activesupport 8.0.4 → 8.0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 32beba8624850f5da4cad945a95adadbf26c3469dc4da4f231412b37b6fbc070
-  data.tar.gz: 66eec5b8c43f67d79449762999acce95b9c73a93800197bdaca5f22033876819
+  metadata.gz: 4c9cda7e70f0c4b499dc6dadf103e87f3d7e8330879a0ee3a354228711b68fe7
+  data.tar.gz: d21140f0a85881f2534febd8e9f0bed0820a72c3a278543c4b1b7b7eeb6a2641
 SHA512:
-  metadata.gz: 1eb3ea47ffa973a4c8378e804c7bf69e03013d39b30f73e5a80285672fa8aa1d109385ea3b9dff14f438d38e39ee47e6333567a385cd3bf0a64371b7e546757b
-  data.tar.gz: f204a3f69b69120cd00b904589a0d6bdfbf0f9655c2f6fd20070af01799b1851dead84e44c9c3ef3af1f70e56cc4323de07dad8dc14128624aba904f48c9dd83
+  metadata.gz: 67213e140a1b59108ba6856958603c56472cfa0b6745e5b5479d3ab0b7be050daf8d15b4276ede433d721f2cf853f3ccec4908387a5c67ed4e9657d929f22621
+  data.tar.gz: 03af70c76a91cf42ca70bb7d7fce52b2c33e7b957bb2c3943399f714bedac5f522628beb95e8f50c8632564653717d7a10f0187cf1f3d33b21cc1ce2ff7446c4

data/CHANGELOG.md

@@ -1,3 +1,24 @@
+## Rails 8.0.4.1 (March 23, 2026) ##
+
+*   Reject scientific notation in NumberConverter
+
+    [CVE-2026-33176]
+
+    *Jean Boussier*
+
+*   Fix `SafeBuffer#%` to preserve unsafe status
+
+    [CVE-2026-33170]
+
+    *Jean Boussier*
+
+*   Improve performance of NumberToDelimitedConverter
+
+    [CVE-2026-33169]
+
+    *Jean Boussier*
+
+
 ## Rails 8.0.4 (October 28, 2025) ##
 
 *   Fix `Enumerable#sole` to return the full tuple instead of just the first element of the tuple.

data/lib/active_support/core_ext/string/output_safety.rb

@@ -128,7 +128,9 @@ module ActiveSupport # :nodoc:
         escaped_args = Array(args).map { |arg| explicit_html_escape_interpolated_argument(arg) }
       end
 
-      self.class.new(super(escaped_args))
+      new_safe_buffer = self.class.new(super(escaped_args))
+      new_safe_buffer.instance_variable_set(:@html_safe, @html_safe)
+      new_safe_buffer
     end
 
     attr_reader :html_safe

data/lib/active_support/gem_version.rb

@@ -10,7 +10,7 @@ module ActiveSupport
     MAJOR = 8
     MINOR = 0
     TINY  = 4
-    PRE   = nil
+    PRE   = "1"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

data/lib/active_support/number_helper/number_converter.rb

@@ -180,7 +180,7 @@ module ActiveSupport
           when Float, Rational
             number.to_d(0)
           when String
-            BigDecimal(number, exception: false)
+            BigDecimal(number, exception: false) unless number.to_s.match?(/[de]/i)
           else
             number.to_d rescue nil
           end

data/lib/active_support/number_helper/number_to_delimited_converter.rb

@@ -16,9 +16,24 @@ module ActiveSupport
       private
         def parts
           left, right = number.to_s.split(".")
-          left.gsub!(delimiter_pattern) do |digit_to_delimit|
-            "#{digit_to_delimit}#{options[:delimiter]}"
+          if delimiter_pattern
+            left.gsub!(delimiter_pattern) do |digit_to_delimit|
+              "#{digit_to_delimit}#{options[:delimiter]}"
+            end
+          else
+            left_parts = []
+            offset = left.size % 3
+            if offset > 0
+              left_parts << left[0, offset]
+            end
+
+            (left.size / 3).times do |i|
+              left_parts << left[offset + (i * 3), 3]
+            end
+
+            left = left_parts.join(options[:delimiter])
           end
+
           [left, right].compact
         end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activesupport
 version: !ruby/object:Gem::Version
-  version: 8.0.4
+  version: 8.0.4.1
 platform: ruby
 authors:
 - David Heinemeier Hansson
@@ -90,6 +90,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '5.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '6'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -97,6 +100,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '5.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '6'
 - !ruby/object:Gem::Dependency
   name: base64
   requirement: !ruby/object:Gem::Requirement
@@ -494,10 +500,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v8.0.4/activesupport/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v8.0.4/
+  changelog_uri: https://github.com/rails/rails/blob/v8.0.4.1/activesupport/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v8.0.4.1/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v8.0.4/activesupport
+  source_code_uri: https://github.com/rails/rails/tree/v8.0.4.1/activesupport
   rubygems_mfa_required: 'true'
 rdoc_options:
 - "--encoding"
@@ -515,7 +521,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.6
 specification_version: 4
 summary: A toolkit of support libraries and Ruby core extensions extracted from the
   Rails framework.