heartcombo/simple_form · warning

[SIMPLE_FORM] SimpleForm.file_methods is deprecated and has

Error message

[SIMPLE_FORM] SimpleForm.file_methods is deprecated and has no effect.

Since version 5, Simple Form now supports automatically discover of file inputs for the following Gems: activestorage, carrierwave, paperclip, refile and shrine.
If you are using a custom method that is not from one of the supported Gems, please change your forms to pass the input type explicitly:

    <%= form.input :avatar, as: :file %>

See http://blog.plataformatec.com.br/2019/09/incorrect-access-control-in-simple-form-cve-2019-16676 for more information.

What it means

Before v5, SimpleForm.file_methods listed methods (avatar?, avatar_changed?) used to guess that an attribute should render as a file input. That guess enabled an HTML-injection vulnerability (CVE-2019-16676), so it was removed: file inputs are auto-detected only for activestorage, carrierwave, paperclip, refile and shrine. The setter now only emits this deprecation warning — the assigned value has no effect (lib/simple_form.rb:279-282).

Source

Thrown at lib/simple_form.rb:280

  end

  def self.additional_classes_for(component)
    generate_additional_classes_for.include?(component) ? yield : []
  end

  ## SETUP

  def self.default_input_size=(*)
    SimpleForm.deprecator.warn "[SIMPLE_FORM] SimpleForm.default_input_size= is deprecated and has no effect", caller
  end

  def self.form_class=(value)
    SimpleForm.deprecator.warn "[SIMPLE_FORM] SimpleForm.form_class= is deprecated and will be removed in 4.x. Use SimpleForm.default_form_class= instead", caller
    @@form_class = value
  end

  def self.file_methods=(file_methods)
    SimpleForm.deprecator.warn(FILE_METHODS_DEPRECATION_WARN, caller)
    @@file_methods = file_methods
  end

  def self.file_methods
    SimpleForm.deprecator.warn(FILE_METHODS_DEPRECATION_WARN, caller)
    @@file_methods
  end

  # Default way to setup Simple Form. Run rails generate simple_form:install
  # to create a fresh initializer with all configuration values.
  def self.setup
    @@configured = true
    yield self
  end

  # Includes a component to be used by Simple Form. Methods defined in a
  # component will be exposed to be used in the wrapper as Simple::Components
  #

View on GitHub (pinned to 18f38aad0b)

Solutions

1. Delete the config.file_methods = ... line from config/initializers/simple_form.rb
2. For attributes that were detected by custom methods, pass the type explicitly in the form: <%= form.input :avatar, as: :file %>
3. Regenerate the initializer with `rails generate simple_form:install` and diff against the old one to sweep every removed setting

Example fix

# before (config/initializers/simple_form.rb)
config.file_methods = [/^.+(_cache|_changed|\?)$/]

# after
# line deleted: file inputs are auto-detected for activestorage, carrierwave,
# paperclip, refile and shrine. Custom detection becomes explicit:
#   <%= form.input :avatar, as: :file %>

# boot check for stale initializer keys
initializer = Rails.root.join('config/initializers/simple_form.rb')
if File.exist?(initializer) && File.read(initializer) =~ /\bfile_methods\b/
  Rails.logger.warn('simple_form: file_methods has no effect since v5 — pass `as: :file` explicitly')
end

When it happens

Trigger: A pre-5.0 initializer containing config.file_methods = [/^.+(_cache|_changed|\?)$/] running under simple_form 5+; application code or a gem assigning SimpleForm.file_methods = ... at boot.

Common situations: Upgrading an app from simple_form 3.x/4.x to 5+ without regenerating the initializer; copy-pasted initializer content from old blog posts; custom file-detection methods that silently stop working after the upgrade.

Related errors

• %{name} method now accepts a `wrapper_options` argument. The
• %{name} method now accepts a `wrapper_options` argument. The
• Couldn't find wrapper with name #{name}
• SimpleForm.include_component expects a module but got: #{com
• Association cannot be used in forms not associated with an o

AI-assisted analysis of heartcombo/simple_form@18f38aad0b (2026-08-21). Data as JSON: /api/errors/10e026cbd8ae29d7. Report an issue: GitHub.