Since Ransack 4.0, you have to explicitly declare which columns and associations are "ransackable". This breaking change can be a pain if you're upgrading from version 3 and have a lot of models. To both ease the transition and make it easier going forward, if your model is 100% "fine" with all columns and relations being filtered by ransack, you can extend this module to effectively bring back the old behavior:

module RansackAllowAll
  def ransackable_attributes(_auth_object=nil)
    @ransackable_attributes ||= authorizable_ransackable_attributes
  end

  def ransackable_associations(_auth_object=nil)
    @ransackable_associations ||= authorizable_ransackable_associations
  end
end


class Order < ApplicationRecord
  extend RansackAllowAll
  # ...
end

If you want to, for example, allow all columns but allow only certain relations, you can still override and define your own ransackable_associations or ransackable_attributes class methods.

Full ransack docs can be found here.