[Bug][ActiveSupport] Digest::UUID namespaced UUID (v3 and v5) generation

Hi all,

A while ago I’ve opened an issue and proposed a fix to a bug I have faced in the namespaced UUID generation logic that is implemented in the Digest::UUID. I would like to know if there’s interest in having it merged.

Since I haven’t received any feedback from the reviewers for a long time already but other people have reached out from time to time vouching for this, I assume this is a recurring pain.

Please, let me know if any change would be required. I’ll be happy to fix the conflicts to get it ready to be merged.

Issue: Namespaced UUIDs are not generated correctly when the namespace ID provided is the string representation of a UUID · Issue #37681 · rails/rails · GitHub

PR: Fixes namespaced UUID generation for namespace IDs represented as strings by erichmachado · Pull Request #37682 · rails/rails · GitHub

It would be worth considering what the right default behavior should be.

I get that people who have already shipped with the buggy code will have lots of problems if the correct behavior becomes the default. However, having the buggy code continue to be the default is probably inadvertently painting new deployment into a corner. UUID versions are standardized for a reason.

Perhaps ship the corrected code as the default for Rails 7? That seems appropriate for breaking changes.

This is being addressed in the PR as well. That flag was raised in this comment and I’ve implemented a configuration option to toggle it, which would be enabled by default for new apps. Here’s a snippet from the updated CHANGELOG.md:

The new behavior will be enabled by setting the config.active_support.use_rfc4122_namespaced_uuids option to true and is the default for new apps.

Also, if the new behaviour is disabled and the user calls Digest::UUID.uuid_v3 or Digest::UUID.uuid_v5 with a UUID namespace that is different than one of the pre-defined constants, there will be a deprecation warning. No warning will appear if the user just relies on the pre-defined constants, even if the fix is not enabled.