activestorage 8.1.3.1 → 8.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4b0ba7028cf3ec69f0c7e7658bf8b03993945ca49fce6c42a4b8f5c3cc4c4eb8
-  data.tar.gz: 4524cbbb93d8e113d3af7bb065ed38d7f22b011def59f81f05e2e30862ea198d
+  metadata.gz: 363218fe84c4760d1243ee6f1325312eab52a4d1d7c33f512022e1a8ad4ed8a5
+  data.tar.gz: 603439dba3d29a9f57b433232954d85d9ec70905ab6114d10e370b2136283258
 SHA512:
-  metadata.gz: b98acaa66a5bb64f6a0845ee8671085e0bef6b51599bb907cb75b02e67f4c088f53d97656448a8f351fb12447352020ffa3a7b7aca63677c90af42eab2de5b16
-  data.tar.gz: d48b0a79c83c6bbf5b0eae9c3dd84f1c4c7dc762cc212c92d263a61275dfeabf7915eb4c0dfae46a68fa10b2a2fddc364e108a23b1073b3e6e11dbae19f263b6
+  metadata.gz: 5277345f853e82ae059c49bde6c2664f84516dfbd4da948e7a48b437da363682104b56fb895b75e7010f7201c5ced03106297c24bba67977a2567b045b2faa60
+  data.tar.gz: 27b8cbc33599414d28774b41d1d3891a1fb803e4316e217f24e47903f8a2d5e6f92fd7ffb2d50d9b02efddf26fa08ae6a199993dbbfc4cdad37aab813df1b906

data/CHANGELOG.md

@@ -1,3 +1,69 @@
+## Rails 8.1.4 (September 24, 2026) ##
+
+*   Warn instead of aborting boot when `image_processing` 2.x is installed without `ruby-vips`
+    or `mini_magick`.
+
+    Both gems became soft dependencies in `image_processing` 2.0, and the `LoadError` raised for
+    a missing one names that gem instead of `image_processing`. Active Storage did not recognize
+    the message, so it re-raised rather than logging its usual warning.
+
+    Fixes #58413.
+
+    *Janko Marohnić*
+
+*   Fix `MirrorService#mirror` losing blob metadata when copying to mirrors.
+
+    Mirrored copies on S3, Azure, and GCS were served as `application/octet-stream`
+    because `content_type`, `filename`, `disposition`, and `custom_metadata` were
+    dropped. Forward the blob's `service_metadata` to each mirror's upload.
+
+    Fixes #57270.
+
+    *Maksim Romanov* + *Andrii Furmanets*
+
+*   Prevent `ActiveStorage.touch_attachment_records = false` from crashing the attachment of a Blob.
+
+    When `ActiveStorage.touch_attachment_records` was set to `false`, attaching a existing Blob to a Record
+    would raise an error. This is now fixed.
+
+    *Edouard Chin*
+
+*   Fix `MirrorService#mirror` raising `ActiveStorage::IntegrityError` when
+    mirroring without a checksum (e.g., `track_variants: false`).
+
+    *Denis Savchuk*
+
+*   Preserve attachment changes when converting record to another class using STI.
+
+    *fatkodima*
+
+*   Correct unexpected behavior resulting from dependent: :purge when using
+    has_one_attached or has_many_attached. Fixes #36423.
+
+    *Mark Oveson*
+
+*   Define `as_json` on `ActiveStorage::Attached::One` and `ActiveStorage::Attached::Many`.
+
+    The proxies hold a back-reference to the owning record in `@record`. Without an explicit
+    `as_json`, the default `Object#as_json` fall back serialized `instance_values`, which made
+    `record.to_json` recurse infinitely whenever the attached name collided with a model
+    attribute (e.g. an `ignored_columns` column brought back by `select('*')`).
+
+    `Attached::One#as_json` now returns the attachment record's JSON when attached and `nil`
+    otherwise. `Attached::Many#as_json` returns the attachment records' JSON as an array.
+
+    *Renxiang Cai*
+
+*   Fix Rails hanging when generating video previews
+
+    When Rails runs in a background process group, ffmpeg's attempt to configure the terminal for
+    interactive input would send SIGTTOU to the Rails process, suspending it indefinitely.
+
+    Fixed by explicitly passing /dev/null to ffmpeg's stdin.
+
+    *Jonathan del Strother*
+
+
 ## Rails 8.1.3.1 (July 29, 2026) ##
 
 *   Disable libvips's unfuzzed image loaders and savers.

data/app/controllers/active_storage/blobs/proxy_controller.rb

@@ -1,10 +1,24 @@
 # frozen_string_literal: true
 
-# Proxy files through application. This avoids having a redirect and makes files easier to cache.
+# Finds a blob by a +signed_id+ and proxies the file through the application.
+# The blob is streamed from storage directly to the response. This avoids having
+# a redirect and makes files easier to cache.
 #
-# WARNING: All Active Storage controllers are publicly accessible by default. The
-# generated URLs are hard to guess, but permanent by design. If your files
-# require a higher level of protection consider implementing
+# The +signed_id+s make URLs hard to guess but permanent by design, allowing the URLs to be cached.
+# The response sets the HTTP cache to public and allows browsers and proxies to cache it indefinitely.
+#
+# The URLs created for this controller are set to never expire by default.
+# To make URLs expire, pass the +expires_in+ option when generating the URL:
+#
+#   rails_storage_proxy_url(blob, expires_in: 1.minute)
+#
+# Or set the default for all Active Storage URLs:
+#
+#   config.active_storage.urls_expire_in = 1.day
+#
+# WARNING: All Active Storage controllers are publicly accessible by default.
+# Anyone who knows the URL can access the file, even if the rest of your application requires
+# authentication. If your files require access control consider implementing
 # {Authenticated Controllers}[https://guides.rubyonrails.org/active_storage_overview.html#authenticated-controllers].
 class ActiveStorage::Blobs::ProxyController < ActiveStorage::BaseController
   include ActiveStorage::SetBlob

data/app/controllers/active_storage/blobs/redirect_controller.rb

@@ -1,10 +1,26 @@
 # frozen_string_literal: true
 
-# Take a signed permanent reference for a blob and turn it into an expiring service URL for download.
+# Finds a blob by a +signed_id+ and redirects to a blob's expiring service URL.
 #
-# WARNING: All Active Storage controllers are publicly accessible by default. The
-# generated URLs are hard to guess, but permanent by design. If your files
-# require a higher level of protection consider implementing
+# The +signed_id+s make URLs hard to guess but permanent by design, allowing the URLs to be cached.
+#
+# The URLs created for this controller are set to never expire by default.
+# To make URLs expire, pass the +expires_in+ option when generating the URL:
+#
+#   rails_storage_redirect_url(blob, expires_in: 1.minute)
+#
+# Or set the default for all Active Storage URLs:
+#
+#   config.active_storage.urls_expire_in = 1.day
+#
+# The service URLs are set to expire in 5 minutes by default.
+# The default can be changed for all service URLs:
+#
+#   config.active_storage.service_urls_expire_in = 1.hour
+#
+# WARNING: All Active Storage controllers are publicly accessible by default.
+# Anyone who knows the URL can access the file, even if the rest of your application requires
+# authentication. If your files require access control consider implementing
 # {Authenticated Controllers}[https://guides.rubyonrails.org/active_storage_overview.html#authenticated-controllers].
 class ActiveStorage::Blobs::RedirectController < ActiveStorage::BaseController
   include ActiveStorage::SetBlob

data/app/controllers/active_storage/representations/proxy_controller.rb

@@ -1,10 +1,24 @@
 # frozen_string_literal: true
 
-# Proxy files through application. This avoids having a redirect and makes files easier to cache.
+# Finds a representation by a +signed_id+ and a +variation_key+, and proxies the file through the application.
+# The representation is streamed from storage directly to the response. This avoids having
+# a redirect and makes files easier to cache.
 #
-# WARNING: All Active Storage controllers are publicly accessible by default. The
-# generated URLs are hard to guess, but permanent by design. If your files
-# require a higher level of protection consider implementing
+# The +signed_id+s make URLs hard to guess but permanent by design, allowing the URLs to be cached.
+# The response sets the HTTP cache to public and allows browsers and proxies to cache it indefinitely.
+#
+# The URLs created for this controller are set to never expire by default.
+# To make URLs expire, pass the +expires_in+ option when generating the URL:
+#
+#   rails_storage_proxy_url(representation, expires_in: 1.minute)
+#
+# Or set the default for all Active Storage URLs:
+#
+#   config.active_storage.urls_expire_in = 1.day
+#
+# WARNING: All Active Storage controllers are publicly accessible by default.
+# Anyone who knows the URL can access the file, even if the rest of your application requires
+# authentication. If your files require access control consider implementing
 # {Authenticated Controllers}[https://guides.rubyonrails.org/active_storage_overview.html#authenticated-controllers].
 class ActiveStorage::Representations::ProxyController < ActiveStorage::Representations::BaseController
   include ActiveStorage::Streaming

data/app/controllers/active_storage/representations/redirect_controller.rb

@@ -1,10 +1,27 @@
 # frozen_string_literal: true
 
-# Take a signed permanent reference for a blob representation and turn it into an expiring service URL for download.
+# Finds a representation by a +signed_id+ and a +variation_key+, and redirects to a representation's expiring
+# service URL.
 #
-# WARNING: All Active Storage controllers are publicly accessible by default. The
-# generated URLs are hard to guess, but permanent by design. If your files
-# require a higher level of protection consider implementing
+# The +signed_id+s make URLs hard to guess but permanent by design, allowing the URLs to be cached.
+#
+# The URLs created for this controller are set to never expire by default.
+# To make URLs expire, pass the +expires_in+ option when generating the URL:
+#
+#   rails_storage_redirect_url(representation, expires_in: 1.minute)
+#
+# Or set the default for all Active Storage URLs:
+#
+#   config.active_storage.urls_expire_in = 1.day
+#
+# The service URLs are set to expire in 5 minutes by default.
+# The default can be changed for all service URLs:
+#
+#   config.active_storage.service_urls_expire_in = 1.hour
+#
+# WARNING: All Active Storage controllers are publicly accessible by default.
+# Anyone who knows the URL can access the file, even if the rest of your application requires
+# authentication. If your files require access control consider implementing
 # {Authenticated Controllers}[https://guides.rubyonrails.org/active_storage_overview.html#authenticated-controllers].
 class ActiveStorage::Representations::RedirectController < ActiveStorage::Representations::BaseController
   def show

data/app/models/active_storage/attachment.rb

@@ -34,7 +34,7 @@ class ActiveStorage::Attachment < ActiveStorage::Record
   delegate :signed_id, to: :blob
 
   after_create_commit :mirror_blob_later, :analyze_blob_later, :transform_variants_later
-  after_destroy_commit :purge_dependent_blob_later
+  after_destroy_commit :purge_dependent_blob
 
   ##
   # :singleton-method:
@@ -147,8 +147,12 @@ class ActiveStorage::Attachment < ActiveStorage::Record
       end
     end
 
-    def purge_dependent_blob_later
-      blob&.purge_later if dependent == :purge_later
+    def purge_dependent_blob
+      if dependent == :purge_later
+        blob&.purge_later
+      elsif dependent == :purge
+        blob&.purge
+      end
     end
 
     def dependent

data/app/models/active_storage/blob.rb

@@ -282,6 +282,16 @@ class ActiveStorage::Blob < ActiveStorage::Record
     service.compose(keys, key, **service_metadata)
   end
 
+  def service_metadata # :nodoc:
+    if forcibly_serve_as_binary?
+      { content_type: ActiveStorage.binary_content_type, disposition: :attachment, filename: filename, custom_metadata: custom_metadata }
+    elsif !allowed_inline?
+      { content_type: content_type, disposition: :attachment, filename: filename, custom_metadata: custom_metadata }
+    else
+      { content_type: content_type, custom_metadata: custom_metadata }
+    end
+  end
+
   # Downloads the file associated with this blob. If no block is given, the entire file is read into memory and returned.
   # That'll use a lot of RAM for very large files. If a block is given, then the download is streamed and yielded in chunks.
   def download(&block)
@@ -371,16 +381,6 @@ class ActiveStorage::Blob < ActiveStorage::Record
       ActiveStorage.web_image_content_types.include?(content_type)
     end
 
-    def service_metadata
-      if forcibly_serve_as_binary?
-        { content_type: ActiveStorage.binary_content_type, disposition: :attachment, filename: filename, custom_metadata: custom_metadata }
-      elsif !allowed_inline?
-        { content_type: content_type, disposition: :attachment, filename: filename, custom_metadata: custom_metadata }
-      else
-        { content_type: content_type, custom_metadata: custom_metadata }
-      end
-    end
-
     def touch_attachments
       attachments.then do |relation|
         if ActiveStorage.touch_attachment_records
@@ -389,7 +389,7 @@ class ActiveStorage::Blob < ActiveStorage::Record
           relation
         end
       end.each do |attachment|
-        attachment.touch
+        attachment.touch unless attachment.new_record?
       end
     end
 

data/app/models/active_storage/variant.rb

@@ -78,7 +78,7 @@ class ActiveStorage::Variant
   #
   # Use <tt>url_for(variant)</tt> (or the implied form, like <tt>link_to variant</tt> or <tt>redirect_to variant</tt>) to get the stable URL
   # for a variant that points to the ActiveStorage::Representations::ProxyController or ActiveStorage::Representations::RedirectController,
-  # which in turn will use this +service_call+ method for its redirection.
+  # which in turn will use this +url+ method for its redirection.
   def url(expires_in: ActiveStorage.service_urls_expire_in, disposition: :inline)
     service.url key, expires_in: expires_in, disposition: disposition, filename: filename, content_type: content_type
   end

data/lib/active_storage/attached/changes/create_many.rb

@@ -2,7 +2,8 @@
 
 module ActiveStorage
   class Attached::Changes::CreateMany # :nodoc:
-    attr_reader :name, :record, :attachables, :pending_uploads
+    attr_reader :name, :attachables, :pending_uploads
+    attr_accessor :record
 
     def initialize(name, record, attachables, pending_uploads: [])
       @name, @record, @attachables = name, record, Array(attachables)

data/lib/active_storage/attached/changes/create_one.rb

@@ -5,7 +5,8 @@ require "action_dispatch/http/upload"
 
 module ActiveStorage
   class Attached::Changes::CreateOne # :nodoc:
-    attr_reader :name, :record, :attachable
+    attr_reader :name, :attachable
+    attr_accessor :record
 
     def initialize(name, record, attachable)
       @name, @record, @attachable = name, record, attachable

data/lib/active_storage/attached/changes/delete_many.rb

@@ -2,7 +2,8 @@
 
 module ActiveStorage
   class Attached::Changes::DeleteMany # :nodoc:
-    attr_reader :name, :record
+    attr_reader :name
+    attr_accessor :record
 
     def initialize(name, record)
       @name, @record = name, record

data/lib/active_storage/attached/changes/delete_one.rb

@@ -2,7 +2,8 @@
 
 module ActiveStorage
   class Attached::Changes::DeleteOne # :nodoc:
-    attr_reader :name, :record
+    attr_reader :name
+    attr_accessor :record
 
     def initialize(name, record)
       @name, @record = name, record

data/lib/active_storage/attached/many.rb

@@ -67,6 +67,10 @@ module ActiveStorage
       attachments.any?
     end
 
+    def as_json(options = nil)
+      attachments.as_json(options)
+    end
+
     private
       def purge_many
         Attached::Changes::PurgeMany.new(name, record, attachments)

data/lib/active_storage/attached/model.rb

@@ -75,7 +75,7 @@ module ActiveStorage
       # The +:dependent+ option defaults to +:purge_later+. This means the attachment will be
       # purged (i.e. destroyed) in the background whenever the record is destroyed.
       # If an ActiveJob::Backend queue adapter is not set in the application set it to
-      # +purge+ instead.
+      # +:purge+ instead.
       #
       # If you need the attachment to use a service which differs from the globally configured one,
       # pass the +:service+ option. For example:
@@ -177,7 +177,7 @@ module ActiveStorage
       # The +:dependent+ option defaults to +:purge_later+. This means the attachments will be
       # purged (i.e. destroyed) in the background whenever the record is destroyed.
       # If an ActiveJob::Backend queue adapter is not set in the application set it to
-      # +purge+ instead.
+      # +:purge+ instead.
       #
       # If you need the attachment to use a service which differs from the globally configured one,
       # pass the +:service+ option. For example:
@@ -278,6 +278,8 @@ module ActiveStorage
         end
     end
 
+    attr_writer :attachment_changes # :nodoc:
+
     def attachment_changes # :nodoc:
       @attachment_changes ||= {}
     end
@@ -295,5 +297,14 @@ module ActiveStorage
     def reload(*) # :nodoc:
       super.tap { @attachment_changes = nil }
     end
+
+    def becomes(klass) # :nodoc:
+      super.tap do |became|
+        attachment_changes = @attachment_changes&.each_value do |change|
+          change.record = became
+        end
+        became.attachment_changes = attachment_changes
+      end
+    end
   end
 end

data/lib/active_storage/attached/one.rb

@@ -45,6 +45,12 @@ module ActiveStorage
       !attached?
     end
 
+    # Returns the attachment record's JSON representation, or +nil+ when no
+    # attachment is present.
+    def as_json(options = nil)
+      attached? ? attachment.as_json(options) : nil
+    end
+
     # Attaches an +attachable+ to the record.
     #
     # If the record is persisted and unchanged, the attachment is saved to

data/lib/active_storage/engine.rb

@@ -115,6 +115,16 @@ module ActiveStorage
               Please add `gem "image_processing", "~> 1.2"` to your Gemfile
               or set `config.active_storage.variant_processor = :disabled`.
             WARNING
+          when /ruby-vips/
+            ActiveStorage.logger.warn <<~WARNING.squish
+              Generating image variants with libvips requires the ruby-vips gem.
+              Please add `gem "ruby-vips", "~> 2.3"` to your Gemfile.
+            WARNING
+          when /mini_magick/
+            ActiveStorage.logger.warn <<~WARNING.squish
+              Generating image variants with ImageMagick requires the mini_magick gem.
+              Please add `gem "mini_magick", "~> 5.0"` to your Gemfile.
+            WARNING
           else
             raise
           end

data/lib/active_storage/gem_version.rb

@@ -9,8 +9,8 @@ module ActiveStorage
   module VERSION
     MAJOR = 8
     MINOR = 1
-    TINY  = 3
-    PRE   = "1"
+    TINY  = 4
+    PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

data/lib/active_storage/previewer.rb

@@ -79,7 +79,7 @@ module ActiveStorage
         to.binmode
 
         open_tempfile do |err|
-          IO.popen(argv, err: err) { |out| IO.copy_stream(out, to) }
+          IO.popen(argv, in: IO::NULL, err: err) { |out| IO.copy_stream(out, to) }
           err.rewind
 
           unless $?.success?

data/lib/active_storage/service/mirror_service.rb

@@ -7,7 +7,7 @@ module ActiveStorage
   # Wraps a set of mirror services and provides a single ActiveStorage::Service object that will all
   # have the files uploaded to them. A +primary+ service is designated to answer calls to:
   # * +download+
-  # * +exists?+
+  # * +exist?+
   # * +url+
   # * +url_for_direct_upload+
   # * +headers_for_direct_upload+
@@ -66,10 +66,12 @@ module ActiveStorage
     def mirror(key, checksum:)
       instrument :mirror, key: key, checksum: checksum do
         if (mirrors_in_need_of_mirroring = mirrors.select { |service| !service.exist?(key) }).any?
-          primary.open(key, checksum: checksum) do |io|
+          metadata = ActiveStorage::Blob.find_by(key: key)&.service_metadata || {}
+
+          primary.open(key, checksum: checksum, verify: checksum.present?) do |io|
             mirrors_in_need_of_mirroring.each do |service|
               io.rewind
-              service.upload key, io, checksum: checksum
+              service.upload key, io, checksum: checksum, **metadata
             end
           end
         end

data/lib/active_storage.rb

@@ -34,6 +34,7 @@ require "active_storage/deprecator"
 require "active_storage/errors"
 
 require "marcel"
+require "openssl"
 
 # :markup: markdown
 # :include: ../README.md
@@ -358,6 +359,9 @@ module ActiveStorage
   mattr_accessor :touch_attachment_records, default: true
   mattr_accessor :urls_expire_in
 
+  # Configures the mount point for the default Active Storage routes. Accepts any
+  # value supported by `scope`, such as a string path prefix or a hash of routing
+  # options.
   mattr_accessor :routes_prefix, default: "/rails/active_storage"
   mattr_accessor :draw_routes, default: true
   mattr_accessor :resolve_model_to_route, default: :rails_storage_redirect

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activestorage
 version: !ruby/object:Gem::Version
-  version: 8.1.3.1
+  version: 8.1.4
 platform: ruby
 authors:
 - David Heinemeier Hansson
@@ -15,56 +15,56 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.3.1
+        version: 8.1.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.3.1
+        version: 8.1.4
 - !ruby/object:Gem::Dependency
   name: actionpack
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.3.1
+        version: 8.1.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.3.1
+        version: 8.1.4
 - !ruby/object:Gem::Dependency
   name: activejob
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.3.1
+        version: 8.1.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.3.1
+        version: 8.1.4
 - !ruby/object:Gem::Dependency
   name: activerecord
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.3.1
+        version: 8.1.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.3.1
+        version: 8.1.4
 - !ruby/object:Gem::Dependency
   name: marcel
   requirement: !ruby/object:Gem::Requirement
@@ -193,10 +193,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v8.1.3.1/activestorage/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v8.1.3.1/
+  changelog_uri: https://github.com/rails/rails/blob/v8.1.4/activestorage/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v8.1.4/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v8.1.3.1/activestorage
+  source_code_uri: https://github.com/rails/rails/tree/v8.1.4/activestorage
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
@@ -212,7 +212,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.16
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Local and cloud file storage framework.
 test_files: []