Skip to content

Bump the rails-gems group across 1 directory with 13 updates - #6420

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bundler/rails-gems-9b8fd3b7d2
Open

Bump the rails-gems group across 1 directory with 13 updates#6420
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bundler/rails-gems-9b8fd3b7d2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the rails-gems group with 1 update in the / directory: rails.

Updates rails from 8.0.5.1 to 8.1.3.1

Release notes

Sourced from rails's releases.

8.1.3.1

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • Disable libvips's unfuzzed image loaders and savers.

    libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Commits
  • 3989ebf Preparing for 8.1.3.1 release
  • 349e7a5 Disable libvips's unfuzzed image loaders and savers
  • fa8f081 Preparing for 8.1.3 release
  • 63cef3d Merge branch '8-1-sec' into 8-1-stable
  • 1db4b89 Preparing for 8.1.2.1 release
  • 1c7d1cf Update changelog
  • e91694b Update CHANGELOG (8.1 only)
  • 6752711 Fix XSS in debug exceptions copy-to-clipboard
  • 63f5ad8 Skip blank attribute names in Action View tag helpers
  • 8c9676b Prevent glob injection in ActiveStorage DiskService#delete_prefixed
  • Additional commits viewable in compare view

Updates actioncable from 8.0.5.1 to 8.1.3.1

Release notes

Sourced from actioncable's releases.

8.1.3.1

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • Disable libvips's unfuzzed image loaders and savers.

    libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Changelog

Sourced from actioncable's changelog.

Rails 8.1.3.1 (July 29, 2026)

  • No changes.

Rails 8.1.3 (March 24, 2026)

  • No changes.

Rails 8.1.2.1 (March 23, 2026)

  • No changes.

Rails 8.1.2 (January 08, 2026)

  • No changes.

Rails 8.1.1 (October 28, 2025)

  • No changes.

Rails 8.1.0 (October 22, 2025)

  • Allow passing composite channels to ActionCable::Channel#stream_for – e.g. stream_for [ group, group.owner ]

    hey-leon

  • Allow setting nil as subscription connection identifier for Redis.

    Nguyen Nguyen

Please check 8-0-stable for previous changes.

Commits
  • 3989ebf Preparing for 8.1.3.1 release
  • fa8f081 Preparing for 8.1.3 release
  • 1db4b89 Preparing for 8.1.2.1 release
  • d7c8ae6 Preparing for 8.1.2 release
  • 90a1eaa Preparing for 8.1.1 release
  • df9f432 Allow methods starting with underscore to be action methods.
  • 53c4ed8 Merge pull request #55973 from rails/fix-ci
  • 1cdd190 Preparing for 8.1.0 release
  • 1ace683 Preparing for 8.1.0.rc1 release
  • b92d302 Address Can not start microsoftedge 17.17134 (Windows 10) error
  • Additional commits viewable in compare view

Updates actionmailbox from 8.0.5.1 to 8.1.3.1

Release notes

Sourced from actionmailbox's releases.

8.1.3.1

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • Disable libvips's unfuzzed image loaders and savers.

    libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Changelog

Sourced from actionmailbox's changelog.

Rails 8.1.3.1 (July 29, 2026)

  • No changes.

Rails 8.1.3 (March 24, 2026)

  • No changes.

Rails 8.1.2.1 (March 23, 2026)

  • No changes.

Rails 8.1.2 (January 08, 2026)

  • No changes.

Rails 8.1.1 (October 28, 2025)

  • No changes.

Rails 8.1.0 (October 22, 2025)

  • Add reply_to_address extension method on Mail::Message.

    Mr0grog

Please check 8-0-stable for previous changes.

Commits
  • 3989ebf Preparing for 8.1.3.1 release
  • fa8f081 Preparing for 8.1.3 release
  • 1db4b89 Preparing for 8.1.2.1 release
  • d7c8ae6 Preparing for 8.1.2 release
  • 90a1eaa Preparing for 8.1.1 release
  • 53c4ed8 Merge pull request #55973 from rails/fix-ci
  • 1cdd190 Preparing for 8.1.0 release
  • 1ace683 Preparing for 8.1.0.rc1 release
  • 80827ca Preparing for 8.1.0.beta1 release
  • f3e0670 Remove deprecated :azure storage service
  • Additional commits viewable in compare view

Updates actionmailer from 8.0.5.1 to 8.1.3.1

Release notes

Sourced from actionmailer's releases.

8.1.3.1

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • Disable libvips's unfuzzed image loaders and savers.

    libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Changelog

Sourced from actionmailer's changelog.

Rails 8.1.3.1 (July 29, 2026)

  • No changes.

Rails 8.1.3 (March 24, 2026)

  • No changes.

Rails 8.1.2.1 (March 23, 2026)

  • No changes.

Rails 8.1.2 (January 08, 2026)

  • No changes.

Rails 8.1.1 (October 28, 2025)

  • No changes.

Rails 8.1.0 (October 22, 2025)

  • Add structured events for Action Mailer:

    • action_mailer.delivered
    • action_mailer.processed

    Gannon McGibbon

  • Add deliver_all_later to enqueue multiple emails at once.

    user_emails = User.all.map { |user| Notifier.welcome(user) }
ActionMailer.deliver_all_later(user_emails)
use a custom queue
ActionMailer.deliver_all_later(user_emails, queue: :my_queue)

    This can greatly reduce the number of round-trips to the queue datastore. For queue adapters that do not implement the enqueue_all method, we fall back to enqueuing email jobs indvidually.

    fatkodima

Please check 8-0-stable for previous changes.

Commits
  • 3989ebf Preparing for 8.1.3.1 release
  • fa8f081 Preparing for 8.1.3 release
  • 1db4b89 Preparing for 8.1.2.1 release
  • d7c8ae6 Preparing for 8.1.2 release
  • dc94813 Merge pull request #56050 from jclusso/fix-stylesheet-tag-nonce-mailer
  • 90a1eaa Preparing for 8.1.1 release
  • df9f432 Allow methods starting with underscore to be action methods.
  • 53c4ed8 Merge pull request #55973 from rails/fix-ci
  • f77a1c3 Require 'rails' at the top of railltie files to ensure Rails is loaded first
  • 1cdd190 Preparing for 8.1.0 release
  • Additional commits viewable in compare view

Updates actionpack from 8.0.5.1 to 8.1.3.1

Release notes

Sourced from actionpack's releases.

8.1.3.1

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • Disable libvips's unfuzzed image loaders and savers.

    libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Changelog

Sourced from actionpack's changelog.

Rails 8.1.3.1 (July 29, 2026)

  • No changes.

Rails 8.1.3 (March 24, 2026)

  • No changes.

Rails 8.1.2.1 (March 23, 2026)

  • No changes.

Rails 8.1.2 (January 08, 2026)

  • Add config.action_controller.live_streaming_excluded_keys to control execution state sharing in ActionController::Live.

    When using ActionController::Live, actions are executed in a separate thread that shares state from the parent thread. This new configuration allows applications to opt-out specific state keys that should not be shared.

    This is useful when streaming inside a connected_to block, where you may want the streaming thread to use its own database connection context.

    # config/application.rb
config.action_controller.live_streaming_excluded_keys = [:active_record_connected_to_stack]

    By default, all keys are shared.

    Eileen M. Uchitelle

  • Fix IpSpoofAttackError message to include Forwarded header content.

    Without it, the error message may be misleading.

    zzak

Rails 8.1.1 (October 28, 2025)

  • Allow methods starting with underscore to be action methods.

    Disallowing methods starting with an underscore from being action methods was an unintended side effect of the performance optimization in 207a254.

... (truncated)

Commits
  • 3989ebf Preparing for 8.1.3.1 release
  • fa8f081 Preparing for 8.1.3 release
  • 63cef3d Merge branch '8-1-sec' into 8-1-stable
  • 1db4b89 Preparing for 8.1.2.1 release
  • 6752711 Fix XSS in debug exceptions copy-to-clipboard
  • 10c6e0e Merge pull request #56750 from nicolasva/fix/UnknownHttpMethod
  • cce61db Merge pull request #56820 from ybiquitous/improve-apidoc-for-ActionDispatch_I...
  • d7c8ae6 Preparing for 8.1.2 release
  • df98a0d Merge pull request #56440 from zzak/ac-live-streaming-keys-typo
  • 0f8014a [8-1-stable] Minitest 6 support
  • Additional commits viewable in compare view

Updates actiontext from 8.0.5.1 to 8.1.3.1

Release notes

Sourced from actiontext's releases.

8.1.3.1

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • Disable libvips's unfuzzed image loaders and savers.

    libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Changelog

Sourced from actiontext's changelog.

Rails 8.1.3.1 (July 29, 2026)

  • No changes.

Rails 8.1.3 (March 24, 2026)

  • No changes.

Rails 8.1.2.1 (March 23, 2026)

  • No changes.

Rails 8.1.2 (January 08, 2026)

  • No changes.

Rails 8.1.1 (October 28, 2025)

  • No changes.

Rails 8.1.0 (October 22, 2025)

  • De-couple @rails/actiontext/attachment_upload.js from Trix.Attachment

    Implement @rails/actiontext/index.js with a direct-upload:progress event listeners and Promise resolution.

    Sean Doyle

  • Capture block content for form helper methods

    <%= rich_textarea_tag :content, nil do %>
  <h1>hello world</h1>
<% end %>
<!-- <input type="hidden" name="content" id="trix_input_1" value="&lt;h1&gt;hello world&lt;/h1&gt;"/><trix-editor … -->
<%= rich_textarea :message, :content, input: "trix_input_1" do %>
<h1>hello world</h1>
<% end %>
<!-- <input type="hidden" name="message[content]" id="trix_input_1" value="&lt;h1&gt;hello world&lt;/h1&gt;"/><trix-editor … -->
<%= form_with model: Message.new do |form| %>
<%= form.rich_textarea :content do %>
<h1>hello world</h1>

... (truncated)

Commits
  • 3989ebf Preparing for 8.1.3.1 release
  • fa8f081 Preparing for 8.1.3 release
  • 1db4b89 Preparing for 8.1.2.1 release
  • d7c8ae6 Preparing for 8.1.2 release
  • 90a1eaa Preparing for 8.1.1 release
  • 53c4ed8 Merge pull request #55973 from rails/fix-ci
  • 1cdd190 Preparing for 8.1.0 release
  • 5e231ae Merge pull request #54914 from chaadow/fix_autoloaded_content_helper
  • 1ace683 Preparing for 8.1.0.rc1 release
  • 8c624be De-couple @rails/actiontext/attachment_upload.js from Trix.Attachment
  • Additional commits viewable in compare view

Updates actionview from 8.0.5.1 to 8.1.3.1

Release notes

Sourced from actionview's releases.

8.1.3.1

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • Disable libvips's unfuzzed image loaders and savers.

    libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Changelog

Sourced from actionview's changelog.

Rails 8.1.3.1 (July 29, 2026)

  • No changes.

Rails 8.1.3 (March 24, 2026)

  • Fix encoding errors for string locals containing non-ASCII characters.

    Kataoka Katsuki

  • Fix collection caching to only forward expires_in argument if explicitly set.

    Pieter Visser

Rails 8.1.2.1 (March 23, 2026)

  • Fix possible XSS in DebugExceptions middleware

    [CVE-2026-33167]

    John Hawthorn

  • Skip blank attribute names in tag helpers to avoid generating invalid HTML.

    [CVE-2026-33168]

    Mike Dalessio

Rails 8.1.2 (January 08, 2026)

  • Fix file_field to join mime types with a comma when provided as Array

    file_field(:article, :image, accept: ['image/png', 'image/gif', 'image/jpeg'])

    Now behaves likes:

    file_field(:article, :image, accept: 'image/png,image/gif,image/jpeg')

    Bogdan Gusiev

  • Fix strict locals parsing to handle multiline definitions.

    Said Kaldybaev

... (truncated)

Commits
  • 3989ebf Preparing for 8.1.3.1 release
  • fa8f081 Preparing for 8.1.3 release
  • 63cef3d Merge branch '8-1-sec' into 8-1-stable
  • 1db4b89 Preparing for 8.1.2.1 release
  • 1c7d1cf Update changelog
  • e91694b Update CHANGELOG (8.1 only)
  • 63f5ad8 Skip blank attribute names in Action View tag helpers
  • e598b94 Merge pull request #56906 from kataokatsuki/fix-strict-locals-non-ascii-encoding
  • c2ea79c Merge pull request #56891 from pietervisser/fix-collection-caching-to-preserv...
  • d7c8ae6 Preparing for 8.1.2 release
  • Additional commits viewable in compare view

Updates activejob from 8.0.5.1 to 8.1.3.1

Release notes

Sourced from activejob's releases.

8.1.3.1

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • Disable libvips's unfuzzed image loaders and savers.

    libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Changelog

Sourced from activejob's changelog.

Rails 8.1.3.1 (July 29, 2026)

  • No changes.

Rails 8.1.3 (March 24, 2026)

  • No changes.

Rails 8.1.2.1 (March 23, 2026)

  • No changes.

Rails 8.1.2 (January 08, 2026)

  • Fix ActiveJob.perform_all_later to respect job_class.enqueue_after_transaction_commit.

    Previously, perform_all_later would enqueue all jobs immediately, even if they had enqueue_after_transaction_commit = true. Now it correctly defers jobs with this setting until after transaction commits, matching the behavior of perform_later.

    OuYangJinTing

  • Fix using custom serializers with ActiveJob::Arguments.serialize when ActiveJob::Base hasn't been loaded.

    Hartley McGuire

Rails 8.1.1 (October 28, 2025)

  • Only index new serializers.

    Jesse Sharps

Rails 8.1.0 (October 22, 2025)

  • Add structured events for Active Job:
    • active_job.enqueued
    • active_job.bulk_enqueued
    • active_job.started
    • active_job.completed
    • active_job.retry_scheduled
    • active_job.retry_stopped
    • active_job.discarded
    • active_job.interrupt
    • active_job.resume

... (truncated)

Commits
  • 3989ebf Preparing for 8.1.3.1 release
  • fa8f081 Preparing for 8.1.3 release
  • 63cef3d Merge branch '8-1-sec' into 8-1-stable
  • 1db4b89 Preparing for 8.1.2.1 release
  • 0924172 Fix deprecation of sidekiq/testing in integration test adapter
  • 3277c4e Fix deprecation of sidekiq/testing/inline
  • d7c8ae6 Preparing for 8.1.2 release
  • f33ca37 Merge pull request #56507 from tiramizoo/rm-sucker_punch
  • 63a0e6c Merge pull request #56264 from byroot/fix/activejob/perform_all_later-2
  • c8155a6 Merge pull request #56093 from skipkayhil/hm-rynrvruzqlkttuqt
  • Additional commits viewable in compare view

Updates activemodel from 8.0.5.1 to 8.1.3.1

Release notes

Sourced from activemodel's releases.

8.1.3.1

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • Disable libvips's unfuzzed image loaders and savers.

    libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Changelog

Sourced from activemodel's changelog.

Rails 8.1.3.1 (July 29, 2026)

  • No changes.

Rails 8.1.3 (March 24, 2026)

  • Fix Ruby 4.0 delegator warning when calling inspect on attributes.

    Hammad Khan

  • Fix NoMethodError when deserialising Type::Integer objects marshalled under Rails 8.0.

    The performance optimisation that replaced @range with @max/@min broke Marshal compatibility. Objects serialised under 8.0 (with @range) and deserialised under 8.1 (expecting @max/@min) would crash with undefined method '<=' for nil because Marshal.load restores instance variables without calling initialize.

    Edward Woodcock

Rails 8.1.2.1 (March 23, 2026)

  • No changes.

Rails 8.1.2 (January 08, 2026)

  • No changes.

Rails 8.1.1 (October 28, 2025)

  • No changes.

Rails 8.1.0 (October 22, 2025)

  • Add reset_token: { expires_in: ... } option to has_secure_password.

    Allows configuring the expiry duration of password reset tokens (default remains 15 minutes for backwards compatibility).

    has_secure_password reset_token: { expires_in: 1.hour }

    Jevin Sew, Abeid Ahmed

  • Add except_on: option for validation callbacks.

... (truncated)

Commits
  • 3989ebf Preparing for 8.1.3.1 release
  • fa8f081 Preparing for 8.1.3 release
  • 63cef3d Merge branch '8-1-sec' into 8-1-stable
  • 1db4b89 Preparing for 8.1.2.1 release
  • 5a3d7d9 Merge pull request #56943 from yahonda/ruby-16321
  • 034ca73 Merge pull request #56867 from hammadxcm/fix-ruby4-delegator-inspect-warning
  • 6c23f3b Merge pull request #56768 from RemoteCTO/fix/integer-type-marshal-compat
  • d7c8ae6 Preparing for 8.1.2 release
  • 1723cc5 Address Layout/EmptyLineAfterMagicComment offense at 8-1-stable
  • 3c3c20b Merge pull request #56058 from Shopify/uk-am-secure-password-require-fix
  • Additional commits viewable in compare view

Updates activerecord from 8.0.5.1 to 8.1.3.1

Release notes

Sourced from activerecord's releases.

8.1.3.1

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • Disable libvips's unfuzzed image loaders and savers.

    libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Changelog

Sourced from activerecord's changelog.

Rails 8.1.3.1 (July 29, 2026)

  • No changes.

Rails 8.1.3 (March 24, 2026)

  • Fix insert_all and upsert_all log message when called on anonymous classes.

    Gabriel Sobrinho

  • Respect ActiveRecord::SchemaDumper.ignore_tables when dumping SQLite virtual tables.

    Hans Schnedlitz

  • Restore previous instrumenter after execute_or_skip

    FutureResult#execute_or_skip replaces the thread's instrumenter with an EventBuffer to collect events published during async query execution. If the global async executor is saturated and the caller_runs fallback executes the task on the calling thread, we need to make sure the previous instrumenter is restored or the stale EventBuffer would stay in place and permanently swallow all subsequent sql.active_record notifications on that thread.

    Rosa Gutierrez

  • Bump the minimum PostgreSQL version to 9.5, due to usage of array_position function.

    Ivan Kuchin

  • Fix Ruby 4.0 delegator warning when calling inspect on ActiveRecord::Type::Serialized.

    Hammad Khan

  • Fix support for table names containing hyphens.

    Evgeniy Demin

  • Fix column deduplication for SQLite3 and PostgreSQL virtual (generated) columns.

    Column#== and Column#hash now account for virtual? so that the Deduplicable registry does not treat a generated column and a regular column with the same name and type as identical. Previously, if a generated column was registered first, a regular column on a different table could be deduplicated to the generated instance, silently excluding it from INSERT/UPDATE statements.

    Jay Huber

... (truncated)

Commits
  • 3989ebf Preparing for 8.1.3.1 release
  • fa8f081 Preparing for 8.1.3 release
  • 63cef3d Merge branch '8-1-sec' into 8-1-stable
  • 1db4b89 Preparing for 8.1.2.1 release
  • e449905 Merge pull request #57022 from byroot/sobrinho-main
  • 7d8eeea Merge pull request #56977 from hschne/26-03-fix-ignore-virtual-tables
  • 148e4d8 Merge pull request #56970 from nicolasva/fix_spatia_lite
  • 004eb65 Restore previous instrumenter after execute_or_skip
  • b8b23c0 Merge pull request #56932 from eglitobias/fix-dbconsole-notimplemented-message
  • 2250b16 Merge pull request #56951 from r-plus/patch-1
  • Additional commits viewable in compare view

Updates activestorage from 8.0.5.1 to 8.1.3.1

Release notes

Sourced from activestorage's releases.

8.1.3.1

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • Disable libvips's unfuzzed image loaders and savers.

    libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Changelog

Sourced from activestorage's changelog.

Rails 8.1.3.1 (July 29, 2026)

  • Disable libvips's unfuzzed image loaders and savers.

    libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

    This is a breaking change for applications that process image types with an unfuzzed loader or saver. Variant transformation of BMP, ICO, and PSD attachments will raise Vips::Error, and analysis of these and other types such as SVG, JPEG XL, JPEG 2000, and Netpbm will no longer record width and height. Requesting an unfuzzed output format, typically FITS, JXL, or anything delegated to ImageMagick, will also raise Vips::Error. Attaching, storing, and downloading are unchanged.

    An application seeing Vips::Error raised during image transformation may wish to remove the affected content types from config.active_storage.variable_content_types in an initializer. Active Storage will then treat those attachments as not variable and will not generate variants for them. This most often matters to an application that transforms images during a request rather than in a background job, where the failure surfaces as an error response instead of a failed job.

    Rails.application.config.active_storage.variable_content_types -=
  %w[ image/bmp image/vnd.microsoft.icon image/vnd.adobe.photoshop ]

    Applications using the :mini_magick variant processor will see no change in how their attachments are processed, but the loaders and savers will be disabled process-wide whenever ruby-vips is installed, and the version requirements below will still apply. Such an application may remove ruby-vips from its Gemfile to avoid both.

    The minimum supported version of libvips is now 8.13, and the minimum supported version of ruby-vips is now 2.2.1. These are the earliest versions that are capable of disabling untrusted operations. When ruby-vips is installed and either minimum is not met, Active Storage will raise a RuntimeError while booting rather than run in an unsecurable environment.

    [GHSA-xr9x-r78c-5hrm] [CVE-2026-66066]

    Mike Dalessio

Rails 8.1.3 (March 24, 2026)

  • Fix ActiveStorage::Blob content type predicate methods to handle nil.

    Daichi KUDO

... (truncated)

Commits
  • 3989ebf Preparing for 8.1.3.1 release
  • 349e7a5 Disable libvips's unfuzzed image loaders and savers
  • fa8f081 Preparing for 8.1.3 release
  • 63cef3d Merge branch '8-1-sec' into 8-1-stable
  • 1db4b89 Preparing for 8.1.2.1 release
  • 1c7d1cf Update changelog
  • 8c9676b Prevent glob injection in ActiveStorage DiskService#delete_prefixed
  • 9b06fbc Prevent path traversal in ActiveStorage DiskService
  • d9502f5 Active Storage: Filter user supplied metadata in DirectUploadController
  • 85ec5b1 ActiveStorage::Streaming limit range requests to a single range
  • Additional commits viewable in compare view

Updates activesupport from 8.0.5.1 to 8.1.3.1

Release notes

Sourced from activesupport's releases.

8.1.3.1

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • Disable libvips's unfuzzed image loaders and savers.

    libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Changelog

Sourced from activesupport's changelog.

Rails 8.1.3.1 (July 29, 2026)

  • No changes.

Rails 8.1.3 (March 24, 2026)

  • Fix JSONGemCoderEncoder to correctly serialize custom object hash keys.

    When hash keys are custom objects whose as_json returns a Hash, the encoder now calls to_s on the original key object instead of on the as_json result.

    Before: hash = {CustomKey.new(123) => "value"} hash.to_json # => {"{:id=>123}":"value"}

    After: hash.to_json # => {"custom_123":"value"}

    Dan Sharp

  • Fix inflections to better handle overlapping acronyms.

    ActiveSupport::Inflector.inflections(:en) do |inflect|
  inflect.acronym "USD"
  inflect.acronym "USDC"
end
"USDC".underscore # => "usdc"

    Said Kaldybaev

  • Silence Dalli 4.0+ warning when using ActiveSupport::Cache::MemCacheStore.

    zzak

Rails 8.1.2.1 (March 23, 2026)

  • Reject scientific notation in NumberConverter

    [CVE-2026-33176]

    Jean Boussier

  • Fix SafeBuffer#% to preserve unsafe status

... (truncated)

Commits
  • 3989ebf Preparing for 8.1.3.1 release
  • fa8f081 Preparing for 8.1.3 release
  • 63cef3d Merge branch '8-1-sec' into 8-1-stable
  • 1db4b89 Preparing for 8.1.2.1 release
  • 1c7d1cf Update changelog
  • ec1a0e2 Improve performance of NumberToDelimitedConverter
  • 50d732a Fix SafeBuffer#% to preserve unsafe status
  • 19dbab5 NumberConverter: reject scientific notation
  • c315744 Merge pull request #56889 from alpaca-tc/support-spring-on-test-environment
  • 2ac86a8 Revert benchmark.rb to a silent shim (#56832)
  • Additional commits viewable in compare view

Updates railties from 8.0.5.1 to 8.1.3.1

Release notes

Sourced from railties's releases.

8.1.3.1

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • Disable libvips's unfuzzed image loaders and savers.

    libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Changelog

Sourced from railties's changelog.

Rails 8.1.3.1 (July 29, 2026)

  • No changes.

Rails 8.1.3 (March 24, 2026)

  • Add libvips to generated ci.yml

    Conditionally adds libvips to ci.yml.

    Steve Polito

Rails 8.1.2.1 (March 23, 2026)

  • No changes.

Rails 8.1.2 (January 08, 2026)

  • Skip all system test files on app generation.

    Eileen M. Uchitelle

  • Fix db:system:change to correctly update Dockerfile base packages.

    Josiah Smith

  • Fix devcontainer volume mount when app name differs from folder name.

    Rafael Mendonça França

  • Fixed the rails notes command to properly extract notes in CSS files.

    David White

  • Fixed the default Dockerfile to properly include the vendor/ directory during bundle install.

    Zhong Sheng

Rails 8.1.1 (October 28, 2025)

  • Do not assume and force SSL in production by default when using Kamal, to allow for out of the box Kamal deployments.

    It is still recommended to assume and force SSL in production as soon as you can.

    Jerome Dalbert

... (truncated)

Commits
  • 3989ebf Preparing for 8.1.3.1 release
  • fa8f081 Preparing for 8.1.3 release
  • 63cef3d Merge branch '8-1-sec' into 8-1-stable
  • 1db4b89 Preparing for 8.1.2.1 release
  • 635841a Merge pull request #56911 from toy/postgresql-9.5-required
  • b8f4e47 Merge pull request #53417 from vinibispo/fix/skip_storage-changes-gitignore
  • 6b0ebde Merge pull request #56693 from r7kamura/configuration-duplicated-if
  • 54aa1c5 Merge pull request #56523 from stevepolitodesign/sp-cl-libvips
  • d7c8ae6 Preparing for 8.1.2 release
  • 3ea2701 CHANGELOG sync
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies ruby Pull requests that update Ruby code labels Aug 14, 2026
@dependabot
dependabot Bot force-pushed the dependabot/bundler/rails-gems-9b8fd3b7d2 branch 11 times, most recently from 0b86abf to 3cb8305 Compare August 25, 2026 04:03
@dependabot
dependabot Bot force-pushed the dependabot/bundler/rails-gems-9b8fd3b7d2 branch 5 times, most recently from bebd0d8 to fecb51b Compare September 2, 2026 12:21
@joaquinco

joaquinco commented Sep 2, 2026

Copy link
Copy Markdown
Collaborator

@dependabot recreate

@dependabot
dependabot Bot force-pushed the dependabot/bundler/rails-gems-9b8fd3b7d2 branch from fecb51b to bc2ee37 Compare September 2, 2026 12:37
@dependabot
Bump the rails-gems group across 1 directory with 13 updates
44dbeea 
Bumps the rails-gems group with 1 update in the / directory: [rails](https://github.com/rails/rails).


Updates `rails` from 8.0.5.1 to 8.1.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Commits](rails/rails@v8.0.5.1...v8.1.3.1)

Updates `actioncable` from 8.0.5.1 to 8.1.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.3.1/actioncable/CHANGELOG.md)
- [Commits](rails/rails@v8.0.5.1...v8.1.3.1)

Updates `actionmailbox` from 8.0.5.1 to 8.1.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.3.1/actionmailbox/CHANGELOG.md)
- [Commits](rails/rails@v8.0.5.1...v8.1.3.1)

Updates `actionmailer` from 8.0.5.1 to 8.1.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.3.1/actionmailer/CHANGELOG.md)
- [Commits](rails/rails@v8.0.5.1...v8.1.3.1)

Updates `actionpack` from 8.0.5.1 to 8.1.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.3.1/actionpack/CHANGELOG.md)
- [Commits](rails/rails@v8.0.5.1...v8.1.3.1)

Updates `actiontext` from 8.0.5.1 to 8.1.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.3.1/actiontext/CHANGELOG.md)
- [Commits](rails/rails@v8.0.5.1...v8.1.3.1)

Updates `actionview` from 8.0.5.1 to 8.1.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.3.1/actionview/CHANGELOG.md)
- [Commits](rails/rails@v8.0.5.1...v8.1.3.1)

Updates `activejob` from 8.0.5.1 to 8.1.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.3.1/activejob/CHANGELOG.md)
- [Commits](rails/rails@v8.0.5.1...v8.1.3.1)

Updates `activemodel` from 8.0.5.1 to 8.1.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.3.1/activemodel/CHANGELOG.md)
- [Commits](rails/rails@v8.0.5.1...v8.1.3.1)

Updates `activerecord` from 8.0.5.1 to 8.1.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.3.1/activerecord/CHANGELOG.md)
- [Commits](rails/rails@v8.0.5.1...v8.1.3.1)

Updates `activestorage` from 8.0.5.1 to 8.1.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.3.1/activestorage/CHANGELOG.md)
- [Commits](rails/rails@v8.0.5.1...v8.1.3.1)

Updates `activesupport` from 8.0.5.1 to 8.1.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.3.1/activesupport/CHANGELOG.md)
- [Commits](rails/rails@v8.0.5.1...v8.1.3.1)

Updates `railties` from 8.0.5.1 to 8.1.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.3.1/railties/CHANGELOG.md)
- [Commits](rails/rails@v8.0.5.1...v8.1.3.1)

---
updated-dependencies:
- dependency-name: actioncable
  dependency-version: 8.1.3.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: rails-gems
- dependency-name: actionmailbox
  dependency-version: 8.1.3.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: rails-gems
- dependency-name: actionmailer
  dependency-version: 8.1.3.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: rails-gems
- dependency-name: actionpack
  dependency-version: 8.1.3.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: rails-gems
- dependency-name: actiontext
  dependency-version: 8.1.3.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: rails-gems
- dependency-name: actionview
  dependency-version: 8.1.3.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: rails-gems
- dependency-name: activejob
  dependency-version: 8.1.3.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: rails-gems
- dependency-name: activemodel
  dependency-version: 8.1.3.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: rails-gems
- dependency-name: activerecord
  dependency-version: 8.1.3.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: rails-gems
- dependency-name: activestorage
  dependency-version: 8.1.3.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: rails-gems
- dependency-name: activesupport
  dependency-version: 8.1.3.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: rails-gems
- dependency-name: rails
  dependency-version: 8.1.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rails-gems
- dependency-name: railties
  dependency-version: 8.1.3.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: rails-gems
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/bundler/rails-gems-9b8fd3b7d2 branch from bc2ee37 to 44dbeea Compare September 2, 2026 14:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies ruby Pull requests that update Ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@joaquinco