Update dependency rails to v8.1.3.1 #63
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/ruby-on-rails-packages"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
8.1.3→8.1.3.1Release Notes
rails/rails (rails)
v8.1.3.1: 8.1.3.1Compare Source
Active Support
Active Model
Active Record
Action View
Action Pack
Active Job
Action Mailer
Action Cable
Active Storage
Disable libvips's unfuzzed image loaders and savers.
libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only
safe for trusted content. Active Storage will call
Vips.block_untrusted(true)to disable themwhile booting. An application that needs a specific loader or saver may re-enable it in an
initializer.
This is a breaking change for applications that process image types with an unfuzzed loader or
saver. Variant transformation of BMP, ICO, and PSD attachments will raise
Vips::Error, andanalysis of these and other types such as SVG, JPEG XL, JPEG 2000, and Netpbm will no longer
record
widthandheight. Requesting an unfuzzed output format, typically FITS, JXL, oranything delegated to ImageMagick, will also raise
Vips::Error. Attaching, storing, anddownloading are unchanged.
An application seeing
Vips::Errorraised during image transformation may wish to remove theaffected content types from
config.active_storage.variable_content_typesin an initializer.Active Storage will then treat those attachments as not variable and will not generate variants
for them. This most often matters to an application that transforms images during a request
rather than in a background job, where the failure surfaces as an error response instead of a
failed job.
Applications using the
:mini_magickvariant processor will see no change in how theirattachments are processed, but the loaders and savers will be disabled process-wide whenever
ruby-vips is installed, and the version requirements below will still apply. Such an application
may remove ruby-vips from its Gemfile to avoid both.
The minimum supported version of libvips is now 8.13, and the minimum supported version of
ruby-vips is now 2.2.1. These are the earliest versions that are capable of disabling untrusted
operations. When ruby-vips is installed and either minimum is not met, Active Storage will raise
a
RuntimeErrorwhile booting rather than run in an unsecurable environment.[GHSA-xr9x-r78c-5hrm]
[CVE-2026-66066]
Mike Dalessio
Action Mailbox
Action Text
Railties
Guides
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.