activesupport 8.1.4 → 8.1.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 273220875f318471f4762274c8b1f360159e9e89b008fd5b4b79ea0931e0974b
-  data.tar.gz: e7a6e2364c58e00ef9993314e3182207b0c2b39a07d4e30470b3485438eb9dc6
+  metadata.gz: d814e12819b93177e9cd65bf4fd7b1422f4684dac923ba3c2cd3e600983ada02
+  data.tar.gz: 279ffdf8add2ff5b5238ee9a3792bd9f5f904c4c305b50948952115c77a1ebc0
 SHA512:
-  metadata.gz: 3562450b3e30a8426934851940e2f344c781ba56a1048e70c80b90da735a4dec4e571aaeb892313ab5ab546ff52ce7e0423d3012d090ffd2e3713c9e4e8b08db
-  data.tar.gz: 403060699c2a65347f2c9f5fb1238c898f04f7675e4102ad43bae2da4e64d55c17b33c9c15d1484a4e565fc34efd0d3150a5e4725ee26e1e567b46c0b55dabc9
+  metadata.gz: 35600d081d262c463d19a4e8baaf214d4e1602160e855b727b7cc593163ad2cac5d02a62f874ad4c47b7fb256c44d08069efac18400f9a7a64b648625742fedc
+  data.tar.gz: c475cd1858143209f9b7f4f5d14fb7a1d679d16bf3dcab32aa86ef98b9f11788f8256ffa89f4312de8f7db808405c09da88c2f4bb83f2913b2857a2ef56b64eb

data/CHANGELOG.md

@@ -1,3 +1,29 @@
+## Rails 8.1.4.1 (November 03, 2026) ##
+
+*   `ActiveSupport::MessagePack` no longer deserializes an unsafe
+    `ActiveSupport::SafeBuffer` as `html_safe`.
+
+    A `SafeBuffer` that was no longer `html_safe?`, for example after an
+    in-place `gsub!`, was deserialized as an `html_safe` `SafeBuffer`. It is now
+    serialized with an unsafe marker and deserialized as a `String`. Earlier
+    versions of Rails cannot read an unsafe buffer serialized this way.
+
+    [GHSA-2w9f-fxwj-w2qf]
+
+    *Jean Boussier*
+
+*   `ActiveSupport::Inflector#safe_constantize` matches the constant name in a
+    `LoadError` message as a literal string instead of building a `Regexp`
+    from it.
+
+    The name's segments were interpolated unescaped into the pattern, so input
+    that reaches `safe_constantize`, such as the channel identifier in an Action
+    Cable subscribe command, chose the source passed to the regexp compiler.
+
+    [GHSA-8474-xrp6-wh69]
+
+    *Jeremy Daer*
+
 ## Rails 8.1.4 (September 24, 2026) ##
 
 *   Fix the debug error page rendering for `SyntaxError`s with multi-line messages.

data/lib/active_support/gem_version.rb

@@ -10,7 +10,7 @@ module ActiveSupport
     MAJOR = 8
     MINOR = 1
     TINY  = 4
-    PRE   = nil
+    PRE   = "1"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

data/lib/active_support/inflector/methods.rb

@@ -319,7 +319,8 @@ module ActiveSupport
         e.name.to_s == camel_cased_word.to_s)
     rescue LoadError => e
       message = e.respond_to?(:original_message) ? e.original_message : e.message
-      raise unless /Unable to autoload constant #{const_regexp(camel_cased_word)}/.match?(message)
+      constant_name = camel_cased_word.split("::").find { |part| !part.empty? } || camel_cased_word
+      raise unless message.include?("Unable to autoload constant #{constant_name}")
     end
 
     # Returns the suffix that should be added to a number to denote the position
@@ -349,23 +350,6 @@ module ActiveSupport
     end
 
     private
-      # Mounts a regular expression, returned as a string to ease interpolation,
-      # that will match part by part the given constant.
-      #
-      #   const_regexp("Foo::Bar::Baz") # => "Foo(::Bar(::Baz)?)?"
-      #   const_regexp("::")            # => "::"
-      def const_regexp(camel_cased_word)
-        parts = camel_cased_word.split("::")
-
-        return Regexp.escape(camel_cased_word) if parts.empty?
-
-        last = parts.pop
-
-        parts.reverse!.inject(last) do |acc, part|
-          part.empty? ? acc : "#{part}(::#{acc})?"
-        end
-      end
-
       # Applies inflection rules for +singularize+ and +pluralize+.
       #
       # If passed an optional +locale+ parameter, the uncountables will be

data/lib/active_support/message_pack/extensions.rb

@@ -249,11 +249,19 @@ module ActiveSupport
       end
 
       def write_safe_buffer(buffer, packer)
+        unless buffer.html_safe?
+          packer.write(false)
+        end
         packer.write(buffer.to_str)
       end
 
       def read_safe_buffer(unpacker)
-        ActiveSupport::SafeBuffer.new(unpacker.read)
+        string_or_safe = unpacker.read
+        if string_or_safe
+          ActiveSupport::SafeBuffer.new(string_or_safe)
+        else
+          unpacker.read
+        end
       end
 
       def raise_unserializable(object, *)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activesupport
 version: !ruby/object:Gem::Version
-  version: 8.1.4
+  version: 8.1.4.1
 platform: ruby
 authors:
 - David Heinemeier Hansson
@@ -501,10 +501,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v8.1.4/activesupport/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v8.1.4/
+  changelog_uri: https://github.com/rails/rails/blob/v8.1.4.1/activesupport/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v8.1.4.1/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v8.1.4/activesupport
+  source_code_uri: https://github.com/rails/rails/tree/v8.1.4.1/activesupport
   rubygems_mfa_required: 'true'
 rdoc_options:
 - "--encoding"