Repository: rails/rails
File: activerecord/lib/active_record/railtie.rb (Ruby)

Code before:
          # but sometimes it does. In case it did, we want to empty out the
          # connection pools so that a non-database-using process (e.g. a master
          # process in a forking server model) doesn't retain a needless
          # connection. If it was needed, the incremental cost of reestablishing
          # this connection is trivial: the rest of the pool would need to be
          # populated anyway.

          connection_handler.clear_active_connections!(:all)
          connection_handler.flush_idle_connections!(:all)
        end
      end
    end

    initializer "active_record.set_filter_attributes" do
      ActiveSupport.on_load(:active_record) do
        self.filter_attributes += Rails.application.config.filter_parameters
      end
    end

    initializer "active_record.set_signed_id_verifier" do
      config.after_initialize do |app|
        ActiveSupport.on_load(:active_record) do
          secret = self.signed_id_verifier_secret
          secret_generator = if secret
            ActiveRecord.deprecator.warn(<<~MSG)
              ActiveRecord::Base.signed_id_verifier_secret is deprecated and will be removed in Rails ?.?. The secret will be derived from 'secret_key_base' instead.
            MSG
            secret.respond_to?(:call) ? secret : -> (_) { secret }
          end
          legacy_options = { secret_generator: secret_generator, digest: "SHA256", serializer: JSON, url_safe: true }.compact

          if self.use_legacy_signed_id_verifier == :generate_and_verify
            app.message_verifiers.prepend { |salt| legacy_options if salt == "active_record/signed_id" }
          elsif self.use_legacy_signed_id_verifier == :verify
            app.message_verifiers.rotate { |salt| legacy_options if salt == "active_record/signed_id" }
          end

          self.signed_id_verifier ||= app.message_verifier("active_record/signed_id")
        end
      end
    end

    initializer "active_record.generated_token_verifier" do
      config.after_initialize do |app|
        ActiveSupport.on_load(:active_record) do
          self.generated_token_verifier ||= app.message_verifier("active_record/token_for")
        end
      end
    end

    initializer "active_record_encryption.configuration" do |app|

Review comment (security):
❓ What is the Rails version that we can remove `signed_id_verifier_secret`?

Code after:
        ActiveSupport.on_load(:active_record) do
          # Ideally the application doesn't connect to the database during boot,
          # but sometimes it does. In case it did, we want to empty out the
          # connection pools so that a non-database-using process (e.g. a master
          # process in a forking server model) doesn't retain a needless
          # connection. If it was needed, the incremental cost of reestablishing
          # this connection is trivial: the rest of the pool would need to be
          # populated anyway.

          connection_handler.clear_active_connections!(:all)
          connection_handler.flush_idle_connections!(:all)
        end
      end
    end

    initializer "active_record.set_filter_attributes" do
      ActiveSupport.on_load(:active_record) do
        self.filter_attributes += Rails.application.config.filter_parameters
      end
    end

    initializer "active_record.configure_message_verifiers" do |app|
      ActiveRecord.message_verifiers = app.message_verifiers

      use_legacy_signed_id_verifier = app.config.active_record.use_legacy_signed_id_verifier
      legacy_options = { digest: "SHA256", serializer: JSON, url_safe: true }

      if use_legacy_signed_id_verifier == :generate_and_verify
        app.message_verifiers.prepend { |salt| legacy_options if salt == "active_record/signed_id" }
      elsif use_legacy_signed_id_verifier == :verify
        app.message_verifiers.rotate { |salt| legacy_options if salt == "active_record/signed_id" }
      elsif use_legacy_signed_id_verifier
        raise ArgumentError, "Unrecognized value for config.active_record.use_legacy_signed_id_verifier: #{use_legacy_signed_id_verifier.inspect}"
      end
    end

    initializer "active_record.generated_token_verifier" do
      config.after_initialize do |app|
        ActiveSupport.on_load(:active_record) do
          self.generated_token_verifier ||= app.message_verifier("active_record/token_for")
        end
      end
    end

    initializer "active_record_encryption.configuration" do |app|
      ActiveSupport.on_load(:active_record_encryption) do
        ActiveRecord::Encryption.configure(
          primary_key: app.credentials.dig(:active_record_encryption, :primary_key),
          deterministic_key: app.credentials.dig(:active_record_encryption, :deterministic_key),
          key_derivation_salt: app.credentials.dig(:active_record_encryption, :key_derivation_salt),
          **app.config.active_record.encryption