Track the version-compatible config settings inside railties

railties/lib/rails/application/configuration.rb

@@ -55,6 +55,34 @@ def initialize(*)
         @read_encrypted_secrets          = false
       end
 
+      def load_defaults(target_version)
+        case target_version.to_s
+        when "5.0"
+          if defined?(action_controller)
+            action_controller.per_form_csrf_tokens = true
+            action_controller.forgery_protection_origin_check = true
+          end
+
+          ActiveSupport.to_time_preserves_timezone = true
+
+          if defined?(active_record)
+            active_record.belongs_to_required_by_default = true
+          end
+
+          self.ssl_options = { hsts: { subdomains: true } }
+
+        when "5.1"
+          load_defaults "5.0"
+
+          if defined?(assets)
+            assets.unknown_asset_fallback = false
+          end
+
+        else
+          raise "Unknown version #{target_version.to_s.inspect}"
+        end
+      end
+
       def encoding=(value)
         @encoding = value
         silence_warnings do

railties/lib/rails/generators/rails/app/app_generator.rb

@@ -371,6 +371,14 @@ def delete_api_initializers
         end
       end
 
+      def delete_new_framework_defaults
+        # Sprockets owns the only new default for 5.1: if it's disabled,
+        # we don't want the file.
+        unless options[:update] && !options[:skip_sprockets]
+          remove_file "config/initializers/new_framework_defaults_5_1.rb"
+        end
+      end
+
       def delete_bin_yarn_if_skip_yarn_option
         remove_file "bin/yarn" if options[:skip_yarn]
       end

railties/lib/rails/generators/rails/app/templates/config/application.rb

@@ -22,6 +22,9 @@
 
 module <%= app_const_base %>
   class Application < Rails::Application
+    # Initialize configuration defaults for originally generated Rails version.
+    config.load_defaults <%= Rails::VERSION::STRING.to_f %>
+
     # Settings in config/environments/* take precedence over those specified here.
     # Application configuration should go into files in config/initializers
     # -- all .rb files in that directory are automatically loaded.

railties/lib/rails/generators/rails/app/templates/config/initializers/new_framework_defaults_5_1.rb.tt

@@ -0,0 +1,13 @@
+# Be sure to restart your server when you modify this file.
+#
+# This file contains migration options to ease your Rails 5.1 upgrade.
+#
+# Once upgraded flip defaults one by one to migrate to the new default.
+#
+# Read the Guide for Upgrading Ruby on Rails for more info on each option.
+<%- unless options[:skip_sprockets] -%>
+
+# Unknown asset fallback will return the path passed in when the given
+# asset is not present in the asset pipeline.
+# Rails.application.config.assets.unknown_asset_fallback = false
+<%- end -%>

railties/test/generators/api_app_generator_test.rb

@@ -61,15 +61,6 @@ def test_generator_if_skip_action_cable_is_given
     end
   end
 
-  def test_generator_skips_per_form_csrf_token_and_origin_check_configs_for_api_apps
-    run_generator
-
-    assert_file "config/initializers/new_framework_defaults.rb" do |initializer_content|
-      assert_no_match(/per_form_csrf_tokens/, initializer_content)
-      assert_no_match(/forgery_protection_origin_check/, initializer_content)
-    end
-  end
-
   private
 
     def default_files

railties/test/generators/app_generator_test.rb

@@ -156,6 +156,10 @@ def test_new_application_not_include_api_initializers
     assert_no_file "config/initializers/cors.rb"
   end
 
+  def test_new_application_doesnt_need_defaults
+    assert_no_file "config/initializers/new_framework_defaults_5_1.rb"
+  end
+
   def test_app_update_keep_the_cookie_serializer_if_it_is_already_configured
     app_root = File.join(destination_root, "myapp")
     run_generator [app_root]
@@ -197,21 +201,18 @@ def test_app_update_dont_set_file_watcher
     end
   end
 
-  def test_app_update_does_not_create_new_framework_defaults_by_default
+  def test_app_update_create_new_framework_defaults
     app_root = File.join(destination_root, "myapp")
     run_generator [app_root]
 
-    FileUtils.rm("#{app_root}/config/initializers/new_framework_defaults.rb")
+    assert_no_file "#{app_root}/config/initializers/new_framework_defaults_5_1.rb"
 
     stub_rails_application(app_root) do
       generator = Rails::Generators::AppGenerator.new ["rails"], { update: true }, destination_root: app_root, shell: @shell
       generator.send(:app_const)
       quietly { generator.send(:update_config_files) }
 
-      assert_file "#{app_root}/config/initializers/new_framework_defaults.rb" do |content|
-        assert_match(/Rails\.application\.config.active_record\.belongs_to_required_by_default = false/, content)
-        assert_no_match(/Rails\.application\.config\.ssl_options/, content)
-      end
+      assert_file "#{app_root}/config/initializers/new_framework_defaults_5_1.rb"
     end
   end
 
@@ -367,10 +368,6 @@ def test_generator_if_skip_active_record_is_given
     assert_file "bin/update" do |update_content|
       assert_no_match(/db:migrate/, update_content)
     end
-
-    assert_file "config/initializers/new_framework_defaults.rb" do |initializer_content|
-      assert_no_match(/belongs_to_required_by_default/, initializer_content)
-    end
   end
 
   def test_generator_if_skip_action_mailer_is_given
@@ -415,9 +412,7 @@ def test_generator_if_skip_sprockets_is_given
       assert_no_match(/config\.assets\.js_compressor = :uglifier/, content)
       assert_no_match(/config\.assets\.css_compressor = :sass/, content)
     end
-    assert_file "config/initializers/new_framework_defaults.rb" do |content|
-      assert_no_match(/unknown_asset_fallback/, content)
-    end
+    assert_no_file "config/initializers/new_framework_defaults_5_1.rb"
   end
 
   def test_generator_if_skip_yarn_is_given