- Active Storage now blocks libvips's unfuzzed image loaders and savers by default for security
- Image variant transformation for BMP, ICO, and PSD files will raise errors
- Image analysis no longer records dimensions for SVG, JPEG XL, JPEG 2000, Netpbm, and other untrusted formats
- Minimum libvips version is now 8.13 and ruby-vips is now 2.2.1
what breaks
Applications processing BMP, ICO, PSD, SVG, JPEG XL, JPEG 2000, Netpbm, FITS, JXL, or ImageMagick-delegated formats with libvips will experience failures during image transformation and analysis. This affects any app using Active Storage with image variants on these content types.
to upgrade
If your application processes affected image types, remove them from config.active_storage.variable_content_types in an initializer to treat them as non-variable. Alternatively, upgrade libvips to 8.13+ and ruby-vips to 2.2.1+. Applications using :mini_magick can remove ruby-vips from their Gemfile to avoid the process-wide restrictions.
- Fixed JSON serialization of hashes with custom object keys to use the key's string representation instead of its as_json output
- Fixed inflections to better handle overlapping acronyms like USD and USDC
- Fixed Marshal deserialization of ActiveRecord::Type::Integer objects that were serialized under Rails 8.0
- Fixed PostgreSQL schema dumping for foreign key references that span different schemas
changelog ↗- Fixed multiple security vulnerabilities across Active Support, Action View, Action Pack, and Active Storage
- Improved NumberToDelimitedConverter performance
- Active Storage now limits range requests to single ranges and enforces maximum streaming chunk size of 100mb by default
- DiskService now prevents path traversal attacks and glob injection in delete_prefixed
what breaks
Code relying on DiskService#delete_prefixed to expand glob metacharacters will break, as glob metacharacters are now escaped. DiskService#path_for now raises InvalidKeyError (instead of potentially ArgumentError or Encoding::CompatibilityError) for invalid keys.
to upgrade
Review any code using DiskService#delete_prefixed that may depend on glob metacharacter expansion. Update exception handling for DiskService#path_for to expect InvalidKeyError instead of ArgumentError or Encoding::CompatibilityError.
- Fixed multiple bugs in Active Support including TimeWithZone JSON/XML serialization, inflector handling with international characters, and delegate behavior in BasicObject subclasses
- Fixed Active Record issues with enum float values, PostgreSQL schema_search_path reapplication, SQLite3 schema dumps, and eager loading with composite primary keys
- Fixed Action View file_field mime type handling and strict locals parsing
- Added config.action_controller.live_streaming_excluded_keys to control state sharing in ActionController::Live
changelog ↗- Action View now respects the remove_hidden_field_autocomplete config in form builder hidden_field
- Action Pack allows methods starting with underscore to be action methods again (fixes unintended regression)
- Railties no longer forces SSL in production by default when using Kamal deployments
changelog ↗No changelog text published for this release.
No changelog text published for this release.
No changelog text published for this release.
- Active Storage now blocks libvips's unfuzzed image loaders and savers by default for security
- Image variant transformation for BMP, ICO, and PSD files will raise errors
- Image analysis no longer records dimensions for SVG, JPEG XL, JPEG 2000, Netpbm, and other untrusted formats
- Minimum libvips version is now 8.13 and ruby-vips is now 2.2.1
what breaks
Applications processing BMP, ICO, PSD, SVG, JPEG XL, JPEG 2000, Netpbm, FITS, JXL, or ImageMagick-delegated formats with libvips will experience Vips::Error during image transformation or lose dimension analysis. This affects any app using Active Storage with these image types.
to upgrade
If you process affected image types, either: (1) remove them from config.active_storage.variable_content_types in an initializer to treat them as non-variable, or (2) re-enable specific loaders/savers in an initializer if needed. Upgrade libvips to 8.13+ and ruby-vips to 2.2.1+. Consider removing ruby-vips from Gemfile if using :mini_magick processor exclusively.
- Fixed inflections to better handle overlapping acronyms like USD and USDC
- Fixed various Active Record issues including schema dumping, virtual columns, and composite primary key eager loading
- Added config.action_controller.live_streaming_excluded_keys to control state sharing in ActionController::Live
- Fixed encoding and parsing issues in Action View, Active Storage, and other components
changelog ↗- Fixed multiple security vulnerabilities in number conversion, HTML tag generation, and file storage operations
- Active Storage now limits streaming chunk sizes to prevent denial of service attacks
- DiskService path handling now rejects invalid keys with dot segments and prevents path traversal
- DiskService#delete_prefixed no longer expands glob metacharacters in paths
what breaks
Code relying on DiskService#delete_prefixed to expand glob metacharacters (like * or ?) will break, as this behavior is no longer supported. DiskService#path_for now raises InvalidKeyError instead of ArgumentError or Encoding::CompatibilityError for invalid keys.
to upgrade
Review any code using DiskService#delete_prefixed that depends on glob pattern expansion and update to handle paths explicitly instead of relying on glob metacharacter expansion.
No changelog text published for this release.
No changelog text published for this release.
No changelog text published for this release.
No changelog text published for this release.
No changelog text published for this release.
No changelog text published for this release.
No changelog text published for this release.
No changelog text published for this release.
No changelog text published for this release.
No changelog text published for this release.
- Active Storage now blocks libvips's unfuzzed image loaders and savers by default for security
- Image variant transformation for BMP, ICO, and PSD files will raise errors
- Image analysis no longer records dimensions for SVG, JPEG XL, JPEG 2000, Netpbm, and other untrusted formats
- Minimum libvips version is now 8.13 and ruby-vips is now 2.2.1
what breaks
Applications processing BMP, ICO, PSD, SVG, JPEG XL, JPEG 2000, Netpbm, FITS, JXL, or ImageMagick-delegated formats with libvips will experience Vips::Error during image transformation or lose dimension analysis. This affects any app using Active Storage with these image types.
to upgrade
If you process affected image types, remove them from config.active_storage.variable_content_types in an initializer, or re-enable specific loaders/savers if needed. Update libvips to 8.13+ and ruby-vips to 2.2.1+. Consider removing ruby-vips from Gemfile if using :mini_magick processor exclusively.
- Fixed multiple security vulnerabilities in number conversion, HTML tag generation, and file storage operations
- Improved performance of number-to-delimited conversion
- Added configurable maximum streaming chunk size for blob downloads (100MB default)
- Prevented path traversal and glob injection attacks in DiskService
what breaks
Code relying on delete_prefixed to expand glob metacharacters will break, as glob metacharacters are now escaped. This change affects applications using DiskService#delete_prefixed with glob patterns.
to upgrade
Review any code using DiskService#delete_prefixed that may depend on glob metacharacter expansion. The exception type raised by DiskService#path_for may change from ArgumentError or Encoding::CompatibilityError to InvalidKeyError in some cases.
No changelog text published for this release.
No changelog text published for this release.
No changelog text published for this release.
No changelog text published for this release.
No changelog text published for this release.
No changelog text published for this release.
No changelog text published for this release.
No changelog text published for this release.
No changelog text published for this release.
No changelog text published for this release.
No changelog text published for this release.
No changelog text published for this release.
No changelog text published for this release.
changelog ↗No changelog text published for this release.
No changelog text published for this release.
No changelog text published for this release.
No changelog text published for this release.