activestorage 8.1.3 → 8.1.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2a42fb3f7bbc7e2032f582d6d934bfb06245afdd8fe2db1b07b35d6c8223a617
-  data.tar.gz: aefc082d3ed704bf9c675e40560d9eb3be6f2e315ea28d7313ceabb493a95b93
+  metadata.gz: 4b0ba7028cf3ec69f0c7e7658bf8b03993945ca49fce6c42a4b8f5c3cc4c4eb8
+  data.tar.gz: 4524cbbb93d8e113d3af7bb065ed38d7f22b011def59f81f05e2e30862ea198d
 SHA512:
-  metadata.gz: c5c63ac998f475f5b3b9fb11d6bd57f0697b1ece83903f4283b35eefe490a0b0a6edb4e9b8d6d2fc4673c67948296c66af79bc25821a16ed9ad3144d76bdef5e
-  data.tar.gz: 12412531395d736326f067fdb7cdbe23f4a99a3167d4921d1882191baf4d5c79d6260d9ef598b1bcc90c0ffc35a78a2b898bcad9d8d2332c5f5749378eceeaca
+  metadata.gz: b98acaa66a5bb64f6a0845ee8671085e0bef6b51599bb907cb75b02e67f4c088f53d97656448a8f351fb12447352020ffa3a7b7aca63677c90af42eab2de5b16
+  data.tar.gz: d48b0a79c83c6bbf5b0eae9c3dd84f1c4c7dc762cc212c92d263a61275dfeabf7915eb4c0dfae46a68fa10b2a2fddc364e108a23b1073b3e6e11dbae19f263b6

data/CHANGELOG.md

@@ -1,3 +1,47 @@
+## Rails 8.1.3.1 (July 29, 2026) ##
+
+*   Disable libvips's unfuzzed image loaders and savers.
+
+    libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only
+    safe for trusted content. Active Storage will call `Vips.block_untrusted(true)` to disable them
+    while booting. An application that needs a specific loader or saver may re-enable it in an
+    initializer.
+
+    This is a breaking change for applications that process image types with an unfuzzed loader or
+    saver. Variant transformation of BMP, ICO, and PSD attachments will raise `Vips::Error`, and
+    analysis of these and other types such as SVG, JPEG XL, JPEG 2000, and Netpbm will no longer
+    record `width` and `height`. Requesting an unfuzzed output format, typically FITS, JXL, or
+    anything delegated to ImageMagick, will also raise `Vips::Error`. Attaching, storing, and
+    downloading are unchanged.
+
+    An application seeing `Vips::Error` raised during image transformation may wish to remove the
+    affected content types from `config.active_storage.variable_content_types` in an initializer.
+    Active Storage will then treat those attachments as not variable and will not generate variants
+    for them. This most often matters to an application that transforms images during a request
+    rather than in a background job, where the failure surfaces as an error response instead of a
+    failed job.
+
+    ```ruby
+    Rails.application.config.active_storage.variable_content_types -=
+      %w[ image/bmp image/vnd.microsoft.icon image/vnd.adobe.photoshop ]
+    ```
+
+    Applications using the `:mini_magick` variant processor will see no change in how their
+    attachments are processed, but the loaders and savers will be disabled process-wide whenever
+    ruby-vips is installed, and the version requirements below will still apply. Such an application
+    may remove ruby-vips from its Gemfile to avoid both.
+
+    The minimum supported version of libvips is now 8.13, and the minimum supported version of
+    ruby-vips is now 2.2.1. These are the earliest versions that are capable of disabling untrusted
+    operations. When ruby-vips is installed and either minimum is not met, Active Storage will raise
+    a `RuntimeError` while booting rather than run in an unsecurable environment.
+
+    [GHSA-xr9x-r78c-5hrm]
+    [CVE-2026-66066]
+
+    *Mike Dalessio*
+
+
 ## Rails 8.1.3 (March 24, 2026) ##
 
 *   Fix `ActiveStorage::Blob` content type predicate methods to handle `nil`.

data/lib/active_storage/analyzer/image_analyzer/vips.rb

@@ -1,21 +1,6 @@
 # frozen_string_literal: true
 
-begin
-  require "nokogiri"
-rescue LoadError
-  # Ensure nokogiri is loaded before vips, which also depends on libxml2.
-  # See Nokogiri RFC: Stop exporting symbols:
-  #   https://github.com/sparklemotion/nokogiri/discussions/2746
-end
-
-begin
-  gem "ruby-vips"
-  require "ruby-vips"
-  ActiveStorage::VIPS_AVAILABLE = true # :nodoc:
-rescue LoadError => error
-  ActiveStorage::VIPS_AVAILABLE = false # :nodoc:
-  raise error unless error.message.match?(/libvips|ruby-vips/)
-end
+require "active_storage/vips"
 
 module ActiveStorage
   # This analyzer relies on the third-party {ruby-vips}[https://github.com/libvips/ruby-vips] gem. Ruby-vips requires

data/lib/active_storage/gem_version.rb

@@ -10,7 +10,7 @@ module ActiveStorage
     MAJOR = 8
     MINOR = 1
     TINY  = 3
-    PRE   = nil
+    PRE   = "1"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

data/lib/active_storage/transformers/vips.rb

@@ -1,5 +1,14 @@
 # frozen_string_literal: true
 
+# Do not remove either of these requires.
+#
+# active_storage/vips disables libvips's unfuzzed loaders and savers.
+#
+# active_storage/vips has already loaded image_processing/vips, but requiring it here is what
+# raises LoadError when the gem is missing, which the engine reports as an actionable warning.
+require "active_storage/vips"
+require "image_processing/vips"
+
 module ActiveStorage
   module Transformers
     class Vips < ImageProcessingTransformer

data/lib/active_storage/vips.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+# :markup: markdown
+
+require "active_storage"
+require "active_support/core_ext/string/filters"
+
+begin
+  require "nokogiri"
+rescue LoadError
+  # Ensure nokogiri is loaded before vips, which also depends on libxml2.
+  # See Nokogiri RFC: Stop exporting symbols:
+  #   https://github.com/sparklemotion/nokogiri/discussions/2746
+end
+
+begin
+  gem "ruby-vips"
+  require "ruby-vips"
+  ActiveStorage::VIPS_AVAILABLE = true # :nodoc:
+rescue LoadError => error
+  ActiveStorage::VIPS_AVAILABLE = false # :nodoc:
+  raise error unless error.message.match?(/libvips|ruby-vips/)
+end
+
+if ActiveStorage::VIPS_AVAILABLE
+  begin
+    # image_processing 2.0 calls Vips.block_untrusted(true) itself when it loads, so it has to load
+    # before the lines below. Leaving it to load later, when the transformer is autoloaded, would
+    # disable the loaders again after an application's initializers had re-enabled them.
+    require "image_processing/vips"
+  rescue LoadError
+    # image_processing is only needed to generate variants, not to analyze blobs.
+  end
+
+  unless Vips.respond_to?(:block_untrusted)
+    raise <<~ERROR.squish
+      libvips's unfuzzed operations are not safe to use with untrusted content, and Active Storage
+      cannot disable them. Disabling them requires libvips 8.13 or later and ruby-vips 2.2.1 or
+      later. Please upgrade libvips and ruby-vips, or remove the ruby-vips gem from your Gemfile.
+    ERROR
+  end
+
+  Vips.block_untrusted(true)
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activestorage
 version: !ruby/object:Gem::Version
-  version: 8.1.3
+  version: 8.1.3.1
 platform: ruby
 authors:
 - David Heinemeier Hansson
@@ -15,56 +15,56 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.3
+        version: 8.1.3.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.3
+        version: 8.1.3.1
 - !ruby/object:Gem::Dependency
   name: actionpack
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.3
+        version: 8.1.3.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.3
+        version: 8.1.3.1
 - !ruby/object:Gem::Dependency
   name: activejob
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.3
+        version: 8.1.3.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.3
+        version: 8.1.3.1
 - !ruby/object:Gem::Dependency
   name: activerecord
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.3
+        version: 8.1.3.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.3
+        version: 8.1.3.1
 - !ruby/object:Gem::Dependency
   name: marcel
   requirement: !ruby/object:Gem::Requirement
@@ -186,16 +186,17 @@ files:
 - lib/active_storage/transformers/transformer.rb
 - lib/active_storage/transformers/vips.rb
 - lib/active_storage/version.rb
+- lib/active_storage/vips.rb
 - lib/tasks/activestorage.rake
 homepage: https://rubyonrails.org
 licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v8.1.3/activestorage/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v8.1.3/
+  changelog_uri: https://github.com/rails/rails/blob/v8.1.3.1/activestorage/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v8.1.3.1/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v8.1.3/activestorage
+  source_code_uri: https://github.com/rails/rails/tree/v8.1.3.1/activestorage
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
@@ -211,7 +212,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Local and cloud file storage framework.
 test_files: []