[dependabot]

Bumps activestorage from 8.1.4 to 8.1.4.1.

Release notes

Sourced from activestorage's releases.

8.1.4.1

Active Support

• ActiveSupport::MessagePack no longer deserializes an unsafe ActiveSupport::SafeBuffer as html_safe.

  A SafeBuffer that was no longer html_safe?, for example after an in-place gsub!, was deserialized as an html_safe SafeBuffer. It is now serialized with an unsafe marker and deserialized as a String. Earlier versions of Rails cannot read an unsafe buffer serialized this way.

  [GHSA-2w9f-fxwj-w2qf]

  Jean Boussier

• ActiveSupport::Inflector#safe_constantize matches the constant name in a LoadError message as a literal string instead of building a Regexp from it.

  The name's segments were interpolated unescaped into the pattern, so input that reaches safe_constantize, such as the channel identifier in an Action Cable subscribe command, chose the source passed to the regexp compiler.

  [GHSA-8474-xrp6-wh69]

  Jeremy Daer

Active Model

• No changes.

Active Record

• No changes.

Action View

• Skip attribute names in tag helpers that are blank once converted to a string.

  A Symbol such as :" " is not blank, because Symbol#blank? is Symbol#empty?, so it reached the escaping step and produced an attribute with no name. The asset helpers symbolize their keys, so an ordinary String key reached the same place.

  [GHSA-68p9-83h6-5wpj]

  Mike Dalessio

... (truncated)

Changelog

Sourced from activestorage's changelog.

Rails 8.1.4.1 (November 03, 2026)

• Preserve committed proxy responses when a storage error interrupts a streamed download.

  [GHSA-4v2w-w6g6-f8f8]

  Jeremy Daer

• Derive ActiveStorage::Filename#base and #extension from the sanitized filename.

  This prevents null bytes and invalid byte sequences in stored filename metadata from raising when a blob is opened or represented. Existing blob records are handled without a data migration.

  [GHSA-p2pm-g2h6-7j5j]

  Jeremy Daer

• Ship an ImageMagick security policy and apply it to every ImageMagick process MiniMagick spawns.

  ImageMagick chooses a coder from the content of the file it is given, and some coders act on files named inside the image rather than on the image itself. Active Storage constrained none of them, so an uploaded file could reach any coder the host's policy allowed, through the ImageMagick analyzer at attach time, with no variant or analyze call in the application.

  Active Storage now ships a policy.xml in ActiveStorage::ImageMagick::POLICY_DIRECTORY and prepends that directory to MAGICK_CONFIGURE_PATH through MiniMagick.cli_env. ImageMagick applies every policy file on its search path, so the shipped policy adds to the host's policy rather than replacing it. A MAGICK_CONFIGURE_PATH set in the environment or in MiniMagick.cli_env, including by an initializer or dotenv, is kept after the shipped directory.

  The shipped policy denies the coders that script ImageMagick (MSL), read or delete files other than the image (TEXT, EPHEMERAL), fetch remote references (URL, HTTP, HTTPS, FTP), display to a screen (SHOW, WIN, PLT), or hand the file to Ghostscript (the PS, EPS, EPT and PDF coders, every alias of them, and the gs delegate), or reach a file directly (FILE, MPC, XPS, PCL), and it refuses @filename indirection. The policy applies to every ImageMagick command MiniMagick runs, not only Active Storage's.

  These applications must act:

  • One whose variant processor is :mini_magick has to use mini_magick 5.1 or later, which applying the policy requires. With an older mini_magick,

... (truncated)

Commits

• 3f290b7 Preparing for 8.1.4.1 release
• 3c67a69 Preserve committed Active Storage streams after errors
• 60f22af Sanitize Active Storage filename parts
• 849a6c3 Don't write upgraded cookies to a response that skips the session
• 468aa9a Ship an ImageMagick security policy for every MiniMagick process
• e19916c Enforce the content length on GCS direct uploads
• 8d93f6a Sign GCS direct uploads with V2 when cache_control is set
• 72136ff Active Storage: tempfile extension must match the blob's content type
• 3b1f262 Restrict the formats ffmpeg and ffprobe may open
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[mroderick]

Dependency Upgrade Review

Verdict: Likely Compatible (head 705278366f6f2df2ff1b97291d7fcdc40a31f392) · Confidence: Medium

Lockfile-only bump of the Rails framework set 8.1.4 → 8.1.4.1 (security patch release, including the Active Storage ImageMagick policy) plus an indirect minitest 6.1.0; planner's full RSpec suite passes. The failing auth-suite and round-trip probe exercise a separate auth service absent from this diff and fail in a uniform fast pattern typical of a harness environment failure, so the upgrade looks safe for planner pending a clean probe re-run.

Checks

Check	Result
planner suite	pass
auth suite	fail
round-trip probe	fail

Contracts

Contract	Status	Basis
Gemfile pin 'rails ~> 8.1.3' satisfied by lock resolution 8.1.4.1	Verified	Gemfile pin read against resolved lockfile versions
Planner boots and full RSpec suite passes under 8.1.4.1	Verified	planner-suite pass (given result)
Auth-app ↔ planner OAuth/JWT round trip unaffected	Unverified	Given auth-suite/probe fail; auth service absent from this diff
Session/cookie behavior unchanged for planner's CookieStore	Partially verified	planner-suite covers session flows; fix targets non-CookieStore stores

Compatibility analysis — 15 packages

• activestorage 8.1.4 → 8.1.4.1: Security patch: streamed-download proxy fix, filename sanitization, ImageMagick policy for MiniMagick spawns. Planner attaches no blobs and runs no variants; CarrierWave bypasses the shipped policy. Inert here.
• rails 8.1.4 → 8.1.4.1: Framework metapackage in lockstep; still satisfies the Gemfile pin 'rails ~> 8.1.3'.
• railties 8.1.4 → 8.1.4.1: Lockstep bump; boot and initialization covered by the passing planner-suite.
• actionpack 8.1.4 → 8.1.4.1: Security fixes: RemoteIp now raises IpSpoofAttackError on conflicting Forwarded/X-Forwarded-For; Vary header added on rendered responses; session/cookie hardening; each_key returns self. Planner uses CookieStore; the proxy-header change is a watch item for any fronting proxy.
• actionview 8.1.4 → 8.1.4.1: strip_tags now escapes quotes in its output; blank-attribute tag helper fix. Views and mailers are green in planner-suite.
• activerecord 8.1.4 → 8.1.4.1: No release-note changes; lockstep only.
• activemodel 8.1.4 → 8.1.4.1: No release-note changes; lockstep only.
• activesupport 8.1.4 → 8.1.4.1: MessagePack no longer deserializes an unsafe SafeBuffer as html_safe; buffers serialized the new way are unreadable by 8.1.4. Matters only for a mixed-version rollout on the Solid Cache store.
• activejob 8.1.4 → 8.1.4.1: No release-note changes; lockstep only.
• actionmailer 8.1.4 → 8.1.4.1: No release-note changes; lockstep only.
• actioncable 8.1.4 → 8.1.4.1: No release-note changes; lockstep only.
• actionmailbox 8.1.4 → 8.1.4.1: Lockstep bump; pulls activestorage 8.1.4.1 transitively.
• actiontext 8.1.4 → 8.1.4.1: Lockstep only; no rich-text usage in the app code.
• minitest 6.0.6 → 6.1.0: Indirect bump via rails-dom-testing; prism constraint widened to '>= 1.5, < 3'. Test-only; planner-suite passes.
• rails-html-sanitizer (unchanged): Left unchanged at 1.7.2: actionview's new '>= 1.7.2' floor is already satisfied by the lock. No gem change.

Usage of 3 dependencies

• rails (framework set): config/application.rb (load_defaults 8.1); app/ controllers, models, views
• activestorage: config/application.rb (variant_processor :mini_magick); config/environments/*.rb (service settings); no attachments or variants in app code
• minitest: transitive via rails-dom-testing; exercised by the RSpec run

Test coverage

• Strong: planner-suite (full RSpec run) passes on the bumped lockfile — app boot, rendering, and auth flows verified
• Thin: no spec exercises Active Storage blob proxying or variants; config declares them unused
• Gap: auth-suite and probe could not be inspected or re-run here; given detail is only 'probe ran'
• Gap: mixed-version MessagePack/Solid Cache rollout interaction untested

Calibration and confidence

Confidence: Medium — The diff is a lockfile-only security patch and planner's full RSpec suite is green, but a given failing check (probe) cannot be ruled unrelated without harness logs, so Compatible cannot be asserted outright.

1. Weakest claim: Attribution of the auth-suite and probe failures: no logs available, and the suites live outside this repository, so the environment-failure conclusion is inference from failure shape.
2. Relied on but unverified: That the external auth service and its round trip are unaffected by planner's patch bump; its suite failure is environmental.
3. Falsifier: Re-run the auth-suite and probe against this head with full logs; per-assertion failures against a live planner 8.1.4.1 (rather than connect/setup errors) would flip this to Potentially Incompatible.

Failure diagnosis

Failing tests: auth-suite: all 9 feature/integration files, round-trip probe
Likely cause: All nine files fail uniformly in ~150–220 ms, including health and home checks, for features absent from this repo — indicating the harness target did not start or was unreachable, not a planner behavior change from this lockfile-only bump (planner-suite is fully green).
Location: External auth-service harness (no test/ or package.json in this repo); PR touches only Gemfile.lock.