- Deprecate
EscapeUtils.escape_urlandEscapeUtils.unescape_urlgiven that Ruby 2.5 provides an optimizedCGI.escapeandCGI.unescapewith mostly similar performance. - Don't patch
URI.escapeandURI.unescapeif they don't already exist. - Add
EscapeUtils.escape_html_onceandEscapeUtils.rb_eu_escape_html_once_as_html_safeas faster implementations of Railsescape_oncehelper. - Deprecate
escape_htmlandescape_html_as_html_safegiven that Ruby 2.5 optimizedCGI.escapeHTMLto be twice faster than theEscapeUtilsimplementation. - Deprecate
unescape_htmlgiven that Ruby 2.5 optimizedCGI.unescapeHTMLto be only 40% slower than thEscapeUtilsimplementation. - Deprecate
escape_html_as_html_safeas well. - Deprecate
EscapeUtils.html_safe, there's no reason to escape for slashes/in 2022.
- Update EscapeUtils.escape_javascript to match Rails
escape_javascriptNow escapes, Backquotes (```), Dollar ($), `U+2000` and `U+2001` - Make the Rack monkey patch a noop as it's no longer correct since circa 2011.
- Require Ruby 2.5+
- Stop escaping
~likeCGI.escapedoes since Ruby 2.5
- Historical version