[dependabot]

Bumps activesupport from 8.1.4 to 8.1.4.1.

Release notes

Sourced from activesupport's releases.

8.1.4.1

Active Support

• ActiveSupport::MessagePack no longer deserializes an unsafe ActiveSupport::SafeBuffer as html_safe.

  A SafeBuffer that was no longer html_safe?, for example after an in-place gsub!, was deserialized as an html_safe SafeBuffer. It is now serialized with an unsafe marker and deserialized as a String. Earlier versions of Rails cannot read an unsafe buffer serialized this way.

  [GHSA-2w9f-fxwj-w2qf]

  Jean Boussier

• ActiveSupport::Inflector#safe_constantize matches the constant name in a LoadError message as a literal string instead of building a Regexp from it.

  The name's segments were interpolated unescaped into the pattern, so input that reaches safe_constantize, such as the channel identifier in an Action Cable subscribe command, chose the source passed to the regexp compiler.

  [GHSA-8474-xrp6-wh69]

  Jeremy Daer

Active Model

• No changes.

Active Record

• No changes.

Action View

• Skip attribute names in tag helpers that are blank once converted to a string.

  A Symbol such as :" " is not blank, because Symbol#blank? is Symbol#empty?, so it reached the escaping step and produced an attribute with no name. The asset helpers symbolize their keys, so an ordinary String key reached the same place.

  [GHSA-68p9-83h6-5wpj]

  Mike Dalessio

... (truncated)

Changelog

Sourced from activesupport's changelog.

Rails 8.1.4.1 (November 03, 2026)

• ActiveSupport::MessagePack no longer deserializes an unsafe ActiveSupport::SafeBuffer as html_safe.

  A SafeBuffer that was no longer html_safe?, for example after an in-place gsub!, was deserialized as an html_safe SafeBuffer. It is now serialized with an unsafe marker and deserialized as a String. Earlier versions of Rails cannot read an unsafe buffer serialized this way.

  [GHSA-2w9f-fxwj-w2qf]

  Jean Boussier

• ActiveSupport::Inflector#safe_constantize matches the constant name in a LoadError message as a literal string instead of building a Regexp from it.

  The name's segments were interpolated unescaped into the pattern, so input that reaches safe_constantize, such as the channel identifier in an Action Cable subscribe command, chose the source passed to the regexp compiler.

  [GHSA-8474-xrp6-wh69]

  Jeremy Daer

Commits

• 3f290b7 Preparing for 8.1.4.1 release
• 4ca0906 ActiveSupport::MessagePack preserve SafeBuffer html_safe status
• 95aa9e4 Avoid dynamic regexp in safe_constantize LoadError handling
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[mroderick]

Dependency Upgrade Review

Verdict: Likely Compatible (head c9228af6bff35f00b95f0e379b9e7265a8ba07bd) · Confidence: Low

Dependabot bump of activesupport to 8.1.4.1 in the lock actually re-pins every exact-pinned Rails gem to 8.1.4.1, pulling in the full Rails 8.1.4.1 patch release: cookie/session hardening, RemoteIp X-Forwarded-For conflict detection, Vary-by-negotiation rendering, strip_tags output encoding, and a riding-along minitest 6.1.0 bump. No used API is removed, but behavior changes touch live paths (cookie-store session, request-completion log payload) and all three verification checks failed at this head, so merge should wait on those failures being explained.

Checks

Check	Result
planner suite	fail
auth suite	fail
round-trip probe	fail

Contracts

Contract	Status	Basis
Session cookie _planner_session (cookie_store, JSON serializer) round-trips member_id	Partially verified	Diff file list of actionpack cookies.rb and session stores; no line-trace of the pinned version possible in this environment
Request-completion Completed log line payload (path_template, rss_mb) consumed by Loki	Unverified	Failing planner-suite spec at spec/requests/canonical_log_line_spec.rb; initializer config/initializers/canonical_log.rb read
Event meta description HTML emitted via strip_tags	Partially verified	Actionview text_helper change seen in compare diff; call site read at app/views/events/_meta_tags.html.haml
Client IP resolution behind Heroku proxy (RemoteIp middleware)	Unverified	Diff file list only; no remote_ip call sites found in app code
Solid Cache entries under the default message_pack coder	Unverified	Diff file list only; no explicit message_pack usage found in repo

Compatibility analysis — 15 packages

• activesupport 8.1.4 → 8.1.4.1: Pinned patch release: inflector safe_constantize LoadError regexp fix and MessagePack SafeBuffer html_safe preservation. Used APIs (TimeZone lookup, MessageVerifier in lib/verifier.rb) are untouched by the diff.
• rails 8.1.4 → 8.1.4.1: Umbrella gem rides the exact-pinned 8.1.4.1 bump; no code changes of its own in the compare.
• actionpack 8.1.4 → 8.1.4.1: Cookie/session-store hardening (no upgraded cookies written when session is skipped, same-site protection across stores), RemoteIp X-Forwarded-For conflict detection, and Vary-by-negotiation-header rendering. This repo sets a cookie_store session, so these paths are live at runtime.
• actionview 8.1.4 → 8.1.4.1: strip_tags now encodes " and ' in output; highlighter phrase escaped; blank tag attribute names skipped. strip_tags is used in app/views/events/_meta_tags.html.haml, so emitted meta descriptions change.
• activerecord 8.1.4 → 8.1.4.1: Pinned along with the release; diff shows no changes to the record/model surface this app relies on.
• activemodel 8.1.4 → 8.1.4.1: Pinned along with the release; no code changes in the compare.
• activejob 8.1.4 → 8.1.4.1: Pinned along with the release; no code changes in the compare.
• activestorage 8.1.4 → 8.1.4.1: Security hardening: restricted ffmpeg/ffprobe formats, tempfile extension must match content type, ImageMagick policy shipped, GCS direct-upload signing. App uploads go through CarrierWave, so impact is expected to be nil, not verified.
• actionmailer 8.1.4 → 8.1.4.1: Pinned along with the release; no code changes in the compare.
• actioncable 8.1.4 → 8.1.4.1: Pinned along with the release; no code changes in the compare.
• actiontext 8.1.4 → 8.1.4.1: Pinned along with the release; no code changes in the compare.
• actionmailbox 8.1.4 → 8.1.4.1: Mailgun ingress now rejects timestamps from the future; no Mailgun ingress is configured in this repo.
• railties 8.1.4 → 8.1.4.1: Pinned along with the release; no code changes in the compare.
• minitest 6.0.6 → 6.1.0: Rides along in the lock bump (test-stack transitive). Prism constraint relaxed to >= 1.5, < 3; prism itself stays 1.9.0. Could shift RSpec-adjacent behavior without code changes.
• rails-html-sanitizer constraint: Actionview now demands >= 1.7.2; the lock already pins 1.7.2, so no gem change, only the constraint.

Usage of 5 dependencies

• rails / railties: config/initializers/session_store.rb (cookie_store, expire_after 24h); config/initializers/cookies_serializer.rb (:json); config/initializers/canonical_log.rb (ActionController::Base prepend)
• actionpack: 20 controllers using params.expect; session writes in members_controller.rb, check_ins_controller.rb, admin/stats_controller.rb; request instrumentation payload via append_info_to_payload
• actionview: app/views/events/_meta_tags.html.haml (strip_tags + truncate)
• activesupport: ActiveSupport::TimeZone lookups in app/models/concerns/date_time_concerns.rb, app/models/chapter.rb, app/serializers/workshop_calendar.rb; ActiveSupport::MessageVerifier in lib/verifier.rb
• minitest: transitive via rails-dom-testing and railties; not required directly by spec code

Test coverage

• Thin: spec/requests/canonical_log_line_spec.rb covers the request-completion payload the upgrade's ActionPack changes could touch — and it fails at this head.
• Thin: Capybara/RSpec feature specs under spec/features exercise session and admin flows, but the reported auth-suite file list does not match this repo's layout.
• Gap: no local ruby or bundle available in the review environment, so no failing suite could be rerun or attributed here.

Calibration and confidence

Confidence: Low — No used API is removed and the diff is a bug/security patch release, but every verification check failed at this head and none of the runtime contracts could be line-traced because no ruby/bundle is available in the review environment.

1. Weakest claim: Attribution of the failing canonical-log spec to this upgrade; only rerunning planner-suite with the gems held back at 8.1.4 would shore it up.
2. Relied on but unverified: That the ActionPack cookie/session-store changes preserve the JSON-serialized _planner_session format and the RemoteIp change does not alter client-IP resolution behind the Heroku proxy — neither was line-traced.
3. Falsifier: Re-run planner-suite at this head with the rails gems held back at 8.1.4: if the canonical-log spec still fails, the failure is not upgrade-caused and this verdict firms up; if it passes, the upgrade broke a used path and this verdict is wrong.

Failure diagnosis

Failing tests: planner-suite: canonical request log line logs one structured Completed event with the canonical fields (spec/requests/canonical_log_line_spec.rb), auth-suite: admin/authentication/health/home/magic-links/oauth-provider/profile feature suites, jwt-payload and oauth-flow integration suites, probe: probe ran
Likely cause: ActionPack 8.1.4.1 changes to request rendering/negotiation or the riding-along minitest 6.1.0 bump are candidates, but with no ruby/bundle available locally the failure could not be reproduced or attributed; the auth-suite's listed files (test/features/*.test.js) do not exist in this repo, whose tests live under spec/
Location: spec/requests/canonical_log_line_spec.rb exercising config/initializers/canonical_log.rb (append_info_to_payload on ActionController::Base)