test case for #limit added - picking latest value from limit
Default I18n.enforce_available_locales to true

We will default this option to true from now on to ensure users properly
handle their list of available locales whenever necessary. This option
was added as a security measure and thus Rails will follow it defaulting
to secure option.

Also improve the handling of I18n config options in its railtie, taking
the new enforce_available_locales option into account, by setting it as
the last one in the process. This ensures no other configuration will
trigger a deprecation warning due to that setting.
Disable available locales checks to avoid warnings running the tests
Add changelog and upgrading notice related to I18n enforce_available_locales handling
Require I18n >= 0.6.9

The option enforce_available_locales is only available on latest
versions, so require the last available one which has the option +
other related fixes and should not have backward compatibility issues.
Merge pull request #13343 from akshay-vishnoi/test-cases

test case for #limit added - picking latest value from limit
concern doesn't include the module automatically

[ci skip]
Create a blacklist to disallow mutator methods to be delegated to `Array`.

This change was necessary because the whitelist wouldn't work.
It would be painful for users trying to update their applications.

This blacklist intent to prevent odd bugs and confusion in code that call mutator
methods directely on the `Relation`.
Merge pull request #13341 from carlosantoniodasilva/ca-i18n

Default I18n.enforce_available_locales to true

We will default this option to true from now on to ensure users properly handle their list of available locales whenever necessary. This option was added as a security measure and thus Rails will follow it defaulting to secure option.

Also improve the handling of I18n config options in its railtie, taking the new enforce_available_locales option into account, by setting it as the last one in the process. This ensures no other configuration will trigger a deprecation warning due to that setting.
Some assorted fixes for the 4.1 release notes:

* Added release notes for secrets.yml and mentioned it in the highlights
* Added release notes for Mailer previews and mentioned it in the highlights
* Added release notes for Module#concerning
* Removed mention for AV extraction from the highlights
* Rearranged the major features to put highlighted features first
* Various improvements and typo fixes

[ci skip]
Merge pull request #13346 from chancancode/release_notes_etc

Release notes fixes [ci skip]
Add changelog entries about secrets.yml and secrets.secret_key_base
Merge pull request #13314 from laurocaetano/blacklist_array_methods

Create a blacklist to disallow mutator methods to be delegated to Array

Conflicts:
	guides/source/upgrading_ruby_on_rails.md
CSRF protection from cross-origin <script> tags

Thanks to @homakov for sounding the alarm about JSONP-style data leaking
Merge pull request #13345 from jeremy/get-csrf

CSRF protection from cross-origin <script> tags
Fix integration test to pass same-origin verification
Discuss Action Pack's new CSRF protection from remote script tags and what it means for your app. In short, update your tests if they don't already use the 'xhr :post' style.
Mention new CSRF protection gotcha in upgrade guide
Clearly limit new CSRF protection to GET requests
Remove the navigator for now. Its ugly and it promises more than it can deliver. These other views (properties, routes) are not designed to be loaded in isolation