shrine 3.7.1 → 3.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 29a02d25cd1180c4f0170434edd185b3b1ab0bd2be060fa53e58fcd32c50d4ae
-  data.tar.gz: 56e50d961ef88e0d3cae4d295b6996c52cd2021b923d9b453f401f10b04021b3
+  metadata.gz: 55c3fc9bf7eb40700d2be0ee82900986c601b1b3449d5d5ee7b246546bfe5eb3
+  data.tar.gz: 11ffe3b196b79946c931f5a0e9538bda74cc4abd74711124509c76a13a5eaddc
 SHA512:
-  metadata.gz: cb06f261af63f09ba767556d65f8b99e5204c1162ce7d8e28e5355148539a02c486fa088819884cf38dee4bf0683e8167b6582c4a028271a5145bd8661f64765
-  data.tar.gz: ec5cd4f04fe90ada87cd594bf78e61c2de9fcbebe8d51cb9e49b0bec566614be5ea5826382a8f25608888c84a951f25ad80442a6af2d641a37bae0e8fe184d7e
+  metadata.gz: 19585a7a2c486d43fb9be2abc84123adced4d18beebf50919938a9c631d16c0c2ecb15e777397b5b8a1642911171d328c55bf86769b9a31a4a3957cf3d8256d9
+  data.tar.gz: 1dfbb667941b5f2bfa1b035230f0b1fb809c59855fc253f8365394624cffd4e3078a0aa41188eb27c8e57be8d4243e45d5dcf56a83b4d9ea1900bf02fa340dc6

data/CHANGELOG.md

@@ -1,6 +1,18 @@
+## 3.8.0 (2026-06-24)
+
+* `s3` – Use single-request uploads for smaller files again instead of always using multipart uploads (@janko)
+
+* `derivatives` – Forward `Attacher#promote` options to `Attacher#upload_derivatives` (@milkcocoa)
+
+* `file_system` – Prevent path traversal outside of the storage directory (@janko)
+
 ## 3.7.1 (2026-06-03)
 
-* Update method signatures of some plugins to work around a Bootsnap bug causing a `wrong number of arguments` error.
+* Update method signatures of some plugins to work around a Bootsnap bug causing a `wrong number of arguments` error (@janko)
+
+* `derivation_endpoint` – Add `:format` argument to `UploadedFile#derivation_url` for path extension (@janko)
+
+* `rack_response` – Add `:etag` argument for setting a custom `ETag` (@camilohollanda)
 
 ## 3.7.0 (2026-05-27)
 

data/doc/release_notes/3.7.1.md

@@ -2,6 +2,24 @@
 title: Shrine 3.7.1
 ---
 
+## New features
+
+* The `derivation_endpoint` plugin now supports adding a file extension to the derivation URL path via the `:format` option on `UploadedFile#derivation_url`. Some HTTP clients and CDNs use the URL path extension to determine the content type of the response.
+
+  ```rb
+  uploaded_file.derivation_url(:thumbnail, format: "jpg")
+  #=> ".../thumbnail/eyJpZCI6ImZvbyIsInN.jpg?signature=..."
+  ```
+
+  The extension is included in the URL signature, so it cannot be tampered with.
+
+* The `rack_response` plugin now accepts an `:etag` option for setting a custom `ETag` header, overriding the default one Shrine generates.
+
+  ```rb
+  response = uploaded_file.to_rack_response(etag: "my-custom-etag")
+  response[1]["ETag"] #=> "my-custom-etag"
+  ```
+
 ## Bug fixes
 
 * When initializing Shrine with the `activerecord` plugin, under Bootsnap 1.24.5 and Ruby 3.4.5 this would raise an error:

data/doc/release_notes/3.8.0.md

@@ -0,0 +1,37 @@
+---
+title: Shrine 3.8.0
+---
+
+## Security
+
+* The `file_system` storage now prevents path traversal outside of the storage
+  directory. Previously, an id containing `../` sequences (e.g. coming from
+  attacker-controlled data) could resolve to a location outside of the
+  configured storage directory. Now `Shrine::Error` is raised whenever an id
+  would resolve outside of the storage directory:
+
+  ```rb
+  storage = Shrine::Storage::FileSystem.new("uploads")
+  storage.open("../../etc/passwd") #~> Shrine::Error
+  ```
+
+## New features
+
+* The `derivatives` plugin now forwards options passed to `Attacher#promote`
+  into `Attacher#upload_derivatives`. This means options such as upload options
+  reach the derivatives upload as well, not just the main file.
+
+  ```rb
+  attacher.promote(upload_options: { acl: "public-read" })
+  # the same options are now forwarded when uploading derivatives
+  ```
+
+## Other improvements
+
+* The `s3` storage again uses single-request uploads for smaller files, instead
+  of always using multipart uploads. In Shrine 3.7.0, when a `TransferManager`
+  was available, it was used for uploads of any size, but `TransferManager`
+  uploads via multipart unconditionally, which is inefficient for smaller files.
+  Now files at or below the multipart threshold (`:upload`, 15MB by default) are
+  uploaded in a single request, and only larger files use multipart upload via
+  the `TransferManager` (falling back to the older API when it's not available).

data/lib/shrine/plugins/derivatives.rb

@@ -161,7 +161,7 @@ class Shrine
         #     attacher.stored?(attacher.derivatives[:thumb]) #=> true
         def promote(**options)
           super
-          promote_derivatives
+          promote_derivatives(**options)
           create_derivatives if create_derivatives_on_promote?
         end
 

data/lib/shrine/storage/file_system.rb

@@ -113,9 +113,18 @@ class Shrine
         end
       end
 
-      # Returns the full path to the file.
+      # Returns the full path to the file. Raises Shrine::Error if the id would
+      # resolve to a location outside of the storage #directory (e.g. an id
+      # containing `../` path traversal sequences in attacker-controlled data).
       def path(id)
-        directory.join(id.gsub("/", File::SEPARATOR))
+        path = directory.join(id.gsub("/", File::SEPARATOR))
+        expanded = path.expand_path
+
+        unless expanded == directory || expanded.to_s.start_with?("#{directory}#{File::SEPARATOR}")
+          raise Shrine::Error, "path #{id.inspect} resolves outside of the storage directory"
+        end
+
+        path
       end
 
       protected

data/lib/shrine/storage/s3.rb

@@ -230,20 +230,15 @@ class Shrine
 
       private
 
-      # Upload the file to S3.
-      # Uses @transfer_manager, if defined, for any size upload.
-      # Falls back to the original code using the older, now depricated
-      # AWS APIs for users of older version of the AWS Gem.
-      # for multipart uploads of large files.
+      # Uploads the file to S3. Uses multipart upload for large files.
       def put(io, id, **)
-        if @transfer_manager
+        if io.respond_to?(:size) && io.size && io.size <= @multipart_threshold[:upload]
+          object(id).put(body: io, **)
+        elsif @transfer_manager # multipart upload - transfer manager
           @transfer_manager.upload_stream(bucket: bucket.name, key: object_key(id), part_size: part_size(io), **) do |write_stream|
             IO.copy_stream(io, write_stream)
           end
-        elsif io.respond_to?(:size) && io.size && io.size <= @multipart_threshold[:upload]
-          object(id).put(body: io, **)
-        else
-          # multipart upload old API
+        else # multipart upload - before transfer manager
           object(id).upload_stream(part_size: part_size(io), **) do |write_stream|
             IO.copy_stream(io, write_stream)
           end

data/lib/shrine/version.rb

@@ -7,8 +7,8 @@ class Shrine
 
   module VERSION
     MAJOR = 3
-    MINOR = 7
-    TINY  = 1
+    MINOR = 8
+    TINY  = 0
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")

data/shrine.gemspec

@@ -67,10 +67,10 @@ direct uploads for fully asynchronous user experience.
 
   # for instrumentation plugin
   gem.add_development_dependency "dry-monitor"
-  gem.add_development_dependency "activesupport", RUBY_ENGINE == "jruby" ? "~> 7.2" : "~> 8.1"
+  gem.add_development_dependency "activesupport", RUBY_ENGINE == "jruby" ? "~> 8.0.0" : "~> 8.1"
 
   # for ORM plugins
   gem.add_development_dependency "sequel"
-  gem.add_development_dependency "activerecord", RUBY_ENGINE == "jruby" ? "~> 7.2" : "~> 8.1"
+  gem.add_development_dependency "activerecord", RUBY_ENGINE == "jruby" ? "~> 8.0.0" : "~> 8.1"
   gem.add_development_dependency "sqlite3", "~> 2.1" unless RUBY_ENGINE == "jruby"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: shrine
 version: !ruby/object:Gem::Version
-  version: 3.7.1
+  version: 3.8.0
 platform: ruby
 authors:
 - Janko Marohnić
@@ -155,20 +155,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: ruby-filemagic
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.7'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.7'
 - !ruby/object:Gem::Dependency
   name: mime-types
   requirement: !ruby/object:Gem::Requirement
@@ -301,14 +287,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '8.1'
+        version: 8.0.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '8.1'
+        version: 8.0.0
 - !ruby/object:Gem::Dependency
   name: sequel
   requirement: !ruby/object:Gem::Requirement
@@ -329,28 +315,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '8.1'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '8.1'
-- !ruby/object:Gem::Dependency
-  name: sqlite3
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.1'
+        version: 8.0.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.1'
+        version: 8.0.0
 description: |
   Shrine is a toolkit for file attachments in Ruby applications. It supports
   uploading, downloading, processing and deleting IO objects, backed by various
@@ -483,6 +455,7 @@ files:
 - doc/release_notes/3.6.0.md
 - doc/release_notes/3.7.0.md
 - doc/release_notes/3.7.1.md
+- doc/release_notes/3.8.0.md
 - doc/retrieving_uploads.md
 - doc/securing_uploads.md
 - doc/storage/file_system.md
@@ -576,7 +549,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.3
 specification_version: 4
 summary: Toolkit for file attachments in Ruby applications
 test_files: []