class='post_title'>Title</label>" \
-      "<input name='other_name[title]' value='Hello World' type='text' />" \
-      "<textarea name='other_name[body]'>\nBack to the hill and over it again!</textarea>" \
+      "<input name='other_name[title]' value='Hello World' type='text' id='other_name_title' />" \
+      "<textarea name='other_name[body]' id='other_name_body'>\nBack to the hill and over it again!</textarea>" \
       "<input name='other_name[secret]' value='0' type='hidden' />" \
-      "<input name='other_name[secret]' checked='checked' value='1' type='checkbox' />" \
+      "<input name='other_name[secret]' checked='checked' value='1' type='checkbox' id='other_name_secret' />" \
       "<input name='commit' value='Create post' data-disable-with='Create post' type='submit' />"
     end
 
@@ -676,10 +713,10 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/", "create-post", method: "delete") do
-      "<input name='post[title]' type='text' value='Hello World' />" \
-      "<textarea name='post[body]'>\nBack to the hill and over it again!</textarea>" \
+      "<input name='post[title]' type='text' value='Hello World' id='post_title' />" \
+      "<textarea name='post[body]' id='post_body'>\nBack to the hill and over it again!</textarea>" \
       "<input name='post[secret]' type='hidden' value='0' />" \
-      "<input name='post[secret]' checked='checked' type='checkbox' value='1' />"
+      "<input name='post[secret]' checked='checked' type='checkbox' value='1' id='post_secret'/>"
     end
 
     assert_dom_equal expected, output_buffer
@@ -693,10 +730,10 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/", "create-post", method: "delete") do
-      "<input name='post[title]' type='text' value='Hello World' />" \
-      "<textarea name='post[body]'>\nBack to the hill and over it again!</textarea>" \
+      "<input name='post[title]' type='text' value='Hello World' id='post_title' />" \
+      "<textarea name='post[body]' id='post_body' >\nBack to the hill and over it again!</textarea>" \
       "<input name='post[secret]' type='hidden' value='0' />" \
-      "<input name='post[secret]' checked='checked' type='checkbox' value='1' />"
+      "<input name='post[secret]' checked='checked' type='checkbox' value='1' id='post_secret' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -710,7 +747,7 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/search", "search-post", method: "get") do
-      "<input name='post[title]' type='search' />"
+      "<input name='post[title]' type='search' id='post_title' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -724,10 +761,10 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/", "create-post", method: "patch") do
-      "<input name='post[title]' type='text' value='Hello World' />" \
-      "<textarea name='post[body]'>\nBack to the hill and over it again!</textarea>" \
+      "<input name='post[title]' type='text' value='Hello World' id='post_title' />" \
+      "<textarea name='post[body]' id='post_body' >\nBack to the hill and over it again!</textarea>" \
       "<input name='post[secret]' type='hidden' value='0' />" \
-      "<input name='post[secret]' checked='checked' type='checkbox' value='1' />"
+      "<input name='post[secret]' checked='checked' type='checkbox' value='1' id='post_secret' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -744,10 +781,10 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/", "create-post", method: "patch", local: true) do
-      "<input name='post[title]' type='text' value='Hello World' />" \
-      "<textarea name='post[body]'>\nBack to the hill and over it again!</textarea>" \
+      "<input name='post[title]' type='text' value='Hello World' id='post_title' />" \
+      "<textarea name='post[body]' id='post_body'>\nBack to the hill and over it again!</textarea>" \
       "<input name='post[secret]' type='hidden' value='0' />" \
-      "<input name='post[secret]' checked='checked' type='checkbox' value='1' />"
+      "<input name='post[secret]' checked='checked' type='checkbox' value='1' id='post_secret' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -761,7 +798,7 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/", skip_enforcing_utf8: true) do
-      "<input name='post[title]' type='text' value='Hello World' />"
+      "<input name='post[title]' type='text' value='Hello World' id='post_title' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -773,7 +810,7 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/", skip_enforcing_utf8: false) do
-      "<input name='post[title]' type='text' value='Hello World' />"
+      "<input name='post[title]' type='text' value='Hello World' id='post_title' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -787,10 +824,10 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/", "create-post") do
-      "<input name='post[title]' type='text' value='Hello World' />" \
-      "<textarea name='post[body]'>\nBack to the hill and over it again!</textarea>" \
+      "<input name='post[title]' type='text' value='Hello World' id='post_title' />" \
+      "<textarea name='post[body]' id='post_body' >\nBack to the hill and over it again!</textarea>" \
       "<input name='post[secret]' type='hidden' value='0' />" \
-      "<input name='post[secret]' checked='checked' type='checkbox' value='1' />"
+      "<input name='post[secret]' checked='checked' type='checkbox' value='1' id='post_secret' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -806,10 +843,10 @@ class FormWithActsLikeFormForTest < FormWithTest
 
     expected = whole_form("/posts/123", method: "patch") do
       "<label for='post_123_title'>Title</label>" \
-      "<input name='post[123][title]' type='text' value='Hello World' />" \
-      "<textarea name='post[123][body]'>\nBack to the hill and over it again!</textarea>" \
+      "<input name='post[123][title]' type='text' value='Hello World' id='post_123_title' />" \
+      "<textarea name='post[123][body]' id='post_123_body'>\nBack to the hill and over it again!</textarea>" \
       "<input name='post[123][secret]' type='hidden' value='0' />" \
-      "<input name='post[123][secret]' checked='checked' type='checkbox' value='1' />"
+      "<input name='post[123][secret]' checked='checked' type='checkbox' value='1' id='post_123_secret' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -823,10 +860,10 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      "<input name='post[][title]' type='text' value='Hello World' />" \
-      "<textarea name='post[][body]'>\nBack to the hill and over it again!</textarea>" \
+      "<input name='post[][title]' type='text' value='Hello World' id='post__title' />" \
+      "<textarea name='post[][body]' id='post__body' >\nBack to the hill and over it again!</textarea>" \
       "<input name='post[][secret]' type='hidden' value='0' />" \
-      "<input name='post[][secret]' checked='checked' type='checkbox' value='1' />"
+      "<input name='post[][secret]' checked='checked' type='checkbox' value='1' id='post__secret' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -841,7 +878,7 @@ class FormWithActsLikeFormForTest < FormWithTest
 
     expected = whole_form("/posts/123", method: "patch") do
       "<div class='field_with_errors'><label for='post_author_name' class='label'>Author name</label></div>" \
-      "<div class='field_with_errors'><input name='post[author_name]' type='text' value='' /></div>" \
+      "<div class='field_with_errors'><input name='post[author_name]' type='text' value='' id='post_author_name' /></div>" \
       "<input name='commit' data-disable-with='Create post' type='submit' value='Create post' />"
     end
 
@@ -859,7 +896,7 @@ class FormWithActsLikeFormForTest < FormWithTest
 
     expected = whole_form("/posts/123", method: "patch") do
       "<div class='field_with_errors'><label for='post_author_name' class='label'>Author name</label></div>" \
-      "<div class='field_with_errors'><input name='post[author_name]' type='text' value='' /></div>" \
+      "<div class='field_with_errors'><input name='post[author_name]' type='text' value='' id='post_author_name' /></div>" \
       "<input name='commit' data-disable-with='Create post' type='submit' value='Create post' />"
     end
 
@@ -947,7 +984,7 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: :patch) do
-      '<input type="text" name="post[comment][dont_exist_on_model]">'
+      '<input type="text" name="post[comment][dont_exist_on_model]" id="post_comment_dont_exist_on_model" >'
     end
 
     assert_dom_equal expected, output_buffer
@@ -967,7 +1004,7 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form do
-      '<input name="posts[post][0][comment][1][dont_exist_on_model]" type="text">'
+      '<input name="posts[post][0][comment][1][dont_exist_on_model]" type="text" id="posts_post_0_comment_1_dont_exist_on_model" >'
     end
 
     assert_dom_equal expected, output_buffer
@@ -982,7 +1019,7 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      "<input name='post[comment][body]' type='text' value='Hello World' />"
+      "<input name='post[comment][body]' type='text' value='Hello World' id='post_comment_body' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -1002,7 +1039,7 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form do
-      "<input name='posts[post][0][comment][1][name]' type='text' value='comment #1' />"
+      "<input name='posts[post][0][comment][1][name]' type='text' value='comment #1' id='posts_post_0_comment_1_name' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -1017,8 +1054,8 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      "<input name='post[123][title]' type='text' value='Hello World' />" \
-      "<input name='post[123][comment][][name]' type='text' value='new comment' />"
+      "<input name='post[123][title]' type='text' value='Hello World' id='post_123_title' />" \
+      "<input name='post[123][comment][][name]' type='text' value='new comment' id='post_123_comment__name' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -1033,8 +1070,8 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      "<input name='post[1][title]' type='text' value='Hello World' />" \
-      "<input name='post[1][comment][1][name]' type='text' value='new comment' />"
+      "<input name='post[1][title]' type='text' value='Hello World' id='post_1_title' />" \
+      "<input name='post[1][comment][1][name]' type='text' value='new comment' id='post_1_comment_1_name' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -1048,7 +1085,7 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      "<input name='post[1][comment][title]' type='text' value='Hello World' />"
+      "<input name='post[1][comment][title]' type='text' value='Hello World' id='post_1_comment_title' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -1062,7 +1099,7 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      "<input name='post[1][comment][5][title]' type='text' value='Hello World' />"
+      "<input name='post[1][comment][5][title]' type='text' value='Hello World' id='post_1_comment_5_title' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -1076,7 +1113,7 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      "<input name='post[123][comment][title]' type='text' value='Hello World' />"
+      "<input name='post[123][comment][title]' type='text' value='Hello World' id='post_123_comment_title' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -1090,7 +1127,7 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      "<input name='post[comment][5][title]' type='radio' value='hello' />"
+      "<input name='post[comment][5][title]' type='radio' value='hello' id='post_comment_5_title_hello' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -1104,7 +1141,7 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      "<input name='post[123][comment][123][title]' type='text' value='Hello World' />"
+      "<input name='post[123][comment][123][title]' type='text' value='Hello World' id='post_123_comment_123_title' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -1124,9 +1161,9 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      "<input name='post[123][comment][5][title]' type='text' value='Hello World' />"
+      "<input name='post[123][comment][5][title]' type='text' value='Hello World' id='post_123_comment_5_title' />"
     end + whole_form("/posts/123", method: "patch") do
-      "<input name='post[1][comment][123][title]' type='text' value='Hello World' />"
+      "<input name='post[1][comment][123][title]' type='text' value='Hello World' id='post_1_comment_123_title' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -1143,8 +1180,8 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[title]" type="text" value="Hello World" />' \
-        '<input name="post[author_attributes][name]" type="text" value="new author" />'
+      '<input name="post[title]" type="text" value="Hello World" id="post_title" />' \
+        '<input name="post[author_attributes][name]" type="text" value="new author" id="post_author_attributes_name" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1170,9 +1207,9 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[title]" type="text" value="Hello World" />' \
-      '<input name="post[author_attributes][name]" type="text" value="author #321" />' \
-      '<input name="post[author_attributes][id]" type="hidden" value="321" />'
+      '<input name="post[title]" type="text" value="Hello World" id="post_title" />' \
+      '<input name="post[author_attributes][name]" type="text" value="author #321" id="post_author_attributes_name" />' \
+      '<input name="post[author_attributes][id]" type="hidden" value="321" id="post_author_attributes_id" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1189,9 +1226,9 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[title]" type="text" value="Hello World" />' \
-      '<input name="post[author_attributes][name]" type="text" value="author #321" />' \
-      '<input name="post[author_attributes][id]" type="hidden" value="321" />'
+      '<input name="post[title]" type="text" value="Hello World" id="post_title" />' \
+      '<input name="post[author_attributes][name]" type="text" value="author #321" id="post_author_attributes_name" />' \
+      '<input name="post[author_attributes][id]" type="hidden" value="321" id="post_author_attributes_id" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1208,8 +1245,8 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[title]" type="text" value="Hello World" />' \
-      '<input name="post[author_attributes][name]" type="text" value="author #321" />'
+      '<input name="post[title]" type="text" value="Hello World" id="post_title" />' \
+      '<input name="post[author_attributes][name]" type="text" value="author #321" id="post_author_attributes_name" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1226,8 +1263,8 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[title]" type="text" value="Hello World" />' \
-      '<input name="post[author_attributes][name]" type="text" value="author #321" />'
+      '<input name="post[title]" type="text" value="Hello World" id="post_title" />' \
+      '<input name="post[author_attributes][name]" type="text" value="author #321" id="post_author_attributes_name" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1244,9 +1281,9 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[title]" type="text" value="Hello World" />' \
-      '<input name="post[author_attributes][name]" type="text" value="author #321" />' \
-      '<input name="post[author_attributes][id]" type="hidden" value="321" />'
+      '<input name="post[title]" type="text" value="Hello World" id="post_title" />' \
+      '<input name="post[author_attributes][name]" type="text" value="author #321" id="post_author_attributes_name" />' \
+      '<input name="post[author_attributes][id]" type="hidden" value="321" id="post_author_attributes_id" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1264,9 +1301,9 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[title]" type="text" value="Hello World" />' \
-      '<input name="post[author_attributes][id]" type="hidden" value="321" />' \
-      '<input name="post[author_attributes][name]" type="text" value="author #321" />'
+      '<input name="post[title]" type="text" value="Hello World" id="post_title" />' \
+      '<input name="post[author_attributes][id]" type="hidden" value="321" id="post_author_attributes_id" />' \
+      '<input name="post[author_attributes][name]" type="text" value="author #321" id="post_author_attributes_name" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1285,11 +1322,11 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[title]" type="text" value="Hello World" />' \
-      '<input name="post[comments_attributes][0][name]" type="text" value="comment #1" />' \
-      '<input name="post[comments_attributes][0][id]" type="hidden" value="1" />' \
-      '<input name="post[comments_attributes][1][name]" type="text" value="comment #2" />' \
-      '<input name="post[comments_attributes][1][id]" type="hidden" value="2" />'
+      '<input name="post[title]" type="text" value="Hello World" id="post_title" />' \
+      '<input name="post[comments_attributes][0][name]" type="text" value="comment #1" id="post_comments_attributes_0_name" />' \
+      '<input name="post[comments_attributes][0][id]" type="hidden" value="1" id="post_comments_attributes_0_id" />' \
+      '<input name="post[comments_attributes][1][name]" type="text" value="comment #2" id="post_comments_attributes_1_name" />' \
+      '<input name="post[comments_attributes][1][id]" type="hidden" value="2" id="post_comments_attributes_1_id" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1312,11 +1349,11 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[title]" type="text" value="Hello World" />' \
-      '<input name="post[author_attributes][name]" type="text" value="author #321" />' \
-      '<input name="post[author_attributes][id]" type="hidden" value="321" />' \
-      '<input name="post[comments_attributes][0][name]" type="text" value="comment #1" />' \
-      '<input name="post[comments_attributes][1][name]" type="text" value="comment #2" />'
+      '<input name="post[title]" type="text" value="Hello World" id="post_title" />' \
+      '<input name="post[author_attributes][name]" type="text" value="author #321" id="post_author_attributes_name" />' \
+      '<input name="post[author_attributes][id]" type="hidden" value="321" id="post_author_attributes_id" />' \
+      '<input name="post[comments_attributes][0][name]" type="text" value="comment #1" id="post_comments_attributes_0_name" />' \
+      '<input name="post[comments_attributes][1][name]" type="text" value="comment #2" id="post_comments_attributes_1_name" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1339,10 +1376,10 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[title]" type="text" value="Hello World" />' \
-      '<input name="post[author_attributes][name]" type="text" value="author #321" />' \
-      '<input name="post[comments_attributes][0][name]" type="text" value="comment #1" />' \
-      '<input name="post[comments_attributes][1][name]" type="text" value="comment #2" />'
+      '<input name="post[title]" type="text" value="Hello World" id="post_title" />' \
+      '<input name="post[author_attributes][name]" type="text" value="author #321" id="post_author_attributes_name" />' \
+      '<input name="post[comments_attributes][0][name]" type="text" value="comment #1" id="post_comments_attributes_0_name" />' \
+      '<input name="post[comments_attributes][1][name]" type="text" value="comment #2" id="post_comments_attributes_1_name" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1365,11 +1402,11 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[title]" type="text" value="Hello World" />' \
-      '<input name="post[author_attributes][name]" type="text" value="author #321" />' \
-      '<input name="post[author_attributes][id]" type="hidden" value="321" />' \
-      '<input name="post[comments_attributes][0][name]" type="text" value="comment #1" />' \
-      '<input name="post[comments_attributes][1][name]" type="text" value="comment #2" />'
+      '<input name="post[title]" type="text" value="Hello World" id="post_title" />' \
+      '<input name="post[author_attributes][name]" type="text" value="author #321" id="post_author_attributes_name" />' \
+      '<input name="post[author_attributes][id]" type="hidden" value="321" id="post_author_attributes_id" />' \
+      '<input name="post[comments_attributes][0][name]" type="text" value="comment #1" id="post_comments_attributes_0_name" />' \
+      '<input name="post[comments_attributes][1][name]" type="text" value="comment #2" id="post_comments_attributes_1_name" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1388,11 +1425,11 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[title]" type="text" value="Hello World" />' \
-      '<input name="post[comments_attributes][0][name]" type="text" value="comment #1" />' \
-      '<input name="post[comments_attributes][0][id]" type="hidden" value="1" />' \
-      '<input name="post[comments_attributes][1][name]" type="text" value="comment #2" />' \
-      '<input name="post[comments_attributes][1][id]" type="hidden" value="2" />'
+      '<input name="post[title]" type="text" value="Hello World" id="post_title" />' \
+      '<input name="post[comments_attributes][0][name]" type="text" value="comment #1" id="post_comments_attributes_0_name" />' \
+      '<input name="post[comments_attributes][0][id]" type="hidden" value="1" id="post_comments_attributes_0_id" />' \
+      '<input name="post[comments_attributes][1][name]" type="text" value="comment #2" id="post_comments_attributes_1_name" />' \
+      '<input name="post[comments_attributes][1][id]" type="hidden" value="2" id="post_comments_attributes_1_id" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1412,11 +1449,11 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[title]" type="text" value="Hello World" />' \
-      '<input name="post[comments_attributes][0][id]" type="hidden" value="1" />' \
-      '<input name="post[comments_attributes][0][name]" type="text" value="comment #1" />' \
-      '<input name="post[comments_attributes][1][id]" type="hidden" value="2" />' \
-      '<input name="post[comments_attributes][1][name]" type="text" value="comment #2" />'
+      '<input name="post[title]" type="text" value="Hello World" id="post_title" />' \
+      '<input name="post[comments_attributes][0][id]" type="hidden" value="1" id="post_comments_attributes_0_id" />' \
+      '<input name="post[comments_attributes][0][name]" type="text" value="comment #1" id="post_comments_attributes_0_name" />' \
+      '<input name="post[comments_attributes][1][id]" type="hidden" value="2" id="post_comments_attributes_1_id" />' \
+      '<input name="post[comments_attributes][1][name]" type="text" value="comment #2" id="post_comments_attributes_1_name" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1435,9 +1472,9 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[title]" type="text" value="Hello World" />' \
-      '<input name="post[comments_attributes][0][name]" type="text" value="new comment" />' \
-      '<input name="post[comments_attributes][1][name]" type="text" value="new comment" />'
+      '<input name="post[title]" type="text" value="Hello World" id="post_title" />' \
+      '<input name="post[comments_attributes][0][name]" type="text" value="new comment" id="post_comments_attributes_0_name" />' \
+      '<input name="post[comments_attributes][1][name]" type="text" value="new comment" id="post_comments_attributes_1_name" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1456,10 +1493,10 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[title]" type="text" value="Hello World" />' \
-      '<input name="post[comments_attributes][0][name]" type="text" value="comment #321" />' \
-      '<input name="post[comments_attributes][0][id]" type="hidden" value="321" />' \
-      '<input name="post[comments_attributes][1][name]" type="text" value="new comment" />'
+      '<input name="post[title]" type="text" value="Hello World" id="post_title" />' \
+      '<input name="post[comments_attributes][0][name]" type="text" value="comment #321" id="post_comments_attributes_0_name" />' \
+      '<input name="post[comments_attributes][0][id]" type="hidden" value="321" id="post_comments_attributes_0_id"/>' \
+      '<input name="post[comments_attributes][1][name]" type="text" value="new comment" id="post_comments_attributes_1_name" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1474,7 +1511,7 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[title]" type="text" value="Hello World" />'
+      '<input name="post[title]" type="text" value="Hello World" id="post_title" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1491,11 +1528,11 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[title]" type="text" value="Hello World" />' \
-      '<input name="post[comments_attributes][0][name]" type="text" value="comment #1" />' \
-      '<input name="post[comments_attributes][0][id]" type="hidden" value="1" />' \
-      '<input name="post[comments_attributes][1][name]" type="text" value="comment #2" />' \
-      '<input name="post[comments_attributes][1][id]" type="hidden" value="2" />'
+      '<input name="post[title]" type="text" value="Hello World" id="post_title" />' \
+      '<input name="post[comments_attributes][0][name]" type="text" value="comment #1" id="post_comments_attributes_0_name" />' \
+      '<input name="post[comments_attributes][0][id]" type="hidden" value="1" id="post_comments_attributes_0_id" />' \
+      '<input name="post[comments_attributes][1][name]" type="text" value="comment #2" id="post_comments_attributes_1_name" />' \
+      '<input name="post[comments_attributes][1][id]" type="hidden" value="2" id="post_comments_attributes_1_id" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1512,11 +1549,11 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[title]" type="text" value="Hello World" />' \
-      '<input name="post[comments_attributes][0][name]" type="text" value="comment #1" />' \
-      '<input name="post[comments_attributes][0][id]" type="hidden" value="1" />' \
-      '<input name="post[comments_attributes][1][name]" type="text" value="comment #2" />' \
-      '<input name="post[comments_attributes][1][id]" type="hidden" value="2" />'
+      '<input name="post[title]" type="text" value="Hello World" id="post_title" />' \
+      '<input name="post[comments_attributes][0][name]" type="text" value="comment #1" id="post_comments_attributes_0_name" />' \
+      '<input name="post[comments_attributes][0][id]" type="hidden" value="1" id="post_comments_attributes_0_id" />' \
+      '<input name="post[comments_attributes][1][name]" type="text" value="comment #2" id="post_comments_attributes_1_name" />' \
+      '<input name="post[comments_attributes][1][id]" type="hidden" value="2" id="post_comments_attributes_1_id" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1547,11 +1584,11 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[title]" type="text" value="Hello World" />' \
-      '<input name="post[comments_attributes][0][name]" type="text" value="comment #1" />' \
-      '<input name="post[comments_attributes][0][id]" type="hidden" value="1" />' \
-      '<input name="post[comments_attributes][1][name]" type="text" value="comment #2" />' \
-      '<input name="post[comments_attributes][1][id]" type="hidden" value="2" />'
+      '<input name="post[title]" type="text" value="Hello World" id="post_title" />' \
+      '<input name="post[comments_attributes][0][name]" type="text" value="comment #1" id="post_comments_attributes_0_name" />' \
+      '<input name="post[comments_attributes][0][id]" type="hidden" value="1" id="post_comments_attributes_0_id" />' \
+      '<input name="post[comments_attributes][1][name]" type="text" value="comment #2" id="post_comments_attributes_1_name" />' \
+      '<input name="post[comments_attributes][1][id]" type="hidden" value="2" id="post_comments_attributes_1_id" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1570,10 +1607,10 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[title]" type="text" value="Hello World" />' \
-      '<input name="post[comments_attributes][0][name]" type="text" value="comment #321" />' \
-      '<input name="post[comments_attributes][0][id]" type="hidden" value="321" />' \
-      '<input name="post[comments_attributes][1][name]" type="text" value="new comment" />'
+      '<input name="post[title]" type="text" value="Hello World" id="post_title" />' \
+      '<input name="post[comments_attributes][0][name]" type="text" value="comment #321" id="post_comments_attributes_0_name" />' \
+      '<input name="post[comments_attributes][0][id]" type="hidden" value="321" id="post_comments_attributes_0_id" />' \
+      '<input name="post[comments_attributes][1][name]" type="text" value="new comment" id="post_comments_attributes_1_name" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1590,8 +1627,8 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[comments_attributes][abc][name]" type="text" value="comment #321" />' \
-      '<input name="post[comments_attributes][abc][id]" type="hidden" value="321" />'
+      '<input name="post[comments_attributes][abc][name]" type="text" value="comment #321" id="post_comments_attributes_abc_name" />' \
+      '<input name="post[comments_attributes][abc][id]" type="hidden" value="321" id="post_comments_attributes_abc_id" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1607,8 +1644,8 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[comments_attributes][abc][name]" type="text" value="comment #321" />' \
-      '<input name="post[comments_attributes][abc][id]" type="hidden" value="321" />'
+      '<input name="post[comments_attributes][abc][name]" type="text" value="comment #321" id="post_comments_attributes_abc_name" />' \
+      '<input name="post[comments_attributes][abc][id]" type="hidden" value="321" id="post_comments_attributes_abc_id" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1630,8 +1667,8 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[comments_attributes][abc][name]" type="text" value="comment #321" />' \
-      '<input name="post[comments_attributes][abc][id]" type="hidden" value="321" />'
+      '<input name="post[comments_attributes][abc][name]" type="text" value="comment #321" id="post_comments_attributes_abc_name" />' \
+      '<input name="post[comments_attributes][abc][id]" type="hidden" value="321" id="post_comments_attributes_abc_id" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1716,18 +1753,18 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[comments_attributes][0][name]" type="text" value="comment #321" />' \
-      '<input name="post[comments_attributes][0][relevances_attributes][0][value]" type="text" value="commentrelevance #314" />' \
-      '<input name="post[comments_attributes][0][relevances_attributes][0][id]" type="hidden" value="314" />' \
-      '<input name="post[comments_attributes][0][id]" type="hidden" value="321" />' \
-      '<input name="post[tags_attributes][0][value]" type="text" value="tag #123" />' \
-      '<input name="post[tags_attributes][0][relevances_attributes][0][value]" type="text" value="tagrelevance #3141" />' \
-      '<input name="post[tags_attributes][0][relevances_attributes][0][id]" type="hidden" value="3141" />' \
-      '<input name="post[tags_attributes][0][id]" type="hidden" value="123" />' \
-      '<input name="post[tags_attributes][1][value]" type="text" value="tag #456" />' \
-      '<input name="post[tags_attributes][1][relevances_attributes][0][value]" type="text" value="tagrelevance #31415" />' \
-      '<input name="post[tags_attributes][1][relevances_attributes][0][id]" type="hidden" value="31415" />' \
-      '<input name="post[tags_attributes][1][id]" type="hidden" value="456" />'
+      '<input name="post[comments_attributes][0][name]" type="text" value="comment #321" id="post_comments_attributes_0_name" />' \
+      '<input name="post[comments_attributes][0][relevances_attributes][0][value]" type="text" value="commentrelevance #314" id="post_comments_attributes_0_relevances_attributes_0_value" />' \
+      '<input name="post[comments_attributes][0][relevances_attributes][0][id]" type="hidden" value="314" id="post_comments_attributes_0_relevances_attributes_0_id"/>' \
+      '<input name="post[comments_attributes][0][id]" type="hidden" value="321" id="post_comments_attributes_0_id"/>' \
+      '<input name="post[tags_attributes][0][value]" type="text" value="tag #123" id="post_tags_attributes_0_value"/>' \
+      '<input name="post[tags_attributes][0][relevances_attributes][0][value]" type="text" value="tagrelevance #3141" id="post_tags_attributes_0_relevances_attributes_0_value"/>' \
+      '<input name="post[tags_attributes][0][relevances_attributes][0][id]" type="hidden" value="3141" id="post_tags_attributes_0_relevances_attributes_0_id"/>' \
+      '<input name="post[tags_attributes][0][id]" type="hidden" value="123" id="post_tags_attributes_0_id"/>' \
+      '<input name="post[tags_attributes][1][value]" type="text" value="tag #456" id="post_tags_attributes_1_value"/>' \
+      '<input name="post[tags_attributes][1][relevances_attributes][0][value]" type="text" value="tagrelevance #31415" id="post_tags_attributes_1_relevances_attributes_0_value"/>' \
+      '<input name="post[tags_attributes][1][relevances_attributes][0][id]" type="hidden" value="31415" id="post_tags_attributes_1_relevances_attributes_0_id"/>' \
+      '<input name="post[tags_attributes][1][id]" type="hidden" value="456" id="post_tags_attributes_1_id"/>'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1743,7 +1780,7 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      '<input name="post[author_attributes][name]" type="text" value="hash backed author" />'
+      '<input name="post[author_attributes][name]" type="text" value="hash backed author" id="post_author_attributes_name" />'
     end
 
     assert_dom_equal expected, output_buffer
@@ -1757,10 +1794,10 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected =
-      "<input name='post[title]' type='text' value='Hello World' />" \
-      "<textarea name='post[body]'>\nBack to the hill and over it again!</textarea>" \
+      "<input name='post[title]' type='text' value='Hello World' id='post_title' />" \
+      "<textarea name='post[body]' id='post_body'>\nBack to the hill and over it again!</textarea>" \
       "<input name='post[secret]' type='hidden' value='0' />" \
-      "<input name='post[secret]' checked='checked' type='checkbox' value='1' />"
+      "<input name='post[secret]' checked='checked' type='checkbox' value='1' id='post_secret' />"
 
     assert_dom_equal expected, output_buffer
   end
@@ -1773,10 +1810,10 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected =
-      "<input name='post[123][title]' type='text' value='Hello World' />" \
-      "<textarea name='post[123][body]'>\nBack to the hill and over it again!</textarea>" \
+      "<input name='post[123][title]' type='text' value='Hello World' id='post_123_title' />" \
+      "<textarea name='post[123][body]' id='post_123_body'>\nBack to the hill and over it again!</textarea>" \
       "<input name='post[123][secret]' type='hidden' value='0' />" \
-      "<input name='post[123][secret]' checked='checked' type='checkbox' value='1' />"
+      "<input name='post[123][secret]' checked='checked' type='checkbox' value='1' id='post_123_secret' />"
 
     assert_dom_equal expected, output_buffer
   end
@@ -1789,10 +1826,10 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected =
-      "<input name='post[][title]' type='text' value='Hello World' />" \
-      "<textarea name='post[][body]'>\nBack to the hill and over it again!</textarea>" \
+      "<input name='post[][title]' type='text' value='Hello World' id='post__title' />" \
+      "<textarea name='post[][body]' id='post__body'>\nBack to the hill and over it again!</textarea>" \
       "<input name='post[][secret]' type='hidden' value='0' />" \
-      "<input name='post[][secret]' checked='checked' type='checkbox' value='1' />"
+      "<input name='post[][secret]' checked='checked' type='checkbox' value='1' id='post__secret' />"
 
     assert_dom_equal expected, output_buffer
   end
@@ -1805,10 +1842,10 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected =
-      "<input name='post[abc][title]' type='text' value='Hello World' />" \
-      "<textarea name='post[abc][body]'>\nBack to the hill and over it again!</textarea>" \
+      "<input name='post[abc][title]' type='text' value='Hello World' id='post_abc_title' />" \
+      "<textarea name='post[abc][body]' id='post_abc_body'>\nBack to the hill and over it again!</textarea>" \
       "<input name='post[abc][secret]' type='hidden' value='0' />" \
-      "<input name='post[abc][secret]' checked='checked' type='checkbox' value='1' />"
+      "<input name='post[abc][secret]' checked='checked' type='checkbox' value='1' id='post_abc_secret' />"
 
     assert_dom_equal expected, output_buffer
   end
@@ -1821,10 +1858,10 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected =
-      "<input name='post[title]' type='text' value='Hello World' />" \
-      "<textarea name='post[body]'>\nBack to the hill and over it again!</textarea>" \
+      "<input name='post[title]' type='text' value='Hello World' id='post_title' />" \
+      "<textarea name='post[body]' id='post_body' >\nBack to the hill and over it again!</textarea>" \
       "<input name='post[secret]' type='hidden' value='0' />" \
-      "<input name='post[secret]' checked='checked' type='checkbox' value='1' />"
+      "<input name='post[secret]' checked='checked' type='checkbox' value='1' id='post_secret' />"
 
     assert_dom_equal expected, output_buffer
   end
@@ -1837,10 +1874,10 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected =
-      "<input name='post[title]' type='text' value='Hello World' />" \
-      "<textarea name='post[body]'>\nBack to the hill and over it again!</textarea>" \
+      "<input name='post[title]' type='text' value='Hello World' id='post_title' />" \
+      "<textarea name='post[body]' id='post_body' >\nBack to the hill and over it again!</textarea>" \
       "<input name='post[secret]' type='hidden' value='0' />" \
-      "<input name='post[secret]' checked='checked' type='checkbox' value='1' />"
+      "<input name='post[secret]' checked='checked' type='checkbox' value='1' id='post_secret' />"
 
     assert_dom_equal expected, output_buffer
   end
@@ -1852,7 +1889,7 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     assert_dom_equal "<label for=\"author_post_title\">Title</label>" \
-    "<input name='author[post][title]' type='text' value='Hello World' />",
+    "<input name='author[post][title]' type='text' value='Hello World' id='author_post_title' id='author_post_1_title' />",
       output_buffer
   end
 
@@ -1863,7 +1900,7 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     assert_dom_equal "<label for=\"author_post_1_title\">Title</label>" \
-      "<input name='author[post][1][title]' type='text' value='Hello World' />",
+      "<input name='author[post][1][title]' type='text' value='Hello World' id='author_post_1_title' />",
       output_buffer
   end
 
@@ -1882,10 +1919,10 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", "create-post", method: "patch") do
-      "<input name='post[title]' type='text' value='Hello World' />" \
-      "<textarea name='post[body]'>\nBack to the hill and over it again!</textarea>" \
+      "<input name='post[title]' type='text' value='Hello World' id='post_title' />" \
+      "<textarea name='post[body]' id='post_body' >\nBack to the hill and over it again!</textarea>" \
       "<input name='parent_post[secret]' type='hidden' value='0' />" \
-      "<input name='parent_post[secret]' checked='checked' type='checkbox' value='1' />"
+      "<input name='parent_post[secret]' checked='checked' type='checkbox' value='1' id='parent_post_secret' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -1902,9 +1939,9 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", "create-post", method: "patch") do
-      "<input name='post[title]' type='text' value='Hello World' />" \
-      "<textarea name='post[body]'>\nBack to the hill and over it again!</textarea>" \
-      "<input name='post[comment][name]' type='text' value='new comment' />"
+      "<input name='post[title]' type='text' value='Hello World' id='post_title' />" \
+      "<textarea name='post[body]' id='post_body'>\nBack to the hill and over it again!</textarea>" \
+      "<input name='post[comment][name]' type='text' value='new comment' id='post_comment_name' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -1918,7 +1955,7 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      "<input name='post[category][name]' type='text' />"
+      "<input name='post[category][name]' type='text' id='post_category_name' />"
     end
 
     assert_dom_equal expected, output_buffer
@@ -1942,9 +1979,9 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      "<label for='title'>Title:</label> <input name='post[title]' type='text' value='Hello World' /><br/>" \
-      "<label for='body'>Body:</label> <textarea name='post[body]'>\nBack to the hill and over it again!</textarea><br/>" \
-      "<label for='secret'>Secret:</label> <input name='post[secret]' type='hidden' value='0' /><input name='post[secret]' checked='checked' type='checkbox' value='1' /><br/>"
+      "<label for='title'>Title:</label> <input name='post[title]' type='text' value='Hello World' id='post_title'/><br/>" \
+      "<label for='body'>Body:</label> <textarea name='post[body]' id='post_body'>\nBack to the hill and over it again!</textarea><br/>" \
+      "<label for='secret'>Secret:</label> <input name='post[secret]' type='hidden' value='0' /><input name='post[secret]' checked='checked' type='checkbox' value='1' id='post_secret' /><br/>"
     end
 
     assert_dom_equal expected, output_buffer
@@ -1961,9 +1998,9 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      "<label for='title'>Title:</label> <input name='post[title]' type='text' value='Hello World' /><br/>" \
-      "<label for='body'>Body:</label> <textarea name='post[body]'>\nBack to the hill and over it again!</textarea><br/>" \
-      "<label for='secret'>Secret:</label> <input name='post[secret]' type='hidden' value='0' /><input name='post[secret]' checked='checked' type='checkbox' value='1' /><br/>"
+      "<label for='title'>Title:</label> <input name='post[title]' type='text' value='Hello World' id='post_title' /><br/>" \
+      "<label for='body'>Body:</label> <textarea name='post[body]' id='post_body'>\nBack to the hill and over it again!</textarea><br/>" \
+      "<label for='secret'>Secret:</label> <input name='post[secret]' type='hidden' value='0' /><input name='post[secret]' checked='checked' type='checkbox' value='1' id='post_secret' /><br/>"
     end
 
     assert_dom_equal expected, output_buffer
@@ -1980,7 +2017,7 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected = whole_form("/posts/123", method: "patch") do
-      "<label for='title'>Title:</label> <input name='post[title]' type='text' value='Hello World' /><br/>"
+      "<label for='title'>Title:</label> <input name='post[title]' type='text' value='Hello World' id='post_title' /><br/>"
     end
 
     assert_dom_equal expected, output_buffer
@@ -1995,7 +2032,7 @@ class FormWithActsLikeFormForTest < FormWithTest
       concat f.text_field(:title)
     end
 
-    expected = "<label for='title'>Title:</label> <input name='post[title]' type='text' value='Hello World' /><br/>"
+    expected = "<label for='title'>Title:</label> <input name='post[title]' type='text' value='Hello World' id='post_title' /><br/>"
 
     assert_dom_equal expected, output_buffer
   end
@@ -2007,7 +2044,7 @@ class FormWithActsLikeFormForTest < FormWithTest
       concat f.text_field(:title)
     end
 
-    expected = "<label for='title'>Title:</label> <input name='post[title]' type='text' value='Hello World' /><br/>"
+    expected = "<label for='title'>Title:</label> <input name='post[title]' type='text' value='Hello World' id='post_title' /><br/>"
 
     assert_dom_equal expected, output_buffer
   end
@@ -2020,9 +2057,9 @@ class FormWithActsLikeFormForTest < FormWithTest
     end
 
     expected =
-      "<label for='title'>Title:</label> <input name='post[title]' type='text' value='Hello World' /><br/>" \
-      "<label for='body'>Body:</label> <textarea name='post[body]'>\nBack to the hill and over it again!</textarea><br/>" \
-      "<label for='secret'>Secret:</label> <input name='post[secret]' type='hidden' value='0' /><input name='post[secret]' checked='checked' type='checkbox' value='1' /><br/>"
+      "<label for='title'>Title:</label> <input name='post[title]' type='text' value='Hello World' id='post_title'/><br/>" \
+      "<label for='body'>Body:</label> <textarea name='post[body]' id='post_body'>\nBack to the hill and over it again!</textarea><br/>" \
+      "<label for='secret'>Secret:</label> <input name='post[secret]' type='hidden' value='0' /><input name='post[secret]' checked='checked' type='checkbox' value='1' id='post_secret' /><br/>"
 
     assert_dom_equal expected, output_buffer
   end
diff --git a/actionview/test/template/form_helper_test.rb b/actionview/test/template/form_helper_test.rb
index ac64096908..e7b249cc9c 100644
--- a/actionview/test/template/form_helper_test.rb
+++ b/actionview/test/template/form_helper_test.rb
@@ -105,7 +105,7 @@ class FormHelperTest < ActionView::TestCase
 
     @post = Post.new
     @comment = Comment.new
-    def @post.errors()
+    def @post.errors
       Class.new {
         def [](field); field == "author_name" ? ["can't be empty"] : [] end
         def empty?() false end
@@ -1560,6 +1560,38 @@ class FormHelperTest < ActionView::TestCase
     assert_dom_equal expected, output_buffer
   end
 
+  def test_form_for_is_not_affected_by_form_with_generates_ids
+    old_value = ActionView::Helpers::FormHelper.form_with_generates_ids
+    ActionView::Helpers::FormHelper.form_with_generates_ids = false
+
+    form_for(@post, html: { id: "create-post" }) do |f|
+      concat f.label(:title) { "The Title" }
+      concat f.text_field(:title)
+      concat f.text_area(:body)
+      concat f.check_box(:secret)
+      concat f.submit("Create post")
+      concat f.button("Create post")
+      concat f.button {
+        concat content_tag(:span, "Create post")
+      }
+    end
+
+    expected = whole_form("/posts/123", "create-post", "edit_post", method: "patch") do
+      "<label for='post_title'>The Title</label>" \
+      "<input name='post[title]' type='text' id='post_title' value='Hello World' />" \
+      "<textarea name='post[body]' id='post_body'>\nBack to the hill and over it again!</textarea>" \
+      "<input name='post[secret]' type='hidden' value='0' />" \
+      "<input name='post[secret]' checked='checked' type='checkbox' id='post_secret' value='1' />" \
+      "<input name='commit' data-disable-with='Create post' type='submit' value='Create post' />" \
+      "<button name='button' type='submit'>Create post</button>" \
+      "<button name='button' type='submit'><span>Create post</span></button>"
+    end
+
+    assert_dom_equal expected, output_buffer
+  ensure
+    ActionView::Helpers::FormHelper.form_with_generates_ids = old_value
+  end
+
   def test_form_for_with_collection_radio_buttons
     post = Post.new
     def post.active; false; end
diff --git a/activejob/CHANGELOG.md b/activejob/CHANGELOG.md
index 0c69a5c663..4453f845f4 100644
--- a/activejob/CHANGELOG.md
+++ b/activejob/CHANGELOG.md
@@ -1,3 +1,10 @@
+## Rails 5.2.0.beta2 (November 28, 2017) ##
+
+*   No changes.
+
+
+## Rails 5.2.0.beta1 (November 27, 2017) ##
+
 *   Support redis-rb 4.0.
 
     *Jeremy Daer*
diff --git a/activejob/README.md b/activejob/README.md
index 8a9a23929b..f1ebb76e08 100644
--- a/activejob/README.md
+++ b/activejob/README.md
@@ -100,7 +100,7 @@ The latest version of Active Job can be installed with RubyGems:
   $ gem install activejob
 ```
 
-Source code can be downloaded as part of the Rails project on GitHub
+Source code can be downloaded as part of the Rails project on GitHub:
 
 * https://github.com/rails/rails/tree/master/activejob
 
@@ -117,7 +117,7 @@ API documentation is at:
 
 * http://api.rubyonrails.org
 
-Bug reports can be filed for the Ruby on Rails project here:
+Bug reports for the Ruby on Rails project can be filed here:
 
 * https://github.com/rails/rails/issues
 
diff --git a/activejob/lib/active_job/gem_version.rb b/activejob/lib/active_job/gem_version.rb
index 7ee61780e1..49dfd4095e 100644
--- a/activejob/lib/active_job/gem_version.rb
+++ b/activejob/lib/active_job/gem_version.rb
@@ -10,7 +10,7 @@ module ActiveJob
     MAJOR = 5
     MINOR = 2
     TINY  = 0
-    PRE   = "alpha"
+    PRE   = "beta2"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end
diff --git a/activejob/lib/active_job/queue_adapters/delayed_job_adapter.rb b/activejob/lib/active_job/queue_adapters/delayed_job_adapter.rb
index 1978179948..8eeef32b99 100644
--- a/activejob/lib/active_job/queue_adapters/delayed_job_adapter.rb
+++ b/activejob/lib/active_job/queue_adapters/delayed_job_adapter.rb
@@ -34,6 +34,10 @@ module ActiveJob
           @job_data = job_data
         end
 
+        def display_name
+          "#{job_data['job_class']} [#{job_data['job_id']}] from DelayedJob(#{job_data['queue_name']}) with arguments: #{job_data['arguments']}"
+        end
+
         def perform
           Base.execute(job_data)
         end
diff --git a/activejob/test/integration/queuing_test.rb b/activejob/test/integration/queuing_test.rb
index 0d8aa336a6..32ef485c45 100644
--- a/activejob/test/integration/queuing_test.rb
+++ b/activejob/test/integration/queuing_test.rb
@@ -45,6 +45,13 @@ class QueuingTest < ActiveSupport::TestCase
     end
   end
 
+  test "should supply a wrapped class name to DelayedJob" do
+    skip unless adapter_is?(:delayed_job)
+    ::HelloJob.perform_later
+    job = Delayed::Job.first
+    assert_match(/HelloJob \[[0-9a-f-]+\] from DelayedJob\(default\) with arguments: \[\]/, job.name)
+  end
+
   test "resque JobWrapper should have instance variable queue" do
     skip unless adapter_is?(:resque)
     job = ::HelloJob.set(wait: 5.seconds).perform_later
diff --git a/activemodel/CHANGELOG.md b/activemodel/CHANGELOG.md
index 794744c646..2dfde11707 100644
--- a/activemodel/CHANGELOG.md
+++ b/activemodel/CHANGELOG.md
@@ -1,3 +1,10 @@
+## Rails 5.2.0.beta2 (November 28, 2017) ##
+
+*   No changes.
+
+
+## Rails 5.2.0.beta1 (November 27, 2017) ##
+
 *   Execute `ConfirmationValidator` validation when `_confirmation`'s value is `false`.
 
     *bogdanvlviv*
diff --git a/activemodel/README.rdoc b/activemodel/README.rdoc
index 772df0f8f6..1aaf4813ea 100644
--- a/activemodel/README.rdoc
+++ b/activemodel/README.rdoc
@@ -251,11 +251,11 @@ Active Model is released under the MIT license:
 
 == Support
 
-API documentation is at
+API documentation is at:
 
 * http://api.rubyonrails.org
 
-Bug reports can be filed for the Ruby on Rails project here:
+Bug reports for the Ruby on Rails project can be filed here:
 
 * https://github.com/rails/rails/issues
 
diff --git a/activemodel/lib/active_model/attribute_set.rb b/activemodel/lib/active_model/attribute_set.rb
index a892accbc6..54a5dd4064 100644
--- a/activemodel/lib/active_model/attribute_set.rb
+++ b/activemodel/lib/active_model/attribute_set.rb
@@ -5,7 +5,7 @@ require "active_model/attribute_set/yaml_encoder"
 
 module ActiveModel
   class AttributeSet # :nodoc:
-    delegate :each_value, :fetch, to: :attributes
+    delegate :each_value, :fetch, :except, to: :attributes
 
     def initialize(attributes)
       @attributes = attributes
diff --git a/activemodel/lib/active_model/attribute_set/builder.rb b/activemodel/lib/active_model/attribute_set/builder.rb
index f94f47370f..758eb830fc 100644
--- a/activemodel/lib/active_model/attribute_set/builder.rb
+++ b/activemodel/lib/active_model/attribute_set/builder.rb
@@ -5,35 +5,30 @@ require "active_model/attribute"
 module ActiveModel
   class AttributeSet # :nodoc:
     class Builder # :nodoc:
-      attr_reader :types, :always_initialized, :default
+      attr_reader :types, :default_attributes
 
-      def initialize(types, always_initialized = nil, &default)
+      def initialize(types, default_attributes = {})
         @types = types
-        @always_initialized = always_initialized
-        @default = default
+        @default_attributes = default_attributes
       end
 
       def build_from_database(values = {}, additional_types = {})
-        if always_initialized && !values.key?(always_initialized)
-          values[always_initialized] = nil
-        end
-
-        attributes = LazyAttributeHash.new(types, values, additional_types, &default)
+        attributes = LazyAttributeHash.new(types, values, additional_types, default_attributes)
         AttributeSet.new(attributes)
       end
     end
   end
 
   class LazyAttributeHash # :nodoc:
-    delegate :transform_values, :each_key, :each_value, :fetch, to: :materialize
+    delegate :transform_values, :each_key, :each_value, :fetch, :except, to: :materialize
 
-    def initialize(types, values, additional_types, &default)
+    def initialize(types, values, additional_types, default_attributes)
       @types = types
       @values = values
       @additional_types = additional_types
       @materialized = false
       @delegate_hash = {}
-      @default = default || proc {}
+      @default_attributes = default_attributes
     end
 
     def key?(key)
@@ -94,7 +89,7 @@ module ActiveModel
 
     protected
 
-      attr_reader :types, :values, :additional_types, :delegate_hash, :default
+      attr_reader :types, :values, :additional_types, :delegate_hash, :default_attributes
 
       def materialize
         unless @materialized
@@ -117,7 +112,12 @@ module ActiveModel
         if value_present
           delegate_hash[name] = Attribute.from_database(name, value, type)
         elsif types.key?(name)
-          delegate_hash[name] = default.call(name) || Attribute.uninitialized(name, type)
+          attr = default_attributes[name]
+          if attr
+            delegate_hash[name] = attr.dup
+          else
+            delegate_hash[name] = Attribute.uninitialized(name, type)
+          end
         end
       end
   end
diff --git a/activemodel/lib/active_model/gem_version.rb b/activemodel/lib/active_model/gem_version.rb
index 39269c159c..3c344fe854 100644
--- a/activemodel/lib/active_model/gem_version.rb
+++ b/activemodel/lib/active_model/gem_version.rb
@@ -10,7 +10,7 @@ module ActiveModel
     MAJOR = 5
     MINOR = 2
     TINY  = 0
-    PRE   = "alpha"
+    PRE   = "beta2"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end
diff --git a/activemodel/test/cases/attribute_set_test.rb b/activemodel/test/cases/attribute_set_test.rb
index 02c44c5d45..6e522d6c80 100644
--- a/activemodel/test/cases/attribute_set_test.rb
+++ b/activemodel/test/cases/attribute_set_test.rb
@@ -163,7 +163,8 @@ module ActiveModel
     end
 
     test "the primary_key is always initialized" do
-      builder = AttributeSet::Builder.new({ foo: Type::Integer.new }, :foo)
+      defaults = { foo: Attribute.from_user(:foo, nil, nil) }
+      builder = AttributeSet::Builder.new({ foo: Type::Integer.new }, defaults)
       attributes = builder.build_from_database
 
       assert attributes.key?(:foo)
diff --git a/activerecord/CHANGELOG.md b/activerecord/CHANGELOG.md
index 217eada1d7..60ceffac5e 100644
--- a/activerecord/CHANGELOG.md
+++ b/activerecord/CHANGELOG.md
@@ -1,3 +1,22 @@
+*   Don't allow scopes to be defined which conflict with instance methods on `Relation`.
+
+    Fixes #31120.
+
+    *kinnrot*
+
+
+## Rails 5.2.0.beta2 (November 28, 2017) ##
+
+*   No changes.
+
+
+## Rails 5.2.0.beta1 (November 27, 2017) ##
+
+*   Add new error class `QueryCanceled` which will be raised
+    when canceling statement due to user request.
+
+    *Ryuta Kamizono*
+
 *   Add `#up_only` to database migrations for code that is only relevant when
     migrating up, e.g. populating a new column.
 
@@ -190,7 +209,7 @@
 
     *Jeremy Green*
 
-*   Add new error class `TransactionTimeout` which will be raised
+*   Add new error class `LockWaitTimeout` which will be raised
     when lock wait timeout exceeded.
 
     *Gabriel Courtemanche*
diff --git a/activerecord/README.rdoc b/activerecord/README.rdoc
index ba83a9adb2..19650b82ae 100644
--- a/activerecord/README.rdoc
+++ b/activerecord/README.rdoc
@@ -208,7 +208,7 @@ API documentation is at:
 
 * http://api.rubyonrails.org
 
-Bug reports can be filed for the Ruby on Rails project here:
+Bug reports for the Ruby on Rails project can be filed here:
 
 * https://github.com/rails/rails/issues
 
diff --git a/activerecord/lib/active_record/associations/collection_association.rb b/activerecord/lib/active_record/associations/collection_association.rb
index ed215fb22c..921237a735 100644
--- a/activerecord/lib/active_record/associations/collection_association.rb
+++ b/activerecord/lib/active_record/associations/collection_association.rb
@@ -79,7 +79,13 @@ module ActiveRecord
       def find(*args)
         if options[:inverse_of] && loaded?
           args_flatten = args.flatten
-          raise RecordNotFound, "Couldn't find #{scope.klass.name} without an ID" if args_flatten.blank?
+          model = scope.klass
+
+          if args_flatten.blank?
+            error_message = "Couldn't find #{model.name} without an ID"
+            raise RecordNotFound.new(error_message, model.name, model.primary_key, args)
+          end
+
           result = find_by_scan(*args)
 
           result_size = Array(result).size
diff --git a/activerecord/lib/active_record/autosave_association.rb b/activerecord/lib/active_record/autosave_association.rb
index 6974cf74f6..a1250c3835 100644
--- a/activerecord/lib/active_record/autosave_association.rb
+++ b/activerecord/lib/active_record/autosave_association.rb
@@ -436,6 +436,9 @@ module ActiveRecord
             if (autosave && record.changed_for_autosave?) || new_record? || record_changed?(reflection, record, key)
               unless reflection.through_reflection
                 record[reflection.foreign_key] = key
+                if inverse_reflection = reflection.inverse_of
+                  record.association(inverse_reflection.name).loaded!
+                end
               end
 
               saved = record.save(validate: !autosave)
diff --git a/activerecord/lib/active_record/connection_adapters/abstract/connection_pool.rb b/activerecord/lib/active_record/connection_adapters/abstract/connection_pool.rb
index 6c06f67239..9849f9d5d7 100644
--- a/activerecord/lib/active_record/connection_adapters/abstract/connection_pool.rb
+++ b/activerecord/lib/active_record/connection_adapters/abstract/connection_pool.rb
@@ -63,15 +63,13 @@ module ActiveRecord
     # There are several connection-pooling-related options that you can add to
     # your database connection configuration:
     #
-    # * +pool+: number indicating size of connection pool (default 5)
-    # * +checkout_timeout+: number of seconds to block and wait for a connection
-    #   before giving up and raising a timeout error (default 5 seconds).
-    # * +reaping_frequency+: frequency in seconds to periodically run the
-    #   Reaper, which attempts to find and recover connections from dead
-    #   threads, which can occur if a programmer forgets to close a
-    #   connection at the end of a thread or a thread dies unexpectedly.
-    #   Regardless of this setting, the Reaper will be invoked before every
-    #   blocking wait. (Default +nil+, which means don't schedule the Reaper).
+    # * +pool+: maximum number of connections the pool may manage (default 5).
+    # * +idle_timeout+: number of seconds that a connection will be kept
+    #   unused in the pool before it is automatically disconnected (default
+    #   300 seconds). Set this to zero to keep connections forever.
+    # * +checkout_timeout+: number of seconds to wait for a connection to
+    #   become available before giving up and raising a timeout error (default
+    #   5 seconds).
     #
     #--
     # Synchronization policy:
@@ -280,12 +278,12 @@ module ActiveRecord
           end
       end
 
-      # Every +frequency+ seconds, the reaper will call +reap+ on +pool+.
-      # A reaper instantiated with a +nil+ frequency will never reap the
-      # connection pool.
+      # Every +frequency+ seconds, the reaper will call +reap+ and +flush+ on
+      # +pool+. A reaper instantiated with a zero frequency will never reap
+      # the connection pool.
       #
-      # Configure the frequency by setting "reaping_frequency" in your
-      # database yaml file.
+      # Configure the frequency by setting +reaping_frequency+ in your database
+      # yaml file (default 60 seconds).
       class Reaper
         attr_reader :pool, :frequency
 
@@ -295,11 +293,12 @@ module ActiveRecord
         end
 
         def run
-          return unless frequency
+          return unless frequency && frequency > 0
           Thread.new(frequency, pool) { |t, p|
             loop do
               sleep t
               p.reap
+              p.flush
             end
           }
         end
@@ -323,6 +322,10 @@ module ActiveRecord
         @spec = spec
 
         @checkout_timeout = (spec.config[:checkout_timeout] && spec.config[:checkout_timeout].to_f) || 5
+        if @idle_timeout = spec.config.fetch(:idle_timeout, 300)
+          @idle_timeout = @idle_timeout.to_f
+          @idle_timeout = nil if @idle_timeout <= 0
+        end
 
         # default max pool size to 5
         @size = (spec.config[:pool] && spec.config[:pool].to_i) || 5
@@ -353,7 +356,10 @@ module ActiveRecord
 
         @lock_thread = false
 
-        @reaper = Reaper.new(self, spec.config[:reaping_frequency] && spec.config[:reaping_frequency].to_f)
+        # +reaping_frequency+ is configurable mostly for historical reasons, but it could
+        # also be useful if someone wants a very low +idle_timeout+.
+        reaping_frequency = spec.config.fetch(:reaping_frequency, 60)
+        @reaper = Reaper.new(self, reaping_frequency && reaping_frequency.to_f)
         @reaper.run
       end
 
@@ -447,6 +453,21 @@ module ActiveRecord
         disconnect(false)
       end
 
+      # Discards all connections in the pool (even if they're currently
+      # leased!), along with the pool itself. Any further interaction with the
+      # pool (except #spec and #schema_cache) is undefined.
+      #
+      # See AbstractAdapter#discard!
+      def discard! # :nodoc:
+        synchronize do
+          return if @connections.nil? # already discarded
+          @connections.each do |conn|
+            conn.discard!
+          end
+          @connections = @available = @thread_cached_conns = nil
+        end
+      end
+
       # Clears the cache which maps classes and re-connects connections that
       # require reloading.
       #
@@ -572,6 +593,35 @@ module ActiveRecord
         end
       end
 
+      # Disconnect all connections that have been idle for at least
+      # +minimum_idle+ seconds. Connections currently checked out, or that were
+      # checked in less than +minimum_idle+ seconds ago, are unaffected.
+      def flush(minimum_idle = @idle_timeout)
+        return if minimum_idle.nil?
+
+        idle_connections = synchronize do
+          @connections.select do |conn|
+            !conn.in_use? && conn.seconds_idle >= minimum_idle
+          end.each do |conn|
+            conn.lease
+
+            @available.delete conn
+            @connections.delete conn
+          end
+        end
+
+        idle_connections.each do |conn|
+          conn.disconnect!
+        end
+      end
+
+      # Disconnect all currently idle connections. Connections currently checked
+      # out are unaffected.
+      def flush!
+        reap
+        flush(-1)
+      end
+
       def num_waiting_in_queue # :nodoc:
         @available.num_waiting
       end
@@ -863,11 +913,31 @@ module ActiveRecord
     # about the model. The model needs to pass a specification name to the handler,
     # in order to look up the correct connection pool.
     class ConnectionHandler
+      def self.unowned_pool_finalizer(pid_map) # :nodoc:
+        lambda do |_|
+          discard_unowned_pools(pid_map)
+        end
+      end
+
+      def self.discard_unowned_pools(pid_map) # :nodoc:
+        pid_map.each do |pid, pools|
+          pools.values.compact.each(&:discard!) unless pid == Process.pid
+        end
+      end
+
       def initialize
         # These caches are keyed by spec.name (ConnectionSpecification#name).
         @owner_to_pool = Concurrent::Map.new(initial_capacity: 2) do |h, k|
+          # Discard the parent's connection pools immediately; we have no need
+          # of them
+          ConnectionHandler.discard_unowned_pools(h)
+
           h[k] = Concurrent::Map.new(initial_capacity: 2)
         end
+
+        # Backup finalizer: if the forked child never needed a pool, the above
+        # early discard has not occurred
+        ObjectSpace.define_finalizer self, ConnectionHandler.unowned_pool_finalizer(@owner_to_pool)
       end
 
       def connection_pool_list
@@ -921,6 +991,13 @@ module ActiveRecord
         connection_pool_list.each(&:disconnect!)
       end
 
+      # Disconnects all currently idle connections.
+      #
+      # See ConnectionPool#flush! for details.
+      def flush_idle_connections!
+        connection_pool_list.each(&:flush!)
+      end
+
       # Locate the connection of the nearest super class. This can be an
       # active or defined connection: if it is the latter, it will be
       # opened and set as the active connection for the class it was defined
diff --git a/activerecord/lib/active_record/connection_adapters/abstract_adapter.rb b/activerecord/lib/active_record/connection_adapters/abstract_adapter.rb
index 7e6db860dd..8993c517a6 100644
--- a/activerecord/lib/active_record/connection_adapters/abstract_adapter.rb
+++ b/activerecord/lib/active_record/connection_adapters/abstract_adapter.rb
@@ -105,6 +105,7 @@ module ActiveRecord
         @logger              = logger
         @config              = config
         @pool                = nil
+        @idle_since          = Concurrent.monotonic_time
         @schema_cache        = SchemaCache.new self
         @quoted_column_names, @quoted_table_names = {}, {}
         @visitor = arel_visitor
@@ -164,6 +165,7 @@ module ActiveRecord
               "Current thread: #{Thread.current}."
           end
 
+          @idle_since = Concurrent.monotonic_time
           @owner = nil
         else
           raise ActiveRecordError, "Cannot expire connection, it is not currently leased."
@@ -183,6 +185,12 @@ module ActiveRecord
         end
       end
 
+      # Seconds since this connection was returned to the pool
+      def seconds_idle # :nodoc:
+        return 0 if in_use?
+        Concurrent.monotonic_time - @idle_since
+      end
+
       def unprepared_statement
         old_prepared_statements, @prepared_statements = @prepared_statements, false
         yield
@@ -367,6 +375,19 @@ module ActiveRecord
         reset_transaction
       end
 
+      # Immediately forget this connection ever existed. Unlike disconnect!,
+      # this will not communicate with the server.
+      #
+      # After calling this method, the behavior of all other methods becomes
+      # undefined. This is called internally just before a forked process gets
+      # rid of a connection that belonged to its parent.
+      def discard!
+        # This should be overridden by concrete adapters.
+        #
+        # Prevent @connection's finalizer from touching the socket, or
+        # otherwise communicating with its server, when it is collected.
+      end
+
       # Reset the state of this connection, directing the DBMS to clear
       # transactions and other connection-related server-side state. Usually a
       # database-dependent operation.
diff --git a/activerecord/lib/active_record/connection_adapters/abstract_mysql_adapter.rb b/activerecord/lib/active_record/connection_adapters/abstract_mysql_adapter.rb
index ca651ef390..ede8a9c1e2 100644
--- a/activerecord/lib/active_record/connection_adapters/abstract_mysql_adapter.rb
+++ b/activerecord/lib/active_record/connection_adapters/abstract_mysql_adapter.rb
@@ -44,7 +44,7 @@ module ActiveRecord
         json:        { name: "json" },
       }
 
-      class StatementPool < ConnectionAdapters::StatementPool
+      class StatementPool < ConnectionAdapters::StatementPool # :nodoc:
         private def dealloc(stmt)
           stmt[:stmt].close
         end
@@ -635,6 +635,7 @@ module ActiveRecord
         ER_CANNOT_ADD_FOREIGN   = 1215
         ER_CANNOT_CREATE_TABLE  = 1005
         ER_LOCK_WAIT_TIMEOUT    = 1205
+        ER_QUERY_INTERRUPTED    = 1317
         ER_QUERY_TIMEOUT        = 3024
 
         def translate_exception(exception, message)
@@ -660,9 +661,11 @@ module ActiveRecord
           when ER_LOCK_DEADLOCK
             Deadlocked.new(message)
           when ER_LOCK_WAIT_TIMEOUT
-            TransactionTimeout.new(message)
+            LockWaitTimeout.new(message)
           when ER_QUERY_TIMEOUT
             StatementTimeout.new(message)
+          when ER_QUERY_INTERRUPTED
+            QueryCanceled.new(message)
           else
             super
           end
diff --git a/activerecord/lib/active_record/connection_adapters/mysql2_adapter.rb b/activerecord/lib/active_record/connection_adapters/mysql2_adapter.rb
index 8de582fee1..bfdc7995f0 100644
--- a/activerecord/lib/active_record/connection_adapters/mysql2_adapter.rb
+++ b/activerecord/lib/active_record/connection_adapters/mysql2_adapter.rb
@@ -3,9 +3,8 @@
 require "active_record/connection_adapters/abstract_mysql_adapter"
 require "active_record/connection_adapters/mysql/database_statements"
 
-gem "mysql2", ">= 0.3.18", "< 0.5"
+gem "mysql2", "~> 0.4.4"
 require "mysql2"
-raise "mysql2 0.4.3 is not supported. Please upgrade to 0.4.4+" if Mysql2::VERSION == "0.4.3"
 
 module ActiveRecord
   module ConnectionHandling # :nodoc:
@@ -105,6 +104,11 @@ module ActiveRecord
         @connection.close
       end
 
+      def discard! # :nodoc:
+        @connection.automatic_close = false
+        @connection = nil
+      end
+
       private
 
         def connect
diff --git a/activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb b/activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb
index 5ce6765dd8..27011bfe92 100644
--- a/activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb
+++ b/activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb
@@ -166,7 +166,7 @@ module ActiveRecord
         { concurrently: "CONCURRENTLY" }
       end
 
-      class StatementPool < ConnectionAdapters::StatementPool
+      class StatementPool < ConnectionAdapters::StatementPool # :nodoc:
         def initialize(connection, max)
           super(max)
           @connection = connection
@@ -182,7 +182,6 @@ module ActiveRecord
         end
 
         private
-
           def dealloc(key)
             @connection.query "DEALLOCATE #{key}" if connection_active?
           rescue PG::Error
@@ -273,6 +272,11 @@ module ActiveRecord
         end
       end
 
+      def discard! # :nodoc:
+        @connection.socket_io.reopen(IO::NULL)
+        @connection = nil
+      end
+
       def native_database_types #:nodoc:
         NATIVE_DATABASE_TYPES
       end
@@ -413,9 +417,9 @@ module ActiveRecord
           when DEADLOCK_DETECTED
             Deadlocked.new(message)
           when LOCK_NOT_AVAILABLE
-            TransactionTimeout.new(message)
+            LockWaitTimeout.new(message)
           when QUERY_CANCELED
-            StatementTimeout.new(message)
+            QueryCanceled.new(message)
           else
             super
           end
diff --git a/activerecord/lib/active_record/connection_adapters/sqlite3_adapter.rb b/activerecord/lib/active_record/connection_adapters/sqlite3_adapter.rb
index 670afa3684..daece2bffd 100644
--- a/activerecord/lib/active_record/connection_adapters/sqlite3_adapter.rb
+++ b/activerecord/lib/active_record/connection_adapters/sqlite3_adapter.rb
@@ -90,9 +90,8 @@ module ActiveRecord
       #   Rails.application.config.active_record.sqlite3.represent_boolean_as_integer = true
       class_attribute :represent_boolean_as_integer, default: false
 
-      class StatementPool < ConnectionAdapters::StatementPool
+      class StatementPool < ConnectionAdapters::StatementPool # :nodoc:
         private
-
           def dealloc(stmt)
             stmt[:stmt].close unless stmt[:stmt].closed?
           end
diff --git a/activerecord/lib/active_record/connection_handling.rb b/activerecord/lib/active_record/connection_handling.rb
index 9a47edfba4..88d28dc52a 100644
--- a/activerecord/lib/active_record/connection_handling.rb
+++ b/activerecord/lib/active_record/connection_handling.rb
@@ -140,6 +140,6 @@ module ActiveRecord
     end
 
     delegate :clear_active_connections!, :clear_reloadable_connections!,
-      :clear_all_connections!, to: :connection_handler
+      :clear_all_connections!, :flush_idle_connections!, to: :connection_handler
   end
 end
diff --git a/activerecord/lib/active_record/enum.rb b/activerecord/lib/active_record/enum.rb
index f373b98035..1a3e6e4d09 100644
--- a/activerecord/lib/active_record/enum.rb
+++ b/activerecord/lib/active_record/enum.rb
@@ -221,6 +221,8 @@ module ActiveRecord
       def detect_enum_conflict!(enum_name, method_name, klass_method = false)
         if klass_method && dangerous_class_method?(method_name)
           raise_conflict_error(enum_name, method_name, type: "class")
+        elsif klass_method && method_defined_within?(method_name, Relation)
+          raise_conflict_error(enum_name, method_name, type: "class", source: Relation.name)
         elsif !klass_method && dangerous_attribute_method?(method_name)
           raise_conflict_error(enum_name, method_name)
         elsif !klass_method && method_defined_within?(method_name, _enum_methods_module, Module)
diff --git a/activerecord/lib/active_record/errors.rb b/activerecord/lib/active_record/errors.rb
index 7382879fce..efcbd44776 100644
--- a/activerecord/lib/active_record/errors.rb
+++ b/activerecord/lib/active_record/errors.rb
@@ -335,14 +335,18 @@ module ActiveRecord
   class IrreversibleOrderError < ActiveRecordError
   end
 
-  # TransactionTimeout will be raised when lock wait timeout exceeded.
-  class TransactionTimeout < StatementInvalid
+  # LockWaitTimeout will be raised when lock wait timeout exceeded.
+  class LockWaitTimeout < StatementInvalid
   end
 
   # StatementTimeout will be raised when statement timeout exceeded.
   class StatementTimeout < StatementInvalid
   end
 
+  # QueryCanceled will be raised when canceling statement due to user request.
+  class QueryCanceled < StatementInvalid
+  end
+
   # UnknownAttributeReference is raised when an unknown and potentially unsafe
   # value is passed to a query method when allow_unsafe_raw_sql is set to
   # :disabled. For example, passing a non column name value to a relation's
diff --git a/activerecord/lib/active_record/gem_version.rb b/activerecord/lib/active_record/gem_version.rb
index 7ccb57b305..7e47dac016 100644
--- a/activerecord/lib/active_record/gem_version.rb
+++ b/activerecord/lib/active_record/gem_version.rb
@@ -10,7 +10,7 @@ module ActiveRecord
     MAJOR = 5
     MINOR = 2
     TINY  = 0
-    PRE   = "alpha"
+    PRE   = "beta2"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end
diff --git a/activerecord/lib/active_record/migration.rb b/activerecord/lib/active_record/migration.rb
index 360bf25a8c..15e9c09ffb 100644
--- a/activerecord/lib/active_record/migration.rb
+++ b/activerecord/lib/active_record/migration.rb
@@ -737,8 +737,8 @@ module ActiveRecord
     # Used to specify an operation that is only run when migrating up
     # (for example, populating a new column with its initial values).
     #
-    # In the following example, the new column `published` will be given
-    # the value `true` for all existing records.
+    # In the following example, the new column +published+ will be given
+    # the value +true+ for all existing records.
     #
     #    class AddPublishedToPosts < ActiveRecord::Migration[5.2]
     #      def change
diff --git a/activerecord/lib/active_record/migration/command_recorder.rb b/activerecord/lib/active_record/migration/command_recorder.rb
index ac7d506fd1..81ef4828f8 100644
--- a/activerecord/lib/active_record/migration/command_recorder.rb
+++ b/activerecord/lib/active_record/migration/command_recorder.rb
@@ -110,7 +110,7 @@ module ActiveRecord
 
       private
 
-        module StraightReversions
+        module StraightReversions # :nodoc:
           private
             { transaction:       :transaction,
               execute_block:     :execute_block,
diff --git a/activerecord/lib/active_record/model_schema.rb b/activerecord/lib/active_record/model_schema.rb
index 12ee4a4137..1941d3d5ea 100644
--- a/activerecord/lib/active_record/model_schema.rb
+++ b/activerecord/lib/active_record/model_schema.rb
@@ -323,11 +323,11 @@ module ActiveRecord
       end
 
       def attributes_builder # :nodoc:
-        @attributes_builder ||= ActiveModel::AttributeSet::Builder.new(attribute_types, primary_key) do |name|
-          unless columns_hash.key?(name)
-            _default_attributes[name].dup
-          end
+        unless defined?(@attributes_builder) && @attributes_builder
+          defaults = _default_attributes.except(*(column_names - [primary_key]))
+          @attributes_builder = ActiveModel::AttributeSet::Builder.new(attribute_types, defaults)
         end
+        @attributes_builder
       end
 
       def columns_hash # :nodoc:
diff --git a/activerecord/lib/active_record/railtie.rb b/activerecord/lib/active_record/railtie.rb
index 812e1d7a00..9ee8425e1b 100644
--- a/activerecord/lib/active_record/railtie.rb
+++ b/activerecord/lib/active_record/railtie.rb
@@ -177,7 +177,16 @@ end_warning
     initializer "active_record.clear_active_connections" do
       config.after_initialize do
         ActiveSupport.on_load(:active_record) do
+          # Ideally the application doesn't connect to the database during boot,
+          # but sometimes it does. In case it did, we want to empty out the
+          # connection pools so that a non-database-using process (e.g. a master
+          # process in a forking server model) doesn't retain a needless
+          # connection. If it was needed, the incremental cost of reestablishing
+          # this connection is trivial: the rest of the pool would need to be
+          # populated anyway.
+
           clear_active_connections!
+          flush_idle_connections!
         end
       end
     end
diff --git a/activerecord/lib/active_record/relation/finder_methods.rb b/activerecord/lib/active_record/relation/finder_methods.rb
index 706fd57704..ff06ecbee1 100644
--- a/activerecord/lib/active_record/relation/finder_methods.rb
+++ b/activerecord/lib/active_record/relation/finder_methods.rb
@@ -18,9 +18,10 @@ module ActiveRecord
     #   Person.find([1])        # returns an array for the object with ID = 1
     #   Person.where("administrator = 1").order("created_on DESC").find(1)
     #
-    # NOTE: The returned records may not be in the same order as the ids you
-    # provide since database rows are unordered. You will need to provide an explicit QueryMethods#order
-    # option if you want the results to be sorted.
+    # NOTE: The returned records are in the same order as the ids you provide.
+    # If you want the results to be sorted by database, you can use ActiveRecord::QueryMethods#where
+    # method and provide an explicit ActiveRecord::QueryMethods#order option.
+    # But ActiveRecord::QueryMethods#where method doesn't raise ActiveRecord::RecordNotFound.
     #
     # ==== Find with lock
     #
@@ -88,7 +89,7 @@ module ActiveRecord
       where(arg, *args).take!
     rescue ::RangeError
       raise RecordNotFound.new("Couldn't find #{@klass.name} with an out of range value",
-                               @klass.name)
+                               @klass.name, @klass.primary_key)
     end
 
     # Gives a record (or N records if a parameter is supplied) without any implied
@@ -339,7 +340,7 @@ module ActiveRecord
       if ids.nil?
         error = "Couldn't find #{name}".dup
         error << " with#{conditions}" if conditions
-        raise RecordNotFound.new(error, name)
+        raise RecordNotFound.new(error, name, key)
       elsif Array(ids).size == 1
         error = "Couldn't find #{name} with '#{key}'=#{ids}#{conditions}"
         raise RecordNotFound.new(error, name, key, ids)
@@ -347,7 +348,7 @@ module ActiveRecord
         error = "Couldn't find all #{name.pluralize} with '#{key}': ".dup
         error << "(#{ids.join(", ")})#{conditions} (found #{result_size} results, but was looking for #{expected_size})."
         error << " Couldn't find #{name.pluralize(not_found_ids.size)} with #{key.to_s.pluralize(not_found_ids.size)} #{not_found_ids.join(', ')}." if not_found_ids
-        raise RecordNotFound.new(error, name, primary_key, ids)
+        raise RecordNotFound.new(error, name, key, ids)
       end
     end
 
@@ -433,9 +434,12 @@ module ActiveRecord
 
         ids = ids.flatten.compact.uniq
 
+        model_name = @klass.name
+
         case ids.size
         when 0
-          raise RecordNotFound, "Couldn't find #{@klass.name} without an ID"
+          error_message = "Couldn't find #{model_name} without an ID"
+          raise RecordNotFound.new(error_message, model_name, primary_key)
         when 1
           result = find_one(ids.first)
           expects_array ? [ result ] : result
@@ -443,7 +447,8 @@ module ActiveRecord
           find_some(ids)
         end
       rescue ::RangeError
-        raise RecordNotFound, "Couldn't find #{@klass.name} with an out of range ID"
+        error_message = "Couldn't find #{model_name} with an out of range ID"
+        raise RecordNotFound.new(error_message, model_name, primary_key, ids)
       end
 
       def find_one(id)
diff --git a/activerecord/lib/active_record/scoping.rb b/activerecord/lib/active_record/scoping.rb
index da585a9562..01ac56570a 100644
--- a/activerecord/lib/active_record/scoping.rb
+++ b/activerecord/lib/active_record/scoping.rb
@@ -11,23 +11,23 @@ module ActiveRecord
       include Named
     end
 
-    module ClassMethods
-      def current_scope(skip_inherited_scope = false) # :nodoc:
+    module ClassMethods # :nodoc:
+      def current_scope(skip_inherited_scope = false)
         ScopeRegistry.value_for(:current_scope, self, skip_inherited_scope)
       end
 
-      def current_scope=(scope) #:nodoc:
+      def current_scope=(scope)
         ScopeRegistry.set_value_for(:current_scope, self, scope)
       end
 
       # Collects attributes from scopes that should be applied when creating
       # an AR instance for the particular class this is called on.
-      def scope_attributes # :nodoc:
+      def scope_attributes
         all.scope_for_create
       end
 
       # Are there attributes associated with this scope?
-      def scope_attributes? # :nodoc:
+      def scope_attributes?
         current_scope
       end
     end
diff --git a/activerecord/lib/active_record/scoping/named.rb b/activerecord/lib/active_record/scoping/named.rb
index 310af72c41..752655aa05 100644
--- a/activerecord/lib/active_record/scoping/named.rb
+++ b/activerecord/lib/active_record/scoping/named.rb
@@ -171,6 +171,12 @@ module ActiveRecord
               "a class method with the same name."
           end
 
+          if method_defined_within?(name, Relation)
+            raise ArgumentError, "You tried to define a scope named \"#{name}\" " \
+              "on the model \"#{self.name}\", but ActiveRecord::Relation already defined " \
+              "an instance method with the same name."
+          end
+
           valid_scope_name?(name)
           extension = Module.new(&block) if block
 
diff --git a/activerecord/test/cases/adapters/mysql2/transaction_test.rb b/activerecord/test/cases/adapters/mysql2/transaction_test.rb
index 4a3a4503de..cb183cc54c 100644
--- a/activerecord/test/cases/adapters/mysql2/transaction_test.rb
+++ b/activerecord/test/cases/adapters/mysql2/transaction_test.rb
@@ -60,8 +60,8 @@ module ActiveRecord
       end
     end
 
-    test "raises TransactionTimeout when lock wait timeout exceeded" do
-      assert_raises(ActiveRecord::TransactionTimeout) do
+    test "raises LockWaitTimeout when lock wait timeout exceeded" do
+      assert_raises(ActiveRecord::LockWaitTimeout) do
         s = Sample.create!(value: 1)
         latch1 = Concurrent::CountDownLatch.new
         latch2 = Concurrent::CountDownLatch.new
@@ -116,5 +116,32 @@ module ActiveRecord
         end
       end
     end
+
+    test "raises QueryCanceled when canceling statement due to user request" do
+      assert_raises(ActiveRecord::QueryCanceled) do
+        s = Sample.create!(value: 1)
+        latch = Concurrent::CountDownLatch.new
+
+        thread = Thread.new do
+          Sample.transaction do
+            Sample.lock.find(s.id)
+            latch.count_down
+            sleep(0.5)
+            conn = Sample.connection
+            pid = conn.query_value("SELECT id FROM information_schema.processlist WHERE info LIKE '% FOR UPDATE'")
+            conn.execute("KILL QUERY #{pid}")
+          end
+        end
+
+        begin
+          Sample.transaction do
+            latch.wait
+            Sample.lock.find(s.id)
+          end
+        ensure
+          thread.join
+        end
+      end
+    end
   end
 end
diff --git a/activerecord/test/cases/adapters/postgresql/transaction_test.rb b/activerecord/test/cases/adapters/postgresql/transaction_test.rb
index 4d63bbce59..c24dfeb345 100644
--- a/activerecord/test/cases/adapters/postgresql/transaction_test.rb
+++ b/activerecord/test/cases/adapters/postgresql/transaction_test.rb
@@ -91,9 +91,9 @@ module ActiveRecord
       end
     end
 
-    test "raises TransactionTimeout when lock wait timeout exceeded" do
+    test "raises LockWaitTimeout when lock wait timeout exceeded" do
       skip unless ActiveRecord::Base.connection.postgresql_version >= 90300
-      assert_raises(ActiveRecord::TransactionTimeout) do
+      assert_raises(ActiveRecord::LockWaitTimeout) do
         s = Sample.create!(value: 1)
         latch1 = Concurrent::CountDownLatch.new
         latch2 = Concurrent::CountDownLatch.new
@@ -120,8 +120,8 @@ module ActiveRecord
       end
     end
 
-    test "raises StatementTimeout when statement timeout exceeded" do
-      assert_raises(ActiveRecord::StatementTimeout) do
+    test "raises QueryCanceled when statement timeout exceeded" do
+      assert_raises(ActiveRecord::QueryCanceled) do
         s = Sample.create!(value: 1)
         latch1 = Concurrent::CountDownLatch.new
         latch2 = Concurrent::CountDownLatch.new
@@ -148,6 +148,33 @@ module ActiveRecord
       end
     end
 
+    test "raises QueryCanceled when canceling statement due to user request" do
+      assert_raises(ActiveRecord::QueryCanceled) do
+        s = Sample.create!(value: 1)
+        latch = Concurrent::CountDownLatch.new
+
+        thread = Thread.new do
+          Sample.transaction do
+            Sample.lock.find(s.id)
+            latch.count_down
+            sleep(0.5)
+            conn = Sample.connection
+            pid = conn.query_value("SELECT pid FROM pg_stat_activity WHERE query LIKE '% FOR UPDATE'")
+            conn.execute("SELECT pg_cancel_backend(#{pid})")
+          end
+        end
+
+        begin
+          Sample.transaction do
+            latch.wait
+            Sample.lock.find(s.id)
+          end
+        ensure
+          thread.join
+        end
+      end
+    end
+
     private
 
       def with_warning_suppression
diff --git a/activerecord/test/cases/associations/inverse_associations_test.rb b/activerecord/test/cases/associations/inverse_associations_test.rb
index e13cf93dcf..c0d328ca8a 100644
--- a/activerecord/test/cases/associations/inverse_associations_test.rb
+++ b/activerecord/test/cases/associations/inverse_associations_test.rb
@@ -484,7 +484,10 @@ class InverseHasManyTests < ActiveRecord::TestCase
   def test_raise_record_not_found_error_when_no_ids_are_passed
     man = Man.create!
 
-    assert_raise(ActiveRecord::RecordNotFound) { man.interests.find() }
+    exception = assert_raise(ActiveRecord::RecordNotFound) { man.interests.load.find() }
+
+    assert_equal exception.model, "Interest"
+    assert_equal exception.primary_key, "id"
   end
 
   def test_trying_to_use_inverses_that_dont_exist_should_raise_an_error
@@ -672,6 +675,16 @@ class InversePolymorphicBelongsToTests < ActiveRecord::TestCase
     assert_equal old_inversed_man.object_id, new_inversed_man.object_id
   end
 
+  def test_inversed_instance_should_not_be_reloaded_after_stale_state_changed_with_validation
+    face = Face.new man: Man.new
+
+    old_inversed_man = face.man
+    face.save!
+    new_inversed_man = face.man
+
+    assert_equal old_inversed_man.object_id, new_inversed_man.object_id
+  end
+
   def test_should_not_try_to_set_inverse_instances_when_the_inverse_is_a_has_many
     i = interests(:llama_wrangling)
     m = i.polymorphic_man
diff --git a/activerecord/test/cases/attribute_methods_test.rb b/activerecord/test/cases/attribute_methods_test.rb
index 2f42684212..c48f7d3518 100644
--- a/activerecord/test/cases/attribute_methods_test.rb
+++ b/activerecord/test/cases/attribute_methods_test.rb
@@ -200,12 +200,7 @@ class AttributeMethodsTest < ActiveRecord::TestCase
   if current_adapter?(:Mysql2Adapter)
     test "read attributes_before_type_cast on a boolean" do
       bool = Boolean.create!("value" => false)
-      if RUBY_PLATFORM.include?("java")
-        # JRuby will return the value before typecast as string.
-        assert_equal "0", bool.reload.attributes_before_type_cast["value"]
-      else
-        assert_equal 0, bool.reload.attributes_before_type_cast["value"]
-      end
+      assert_equal 0, bool.reload.attributes_before_type_cast["value"]
     end
   end
 
diff --git a/activerecord/test/cases/connection_adapters/connection_handler_test.rb b/activerecord/test/cases/connection_adapters/connection_handler_test.rb
index 74d0ed348e..cae74a2b9b 100644
--- a/activerecord/test/cases/connection_adapters/connection_handler_test.rb
+++ b/activerecord/test/cases/connection_adapters/connection_handler_test.rb
@@ -1,10 +1,15 @@
 # frozen_string_literal: true
 
 require "cases/helper"
+require "models/person"
 
 module ActiveRecord
   module ConnectionAdapters
     class ConnectionHandlerTest < ActiveRecord::TestCase
+      self.use_transactional_tests = false
+
+      fixtures :people
+
       def setup
         @handler = ConnectionHandler.new
         @spec_name = "primary"
@@ -139,6 +144,33 @@ module ActiveRecord
           rd.close
         end
 
+        def test_forked_child_doesnt_mangle_parent_connection
+          object_id = ActiveRecord::Base.connection.object_id
+          assert ActiveRecord::Base.connection.active?
+
+          rd, wr = IO.pipe
+          rd.binmode
+          wr.binmode
+
+          pid = fork {
+            rd.close
+            if ActiveRecord::Base.connection.active?
+              wr.write Marshal.dump ActiveRecord::Base.connection.object_id
+            end
+            wr.close
+
+            exit # allow finalizers to run
+          }
+
+          wr.close
+
+          Process.waitpid pid
+          assert_not_equal object_id, Marshal.load(rd.read)
+          rd.close
+
+          assert_equal 3, ActiveRecord::Base.connection.select_value("SELECT COUNT(*) FROM people")
+        end
+
         def test_retrieve_connection_pool_copies_schema_cache_from_ancestor_pool
           @pool.schema_cache = @pool.connection.schema_cache
           @pool.schema_cache.add("posts")
diff --git a/activerecord/test/cases/connection_pool_test.rb b/activerecord/test/cases/connection_pool_test.rb
index cb2fefb4f6..1e08cc74dc 100644
--- a/activerecord/test/cases/connection_pool_test.rb
+++ b/activerecord/test/cases/connection_pool_test.rb
@@ -156,6 +156,53 @@ module ActiveRecord
         @pool.connections.each { |conn| conn.close if conn.in_use? }
       end
 
+      def test_flush
+        idle_conn = @pool.checkout
+        recent_conn = @pool.checkout
+        active_conn = @pool.checkout
+
+        @pool.checkin idle_conn
+        @pool.checkin recent_conn
+
+        assert_equal 3, @pool.connections.length
+
+        def idle_conn.seconds_idle
+          1000
+        end
+
+        @pool.flush(30)
+
+        assert_equal 2, @pool.connections.length
+
+        assert_equal [recent_conn, active_conn].sort_by(&:__id__), @pool.connections.sort_by(&:__id__)
+      ensure
+        @pool.checkin active_conn
+      end
+
+      def test_flush_bang
+        idle_conn = @pool.checkout
+        recent_conn = @pool.checkout
+        active_conn = @pool.checkout
+        _dead_conn = Thread.new { @pool.checkout }.join
+
+        @pool.checkin idle_conn
+        @pool.checkin recent_conn
+
+        assert_equal 4, @pool.connections.length
+
+        def idle_conn.seconds_idle
+          1000
+        end
+
+        @pool.flush!
+
+        assert_equal 1, @pool.connections.length
+
+        assert_equal [active_conn].sort_by(&:__id__), @pool.connections.sort_by(&:__id__)
+      ensure
+        @pool.checkin active_conn
+      end
+
       def test_remove_connection
         conn = @pool.checkout
         assert conn.in_use?
diff --git a/activerecord/test/cases/enum_test.rb b/activerecord/test/cases/enum_test.rb
index 78cb89ccc5..7cda712112 100644
--- a/activerecord/test/cases/enum_test.rb
+++ b/activerecord/test/cases/enum_test.rb
@@ -308,6 +308,24 @@ class EnumTest < ActiveRecord::TestCase
     end
   end
 
+  test "reserved enum values for relation" do
+    relation_method_samples = [
+      :records,
+      :to_ary,
+      :scope_for_create
+    ]
+
+    relation_method_samples.each do |value|
+      e = assert_raises(ArgumentError, "enum value `#{value}` should not be allowed") do
+        Class.new(ActiveRecord::Base) do
+          self.table_name = "books"
+          enum category: [:other, value]
+        end
+      end
+      assert_match(/You tried to define an enum named .* on the model/, e.message)
+    end
+  end
+
   test "overriding enum method should not raise" do
     assert_nothing_raised do
       Class.new(ActiveRecord::Base) do
diff --git a/activerecord/test/cases/finder_test.rb b/activerecord/test/cases/finder_test.rb
index 1268949ba9..e936c56ab8 100644
--- a/activerecord/test/cases/finder_test.rb
+++ b/activerecord/test/cases/finder_test.rb
@@ -120,6 +120,21 @@ class FinderTest < ActiveRecord::TestCase
     assert_equal "The Fourth Topic of the day", records[2].title
   end
 
+  def test_find_with_ids_with_no_id_passed
+    exception = assert_raises(ActiveRecord::RecordNotFound) { Topic.find }
+    assert_equal exception.model, "Topic"
+    assert_equal exception.primary_key, "id"
+  end
+
+  def test_find_with_ids_with_id_out_of_range
+    exception = assert_raises(ActiveRecord::RecordNotFound) do
+      Topic.find("9999999999999999999999999999999")
+    end
+
+    assert_equal exception.model, "Topic"
+    assert_equal exception.primary_key, "id"
+  end
+
   def test_find_passing_active_record_object_is_not_permitted
     assert_raises(ArgumentError) do
       Topic.find(Topic.last)
diff --git a/activerecord/test/cases/reaper_test.rb b/activerecord/test/cases/reaper_test.rb
index 49170abe6f..6c7727ab1b 100644
--- a/activerecord/test/cases/reaper_test.rb
+++ b/activerecord/test/cases/reaper_test.rb
@@ -18,6 +18,7 @@ module ActiveRecord
 
       class FakePool
         attr_reader :reaped
+        attr_reader :flushed
 
         def initialize
           @reaped = false
@@ -26,6 +27,10 @@ module ActiveRecord
         def reap
           @reaped = true
         end
+
+        def flush
+          @flushed = true
+        end
       end
 
       # A reaper with nil time should never reap connections
@@ -47,6 +52,7 @@ module ActiveRecord
           Thread.pass
         end
         assert fp.reaped
+        assert fp.flushed
       end
 
       def test_pool_has_reaper
diff --git a/activerecord/test/cases/scoping/named_scoping_test.rb b/activerecord/test/cases/scoping/named_scoping_test.rb
index b0431a4e34..17d3f27bb1 100644
--- a/activerecord/test/cases/scoping/named_scoping_test.rb
+++ b/activerecord/test/cases/scoping/named_scoping_test.rb
@@ -151,6 +151,22 @@ class NamedScopingTest < ActiveRecord::TestCase
     assert_equal "The scope body needs to be callable.", e.message
   end
 
+  def test_scopes_name_is_relation_method
+    conflicts = [
+      :records,
+      :to_ary,
+      :to_sql,
+      :explain
+    ]
+
+    conflicts.each do |name|
+      e = assert_raises ArgumentError do
+        Class.new(Post).class_eval { scope name, -> { where(approved: true) } }
+      end
+      assert_match(/You tried to define a scope named \"#{name}\" on the model/, e.message)
+    end
+  end
+
   def test_active_records_have_scope_named__all__
     assert !Topic.all.empty?
 
diff --git a/activerecord/test/models/face.rb b/activerecord/test/models/face.rb
index 796aaa4dc9..948435136d 100644
--- a/activerecord/test/models/face.rb
+++ b/activerecord/test/models/face.rb
@@ -8,4 +8,8 @@ class Face < ActiveRecord::Base
   # These is a "broken" inverse_of for the purposes of testing
   belongs_to :horrible_man, class_name: "Man", inverse_of: :horrible_face
   belongs_to :horrible_polymorphic_man, polymorphic: true, inverse_of: :horrible_polymorphic_face
+
+  validate do
+    man
+  end
 end
diff --git a/activestorage/CHANGELOG.md b/activestorage/CHANGELOG.md
index 358552313f..c5171e7490 100644
--- a/activestorage/CHANGELOG.md
+++ b/activestorage/CHANGELOG.md
@@ -1,3 +1,12 @@
+## Rails 5.2.0.beta2 (November 28, 2017) ##
+
+*   Fix the gem adding the migrations files to the package.
+
+    *Yuji Yaginuma*
+
+
+## Rails 5.2.0.beta1 (November 27, 2017) ##
+
 *   Added to Rails.
 
     *DHH*
diff --git a/activestorage/README.md b/activestorage/README.md
index 78e4463c5a..8af0409ec5 100644
--- a/activestorage/README.md
+++ b/activestorage/README.md
@@ -143,3 +143,17 @@ Active Storage, with its included JavaScript library, supports uploading directl
 ## License
 
 Active Storage is released under the [MIT License](https://opensource.org/licenses/MIT).
+
+ ## Support
+
+API documentation is at:
+
+* http://api.rubyonrails.org
+
+Bug reports for the Ruby on Rails project can be filed here:
+
+* https://github.com/rails/rails/issues
+
+Feature requests should be discussed on the rails-core mailing list here:
+
+* https://groups.google.com/forum/?fromgroups#!forum/rubyonrails-core
diff --git a/activestorage/activestorage.gemspec b/activestorage/activestorage.gemspec
index 911e1a0469..7f7f1a26ac 100644
--- a/activestorage/activestorage.gemspec
+++ b/activestorage/activestorage.gemspec
@@ -17,7 +17,7 @@ Gem::Specification.new do |s|
   s.email    = "david@loudthinking.com"
   s.homepage = "http://rubyonrails.org"
 
-  s.files        = Dir["CHANGELOG.md", "MIT-LICENSE", "README.md", "lib/**/*", "app/**/*", "config/**/*"]
+  s.files        = Dir["CHANGELOG.md", "MIT-LICENSE", "README.md", "lib/**/*", "app/**/*", "config/**/*", "db/**/*"]
   s.require_path = "lib"
 
   s.metadata = {
diff --git a/activestorage/app/controllers/active_storage/disk_controller.rb b/activestorage/app/controllers/active_storage/disk_controller.rb
index 8caecfff49..a7e10c0696 100644
--- a/activestorage/app/controllers/active_storage/disk_controller.rb
+++ b/activestorage/app/controllers/active_storage/disk_controller.rb
@@ -5,7 +5,7 @@
 # Always go through the BlobsController, or your own authenticated controller, rather than directly
 # to the service url.
 class ActiveStorage::DiskController < ActionController::Base
-  skip_forgery_protection
+  skip_forgery_protection if default_protect_from_forgery
 
   def show
     if key = decode_verified_key
diff --git a/activestorage/lib/active_storage/gem_version.rb b/activestorage/lib/active_storage/gem_version.rb
index e1d7b3493a..f048bb0b77 100644
--- a/activestorage/lib/active_storage/gem_version.rb
+++ b/activestorage/lib/active_storage/gem_version.rb
@@ -10,7 +10,7 @@ module ActiveStorage
     MAJOR = 5
     MINOR = 2
     TINY  = 0
-    PRE   = "alpha"
+    PRE   = "beta2"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end
diff --git a/activestorage/lib/active_storage/service/gcs_service.rb b/activestorage/lib/active_storage/service/gcs_service.rb
index b4ffeeeb8a..fd9916634a 100644
--- a/activestorage/lib/active_storage/service/gcs_service.rb
+++ b/activestorage/lib/active_storage/service/gcs_service.rb
@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+gem "google-cloud-storage", "~> 1.8"
+
 require "google/cloud/storage"
 require "active_support/core_ext/object/to_query"
 
@@ -7,11 +9,8 @@ module ActiveStorage
   # Wraps the Google Cloud Storage as an Active Storage service. See ActiveStorage::Service for the generic API
   # documentation that applies to all services.
   class Service::GCSService < Service
-    attr_reader :client, :bucket
-
-    def initialize(project:, keyfile:, bucket:, **options)
-      @client = Google::Cloud::Storage.new(project: project, keyfile: keyfile, **options)
-      @bucket = @client.bucket(bucket)
+    def initialize(**config)
+      @config = config
     end
 
     def upload(key, io, checksum: nil)
@@ -85,8 +84,18 @@ module ActiveStorage
     end
 
     private
+      attr_reader :config
+
       def file_for(key)
         bucket.file(key, skip_lookup: true)
       end
+
+      def bucket
+        @bucket ||= client.bucket(config.fetch(:bucket))
+      end
+
+      def client
+        @client ||= Google::Cloud::Storage.new(config.except(:bucket))
+      end
   end
 end
diff --git a/activestorage/package.json b/activestorage/package.json
index 8e6dd1c57f..621706000b 100644
--- a/activestorage/package.json
+++ b/activestorage/package.json
@@ -1,6 +1,6 @@
 {
   "name": "activestorage",
-  "version": "5.2.0-alpha",
+  "version": "5.2.0-beta2",
   "description": "Attach cloud and local files in Rails applications",
   "main": "app/assets/javascripts/activestorage.js",
   "files": [
diff --git a/activestorage/test/service/configurations.example.yml b/activestorage/test/service/configurations.example.yml
index 56ed37be5d..43cc013bc8 100644
--- a/activestorage/test/service/configurations.example.yml
+++ b/activestorage/test/service/configurations.example.yml
@@ -7,7 +7,7 @@
 #
 # gcs:
 #   service: GCS
-#   keyfile: {
+#   credentials: {
 #     type: "service_account",
 #     project_id: "",
 #     private_key_id: "",
diff --git a/activestorage/test/service/gcs_service_test.rb b/activestorage/test/service/gcs_service_test.rb
index 5566c664a9..1860149da9 100644
--- a/activestorage/test/service/gcs_service_test.rb
+++ b/activestorage/test/service/gcs_service_test.rb
@@ -32,13 +32,8 @@ if SERVICE_CONFIGURATIONS[:gcs]
     end
 
     test "signed URL generation" do
-      freeze_time do
-        url = SERVICE.bucket.signed_url(FIXTURE_KEY, expires: 120) +
-          "&response-content-disposition=inline%3B+filename%3D%22test.txt%22%3B+filename%2A%3DUTF-8%27%27test.txt" +
-          "&response-content-type=text%2Fplain"
-
-        assert_equal url, @service.url(FIXTURE_KEY, expires_in: 2.minutes, disposition: :inline, filename: ActiveStorage::Filename.new("test.txt"), content_type: "text/plain")
-      end
+      assert_match(/storage\.googleapis\.com\/.*response-content-disposition=inline.*test\.txt.*response-content-type=text%2Fplain/,
+        @service.url(FIXTURE_KEY, expires_in: 2.minutes, disposition: :inline, filename: ActiveStorage::Filename.new("test.txt"), content_type: "text/plain"))
     end
   end
 else
diff --git a/activestorage/yarn.lock b/activestorage/yarn.lock
index dd09577445..41742be201 100644
--- a/activestorage/yarn.lock
+++ b/activestorage/yarn.lock
@@ -1219,12 +1219,6 @@ escope@^3.6.0:
     esrecurse "^4.1.0"
     estraverse "^4.1.1"
 
-eslint-config-airbnb-base@^11.3.1:
-  version "11.3.1"
-  resolved "https://registry.yarnpkg.com/eslint-config-airbnb-base/-/eslint-config-airbnb-base-11.3.1.tgz#c0ab108c9beed503cb999e4c60f4ef98eda0ed30"
-  dependencies:
-    eslint-restricted-globals "^0.1.1"
-
 eslint-import-resolver-node@^0.3.1:
   version "0.3.1"
   resolved "https://registry.yarnpkg.com/eslint-import-resolver-node/-/eslint-import-resolver-node-0.3.1.tgz#4422574cde66a9a7b099938ee4d508a199e0e3cc"
@@ -1254,10 +1248,6 @@ eslint-plugin-import@^2.7.0:
     minimatch "^3.0.3"
     read-pkg-up "^2.0.0"
 
-eslint-restricted-globals@^0.1.1:
-  version "0.1.1"
-  resolved "https://registry.yarnpkg.com/eslint-restricted-globals/-/eslint-restricted-globals-0.1.1.tgz#35f0d5cbc64c2e3ed62e93b4b1a7af05ba7ed4d7"
-
 eslint-scope@^3.7.1:
   version "3.7.1"
   resolved "https://registry.yarnpkg.com/eslint-scope/-/eslint-scope-3.7.1.tgz#3d63c3edfda02e06e01a452ad88caacc7cdcb6e8"
diff --git a/activesupport/CHANGELOG.md b/activesupport/CHANGELOG.md
index 88bbafc3a8..42c4406967 100644
--- a/activesupport/CHANGELOG.md
+++ b/activesupport/CHANGELOG.md
@@ -1,3 +1,25 @@
+## Rails 5.2.0.beta2 (November 28, 2017) ##
+
+*   No changes.
+
+
+## Rails 5.2.0.beta1 (November 27, 2017) ##
+
+*   Changed default behaviour of `ActiveSupport::SecurityUtils.secure_compare`,
+    to make it not leak length information even for variable length string.
+
+    Renamed old `ActiveSupport::SecurityUtils.secure_compare` to `fixed_length_secure_compare`,
+    and started raising `ArgumentError` in case of length mismatch of passed strings.
+
+    *Vipul A M*
+
+*   Make `ActiveSupport::TimeZone.all` return only time zones that are in
+    `ActiveSupport::TimeZone::MAPPING`.
+
+    Fixes #7245.
+
+    *Chris LaRose*
+
 *   MemCacheStore: Support expiring counters.
 
     Pass `expires_in: [seconds]` to `#increment` and `#decrement` options
diff --git a/activesupport/README.rdoc b/activesupport/README.rdoc
index 8b47933bd2..c770324be8 100644
--- a/activesupport/README.rdoc
+++ b/activesupport/README.rdoc
@@ -30,7 +30,7 @@ API documentation is at:
 
 * http://api.rubyonrails.org
 
-Bug reports can be filed for the Ruby on Rails project here:
+Bug reports for the Ruby on Rails project can be filed here:
 
 * https://github.com/rails/rails/issues
 
diff --git a/activesupport/lib/active_support/cache/redis_cache_store.rb b/activesupport/lib/active_support/cache/redis_cache_store.rb
index 08200a556f..3cf002f67e 100644
--- a/activesupport/lib/active_support/cache/redis_cache_store.rb
+++ b/activesupport/lib/active_support/cache/redis_cache_store.rb
@@ -33,9 +33,9 @@ module ActiveSupport
     # * Fault tolerant. If the Redis server is unavailable, no exceptions are
     #   raised. Cache fetches are all misses and writes are dropped.
     # * Local cache. Hot in-memory primary cache within block/middleware scope.
-    # * `read_/write_multi` support for Redis mget/mset. Use Redis::Distributed
+    # * +read_multi+ and +write_multi+ support for Redis mget/mset. Use Redis::Distributed
     #   4.0.1+ for distributed mget support.
-    # * `delete_matched` support for Redis KEYS globs.
+    # * +delete_matched+ support for Redis KEYS globs.
     class RedisCacheStore < Store
       # Keys are truncated with their own SHA2 digest if they exceed 1kB
       MAX_KEY_BYTESIZE = 1024
@@ -143,12 +143,12 @@ module ActiveSupport
       #   :url   Array  -> Redis::Distributed.new([{ url: … }, { url: … }, …])
       #
       # No namespace is set by default. Provide one if the Redis cache
-      # server is shared with other apps: `namespace: 'myapp-cache'`.
+      # server is shared with other apps: <tt>namespace: 'myapp-cache'<tt>.
       #
       # Compression is enabled by default with a 1kB threshold, so cached
       # values larger than 1kB are automatically compressed. Disable by
-      # passing `cache: false` or change the threshold by passing
-      # `compress_threshold: 4.kilobytes`.
+      # passing <tt>cache: false</tt> or change the threshold by passing
+      # <tt>compress_threshold: 4.kilobytes</tt>.
       #
       # No expiry is set on cache entries by default. Redis is expected to
       # be configured with an eviction policy that automatically deletes
diff --git a/activesupport/lib/active_support/core_ext/array/access.rb b/activesupport/lib/active_support/core_ext/array/access.rb
index d67f99df0e..b7ff7a3907 100644
--- a/activesupport/lib/active_support/core_ext/array/access.rb
+++ b/activesupport/lib/active_support/core_ext/array/access.rb
@@ -35,8 +35,8 @@ class Array
   #   people.without "Aaron", "Todd"
   #   # => ["David", "Rafael"]
   #
-  # Note: This is an optimization of `Enumerable#without` that uses `Array#-`
-  # instead of `Array#reject` for performance reasons.
+  # Note: This is an optimization of <tt>Enumerable#without</tt> that uses <tt>Array#-</tt>
+  # instead of <tt>Array#reject</tt> for performance reasons.
   def without(*elements)
     self - elements
   end
diff --git a/activesupport/lib/active_support/core_ext/date_and_time/calculations.rb b/activesupport/lib/active_support/core_ext/date_and_time/calculations.rb
index 061b79e098..f6cb1a384c 100644
--- a/activesupport/lib/active_support/core_ext/date_and_time/calculations.rb
+++ b/activesupport/lib/active_support/core_ext/date_and_time/calculations.rb
@@ -330,20 +330,28 @@ module DateAndTime
       beginning_of_year..end_of_year
     end
 
-    # Returns specific next occurring day of week
+    # Returns a new date/time representing the next occurrence of the specified day of week.
+    #
+    #   today = Date.today               # => Thu, 14 Dec 2017
+    #   today.next_occurring(:monday)    # => Mon, 18 Dec 2017
+    #   today.next_occurring(:thursday)  # => Thu, 21 Dec 2017
     def next_occurring(day_of_week)
       current_day_number = wday != 0 ? wday - 1 : 6
       from_now = DAYS_INTO_WEEK.fetch(day_of_week) - current_day_number
       from_now += 7 unless from_now > 0
-      since(from_now.days)
+      advance(days: from_now)
     end
 
-    # Returns specific previous occurring day of week
+    # Returns a new date/time representing the previous occurrence of the specified day of week.
+    #
+    #   today = Date.today               # => Thu, 14 Dec 2017
+    #   today.prev_occurring(:monday)    # => Mon, 11 Dec 2017
+    #   today.prev_occurring(:thursday)  # => Thu, 07 Dec 2017
     def prev_occurring(day_of_week)
       current_day_number = wday != 0 ? wday - 1 : 6
       ago = current_day_number - DAYS_INTO_WEEK.fetch(day_of_week)
       ago += 7 unless ago > 0
-      ago(ago.days)
+      advance(days: -ago)
     end
 
     private
diff --git a/activesupport/lib/active_support/core_ext/date_time/compatibility.rb b/activesupport/lib/active_support/core_ext/date_time/compatibility.rb
index 424f64d6fa..2d6b49722d 100644
--- a/activesupport/lib/active_support/core_ext/date_time/compatibility.rb
+++ b/activesupport/lib/active_support/core_ext/date_time/compatibility.rb
@@ -8,8 +8,8 @@ class DateTime
 
   silence_redefinition_of_method :to_time
 
-  # Either return an instance of `Time` with the same UTC offset
-  # as +self+ or an instance of `Time` representing the same time
+  # Either return an instance of +Time+ with the same UTC offset
+  # as +self+ or an instance of +Time+ representing the same time
   # in the the local system timezone depending on the setting of
   # on the setting of +ActiveSupport.to_time_preserves_timezone+.
   def to_time
diff --git a/activesupport/lib/active_support/core_ext/object/with_options.rb b/activesupport/lib/active_support/core_ext/object/with_options.rb
index b6c464db33..2838fd76be 100644
--- a/activesupport/lib/active_support/core_ext/object/with_options.rb
+++ b/activesupport/lib/active_support/core_ext/object/with_options.rb
@@ -62,7 +62,7 @@ class Object
   #
   #   validates :content, length: { minimum: 50 }, if: -> { content.present? }
   #
-  # Hence the inherited default for `if` key is ignored.
+  # Hence the inherited default for +if+ key is ignored.
   #
   # NOTE: You cannot call class methods implicitly inside of with_options.
   # You can access these methods using the class name instead:
diff --git a/activesupport/lib/active_support/core_ext/string/inflections.rb b/activesupport/lib/active_support/core_ext/string/inflections.rb
index da53739efc..8af301734a 100644
--- a/activesupport/lib/active_support/core_ext/string/inflections.rb
+++ b/activesupport/lib/active_support/core_ext/string/inflections.rb
@@ -174,7 +174,7 @@ class String
   #   <%= link_to(@person.name, person_path) %>
   #   # => <a href="/person/1-donald-e-knuth">Donald E. Knuth</a>
   #
-  # To preserve the case of the characters in a string, use the `preserve_case` argument.
+  # To preserve the case of the characters in a string, use the +preserve_case+ argument.
   #
   #   class Person
   #     def to_param
diff --git a/activesupport/lib/active_support/core_ext/string/multibyte.rb b/activesupport/lib/active_support/core_ext/string/multibyte.rb
index 38224ea5da..07c0d16398 100644
--- a/activesupport/lib/active_support/core_ext/string/multibyte.rb
+++ b/activesupport/lib/active_support/core_ext/string/multibyte.rb
@@ -16,6 +16,8 @@ class String
   #   >> "lj".mb_chars.upcase.to_s
   #   => "LJ"
   #
+  # NOTE: An above example is useful for pre Ruby 2.4. Ruby 2.4 supports Unicode case mappings.
+  #
   # == Method chaining
   #
   # All the methods on the Chars proxy which normally return a string will return a Chars object. This allows
diff --git a/activesupport/lib/active_support/core_ext/string/output_safety.rb b/activesupport/lib/active_support/core_ext/string/output_safety.rb
index b712200959..f3bdc2977e 100644
--- a/activesupport/lib/active_support/core_ext/string/output_safety.rb
+++ b/activesupport/lib/active_support/core_ext/string/output_safety.rb
@@ -250,7 +250,7 @@ class String
   # Marks a string as trusted safe. It will be inserted into HTML with no
   # additional escaping performed. It is your responsibility to ensure that the
   # string contains no malicious content. This method is equivalent to the
-  # `raw` helper in views. It is recommended that you use `sanitize` instead of
+  # +raw+ helper in views. It is recommended that you use +sanitize+ instead of
   # this method. It should never be called on user input.
   def html_safe
     ActiveSupport::SafeBuffer.new(self)
diff --git a/activesupport/lib/active_support/deprecation/constant_accessor.rb b/activesupport/lib/active_support/deprecation/constant_accessor.rb
index dd515cd6f4..1ed0015812 100644
--- a/activesupport/lib/active_support/deprecation/constant_accessor.rb
+++ b/activesupport/lib/active_support/deprecation/constant_accessor.rb
@@ -15,7 +15,7 @@ module ActiveSupport
     #
     #   PLANETS = %w(mercury venus earth mars jupiter saturn uranus neptune pluto)
     #
-    #   (In a later update, the original implementation of `PLANETS` has been removed.)
+    #   # (In a later update, the original implementation of `PLANETS` has been removed.)
     #
     #   PLANETS_POST_2006 = %w(mercury venus earth mars jupiter saturn uranus neptune)
     #   include ActiveSupport::Deprecation::DeprecatedConstantAccessor
diff --git a/activesupport/lib/active_support/deprecation/method_wrappers.rb b/activesupport/lib/active_support/deprecation/method_wrappers.rb
index d359992bf5..c4b78102eb 100644
--- a/activesupport/lib/active_support/deprecation/method_wrappers.rb
+++ b/activesupport/lib/active_support/deprecation/method_wrappers.rb
@@ -8,9 +8,7 @@ module ActiveSupport
     module MethodWrapper
       # Declare that a method has been deprecated.
       #
-      #   module Fred
-      #     extend self
-      #
+      #   class Fred
       #     def aaa; end
       #     def bbb; end
       #     def ccc; end
@@ -22,15 +20,15 @@ module ActiveSupport
       #   ActiveSupport::Deprecation.deprecate_methods(Fred, :aaa, bbb: :zzz, ccc: 'use Bar#ccc instead')
       #   # => Fred
       #
-      #   Fred.aaa
+      #   Fred.new.aaa
       #   # DEPRECATION WARNING: aaa is deprecated and will be removed from Rails 5.1. (called from irb_binding at (irb):10)
       #   # => nil
       #
-      #   Fred.bbb
+      #   Fred.new.bbb
       #   # DEPRECATION WARNING: bbb is deprecated and will be removed from Rails 5.1 (use zzz instead). (called from irb_binding at (irb):11)
       #   # => nil
       #
-      #   Fred.ccc
+      #   Fred.new.ccc
       #   # DEPRECATION WARNING: ccc is deprecated and will be removed from Rails 5.1 (use Bar#ccc instead). (called from irb_binding at (irb):12)
       #   # => nil
       #
@@ -39,7 +37,7 @@ module ActiveSupport
       #   ActiveSupport::Deprecation.deprecate_methods(Fred, ddd: :zzz, deprecator: custom_deprecator)
       #   # => [:ddd]
       #
-      #   Fred.ddd
+      #   Fred.new.ddd
       #   DEPRECATION WARNING: ddd is deprecated and will be removed from MyGem next-release (use zzz instead). (called from irb_binding at (irb):15)
       #   # => nil
       #
@@ -48,7 +46,7 @@ module ActiveSupport
       #   custom_deprecator.deprecate_methods(Fred, eee: :zzz)
       #   # => [:eee]
       #
-      #   Fred.eee
+      #   Fred.new.eee
       #   DEPRECATION WARNING: eee is deprecated and will be removed from MyGem next-release (use zzz instead). (called from irb_binding at (irb):18)
       #   # => nil
       def deprecate_methods(target_module, *method_names)
diff --git a/activesupport/lib/active_support/deprecation/proxy_wrappers.rb b/activesupport/lib/active_support/deprecation/proxy_wrappers.rb
index 782ad2519c..896c0d2d8e 100644
--- a/activesupport/lib/active_support/deprecation/proxy_wrappers.rb
+++ b/activesupport/lib/active_support/deprecation/proxy_wrappers.rb
@@ -113,7 +113,7 @@ module ActiveSupport
     #
     #   PLANETS = %w(mercury venus earth mars jupiter saturn uranus neptune pluto)
     #
-    #   (In a later update, the original implementation of `PLANETS` has been removed.)
+    #   # (In a later update, the original implementation of `PLANETS` has been removed.)
     #
     #   PLANETS_POST_2006 = %w(mercury venus earth mars jupiter saturn uranus neptune)
     #   PLANETS = ActiveSupport::Deprecation::DeprecatedConstantProxy.new('PLANETS', 'PLANETS_POST_2006')
diff --git a/activesupport/lib/active_support/gem_version.rb b/activesupport/lib/active_support/gem_version.rb
index 2a7ef2f820..1e09adbb52 100644
--- a/activesupport/lib/active_support/gem_version.rb
+++ b/activesupport/lib/active_support/gem_version.rb
@@ -10,7 +10,7 @@ module ActiveSupport
     MAJOR = 5
     MINOR = 2
     TINY  = 0
-    PRE   = "alpha"
+    PRE   = "beta2"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end
diff --git a/activesupport/lib/active_support/inflector/transliterate.rb b/activesupport/lib/active_support/inflector/transliterate.rb
index 9fb3a2e0af..6f2ca4999c 100644
--- a/activesupport/lib/active_support/inflector/transliterate.rb
+++ b/activesupport/lib/active_support/inflector/transliterate.rb
@@ -73,12 +73,12 @@ module ActiveSupport
     #   parameterize("Donald E. Knuth") # => "donald-e-knuth"
     #   parameterize("^très|Jolie-- ")  # => "tres-jolie"
     #
-    # To use a custom separator, override the `separator` argument.
+    # To use a custom separator, override the +separator+ argument.
     #
     #  parameterize("Donald E. Knuth", separator: '_') # => "donald_e_knuth"
     #  parameterize("^très|Jolie__ ", separator: '_')  # => "tres_jolie"
     #
-    # To preserve the case of the characters in a string, use the `preserve_case` argument.
+    # To preserve the case of the characters in a string, use the +preserve_case+ argument.
     #
     #   parameterize("Donald E. Knuth", preserve_case: true) # => "Donald-E-Knuth"
     #   parameterize("^très|Jolie-- ", preserve_case: true) # => "tres-Jolie"
diff --git a/activesupport/lib/active_support/message_encryptor.rb b/activesupport/lib/active_support/message_encryptor.rb
index 69c95e0622..27fd061947 100644
--- a/activesupport/lib/active_support/message_encryptor.rb
+++ b/activesupport/lib/active_support/message_encryptor.rb
@@ -58,8 +58,8 @@ module ActiveSupport
   # === Rotating keys
   #
   # MessageEncryptor also supports rotating out old configurations by falling
-  # back to a stack of encryptors. Call `rotate` to build and add an encryptor
-  # so `decrypt_and_verify` will also try the fallback.
+  # back to a stack of encryptors. Call +rotate+ to build and add an encryptor
+  # so +decrypt_and_verify+ will also try the fallback.
   #
   # By default any rotated encryptors use the values of the primary
   # encryptor unless specified otherwise.
diff --git a/activesupport/lib/active_support/message_verifier.rb b/activesupport/lib/active_support/message_verifier.rb
index 622b66ee55..83c39c0a86 100644
--- a/activesupport/lib/active_support/message_verifier.rb
+++ b/activesupport/lib/active_support/message_verifier.rb
@@ -31,7 +31,7 @@ module ActiveSupport
   #
   # +MessageVerifier+ creates HMAC signatures using SHA1 hash algorithm by default.
   # If you want to use a different hash algorithm, you can change it by providing
-  # `:digest` key as an option while initializing the verifier:
+  # +:digest+ key as an option while initializing the verifier:
   #
   #   @verifier = ActiveSupport::MessageVerifier.new('s3Krit', digest: 'SHA256')
   #
@@ -78,8 +78,8 @@ module ActiveSupport
   # === Rotating keys
   #
   # MessageVerifier also supports rotating out old configurations by falling
-  # back to a stack of verifiers. Call `rotate` to build and add a verifier to
-  # so either `verified` or `verify` will also try verifying with the fallback.
+  # back to a stack of verifiers. Call +rotate+ to build and add a verifier to
+  # so either +verified+ or +verify+ will also try verifying with the fallback.
   #
   # By default any rotated verifiers use the values of the primary
   # verifier unless specified otherwise.
diff --git a/activesupport/lib/active_support/security_utils.rb b/activesupport/lib/active_support/security_utils.rb
index b6b31ef140..20b6b9cd3f 100644
--- a/activesupport/lib/active_support/security_utils.rb
+++ b/activesupport/lib/active_support/security_utils.rb
@@ -4,14 +4,12 @@ require "digest/sha2"
 
 module ActiveSupport
   module SecurityUtils
-    # Constant time string comparison.
+    # Constant time string comparison, for fixed length strings.
     #
     # The values compared should be of fixed length, such as strings
-    # that have already been processed by HMAC. This should not be used
-    # on variable length plaintext strings because it could leak length info
-    # via timing attacks.
-    def secure_compare(a, b)
-      return false unless a.bytesize == b.bytesize
+    # that have already been processed by HMAC. Raises in case of length mismatch.
+    def fixed_length_secure_compare(a, b)
+      raise ArgumentError, "string length mismatch." unless a.bytesize == b.bytesize
 
       l = a.unpack "C#{a.bytesize}"
 
@@ -19,11 +17,15 @@ module ActiveSupport
       b.each_byte { |byte| res |= byte ^ l.shift }
       res == 0
     end
-    module_function :secure_compare
+    module_function :fixed_length_secure_compare
 
-    def variable_size_secure_compare(a, b) # :nodoc:
-      secure_compare(::Digest::SHA256.hexdigest(a), ::Digest::SHA256.hexdigest(b))
+    # Constant time string comparison, for variable length strings.
+    #
+    # The values are first processed by SHA256, so that we don't leak length info
+    # via timing attacks.
+    def secure_compare(a, b)
+      fixed_length_secure_compare(::Digest::SHA256.hexdigest(a), ::Digest::SHA256.hexdigest(b)) && a == b
     end
-    module_function :variable_size_secure_compare
+    module_function :secure_compare
   end
 end
diff --git a/activesupport/lib/active_support/values/time_zone.rb b/activesupport/lib/active_support/values/time_zone.rb
index b294d99fe0..4d81ac939e 100644
--- a/activesupport/lib/active_support/values/time_zone.rb
+++ b/activesupport/lib/active_support/values/time_zone.rb
@@ -256,6 +256,13 @@ module ActiveSupport
         @country_zones[code] ||= load_country_zones(code)
       end
 
+      def clear #:nodoc:
+        @lazy_zones_map = Concurrent::Map.new
+        @country_zones  = Concurrent::Map.new
+        @zones = nil
+        @zones_map = nil
+      end
+
       private
         def load_country_zones(code)
           country = TZInfo::Country.get(code)
@@ -269,9 +276,8 @@ module ActiveSupport
         end
 
         def zones_map
-          @zones_map ||= begin
-            MAPPING.each_key { |place| self[place] } # load all the zones
-            @lazy_zones_map
+          @zones_map ||= MAPPING.each_with_object({}) do |(name, _), zones|
+            zones[name] = self[name]
           end
         end
     end
diff --git a/activesupport/test/core_ext/date_and_time_behavior.rb b/activesupport/test/core_ext/date_and_time_behavior.rb
index 42da6f6cd0..91b92043d0 100644
--- a/activesupport/test/core_ext/date_and_time_behavior.rb
+++ b/activesupport/test/core_ext/date_and_time_behavior.rb
@@ -328,6 +328,26 @@ module DateAndTimeBehavior
     assert_equal date_time_init(2007, 12, 31, 23, 59, 59, Rational(999999999, 1000)), date_time_init(2007, 12, 31, 10, 10, 10).end_of_year
   end
 
+  def test_next_occurring
+    assert_equal date_time_init(2017, 12, 18, 3, 14, 15), date_time_init(2017, 12, 14, 3, 14, 15).next_occurring(:monday)
+    assert_equal date_time_init(2017, 12, 19, 3, 14, 15), date_time_init(2017, 12, 14, 3, 14, 15).next_occurring(:tuesday)
+    assert_equal date_time_init(2017, 12, 20, 3, 14, 15), date_time_init(2017, 12, 14, 3, 14, 15).next_occurring(:wednesday)
+    assert_equal date_time_init(2017, 12, 21, 3, 14, 15), date_time_init(2017, 12, 14, 3, 14, 15).next_occurring(:thursday)
+    assert_equal date_time_init(2017, 12, 15, 3, 14, 15), date_time_init(2017, 12, 14, 3, 14, 15).next_occurring(:friday)
+    assert_equal date_time_init(2017, 12, 16, 3, 14, 15), date_time_init(2017, 12, 14, 3, 14, 15).next_occurring(:saturday)
+    assert_equal date_time_init(2017, 12, 17, 3, 14, 15), date_time_init(2017, 12, 14, 3, 14, 15).next_occurring(:sunday)
+  end
+
+  def test_prev_occurring
+    assert_equal date_time_init(2017, 12, 11, 3, 14, 15), date_time_init(2017, 12, 14, 3, 14, 15).prev_occurring(:monday)
+    assert_equal date_time_init(2017, 12, 12, 3, 14, 15), date_time_init(2017, 12, 14, 3, 14, 15).prev_occurring(:tuesday)
+    assert_equal date_time_init(2017, 12, 13, 3, 14, 15), date_time_init(2017, 12, 14, 3, 14, 15).prev_occurring(:wednesday)
+    assert_equal date_time_init(2017, 12,  7, 3, 14, 15), date_time_init(2017, 12, 14, 3, 14, 15).prev_occurring(:thursday)
+    assert_equal date_time_init(2017, 12,  8, 3, 14, 15), date_time_init(2017, 12, 14, 3, 14, 15).prev_occurring(:friday)
+    assert_equal date_time_init(2017, 12,  9, 3, 14, 15), date_time_init(2017, 12, 14, 3, 14, 15).prev_occurring(:saturday)
+    assert_equal date_time_init(2017, 12, 10, 3, 14, 15), date_time_init(2017, 12, 14, 3, 14, 15).prev_occurring(:sunday)
+  end
+
   def test_monday_with_default_beginning_of_week_set
     with_bw_default(:saturday) do
       assert_equal date_time_init(2012, 9, 17, 0, 0, 0), date_time_init(2012, 9, 18, 0, 0, 0).monday
diff --git a/activesupport/test/core_ext/date_time_ext_test.rb b/activesupport/test/core_ext/date_time_ext_test.rb
index d942cddb2a..ed962803fa 100644
--- a/activesupport/test/core_ext/date_time_ext_test.rb
+++ b/activesupport/test/core_ext/date_time_ext_test.rb
@@ -30,28 +30,6 @@ class DateTimeExtCalculationsTest < ActiveSupport::TestCase
     end
   end
 
-  def test_next_occur
-    datetime = DateTime.new(2016, 9, 24, 0, 0) # saturday
-    assert_equal datetime.next_occurring(:monday), datetime.since(2.days)
-    assert_equal datetime.next_occurring(:tuesday), datetime.since(3.days)
-    assert_equal datetime.next_occurring(:wednesday), datetime.since(4.days)
-    assert_equal datetime.next_occurring(:thursday), datetime.since(5.days)
-    assert_equal datetime.next_occurring(:friday), datetime.since(6.days)
-    assert_equal datetime.next_occurring(:saturday), datetime.since(1.week)
-    assert_equal datetime.next_occurring(:sunday), datetime.since(1.day)
-  end
-
-  def test_prev_occur
-    datetime = DateTime.new(2016, 9, 24, 0, 0) # saturday
-    assert_equal datetime.prev_occurring(:monday), datetime.ago(5.days)
-    assert_equal datetime.prev_occurring(:tuesday), datetime.ago(4.days)
-    assert_equal datetime.prev_occurring(:wednesday), datetime.ago(3.days)
-    assert_equal datetime.prev_occurring(:thursday), datetime.ago(2.days)
-    assert_equal datetime.prev_occurring(:friday), datetime.ago(1.day)
-    assert_equal datetime.prev_occurring(:saturday), datetime.ago(1.week)
-    assert_equal datetime.prev_occurring(:sunday), datetime.ago(6.days)
-  end
-
   def test_readable_inspect
     datetime = DateTime.new(2005, 2, 21, 14, 30, 0)
     assert_equal "Mon, 21 Feb 2005 14:30:00 +0000", datetime.readable_inspect
diff --git a/activesupport/test/json/encoding_test.rb b/activesupport/test/json/encoding_test.rb
index 96ad8dfbdb..d904f79ccf 100644
--- a/activesupport/test/json/encoding_test.rb
+++ b/activesupport/test/json/encoding_test.rb
@@ -210,7 +210,7 @@ class TestJSONEncoding < ActiveSupport::TestCase
 
   People = Class.new(BasicObject) do
     include Enumerable
-    def initialize()
+    def initialize
       @people = [
         { name: "John", address: { city: "London", country: "UK" } },
         { name: "Jean", address: { city: "Paris" , country: "France" } }
diff --git a/activesupport/test/security_utils_test.rb b/activesupport/test/security_utils_test.rb
index efd2bcfa0f..0a607594a2 100644
--- a/activesupport/test/security_utils_test.rb
+++ b/activesupport/test/security_utils_test.rb
@@ -9,8 +9,14 @@ class SecurityUtilsTest < ActiveSupport::TestCase
     assert_not ActiveSupport::SecurityUtils.secure_compare("a", "b")
   end
 
-  def test_variable_size_secure_compare_should_perform_string_comparison
-    assert ActiveSupport::SecurityUtils.variable_size_secure_compare("a", "a")
-    assert_not ActiveSupport::SecurityUtils.variable_size_secure_compare("a", "b")
+  def test_fixed_length_secure_compare_should_perform_string_comparison
+    assert ActiveSupport::SecurityUtils.fixed_length_secure_compare("a", "a")
+    assert !ActiveSupport::SecurityUtils.fixed_length_secure_compare("a", "b")
+  end
+
+  def test_fixed_length_secure_compare_raise_on_length_mismatch
+    assert_raises(ArgumentError, "string length mismatch.") do
+      ActiveSupport::SecurityUtils.fixed_length_secure_compare("a", "ab")
+    end
   end
 end
diff --git a/activesupport/test/time_zone_test.rb b/activesupport/test/time_zone_test.rb
index 862e872494..405c8f315b 100644
--- a/activesupport/test/time_zone_test.rb
+++ b/activesupport/test/time_zone_test.rb
@@ -718,6 +718,13 @@ class TimeZoneTest < ActiveSupport::TestCase
     end
   end
 
+  def test_all_uninfluenced_by_time_zone_lookups_delegated_to_tzinfo
+    ActiveSupport::TimeZone.clear
+    galapagos = ActiveSupport::TimeZone["Pacific/Galapagos"]
+    all_zones = ActiveSupport::TimeZone.all
+    assert_not_includes all_zones, galapagos
+  end
+
   def test_index
     assert_nil ActiveSupport::TimeZone["bogus"]
     assert_instance_of ActiveSupport::TimeZone, ActiveSupport::TimeZone["Central Time (US & Canada)"]
diff --git a/ci/travis.rb b/ci/travis.rb
index b124358789..f521ef3cf6 100755
--- a/ci/travis.rb
+++ b/ci/travis.rb
@@ -135,7 +135,7 @@ class Build
     if activesupport? && !isolated?
       # There is a known issue with the listen tests that causes files to be
       # incorrectly GC'ed even when they are still in-use. The current solution
-      # is to only run them in isolation to avoid randomly failing our test suite.
+      # is to only run them in isolation to avoid random failures of our test suite.
       { "LISTEN" => "0" }
     else
       {}
diff --git a/guides/CHANGELOG.md b/guides/CHANGELOG.md
index d8b122d264..518b6abfb3 100644
--- a/guides/CHANGELOG.md
+++ b/guides/CHANGELOG.md
@@ -1 +1,10 @@
+## Rails 5.2.0.beta2 (November 28, 2017) ##
+
+*   No changes.
+
+
+## Rails 5.2.0.beta1 (November 27, 2017) ##
+
+*   No changes.
+
 Please check [5-1-stable](https://github.com/rails/rails/blob/5-1-stable/guides/CHANGELOG.md) for previous changes.
diff --git a/guides/assets/images/belongs_to.png b/guides/assets/images/belongs_to.png
index 1a9926e578..2b8c1d52ea 100644
--- a/guides/assets/images/belongs_to.png
+++ b/guides/assets/images/belongs_to.png
diff --git a/guides/assets/images/habtm.png b/guides/assets/images/habtm.png
index 41013b743d..7e508cc1a6 100644
--- a/guides/assets/images/habtm.png
+++ b/guides/assets/images/habtm.png
diff --git a/guides/assets/images/has_many.png b/guides/assets/images/has_many.png
index 0d67bea38b..36ccf9f0f6 100644
--- a/guides/assets/images/has_many.png
+++ b/guides/assets/images/has_many.png
diff --git a/guides/assets/images/has_many_through.png b/guides/assets/images/has_many_through.png
index b4da60e1fb..9e9caabd73 100644
--- a/guides/assets/images/has_many_through.png
+++ b/guides/assets/images/has_many_through.png
diff --git a/guides/assets/images/has_one.png b/guides/assets/images/has_one.png
index c70763856a..c29c6b9c59 100644
--- a/guides/assets/images/has_one.png
+++ b/guides/assets/images/has_one.png
diff --git a/guides/assets/images/has_one_through.png b/guides/assets/images/has_one_through.png
index 888a02b775..fdf13286c4 100644
--- a/guides/assets/images/has_one_through.png
+++ b/guides/assets/images/has_one_through.png
diff --git a/guides/assets/images/polymorphic.png b/guides/assets/images/polymorphic.png
index e0a7f6d64a..d630db9e01 100644
--- a/guides/assets/images/polymorphic.png
+++ b/guides/assets/images/polymorphic.png
diff --git a/guides/rails_guides/markdown/renderer.rb b/guides/rails_guides/markdown/renderer.rb
index 1f2fe91ea1..78820a7856 100644
--- a/guides/rails_guides/markdown/renderer.rb
+++ b/guides/rails_guides/markdown/renderer.rb
@@ -75,7 +75,7 @@ HTML
           #
           # It is important that we do not eat more than one newline
           # because formatting may be wrong otherwise. For example,
-          # if a bulleted list follows the first item is not rendered
+          # if a bulleted list follows, the first item is not rendered
           # as a list item, but as a paragraph starting with a plain
           # asterisk.
           body.gsub(/^(TIP|IMPORTANT|CAUTION|WARNING|NOTE|INFO|TODO)[.:](.*?)(\n(?=\n)|\Z)/m) do
diff --git a/guides/source/5_2_release_notes.md b/guides/source/5_2_release_notes.md
new file mode 100644
index 0000000000..eb361e200a
--- /dev/null
+++ b/guides/source/5_2_release_notes.md
@@ -0,0 +1,210 @@
+**DO NOT READ THIS FILE ON GITHUB, GUIDES ARE PUBLISHED ON http://guides.rubyonrails.org.**
+
+Ruby on Rails 5.2 Release Notes
+===============================
+
+Highlights in Rails 5.2:
+
+* Active Storage
+* Redis Cache Store
+* HTTP/2 Early hints support
+* Credentials
+* Default Content Security Policy
+
+These release notes cover only the major changes. To learn about various bug
+fixes and changes, please refer to the change logs or check out the [list of
+commits](https://github.com/rails/rails/commits/5-2-stable) in the main Rails
+repository on GitHub.
+
+--------------------------------------------------------------------------------
+
+Upgrading to Rails 5.2
+----------------------
+
+If you're upgrading an existing application, it's a great idea to have good test
+coverage before going in. You should also first upgrade to Rails 5.1 in case you
+haven't and make sure your application still runs as expected before attempting
+an update to Rails 5.2.
+
+
+Major Features
+--------------
+
+### Active Storage
+
+[README](https://github.com/rails/rails/blob/d3893ec38ec61282c2598b01a298124356d6b35a/activestorage/README.md)
+
+### Redis Cache Store
+
+[Pull Request](https://github.com/rails/rails/pull/31134)
+
+
+### HTTP/2 Early hints support
+
+[Pull Request](https://github.com/rails/rails/pull/30744)
+
+
+### Credentials
+
+[Pull Request](https://github.com/rails/rails/pull/30067)
+
+
+### Default Content Security Policy
+
+[Pull Request](https://github.com/rails/rails/pull/31162)
+
+Incompatibilities
+-----------------
+
+ToDo
+
+Railties
+--------
+
+Please refer to the [Changelog][railties] for detailed changes.
+
+### Removals
+
+ToDo
+
+### Notable changes
+
+ToDo
+
+Action Cable
+-----------
+
+Please refer to the [Changelog][action-cable] for detailed changes.
+
+### Notable changes
+
+ToDo
+
+Action Pack
+-----------
+
+Please refer to the [Changelog][action-pack] for detailed changes.
+
+### Removals
+
+ToDo
+
+### Deprecations
+
+ToDo
+
+### Notable changes
+
+ToDo
+
+Action View
+-------------
+
+Please refer to the [Changelog][action-view] for detailed changes.
+
+### Removals
+
+ToDo
+
+### Deprecations
+
+ToDo
+
+### Notable changes
+
+ToDo
+
+Action Mailer
+-------------
+
+Please refer to the [Changelog][action-mailer] for detailed changes.
+
+### Notable changes
+
+ToDo
+
+Active Record
+-------------
+
+Please refer to the [Changelog][active-record] for detailed changes.
+
+ToDo
+
+### Deprecations
+
+ToDo
+
+### Notable changes
+
+ToDo
+
+Active Model
+------------
+
+Please refer to the [Changelog][active-model] for detailed changes.
+
+### Removals
+
+ToDo
+
+### Notable changes
+
+ToDo
+
+Active Storage
+--------------
+
+Please refer to the [Changelog][active-support] for detailed changes.
+
+### Notable changes
+
+ToDo
+
+Active Support
+--------------
+
+Please refer to the [Changelog][active-support] for detailed changes.
+
+### Removals
+
+ToDo
+
+### Deprecations
+
+ToDo
+
+### Notable changes
+
+ToDo
+
+Active Job
+-----------
+
+Please refer to the [Changelog][active-job] for detailed changes.
+
+### Removals
+
+ToDo
+
+### Notable changes
+
+ToDo
+
+Credits
+-------
+
+See the
+[full list of contributors to Rails](http://contributors.rubyonrails.org/) for
+the many people who spent many hours making Rails, the stable and robust
+framework it is. Kudos to all of them.
+
+[railties]:       https://github.com/rails/rails/blob/5-2-stable/railties/CHANGELOG.md
+[action-pack]:    https://github.com/rails/rails/blob/5-2-stable/actionpack/CHANGELOG.md
+[action-view]:    https://github.com/rails/rails/blob/5-2-stable/actionview/CHANGELOG.md
+[action-mailer]:  https://github.com/rails/rails/blob/5-2-stable/actionmailer/CHANGELOG.md
+[action-cable]:   https://github.com/rails/rails/blob/5-2-stable/actioncable/CHANGELOG.md
+[active-record]:  https://github.com/rails/rails/blob/5-2-stable/activerecord/CHANGELOG.md
+[active-model]:   https://github.com/rails/rails/blob/5-2-stable/activemodel/CHANGELOG.md
+[active-storage]: https://github.com/rails/rails/blob/5-2-stable/activestorage/CHANGELOG.md
+[active-support]: https://github.com/rails/rails/blob/5-2-stable/activesupport/CHANGELOG.md
+[active-job]:     https://github.com/rails/rails/blob/5-2-stable/activejob/CHANGELOG.md
diff --git a/guides/source/action_cable_overview.md b/guides/source/action_cable_overview.md
index 57403a4bf9..1a86b1fcbb 100644
--- a/guides/source/action_cable_overview.md
+++ b/guides/source/action_cable_overview.md
@@ -1,12 +1,12 @@
 Action Cable Overview
 =====================
 
-In this guide you will learn how Action Cable works and how to use WebSockets to
+In this guide, you will learn how Action Cable works and how to use WebSockets to
 incorporate real-time features into your Rails application.
 
 After reading this guide, you will know:
 
-* What Action Cable is and its integration on backend and frontend
+* What Action Cable is and its integration backend and frontend
 * How to setup Action Cable
 * How to setup channels
 * Deployment and Architecture setup for running Action Cable
@@ -129,7 +129,7 @@ subscriptions based on an identifier sent by the cable consumer.
 # app/channels/chat_channel.rb
 class ChatChannel < ApplicationCable::Channel
   # Called when the consumer has successfully
-  # become a subscriber of this channel.
+  # become a subscriber to this channel.
   def subscribed
   end
 end
@@ -225,7 +225,7 @@ A *broadcasting* is a pub/sub link where anything transmitted by a publisher
 is routed directly to the channel subscribers who are streaming that named
 broadcasting. Each channel can be streaming zero or more broadcastings.
 
-Broadcastings are purely an online queue and time dependent. If a consumer is
+Broadcastings are purely an online queue and time-dependent. If a consumer is
 not streaming (subscribed to a given channel), they'll not get the broadcast
 should they connect later.
 
@@ -515,8 +515,8 @@ user. For a user with an ID of 1, the broadcasting name would be
 The channel has been instructed to stream everything that arrives at
 `web_notifications:1` directly to the client by invoking the `received`
 callback. The data passed as argument is the hash sent as the second parameter
-to the server-side broadcast call, JSON encoded for the trip across the wire,
-and unpacked for the data argument arriving to `received`.
+to the server-side broadcast call, JSON encoded for the trip across the wire
+and unpacked for the data argument arriving as `received`.
 
 ### More Complete Examples
 
@@ -569,7 +569,7 @@ This may change in the future. [#27214](https://github.com/rails/rails/issues/27
 
 Action Cable will only accept requests from specified origins, which are
 passed to the server config as an array. The origins can be instances of
-strings or regular expressions, against which a check for match will be performed.
+strings or regular expressions, against which a check for the match will be performed.
 
 ```ruby
 config.action_cable.allowed_request_origins = ['http://rubyonrails.com', %r{http://ruby.*}]
@@ -592,7 +592,7 @@ environment configuration files.
 
 ### Other Configurations
 
-The other common option to configure, is the log tags applied to the
+The other common option to configure is the log tags applied to the
 per-connection logger. Here's an example that uses
 the user account id if available, else "no-account" while tagging:
 
@@ -607,7 +607,7 @@ config.action_cable.log_tags = [
 For a full list of all configuration options, see the
 `ActionCable::Server::Configuration` class.
 
-Also note that your server must provide at least the same number of database
+Also, note that your server must provide at least the same number of database
 connections as you have workers. The default worker pool size is set to 4, so
 that means you have to make at least that available. You can change that in
 `config/database.yml` through the `pool` attribute.
diff --git a/guides/source/action_controller_overview.md b/guides/source/action_controller_overview.md
index 28f7246197..6ecfb57db3 100644
--- a/guides/source/action_controller_overview.md
+++ b/guides/source/action_controller_overview.md
@@ -21,7 +21,7 @@ After reading this guide, you will know:
 What Does a Controller Do?
 --------------------------
 
-Action Controller is the C in MVC. After the router has determined which controller to use for a request, the controller is responsible for making sense of the request and producing the appropriate output. Luckily, Action Controller does most of the groundwork for you and uses smart conventions to make this as straightforward as possible.
+Action Controller is the C in [MVC](https://en.wikipedia.org/wiki/Model%E2%80%93view%E2%80%93controller). After the router has determined which controller to use for a request, the controller is responsible for making sense of the request, and producing the appropriate output. Luckily, Action Controller does most of the groundwork for you and uses smart conventions to make this as straightforward as possible.
 
 For most conventional [RESTful](https://en.wikipedia.org/wiki/Representational_state_transfer) applications, the controller will receive the request (this is invisible to you as the developer), fetch or save data from a model and use a view to create HTML output. If your controller needs to do things a little differently, that's not a problem, this is just the most common way for a controller to work.
 
diff --git a/guides/source/api_app.md b/guides/source/api_app.md
index 43a7de88b0..b360f270d7 100644
--- a/guides/source/api_app.md
+++ b/guides/source/api_app.md
@@ -414,8 +414,10 @@ Some common modules you might want to add:
 
 - `AbstractController::Translation`: Support for the `l` and `t` localization
   and translation methods.
-- `ActionController::HttpAuthentication::Basic` (or `Digest` or `Token`): Support
-  for basic, digest or token HTTP authentication.
+- Support for basic, digest or token HTTP authentication:
+  * `ActionController::HttpAuthentication::Basic::ControllerMethods`,
+  * `ActionController::HttpAuthentication::Digest::ControllerMethods`,
+  * `ActionController::HttpAuthentication::Token::ControllerMethods`
 - `ActionView::Layouts`: Support for layouts when rendering.
 - `ActionController::MimeResponds`: Support for `respond_to`.
 - `ActionController::Cookies`: Support for `cookies`, which includes
diff --git a/guides/source/configuring.md b/guides/source/configuring.md
index 6e129a5680..4bfcc1e21a 100644
--- a/guides/source/configuring.md
+++ b/guides/source/configuring.md
@@ -578,6 +578,8 @@ Defaults to `'signed cookie'`.
 
 * `config.action_view.form_with_generates_remote_forms` determines whether `form_with` generates remote forms or not. This defaults to `true`.
 
+* `config.action_view.form_with_generates_ids` determines whether `form_with` generates ids on inputs. This defaults to `true`.
+
 ### Configuring Action Mailer
 
 There are a number of settings available on `config.action_mailer`:
diff --git a/guides/source/documents.yaml b/guides/source/documents.yaml
index 126d2e4845..2a4abab116 100644
--- a/guides/source/documents.yaml
+++ b/guides/source/documents.yaml
@@ -194,6 +194,10 @@
       url: upgrading_ruby_on_rails.html
       description: This guide helps in upgrading applications to latest Ruby on Rails versions.
     -
+      name: Ruby on Rails 5.2 Release Notes
+      url: 5_2_release_notes.html
+      description: Release notes for Rails 5.2.
+    -
       name: Ruby on Rails 5.1 Release Notes
       url: 5_1_release_notes.html
       description: Release notes for Rails 5.1.
diff --git a/guides/source/engines.md b/guides/source/engines.md
index b226eac347..33694cf76a 100644
--- a/guides/source/engines.md
+++ b/guides/source/engines.md
@@ -921,7 +921,7 @@ engine:
 mattr_accessor :author_class
 ```
 
-This method works like its brothers, `attr_accessor` and `cattr_accessor`, but
+This method works like its siblings, `attr_accessor` and `cattr_accessor`, but
 provides a setter and getter method on the module with the specified name. To
 use it, it must be referenced using `Blorgh.author_class`.
 
@@ -982,7 +982,7 @@ Blorgh.author_class = "User"
 WARNING: It's very important here to use the `String` version of the class,
 rather than the class itself. If you were to use the class, Rails would attempt
 to load that class and then reference the related table. This could lead to
-problems if the table wasn't already existing. Therefore, a `String` should be
+problems if the table didn't already exist. Therefore, a `String` should be
 used and then converted to a class using `constantize` in the engine later on.
 
 Go ahead and try to create a new article. You will see that it works exactly in the
@@ -1514,7 +1514,7 @@ To hook into the initialization process of one of the following classes use the
 
 ## Configuration hooks
 
-These are the available configuration hooks. They do not hook into any particular framework, instead they run in context of the entire application.
+These are the available configuration hooks. They do not hook into any particular framework, but instead they run in context of the entire application.
 
 | Hook                   | Use Case                                                                              |
 | ---------------------- | ------------------------------------------------------------------------------------- |
diff --git a/guides/source/layout.html.erb b/guides/source/layout.html.erb
index 334595e4d2..3981199e95 100644
--- a/guides/source/layout.html.erb
+++ b/guides/source/layout.html.erb
@@ -99,9 +99,9 @@
           To get started, you can read our <%= link_to 'documentation contributions', 'http://edgeguides.rubyonrails.org/contributing_to_ruby_on_rails.html#contributing-to-the-rails-documentation' %> section.
         </p>
         <p>
-          You may also find incomplete content, or stuff that is not up to date.
+          You may also find incomplete content or stuff that is not up to date.
           Please do add any missing documentation for master. Make sure to check
-          <%= link_to 'Edge Guides','http://edgeguides.rubyonrails.org' %> first to verify
+          <%= link_to 'Edge Guides', 'http://edgeguides.rubyonrails.org' %> first to verify
           if the issues are already fixed or not on the master branch.
           Check the <%= link_to 'Ruby on Rails Guides Guidelines', 'ruby_on_rails_guides_guidelines.html' %>
           for style and conventions.
@@ -111,7 +111,7 @@
           <%= link_to 'open an issue', 'https://github.com/rails/rails/issues' %>.
         </p>
         <p>And last but not least, any kind of discussion regarding Ruby on Rails
-          documentation is very welcome in the <%= link_to 'rubyonrails-docs mailing list', 'https://groups.google.com/forum/#!forum/rubyonrails-docs' %>.
+          documentation is very welcome on the <%= link_to 'rubyonrails-docs mailing list', 'https://groups.google.com/forum/#!forum/rubyonrails-docs' %>.
         </p>
       </div>
     </div>
diff --git a/guides/source/layouts_and_rendering.md b/guides/source/layouts_and_rendering.md
index f4597b0e60..4d79b2db89 100644
--- a/guides/source/layouts_and_rendering.md
+++ b/guides/source/layouts_and_rendering.md
@@ -285,7 +285,7 @@ the response. Using `:plain` or `:html` might be more appropriate most of the
 time.
 
 NOTE: Unless overridden, your response returned from this render option will be
-`text/html`, as that is the default content type of Action Dispatch response.
+`text/plain`, as that is the default content type of Action Dispatch response.
 
 #### Options for `render`
 
diff --git a/guides/source/rails_on_rack.md b/guides/source/rails_on_rack.md
index aa1476ecc0..5718b9ddfc 100644
--- a/guides/source/rails_on_rack.md
+++ b/guides/source/rails_on_rack.md
@@ -122,6 +122,7 @@ use ActiveRecord::Migration::CheckPending
 use ActionDispatch::Cookies
 use ActionDispatch::Session::CookieStore
 use ActionDispatch::Flash
+use ActionDispatch::ContentSecurityPolicy::Middleware
 use Rack::Head
 use Rack::ConditionalGet
 use Rack::ETag
@@ -249,7 +250,7 @@ Much of Action Controller's functionality is implemented as Middlewares. The fol
 
 **`Rails::Rack::Logger`**
 
-* Notifies the logs that the request has began. After request is complete, flushes all the logs.
+* Notifies the logs that the request has begun. After the request is complete, flushes all the logs.
 
 **`ActionDispatch::ShowExceptions`**
 
@@ -289,7 +290,7 @@ Much of Action Controller's functionality is implemented as Middlewares. The fol
 
 **`Rack::ConditionalGet`**
 
-* Adds support for "Conditional `GET`" so that server responds with nothing if page wasn't changed.
+* Adds support for "Conditional `GET`" so that server responds with nothing if the page wasn't changed.
 
 **`Rack::ETag`**
 
diff --git a/guides/source/security.md b/guides/source/security.md
index fa90cadcd2..eeb005b661 100644
--- a/guides/source/security.md
+++ b/guides/source/security.md
@@ -52,7 +52,7 @@ User.find(session[:user_id])
 
 NOTE: _The session ID is a 32-character random hex string._
 
-The session ID is generated using `SecureRandom.hex` which generates a random hex string using platform specific methods (such as OpenSSL, /dev/urandom or Win32) for generating cryptographically secure random numbers. Currently it is not feasible to brute-force Rails' session IDs.
+The session ID is generated using `SecureRandom.hex` which generates a random hex string using platform specific methods (such as OpenSSL, /dev/urandom or Win32 CryptoAPI) for generating cryptographically secure random numbers. Currently it is not feasible to brute-force Rails' session IDs.
 
 ### Session Hijacking
 
diff --git a/guides/source/working_with_javascript_in_rails.md b/guides/source/working_with_javascript_in_rails.md
index b2716c7faa..86746a5ae0 100644
--- a/guides/source/working_with_javascript_in_rails.md
+++ b/guides/source/working_with_javascript_in_rails.md
@@ -188,15 +188,20 @@ bind to the `ajax:success` event. On failure, use `ajax:error`. Check it out:
 
 ```coffeescript
 $(document).ready ->
-  $("#new_article").on("ajax:success", (e, data, status, xhr) ->
+  $("#new_article").on("ajax:success", (event) ->
+    [data, status, xhr] = event.detail
     $("#new_article").append xhr.responseText
-  ).on "ajax:error", (e, xhr, status, error) ->
+  ).on "ajax:error", (event) ->
     $("#new_article").append "<p>ERROR</p>"
 ```
 
 Obviously, you'll want to be a bit more sophisticated than that, but it's a
 start.
 
+NOTE: As of Rails 5.1 and the new `rails-ujs`, the parameters `data, status, xhr`
+have been bundled into `event.detail`. For information about the previously used
+`jquery-ujs` in Rails 5 and earlier, read the [`jquery-ujs` wiki](https://github.com/rails/jquery-ujs/wiki/ajax).
+
 #### link_to
 
 [`link_to`](http://api.rubyonrails.org/classes/ActionView/Helpers/UrlHelper.html#method-i-link_to)
@@ -225,7 +230,7 @@ and write some CoffeeScript like this:
 
 ```coffeescript
 $ ->
-  $("a[data-remote]").on "ajax:success", (e, data, status, xhr) ->
+  $("a[data-remote]").on "ajax:success", (event) ->
     alert "The article was deleted."
 ```
 
@@ -343,39 +348,6 @@ This generates a form with:
 <input data-disable-with="Saving..." type="submit">
 ```
 
-Dealing with Ajax events
-------------------------
-
-Here are the different events that are fired when you deal with elements
-that have a `data-remote` attribute:
-
-NOTE: All handlers bound to these events are always passed the event object as the
-first argument. The table below describes the extra parameters passed after the
-event argument. For example, if the extra parameters are listed as `xhr, settings`,
-then to access them, you would define your handler with `function(event, xhr, settings)`.
-
-| Event name          | Extra parameters | Fired                                                       |
-|---------------------|------------------|-------------------------------------------------------------|
-| `ajax:before`       |                  | Before the whole ajax business, aborts if stopped.          |
-| `ajax:beforeSend`   | xhr, options     | Before the request is sent, aborts if stopped.              |
-| `ajax:send`         | xhr              | When the request is sent.                                   |
-| `ajax:success`      | xhr, status, err | After completion, if the response was a success.            |
-| `ajax:error`        | xhr, status, err | After completion, if the response was an error.             |
-| `ajax:complete`     | xhr, status      | After the request has been completed, no matter the outcome.|
-| `ajax:aborted:file` | elements         | If there are non-blank file inputs, aborts if stopped.      |
-
-### Stoppable events
-
-If you stop `ajax:before` or `ajax:beforeSend` by returning false from the
-handler method, the Ajax request will never take place. The `ajax:before` event
-is also useful for manipulating form data before serialization. The
-`ajax:beforeSend` event is also useful for adding custom request headers.
-
-If you stop the `ajax:aborted:file` event, the default behavior of allowing the
-browser to submit the form via normal means (i.e. non-Ajax submission) will be
-canceled and the form will not be submitted at all. This is useful for
-implementing your own Ajax file upload workaround.
-
 ### Rails-ujs event handlers
 
 Rails 5.1 introduced rails-ujs and dropped jQuery as a dependency.
@@ -405,6 +377,22 @@ document.body.addEventListener('ajax:success', function(event) {
 })
 ```
 
+NOTE: As of Rails 5.1 and the new `rails-ujs`, the parameters `data, status, xhr`
+have been bundled into `event.detail`. For information about the previously used
+`jquery-ujs` in Rails 5 and earlier, read the [`jquery-ujs` wiki](https://github.com/rails/jquery-ujs/wiki/ajax).
+
+### Stoppable events
+
+If you stop `ajax:before` or `ajax:beforeSend` by returning false from the
+handler method, the Ajax request will never take place. The `ajax:before` event
+can manipulate form data before serialization and the
+`ajax:beforeSend` event is useful for adding custom request headers.
+
+If you stop the `ajax:aborted:file` event, the default behavior of allowing the
+browser to submit the form via normal means (i.e. non-Ajax submission) will be
+canceled and the form will not be submitted at all. This is useful for
+implementing your own Ajax file upload workaround.
+
 Server-Side Concerns
 --------------------
 
diff --git a/railties/CHANGELOG.md b/railties/CHANGELOG.md
index d086248278..70c0f5c67b 100644
--- a/railties/CHANGELOG.md
+++ b/railties/CHANGELOG.md
@@ -1,3 +1,10 @@
+## Rails 5.2.0.beta2 (November 28, 2017) ##
+
+*   No changes.
+
+
+## Rails 5.2.0.beta1 (November 27, 2017) ##
+
 *   Deprecate `after_bundle` callback in Rails plugin templates.
 
     *Yuji Yaginuma*
diff --git a/railties/lib/rails/application.rb b/railties/lib/rails/application.rb
index b1429df18b..293a736bfd 100644
--- a/railties/lib/rails/application.rb
+++ b/railties/lib/rails/application.rb
@@ -174,8 +174,9 @@ module Rails
       # team. Details at https://github.com/rails/rails/pull/6952#issuecomment-7661220
       @caching_key_generator ||=
         if secret_key_base
-          ActiveSupport::CachingKeyGenerator.new \
+          ActiveSupport::CachingKeyGenerator.new(
             ActiveSupport::KeyGenerator.new(secret_key_base, iterations: 1000)
+          )
         else
           ActiveSupport::LegacyKeyGenerator.new(secrets.secret_token)
         end
@@ -265,7 +266,9 @@ module Rails
           "action_dispatch.signed_cookie_digest" => config.action_dispatch.signed_cookie_digest,
           "action_dispatch.cookies_serializer" => config.action_dispatch.cookies_serializer,
           "action_dispatch.cookies_digest" => config.action_dispatch.cookies_digest,
-          "action_dispatch.cookies_rotations" => config.action_dispatch.cookies_rotations
+          "action_dispatch.cookies_rotations" => config.action_dispatch.cookies_rotations,
+          "action_dispatch.content_security_policy" => config.content_security_policy,
+          "action_dispatch.content_security_policy_report_only" => config.content_security_policy_report_only
         )
       end
     end
@@ -400,8 +403,9 @@ module Rails
         secrets.secret_token ||= config.secret_token
 
         if secrets.secret_token.present?
-          ActiveSupport::Deprecation.warn \
+          ActiveSupport::Deprecation.warn(
             "`secrets.secret_token` is deprecated in favor of `secret_key_base` and will be removed in Rails 6.0."
+          )
         end
 
         secrets
@@ -424,8 +428,9 @@ module Rails
       if Rails.env.test? || Rails.env.development?
         Digest::MD5.hexdigest self.class.name
       else
-        validate_secret_key_base \
+        validate_secret_key_base(
           ENV["SECRET_KEY_BASE"] || credentials.secret_key_base || secrets.secret_key_base
+        )
       end
     end
 
@@ -464,10 +469,11 @@ module Rails
     #
     #   Rails.application.encrypted("config/special_tokens.yml.enc", key_path: "config/special_tokens.key")
     def encrypted(path, key_path: "config/master.key", env_key: "RAILS_MASTER_KEY")
-      ActiveSupport::EncryptedConfiguration.new \
+      ActiveSupport::EncryptedConfiguration.new(
         config_path: Rails.root.join(path),
         key_path: Rails.root.join(key_path),
         env_key: env_key
+      )
     end
 
     def to_app #:nodoc:
diff --git a/railties/lib/rails/application/configuration.rb b/railties/lib/rails/application/configuration.rb
index 290ec13878..cbc04f8a48 100644
--- a/railties/lib/rails/application/configuration.rb
+++ b/railties/lib/rails/application/configuration.rb
@@ -16,44 +16,46 @@ module Rails
                     :ssl_options, :public_file_server,
                     :session_options, :time_zone, :reload_classes_only_on_change,
                     :beginning_of_week, :filter_redirect, :x, :enable_dependency_loading,
-                    :read_encrypted_secrets, :log_level
+                    :read_encrypted_secrets, :log_level, :content_security_policy_report_only
 
       attr_reader :encoding, :api_only
 
       def initialize(*)
         super
-        self.encoding                    = Encoding::UTF_8
-        @allow_concurrency               = nil
-        @consider_all_requests_local     = false
-        @filter_parameters               = []
-        @filter_redirect                 = []
-        @helpers_paths                   = []
-        @public_file_server              = ActiveSupport::OrderedOptions.new
-        @public_file_server.enabled      = true
-        @public_file_server.index_name   = "index"
-        @force_ssl                       = false
-        @ssl_options                     = {}
-        @session_store                   = nil
-        @time_zone                       = "UTC"
-        @beginning_of_week               = :monday
-        @log_level                       = :debug
-        @generators                      = app_generators
-        @cache_store                     = [ :file_store, "#{root}/tmp/cache/" ]
-        @railties_order                  = [:all]
-        @relative_url_root               = ENV["RAILS_RELATIVE_URL_ROOT"]
-        @reload_classes_only_on_change   = true
-        @file_watcher                    = ActiveSupport::FileUpdateChecker
-        @exceptions_app                  = nil
-        @autoflush_log                   = true
-        @log_formatter                   = ActiveSupport::Logger::SimpleFormatter.new
-        @eager_load                      = nil
-        @secret_token                    = nil
-        @secret_key_base                 = nil
-        @api_only                        = false
-        @debug_exception_response_format = nil
-        @x                               = Custom.new
-        @enable_dependency_loading       = false
-        @read_encrypted_secrets          = false
+        self.encoding                        = Encoding::UTF_8
+        @allow_concurrency                   = nil
+        @consider_all_requests_local         = false
+        @filter_parameters                   = []
+        @filter_redirect                     = []
+        @helpers_paths                       = []
+        @public_file_server                  = ActiveSupport::OrderedOptions.new
+        @public_file_server.enabled          = true
+        @public_file_server.index_name       = "index"
+        @force_ssl                           = false
+        @ssl_options                         = {}
+        @session_store                       = nil
+        @time_zone                           = "UTC"
+        @beginning_of_week                   = :monday
+        @log_level                           = :debug
+        @generators                          = app_generators
+        @cache_store                         = [ :file_store, "#{root}/tmp/cache/" ]
+        @railties_order                      = [:all]
+        @relative_url_root                   = ENV["RAILS_RELATIVE_URL_ROOT"]
+        @reload_classes_only_on_change       = true
+        @file_watcher                        = ActiveSupport::FileUpdateChecker
+        @exceptions_app                      = nil
+        @autoflush_log                       = true
+        @log_formatter                       = ActiveSupport::Logger::SimpleFormatter.new
+        @eager_load                          = nil
+        @secret_token                        = nil
+        @secret_key_base                     = nil
+        @api_only                            = false
+        @debug_exception_response_format     = nil
+        @x                                   = Custom.new
+        @enable_dependency_loading           = false
+        @read_encrypted_secrets              = false
+        @content_security_policy             = nil
+        @content_security_policy_report_only = false
       end
 
       def load_defaults(target_version)
@@ -71,7 +73,6 @@ module Rails
           end
 
           self.ssl_options = { hsts: { subdomains: true } }
-
         when "5.1"
           load_defaults "5.0"
 
@@ -82,7 +83,6 @@ module Rails
           if respond_to?(:action_view)
             action_view.form_with_generates_remote_forms = true
           end
-
         when "5.2"
           load_defaults "5.1"
 
@@ -106,6 +106,9 @@ module Rails
             action_controller.default_protect_from_forgery = true
           end
 
+          if respond_to?(:action_view)
+            action_view.form_with_generates_ids = true
+          end
         else
           raise "Unknown version #{target_version.to_s.inspect}"
         end
@@ -228,6 +231,10 @@ module Rails
         SourceAnnotationExtractor::Annotation
       end
 
+      def content_security_policy(&block)
+        @content_security_policy ||= ActionDispatch::ContentSecurityPolicy.new(&block)
+      end
+
       class Custom #:nodoc:
         def initialize
           @configurations = Hash.new
diff --git a/railties/lib/rails/application/default_middleware_stack.rb b/railties/lib/rails/application/default_middleware_stack.rb
index ea2273c1f2..0e79ba7da0 100644
--- a/railties/lib/rails/application/default_middleware_stack.rb
+++ b/railties/lib/rails/application/default_middleware_stack.rb
@@ -63,6 +63,10 @@ module Rails
             middleware.use ::ActionDispatch::Flash
           end
 
+          unless config.api_only
+            middleware.use ::ActionDispatch::ContentSecurityPolicy::Middleware
+          end
+
           middleware.use ::Rack::Head
           middleware.use ::Rack::ConditionalGet
           middleware.use ::Rack::ETag, "no-cache"
diff --git a/railties/lib/rails/command/helpers/editor.rb b/railties/lib/rails/command/helpers/editor.rb
index 5e9ecc05e7..6191d97672 100644
--- a/railties/lib/rails/command/helpers/editor.rb
+++ b/railties/lib/rails/command/helpers/editor.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "active_support/encrypted_file"
 
 module Rails
diff --git a/railties/lib/rails/gem_version.rb b/railties/lib/rails/gem_version.rb
index 92b5e0392a..2cc861a1bd 100644
--- a/railties/lib/rails/gem_version.rb
+++ b/railties/lib/rails/gem_version.rb
@@ -10,7 +10,7 @@ module Rails
     MAJOR = 5
     MINOR = 2
     TINY  = 0
-    PRE   = "alpha"
+    PRE   = "beta2"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end
diff --git a/railties/lib/rails/generators.rb b/railties/lib/rails/generators.rb
index 5592e8d78e..6c9c109f17 100644
--- a/railties/lib/rails/generators.rb
+++ b/railties/lib/rails/generators.rb
@@ -274,8 +274,9 @@ module Rails
         else
           options     = sorted_groups.flat_map(&:last)
           suggestions = options.sort_by { |suggested| levenshtein_distance(namespace.to_s, suggested) }.first(3)
+          suggestions.map! { |s| "'#{s}'" }
           msg =  "Could not find generator '#{namespace}'. ".dup
-          msg << "Maybe you meant #{ suggestions.map { |s| "'#{s}'" }.to_sentence(last_word_connector: " or ", locale: :en) }\n"
+          msg << "Maybe you meant #{ suggestions[0...-1].join(', ')} or #{suggestions[-1]}\n"
           msg << "Run `rails generate --help` for more options."
           puts msg
         end
diff --git a/railties/lib/rails/generators/app_base.rb b/railties/lib/rails/generators/app_base.rb
index 73256bec61..b9ae24de59 100644
--- a/railties/lib/rails/generators/app_base.rb
+++ b/railties/lib/rails/generators/app_base.rb
@@ -192,7 +192,7 @@ module Rails
       def webserver_gemfile_entry # :doc:
         return [] if options[:skip_puma]
         comment = "Use Puma as the app server"
-        GemfileEntry.new("puma", "~> 3.7", comment)
+        GemfileEntry.new("puma", "~> 3.11", comment)
       end
 
       def include_all_railties? # :doc:
@@ -297,7 +297,7 @@ module Rails
       def gem_for_database
         # %w( mysql postgresql sqlite3 oracle frontbase ibm_db sqlserver jdbcmysql jdbcsqlite3 jdbcpostgresql )
         case options[:database]
-        when "mysql"          then ["mysql2", [">= 0.3.18", "< 0.5"]]
+        when "mysql"          then ["mysql2", ["~> 0.4.4"]]
         when "postgresql"     then ["pg", ["~> 0.18"]]
         when "oracle"         then ["activerecord-oracle_enhanced-adapter", nil]
         when "frontbase"      then ["ruby-frontbase", nil]
diff --git a/railties/lib/rails/generators/erb/scaffold/templates/_form.html.erb.tt b/railties/lib/rails/generators/erb/scaffold/templates/_form.html.erb.tt
index 0eb9d82bbb..518cb1121e 100644
--- a/railties/lib/rails/generators/erb/scaffold/templates/_form.html.erb.tt
+++ b/railties/lib/rails/generators/erb/scaffold/templates/_form.html.erb.tt
@@ -15,15 +15,15 @@
   <div class="field">
 <% if attribute.password_digest? -%>
     <%%= form.label :password %>
-    <%%= form.password_field :password, id: :<%= field_id(:password) %> %>
+    <%%= form.password_field :password %>
   </div>
 
   <div class="field">
     <%%= form.label :password_confirmation %>
-    <%%= form.password_field :password_confirmation, id: :<%= field_id(:password_confirmation) %> %>
+    <%%= form.password_field :password_confirmation %>
 <% else -%>
     <%%= form.label :<%= attribute.column_name %> %>
-    <%%= form.<%= attribute.field_type %> :<%= attribute.column_name %>, id: :<%= field_id(attribute.column_name) %> %>
+    <%%= form.<%= attribute.field_type %> :<%= attribute.column_name %> %>
 <% end -%>
   </div>
 
diff --git a/railties/lib/rails/generators/named_base.rb b/railties/lib/rails/generators/named_base.rb
index 99165168fd..98fcc95964 100644
--- a/railties/lib/rails/generators/named_base.rb
+++ b/railties/lib/rails/generators/named_base.rb
@@ -114,10 +114,6 @@ module Rails
           "new_#{singular_route_name}_url"
         end
 
-        def field_id(attribute_name)
-          [singular_table_name, attribute_name].join("_")
-        end
-
         def singular_table_name # :doc:
           @singular_table_name ||= (pluralize_table_names? ? table_name.singularize : table_name)
         end
diff --git a/railties/lib/rails/generators/rails/app/app_generator.rb b/railties/lib/rails/generators/rails/app/app_generator.rb
index 1fdfc3ca52..bf4570db90 100644
--- a/railties/lib/rails/generators/rails/app/app_generator.rb
+++ b/railties/lib/rails/generators/rails/app/app_generator.rb
@@ -128,6 +128,7 @@ module Rails
       active_storage_config_exist    = File.exist?("config/storage.yml")
       rack_cors_config_exist         = File.exist?("config/initializers/cors.rb")
       assets_config_exist            = File.exist?("config/initializers/assets.rb")
+      csp_config_exist               = File.exist?("config/initializers/content_security_policy.rb")
 
       config
 
@@ -155,6 +156,10 @@ module Rails
         unless assets_config_exist
           remove_file "config/initializers/assets.rb"
         end
+
+        unless csp_config_exist
+          remove_file "config/initializers/content_security_policy.rb"
+        end
       end
     end
 
@@ -343,6 +348,14 @@ module Rails
         build(:public_directory)
       end
 
+      def create_tmp_files
+        build(:tmp)
+      end
+
+      def create_vendor_files
+        build(:vendor)
+      end
+
       def create_test_files
         build(:test) unless options[:skip_test]
       end
@@ -355,14 +368,6 @@ module Rails
         build(:storage) unless skip_active_storage?
       end
 
-      def create_tmp_files
-        build(:tmp)
-      end
-
-      def create_vendor_files
-        build(:vendor)
-      end
-
       def delete_app_assets_if_api_option
         if options[:api]
           remove_dir "app/assets"
@@ -432,6 +437,7 @@ module Rails
       def delete_non_api_initializers_if_api_option
         if options[:api]
           remove_file "config/initializers/cookies_serializer.rb"
+          remove_file "config/initializers/content_security_policy.rb"
         end
       end
 
diff --git a/railties/lib/rails/generators/rails/app/templates/config/initializers/content_security_policy.rb.tt b/railties/lib/rails/generators/rails/app/templates/config/initializers/content_security_policy.rb.tt
new file mode 100644
index 0000000000..656ded4069
--- /dev/null
+++ b/railties/lib/rails/generators/rails/app/templates/config/initializers/content_security_policy.rb.tt
@@ -0,0 +1,20 @@
+# Define an application-wide content security policy
+# For further information see the following documentation
+# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
+
+Rails.application.config.content_security_policy do |p|
+  p.default_src :self, :https
+  p.font_src    :self, :https, :data
+  p.img_src     :self, :https, :data
+  p.object_src  :none
+  p.script_src  :self, :https
+  p.style_src   :self, :https, :unsafe_inline
+
+  # Specify URI for violation reports
+  # p.report_uri "/csp-violation-report-endpoint"
+end
+
+# Report CSP violations to a specified URI
+# For further information see the following documentation:
+# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only
+# Rails.application.config.content_security_policy_report_only = true
diff --git a/railties/lib/rails/generators/rails/app/templates/config/storage.yml.tt b/railties/lib/rails/generators/rails/app/templates/config/storage.yml.tt
index 9bada4b66d..1c0cde0b09 100644
--- a/railties/lib/rails/generators/rails/app/templates/config/storage.yml.tt
+++ b/railties/lib/rails/generators/rails/app/templates/config/storage.yml.tt
@@ -18,7 +18,7 @@ local:
 # google:
 #   service: GCS
 #   project: your_project
-#   keyfile: <%%= Rails.root.join("path/to/gcs.keyfile") %>
+#   credentials: <%%= Rails.root.join("path/to/gcs.keyfile") %>
 #   bucket: your_own_bucket
 
 # Use rails credentials:edit to set the Azure Storage secret (as azure_storage:storage_access_key)
diff --git a/railties/lib/rails/generators/rails/credentials/credentials_generator.rb b/railties/lib/rails/generators/rails/credentials/credentials_generator.rb
index ab15da5423..01a5b502f9 100644
--- a/railties/lib/rails/generators/rails/credentials/credentials_generator.rb
+++ b/railties/lib/rails/generators/rails/credentials/credentials_generator.rb
@@ -8,7 +8,7 @@ module Rails
   module Generators
     class CredentialsGenerator < Base
       def add_credentials_file
-        unless credentials.exist?
+        unless credentials.content_path.exist?
           template = credentials_template
 
           say "Adding #{credentials.content_path} to store encrypted credentials."
@@ -26,15 +26,18 @@ module Rails
       end
 
       def add_credentials_file_silently(template = nil)
-        credentials.write(credentials_template)
+        unless credentials.content_path.exist?
+          credentials.write(credentials_template)
+        end
       end
 
       private
         def credentials
-          ActiveSupport::EncryptedConfiguration.new \
+          ActiveSupport::EncryptedConfiguration.new(
             config_path: "config/credentials.yml.enc",
             key_path: "config/master.key",
             env_key: "RAILS_MASTER_KEY"
+          )
         end
 
         def credentials_template
diff --git a/railties/lib/rails/tasks/engine.rake b/railties/lib/rails/tasks/engine.rake
index 9db9d78ec4..8d77904210 100644
--- a/railties/lib/rails/tasks/engine.rake
+++ b/railties/lib/rails/tasks/engine.rake
@@ -53,7 +53,7 @@ namespace :db do
   desc "Rolls the schema back to the previous version (specify steps w/ STEP=n)."
   app_task "rollback"
 
-  desc "Create a db/schema.rb file that can be portably used against any DB supported by Active Record"
+  desc "Create a db/schema.rb file that can be portably used against any database supported by Active Record"
   app_task "schema:dump"
 
   desc "Load a schema.rb file into the database"
@@ -62,7 +62,7 @@ namespace :db do
   desc "Load the seed data from db/seeds.rb"
   app_task "seed"
 
-  desc "Create the database, load the schema, and initialize with the seed data (use db:reset to also drop the db first)"
+  desc "Create the database, load the schema, and initialize with the seed data (use db:reset to also drop the database first)"
   app_task "setup"
 
   desc "Dump the database structure to an SQL file"
diff --git a/railties/test/application/configuration_test.rb b/railties/test/application/configuration_test.rb
index bb8cc0876c..edb6190ed0 100644
--- a/railties/test/application/configuration_test.rb
+++ b/railties/test/application/configuration_test.rb
@@ -757,6 +757,68 @@ module ApplicationTests
       assert_match(/label/, last_response.body)
     end
 
+    test "form_with can be configured with form_with_generates_ids" do
+      app_file "config/initializers/form_builder.rb", <<-RUBY
+      Rails.configuration.action_view.form_with_generates_ids = false
+      RUBY
+
+      app_file "app/models/post.rb", <<-RUBY
+      class Post
+        include ActiveModel::Model
+        attr_accessor :name
+      end
+      RUBY
+
+      app_file "app/controllers/posts_controller.rb", <<-RUBY
+      class PostsController < ApplicationController
+        def index
+          render inline: "<%= begin; form_with(model: Post.new) {|f| f.text_field(:name)}; rescue => e; e.to_s; end %>"
+        end
+      end
+      RUBY
+
+      add_to_config <<-RUBY
+        routes.prepend do
+          resources :posts
+        end
+      RUBY
+
+      app "development"
+
+      get "/posts"
+
+      assert_no_match(/id=('|")post_name('|")/, last_response.body)
+    end
+
+    test "form_with outputs ids by default" do
+      app_file "app/models/post.rb", <<-RUBY
+      class Post
+        include ActiveModel::Model
+        attr_accessor :name
+      end
+      RUBY
+
+      app_file "app/controllers/posts_controller.rb", <<-RUBY
+      class PostsController < ApplicationController
+        def index
+          render inline: "<%= begin; form_with(model: Post.new) {|f| f.text_field(:name)}; rescue => e; e.to_s; end %>"
+        end
+      end
+      RUBY
+
+      add_to_config <<-RUBY
+        routes.prepend do
+          resources :posts
+        end
+      RUBY
+
+      app "development"
+
+      get "/posts"
+
+      assert_match(/id=('|")post_name('|")/, last_response.body)
+    end
+
     test "form_with can be configured with form_with_generates_remote_forms" do
       app_file "config/initializers/form_builder.rb", <<-RUBY
       Rails.configuration.action_view.form_with_generates_remote_forms = false
diff --git a/railties/test/application/content_security_policy_test.rb b/railties/test/application/content_security_policy_test.rb
new file mode 100644
index 0000000000..97f2957c33
--- /dev/null
+++ b/railties/test/application/content_security_policy_test.rb
@@ -0,0 +1,197 @@
+# frozen_string_literal: true
+
+require "isolation/abstract_unit"
+require "rack/test"
+
+module ApplicationTests
+  class ContentSecurityPolicyTest < ActiveSupport::TestCase
+    include ActiveSupport::Testing::Isolation
+    include Rack::Test::Methods
+
+    def setup
+      build_app
+    end
+
+    def teardown
+      teardown_app
+    end
+
+    test "default content security policy is empty" do
+      controller :pages, <<-RUBY
+        class PagesController < ApplicationController
+          def index
+            render html: "<h1>Welcome to Rails!</h1>"
+          end
+        end
+      RUBY
+
+      app_file "config/routes.rb", <<-RUBY
+        Rails.application.routes.draw do
+          root to: "pages#index"
+        end
+      RUBY
+
+      app("development")
+
+      get "/"
+      assert_equal ";", last_response.headers["Content-Security-Policy"]
+    end
+
+    test "global content security policy in an initializer" do
+      controller :pages, <<-RUBY
+        class PagesController < ApplicationController
+          def index
+            render html: "<h1>Welcome to Rails!</h1>"
+          end
+        end
+      RUBY
+
+      app_file "config/initializers/content_security_policy.rb", <<-RUBY
+        Rails.application.config.content_security_policy do |p|
+          p.default_src :self, :https
+        end
+      RUBY
+
+      app_file "config/routes.rb", <<-RUBY
+        Rails.application.routes.draw do
+          root to: "pages#index"
+        end
+      RUBY
+
+      app("development")
+
+      get "/"
+      assert_policy "default-src 'self' https:;"
+    end
+
+    test "global report only content security policy in an initializer" do
+      controller :pages, <<-RUBY
+        class PagesController < ApplicationController
+          def index
+            render html: "<h1>Welcome to Rails!</h1>"
+          end
+        end
+      RUBY
+
+      app_file "config/initializers/content_security_policy.rb", <<-RUBY
+        Rails.application.config.content_security_policy do |p|
+          p.default_src :self, :https
+        end
+
+        Rails.application.config.content_security_policy_report_only = true
+      RUBY
+
+      app_file "config/routes.rb", <<-RUBY
+        Rails.application.routes.draw do
+          root to: "pages#index"
+        end
+      RUBY
+
+      app("development")
+
+      get "/"
+      assert_policy "default-src 'self' https:;", report_only: true
+    end
+
+    test "override content security policy in a controller" do
+      controller :pages, <<-RUBY
+        class PagesController < ApplicationController
+          content_security_policy do |p|
+            p.default_src "https://example.com"
+          end
+
+          def index
+            render html: "<h1>Welcome to Rails!</h1>"
+          end
+        end
+      RUBY
+
+      app_file "config/initializers/content_security_policy.rb", <<-RUBY
+        Rails.application.config.content_security_policy do |p|
+          p.default_src :self, :https
+        end
+      RUBY
+
+      app_file "config/routes.rb", <<-RUBY
+        Rails.application.routes.draw do
+          root to: "pages#index"
+        end
+      RUBY
+
+      app("development")
+
+      get "/"
+      assert_policy "default-src https://example.com;"
+    end
+
+    test "override content security policy to report only in a controller" do
+      controller :pages, <<-RUBY
+        class PagesController < ApplicationController
+          content_security_policy_report_only
+
+          def index
+            render html: "<h1>Welcome to Rails!</h1>"
+          end
+        end
+      RUBY
+
+      app_file "config/initializers/content_security_policy.rb", <<-RUBY
+        Rails.application.config.content_security_policy do |p|
+          p.default_src :self, :https
+        end
+      RUBY
+
+      app_file "config/routes.rb", <<-RUBY
+        Rails.application.routes.draw do
+          root to: "pages#index"
+        end
+      RUBY
+
+      app("development")
+
+      get "/"
+      assert_policy "default-src 'self' https:;", report_only: true
+    end
+
+    test "global content security policy added to rack app" do
+      app_file "config/initializers/content_security_policy.rb", <<-RUBY
+        Rails.application.config.content_security_policy do |p|
+          p.default_src :self, :https
+        end
+      RUBY
+
+      app_file "config/routes.rb", <<-RUBY
+        Rails.application.routes.draw do
+
+          app = ->(env) {
+            [200, { "Content-Type" => "text/html" }, ["<p>Hello, World!</p>"]]
+          }
+
+          root to: app
+        end
+      RUBY
+
+      app("development")
+
+      get "/"
+      assert_policy "default-src 'self' https:;"
+    end
+
+    private
+
+      def assert_policy(expected, report_only: false)
+        assert_equal 200, last_response.status
+
+        if report_only
+          expected_header = "Content-Security-Policy-Report-Only"
+          unexpected_header = "Content-Security-Policy"
+        else
+          expected_header = "Content-Security-Policy"
+          unexpected_header = "Content-Security-Policy-Report-Only"
+        end
+
+        assert_nil last_response.headers[unexpected_header]
+        assert_equal expected, last_response.headers[expected_header]
+      end
+  end
+end
diff --git a/railties/test/application/middleware_test.rb b/railties/test/application/middleware_test.rb
index 0a5a524692..470a5326c6 100644
--- a/railties/test/application/middleware_test.rb
+++ b/railties/test/application/middleware_test.rb
@@ -42,6 +42,7 @@ module ApplicationTests
         "ActionDispatch::Cookies",
         "ActionDispatch::Session::CookieStore",
         "ActionDispatch::Flash",
+        "ActionDispatch::ContentSecurityPolicy::Middleware",
         "Rack::Head",
         "Rack::ConditionalGet",
         "Rack::ETag"
diff --git a/railties/test/commands/credentials_test.rb b/railties/test/commands/credentials_test.rb
index 4ef827fcf1..f1bb1ef08a 100644
--- a/railties/test/commands/credentials_test.rb
+++ b/railties/test/commands/credentials_test.rb
@@ -39,6 +39,14 @@ class Rails::Command::CredentialsCommandTest < ActiveSupport::TestCase
     end
   end
 
+  test "edit command does not overwrite by default if credentials already exists" do
+    run_edit_command(editor: "eval echo api_key: abc >")
+    assert_match(/api_key: abc/, run_show_command)
+
+    run_edit_command
+    assert_match(/api_key: abc/, run_show_command)
+  end
+
   private
     def run_edit_command(editor: "cat")
       switch_env("EDITOR", editor) do
diff --git a/railties/test/generators/api_app_generator_test.rb b/railties/test/generators/api_app_generator_test.rb
index 7791d472d8..4815cf6362 100644
--- a/railties/test/generators/api_app_generator_test.rb
+++ b/railties/test/generators/api_app_generator_test.rb
@@ -72,6 +72,7 @@ class ApiAppGeneratorTest < Rails::Generators::TestCase
 
     assert_no_file "config/initializers/cookies_serializer.rb"
     assert_no_file "config/initializers/assets.rb"
+    assert_no_file "config/initializers/content_security_policy.rb"
   end
 
   def test_app_update_does_not_generate_unnecessary_bin_files
@@ -149,6 +150,7 @@ class ApiAppGeneratorTest < Rails::Generators::TestCase
          bin/yarn
          config/initializers/assets.rb
          config/initializers/cookies_serializer.rb
+         config/initializers/content_security_policy.rb
          lib/assets
          test/helpers
          tmp/cache/assets
diff --git a/railties/test/generators/app_generator_test.rb b/railties/test/generators/app_generator_test.rb
index fddfab172e..774fd0f315 100644
--- a/railties/test/generators/app_generator_test.rb
+++ b/railties/test/generators/app_generator_test.rb
@@ -56,6 +56,7 @@ DEFAULT_APP_FILES = %w(
   config/initializers/assets.rb
   config/initializers/backtrace_silencers.rb
   config/initializers/cookies_serializer.rb
+  config/initializers/content_security_policy.rb
   config/initializers/filter_parameter_logging.rb
   config/initializers/inflections.rb
   config/initializers/mime_types.rb
@@ -403,7 +404,7 @@ class AppGeneratorTest < Rails::Generators::TestCase
     if defined?(JRUBY_VERSION)
       assert_gem "activerecord-jdbcmysql-adapter"
     else
-      assert_gem "mysql2", "'>= 0.3.18', '< 0.5'"
+      assert_gem "mysql2", "'~> 0.4.4'"
     end
   end
 
@@ -457,7 +458,7 @@ class AppGeneratorTest < Rails::Generators::TestCase
 
   def test_generator_defaults_to_puma_version
     run_generator [destination_root]
-    assert_gem "puma", "'~> 3.7'"
+    assert_gem "puma", "'~> 3.11'"
   end
 
   def test_generator_if_skip_puma_is_given
diff --git a/railties/test/generators/scaffold_generator_test.rb b/railties/test/generators/scaffold_generator_test.rb
index b6294c3b94..29426cd99f 100644
--- a/railties/test/generators/scaffold_generator_test.rb
+++ b/railties/test/generators/scaffold_generator_test.rb
@@ -471,8 +471,8 @@ class ScaffoldGeneratorTest < Rails::Generators::TestCase
     end
 
     assert_file "app/views/accounts/_form.html.erb" do |content|
-      assert_match(/^\W{4}<%= form\.text_field :name, id: :account_name %>/, content)
-      assert_match(/^\W{4}<%= form\.text_field :currency_id, id: :account_currency_id %>/, content)
+      assert_match(/^\W{4}<%= form\.text_field :name %>/, content)
+      assert_match(/^\W{4}<%= form\.text_field :currency_id %>/, content)
     end
   end
 
@@ -495,8 +495,8 @@ class ScaffoldGeneratorTest < Rails::Generators::TestCase
     end
 
     assert_file "app/views/users/_form.html.erb" do |content|
-      assert_match(/<%= form\.password_field :password, id: :user_password %>/, content)
-      assert_match(/<%= form\.password_field :password_confirmation, id: :user_password_confirmation %>/, content)
+      assert_match(/<%= form\.password_field :password %>/, content)
+      assert_match(/<%= form\.password_field :password_confirmation %>/, content)
     end
 
     assert_file "app/views/users/index.html.erb" do |content|
diff --git a/railties/test/generators_test.rb b/railties/test/generators_test.rb
index 28e7617d7f..1735804664 100644
--- a/railties/test/generators_test.rb
+++ b/railties/test/generators_test.rb
@@ -36,6 +36,19 @@ class GeneratorsTest < Rails::Generators::TestCase
     assert_match "Maybe you meant 'migration'", output
   end
 
+  def test_generator_suggestions_except_en_locale
+    orig_available_locales = I18n.available_locales
+    orig_default_locale = I18n.default_locale
+    I18n.available_locales = :ja
+    I18n.default_locale = :ja
+    name = :tas
+    output = capture(:stdout) { Rails::Generators.invoke name }
+    assert_match "Maybe you meant 'task', 'job' or", output
+  ensure
+    I18n.available_locales = orig_available_locales
+    I18n.default_locale = orig_default_locale
+  end
+
   def test_generator_multiple_suggestions
     name = :tas
     output = capture(:stdout) { Rails::Generators.invoke name }
diff --git a/version.rb b/version.rb
index 92b5e0392a..2cc861a1bd 100644
--- a/version.rb
+++ b/version.rb
@@ -10,7 +10,7 @@ module Rails
     MAJOR = 5
     MINOR = 2
     TINY  = 0
-    PRE   = "alpha"
+    PRE   = "beta2"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end