activesupport 8.1.2 → 8.1.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9c47955c56ff0cd5b61a8b4d74383c8f2f7523146088f2f1f7181049c354920c
-  data.tar.gz: a42c08e02aa40dafbaf38a7aff2b2d12dbb32c262bef95e10071381179aec53b
+  metadata.gz: c68d8c9bb247dcd9b6ba1a321f2f697ef70d56a5a2ab18f31995a5005a69004e
+  data.tar.gz: 05f2bc953516e62fa3ec707bac717963bc567b1e7a2d2c9c2ad8ea82e05cb38b
 SHA512:
-  metadata.gz: 83cfdbf2e2542e39fcfbe2918d6f50eca40e3ab713176f4a0ba2085272b642596632fa13704dd5fd37ba97f8d1ec1848d4821ad6d17d3330095f1576b8c1059f
-  data.tar.gz: 1c8b04fd7508ae125f30d5317437258ca35b02f6092562a81aa26bd6eaccb386684367e7bc6273128c7aa9ca036451694c8c67af3784f6e68fdf4a584c5fcdcc
+  metadata.gz: bf2c57851277401b08d89b986357c78dd0676aa660a540dfde0411366377c7198a3350500da5a6e1145017e768d288d1ae85161330f282ec464a7733b286c414
+  data.tar.gz: 14e9dc2f3c8d34c6cda4f319fd83555386ebb175b082a7f82d395f51c35d824055fec2fc4891a984d2e7e9e362be41304e3e285b16f3d0865950f7ddf58ce8cf

data/CHANGELOG.md

@@ -1,3 +1,24 @@
+## Rails 8.1.2.1 (March 23, 2026) ##
+
+*   Reject scientific notation in NumberConverter
+
+    [CVE-2026-33176]
+
+    *Jean Boussier*
+
+*   Fix `SafeBuffer#%` to preserve unsafe status
+
+    [CVE-2026-33170]
+
+    *Jean Boussier*
+
+*   Improve performance of NumberToDelimitedConverter
+
+    [CVE-2026-33169]
+
+    *Jean Boussier*
+
+
 ## Rails 8.1.2 (January 08, 2026) ##
 
 *   Make `delegate` and `delegate_missing_to` work in BasicObject subclasses.

data/lib/active_support/core_ext/string/output_safety.rb

@@ -116,7 +116,7 @@ module ActiveSupport # :nodoc:
       new_string = super
       new_safe_buffer = new_string.is_a?(SafeBuffer) ? new_string : SafeBuffer.new(new_string)
       if @html_unsafe
-        new_safe_buffer.instance_variable_set(:@html_unsafe, true)
+        new_safe_buffer.mark_unsafe!
       end
       new_safe_buffer
     end
@@ -129,7 +129,11 @@ module ActiveSupport # :nodoc:
         escaped_args = Array(args).map { |arg| explicit_html_escape_interpolated_argument(arg) }
       end
 
-      self.class.new(super(escaped_args))
+      new_safe_buffer = self.class.new(super(escaped_args))
+      if @html_unsafe
+        new_safe_buffer.mark_unsafe!
+      end
+      new_safe_buffer
     end
 
     def html_safe?
@@ -194,6 +198,11 @@ module ActiveSupport # :nodoc:
       EOT
     end
 
+    protected
+      def mark_unsafe!
+        @html_unsafe = true
+      end
+
     private
       def explicit_html_escape_interpolated_argument(arg)
         (!html_safe? || arg.html_safe?) ? arg : ERB::Util.unwrapped_html_escape(arg)

data/lib/active_support/gem_version.rb

@@ -10,7 +10,7 @@ module ActiveSupport
     MAJOR = 8
     MINOR = 1
     TINY  = 2
-    PRE   = nil
+    PRE   = "1"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

data/lib/active_support/number_helper/number_converter.rb

@@ -180,7 +180,7 @@ module ActiveSupport
           when Float, Rational
             number.to_d(0)
           when String
-            BigDecimal(number, exception: false)
+            BigDecimal(number, exception: false) unless number.to_s.match?(/[de]/i)
           else
             number.to_d rescue nil
           end

data/lib/active_support/number_helper/number_to_delimited_converter.rb

@@ -16,9 +16,24 @@ module ActiveSupport
       private
         def parts
           left, right = number.to_s.split(".")
-          left.gsub!(delimiter_pattern) do |digit_to_delimit|
-            "#{digit_to_delimit}#{options[:delimiter]}"
+          if delimiter_pattern
+            left.gsub!(delimiter_pattern) do |digit_to_delimit|
+              "#{digit_to_delimit}#{options[:delimiter]}"
+            end
+          else
+            left_parts = []
+            offset = left.size % 3
+            if offset > 0
+              left_parts << left[0, offset]
+            end
+
+            (left.size / 3).times do |i|
+              left_parts << left[offset + (i * 3), 3]
+            end
+
+            left = left_parts.join(options[:delimiter])
           end
+
           [left, right].compact
         end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activesupport
 version: !ruby/object:Gem::Version
-  version: 8.1.2
+  version: 8.1.2.1
 platform: ruby
 authors:
 - David Heinemeier Hansson
@@ -501,10 +501,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v8.1.2/activesupport/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v8.1.2/
+  changelog_uri: https://github.com/rails/rails/blob/v8.1.2.1/activesupport/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v8.1.2.1/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v8.1.2/activesupport
+  source_code_uri: https://github.com/rails/rails/tree/v8.1.2.1/activesupport
   rubygems_mfa_required: 'true'
 rdoc_options:
 - "--encoding"
@@ -522,7 +522,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.6
 specification_version: 4
 summary: A toolkit of support libraries and Ruby core extensions extracted from the
   Rails framework.