[dependabot]

Bumps activestorage from 8.1.4 to 8.1.4.1.

Release notes

Sourced from activestorage's releases.

8.1.4.1

Active Support

• ActiveSupport::MessagePack no longer deserializes an unsafe ActiveSupport::SafeBuffer as html_safe.

  A SafeBuffer that was no longer html_safe?, for example after an in-place gsub!, was deserialized as an html_safe SafeBuffer. It is now serialized with an unsafe marker and deserialized as a String. Earlier versions of Rails cannot read an unsafe buffer serialized this way.

  [GHSA-2w9f-fxwj-w2qf]

  Jean Boussier

• ActiveSupport::Inflector#safe_constantize matches the constant name in a LoadError message as a literal string instead of building a Regexp from it.

  The name's segments were interpolated unescaped into the pattern, so input that reaches safe_constantize, such as the channel identifier in an Action Cable subscribe command, chose the source passed to the regexp compiler.

  [GHSA-8474-xrp6-wh69]

  Jeremy Daer

Active Model

• No changes.

Active Record

• No changes.

Action View

• Skip attribute names in tag helpers that are blank once converted to a string.

  A Symbol such as :" " is not blank, because Symbol#blank? is Symbol#empty?, so it reached the escaping step and produced an attribute with no name. The asset helpers symbolize their keys, so an ordinary String key reached the same place.

  [GHSA-68p9-83h6-5wpj]

  Mike Dalessio

... (truncated)

Changelog

Sourced from activestorage's changelog.

Rails 8.1.4.1 (November 03, 2026)

• Preserve committed proxy responses when a storage error interrupts a streamed download.

  [GHSA-4v2w-w6g6-f8f8]

  Jeremy Daer

• Derive ActiveStorage::Filename#base and #extension from the sanitized filename.

  This prevents null bytes and invalid byte sequences in stored filename metadata from raising when a blob is opened or represented. Existing blob records are handled without a data migration.

  [GHSA-p2pm-g2h6-7j5j]

  Jeremy Daer

• Ship an ImageMagick security policy and apply it to every ImageMagick process MiniMagick spawns.

  ImageMagick chooses a coder from the content of the file it is given, and some coders act on files named inside the image rather than on the image itself. Active Storage constrained none of them, so an uploaded file could reach any coder the host's policy allowed, through the ImageMagick analyzer at attach time, with no variant or analyze call in the application.

  Active Storage now ships a policy.xml in ActiveStorage::ImageMagick::POLICY_DIRECTORY and prepends that directory to MAGICK_CONFIGURE_PATH through MiniMagick.cli_env. ImageMagick applies every policy file on its search path, so the shipped policy adds to the host's policy rather than replacing it. A MAGICK_CONFIGURE_PATH set in the environment or in MiniMagick.cli_env, including by an initializer or dotenv, is kept after the shipped directory.

  The shipped policy denies the coders that script ImageMagick (MSL), read or delete files other than the image (TEXT, EPHEMERAL), fetch remote references (URL, HTTP, HTTPS, FTP), display to a screen (SHOW, WIN, PLT), or hand the file to Ghostscript (the PS, EPS, EPT and PDF coders, every alias of them, and the gs delegate), or reach a file directly (FILE, MPC, XPS, PCL), and it refuses @filename indirection. The policy applies to every ImageMagick command MiniMagick runs, not only Active Storage's.

  These applications must act:

  • One whose variant processor is :mini_magick has to use mini_magick 5.1 or later, which applying the policy requires. With an older mini_magick,

... (truncated)

Commits

• 3f290b7 Preparing for 8.1.4.1 release
• 3c67a69 Preserve committed Active Storage streams after errors
• 60f22af Sanitize Active Storage filename parts
• 849a6c3 Don't write upgraded cookies to a response that skips the session
• 468aa9a Ship an ImageMagick security policy for every MiniMagick process
• e19916c Enforce the content length on GCS direct uploads
• 8d93f6a Sign GCS direct uploads with V2 when cache_control is set
• 72136ff Active Storage: tempfile extension must match the blob's content type
• 3b1f262 Restrict the formats ffmpeg and ffprobe may open
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.