[dependabot]

Bumps actionmailbox from 8.1.4 to 8.1.4.1.

Release notes

Sourced from actionmailbox's releases.

8.1.4.1

Active Support

• ActiveSupport::MessagePack no longer deserializes an unsafe ActiveSupport::SafeBuffer as html_safe.

  A SafeBuffer that was no longer html_safe?, for example after an in-place gsub!, was deserialized as an html_safe SafeBuffer. It is now serialized with an unsafe marker and deserialized as a String. Earlier versions of Rails cannot read an unsafe buffer serialized this way.

  [GHSA-2w9f-fxwj-w2qf]

  Jean Boussier

• ActiveSupport::Inflector#safe_constantize matches the constant name in a LoadError message as a literal string instead of building a Regexp from it.

  The name's segments were interpolated unescaped into the pattern, so input that reaches safe_constantize, such as the channel identifier in an Action Cable subscribe command, chose the source passed to the regexp compiler.

  [GHSA-8474-xrp6-wh69]

  Jeremy Daer

Active Model

• No changes.

Active Record

• No changes.

Action View

• Skip attribute names in tag helpers that are blank once converted to a string.

  A Symbol such as :" " is not blank, because Symbol#blank? is Symbol#empty?, so it reached the escaping step and produced an attribute with no name. The asset helpers symbolize their keys, so an ordinary String key reached the same place.

  [GHSA-68p9-83h6-5wpj]

  Mike Dalessio

... (truncated)

Changelog

Sourced from actionmailbox's changelog.

Rails 8.1.4.1 (November 03, 2026)

• Reject Mailgun inbound emails whose timestamp is more than 2 minutes ahead of local time.

  [GHSA-5957-c7qm-m469]

  Mike Dalessio

Commits

• 3f290b7 Preparing for 8.1.4.1 release
• c3a295c Reject Mailgun timestamps from the future
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[mroderick]

Dependency Upgrade Review

Verdict: Compatible (head c65e684609d4f0cb7bb888f88612dd3b1045f905) · Confidence: Medium

Lockfile-only bump of the Rails patch release 8.1.4 → 8.1.4.1, forced across all 13 Rails gems by exact-version pins, plus a transitive minitest 6.1.0. The patch's changes either miss planner's usage (ActionMailbox unused, ActiveStorage variants explicitly off) or are hardening/bug fixes on used paths; planner's own suite passes, while the failing auth-suite and probe run in the separate auth app's Node harness, which this diff cannot affect — leaving the live OAuth round trip unverified, so confidence is capped at Medium.

Checks

Check	Result
planner suite	pass
auth suite	fail
round-trip probe	fail

Contracts

Contract	Status	Basis
OAuth client handshake with auth app: PKCE exchange, id_token verify (RS256, iss, aud=planner), UserInfo email	Partially verified	OmniAuth strategy spec and callback request specs pass in planner-suite; the live round-trip probe failed, so end-to-end runtime is unverified.
Session cookie _planner_session write/same_site behavior	Verified	Patch read: cookie_store default unchanged; login feature and callback request specs pass in planner-suite.
Event meta-description HTML emitted via strip_tags	Partially verified	Upstream patch read (escaping added); no planner spec asserts meta tag output.
Rendered response Vary headers (CDN caching)	Partially verified	Patch read: Vary now always applied on rendered responses; no planner spec asserts response headers.
ImageMagick processing of sponsor/member image uploads (MiniMagick process-wide policy)	Verified	Policy XML read: denies only coders the jpg/jpeg/gif/png pipeline never uses; PNG upload spec passes in planner-suite.

Compatibility analysis — 15 packages

• actionmailbox 8.1.4 → 8.1.4.1: Patch release; only change is rejecting Mailgun timestamps from the future in the ingress controller. Planner never references or mounts ActionMailbox — it arrives via the rails meta-gem. No effect.
• actionpack 8.1.4 → 8.1.4.1: Cookies: upgraded session cookies are not written to responses that skip the session; same_site default moved to the abstract store with identical value. Planner's cookie_store session semantics are unchanged. each_key now returns self (bug fix). RemoteIp flags conflicting Forwarded/X-Forwarded-For as spoofing. Used APIs remain compatible; planner-suite passes.
• actionview 8.1.4 → 8.1.4.1: strip_tags now HTML-escapes output (upstream security fix) and highlight escapes the highlighter. Planner's single use is truncate(strip_tags(event.description)) in meta tags — descriptions containing quotes/entities will render escaped and can be cut mid-entity. Cosmetic, intended hardening. Vary header is now applied to all rendered responses.
• actionmailer 8.1.4 → 8.1.4.1: Version bump only; no behavioral changes in the diff beyond gem version files and changelog. Planner's mailers and premailer-rails path unaffected.
• actioncable 8.1.4 → 8.1.4.1: Version bump only in the diff; no source changes. Planner uses Turbo, not cable features.
• actiontext 8.1.4 → 8.1.4.1: Version bump only in the diff; test files and gem version changes. Planner does not use ActionText.
• activejob 8.1.4 → 8.1.4.1: Version bump only in the diff. Planner's jobs run on delayed_job; nothing in the patch touches used APIs.
• activemodel 8.1.4 → 8.1.4.1: Version bump only in the diff. No behavioral changes on used paths.
• activerecord 8.1.4 → 8.1.4.1: Version bump only in the diff; no lib/ source changes. Schema/migration behavior untouched.
• activestorage 8.1.4 → 8.1.4.1: Substantive changes: ffmpeg format allowlist, tempfile/content-type checks, GCS upload signing, MiniMagick security policy applied process-wide, filename sanitization, streaming fixes. Planner explicitly does not use variants (config/application.rb:14) but the MiniMagick policy applies to CarrierWave's processes too; it denies only coders planner's jpg/jpeg/gif/png resize pipeline never invokes. PNG upload+thumb processing passes in planner-suite.
• activesupport 8.1.4 → 8.1.4.1: MessagePack now preserves SafeBuffer html_safe status; safe_constantize avoids a dynamic regexp. Both are fixes on paths planner uses; no breaking delta.
• rails 8.1.4 → 8.1.4.1: Meta-gem re-pinning; forces the whole suite to 8.1.4.1 via exact-version constraints. Gemfile's '~> 8.1.3' constraint is satisfied.
• railties 8.1.4 → 8.1.4.1: Version bump only in the diff. Boot, initializers, and engine setup unchanged for planner.
• minitest 6.0.6 → 6.1.0: Transitive bump required by the new Rails release, with prism constraint widened to >= 1.5, < 3 (locked prism version unchanged). Planner tests with RSpec; minitest loads via rails-dom-testing only.
• rails-html-sanitizer 1.7.2 (unchanged): actionview's constraint widened to ~> 1.6, >= 1.7.2; the lock keeps 1.7.2, which the Gemfile already pins directly. No version change.

Usage of 10 dependencies

• actionpack: config/routes.rb dispatch, controllers using params.expect, request specs incl. auth callbacks (spec/requests/auth_services_callback_spec.rb).
• actionview: HAML views; strip_tags once in app/views/events/_meta_tags.html.haml.
• activerecord/activemodel: app/models scopes and associations; strong_migrations-audited db/migrate.
• activesupport: Rails.cache for JWKS in lib/omniauth/strategies/codebar.rb; inflector across app.
• actionmailer: app/mailers with premailer-rails; spec/mailers.
• activejob: app/jobs on the delayed_job queue.
• activestorage: config only — variants explicitly unused (config/application.rb:14); CarrierWave+MiniMagick handles uploads.
• actionmailbox: none — pulled in by the rails meta-gem, never mounted or referenced.
• actioncable/turbo: turbo-rails for page transitions; no cable channels in use.
• minitest: transitive via rails-dom-testing; the repo tests with RSpec under spec/.

Test coverage

• Strong: planner-suite passes on the new lock, covering dispatch, params.expect, session/cookie flows, the OmniAuth strategy spec, and real PNG upload processing through MiniMagick.
• Gap: no spec asserts event meta-description output, so the strip_tags escaping change is unexercised by tests.
• Gap: the round-trip probe failed, so the live planner-to-auth OAuth round trip is unverified at runtime.
• Thin: the minitest bump is exercised only indirectly, since the app tests with RSpec while rails-dom-testing loads minitest.

Calibration and confidence

Confidence: Medium — The diff is lockfile-only, every runtime-relevant upstream patch was read, used APIs show no breaking delta, and planner's own suite passes. Confidence is capped at Medium because the live OAuth round-trip probe failed (leaving that cross-service contract unverified at runtime) and two emitted-HTML contracts are only partially verified.

1. Weakest claim: The claim that the probe and auth-suite failures are environmental, not upgrade-caused, rests on structure (lockfile-only diff, auth app has its own Node deps, trivial suites like home/health failing too) rather than on a green re-run; a healthy harness re-run would shore it up.
2. Relied on but unverified: That Rails 8.1.4.1 introduces no wire-level change to OmniAuth callback handling, cookie_store session semantics, or rendering that the probe would catch — I verified the files named in the diff at patch level, not a full behavioral audit of both releases.
3. Falsifier: A probe run that fails on this lock but passes on the base lock — or an auth-suite run that passes once its Postgres container is up while the probe still fails — would prove the upgrade breaks the round trip.

Failure diagnosis

Failing tests: auth-suite: 9 files, all in /home/morgan/code/codebar/auth (e.g. test/features/health.test.js, test/integration/oauth-flow.test.js), probe: round-trip probe failed on run
Likely cause: The failing suites belong to the separate auth app (Node/tap) whose test:pg harness needs a Postgres container; its failures span planner-independent tests (home, health) and its deps are untouched by planner's Gemfile.lock, so they are not attributable to this upgrade. The probe failure is most likely downstream of the same broken auth-service environment, but the live round trip is therefore unverified.
Location: /home/morgan/code/codebar/auth test harness (separate service), not planner code.