🚨 [security] [ruby] Update rails 8.1.3 → 8.1.3.1 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ rails (8.1.3 → 8.1.3.1) · Repo · Changelog

Release Notes

8.1.3.1

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• No changes.

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• Disable libvips's unfuzzed image loaders and savers.

  libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only
  safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them
  while booting. An application that needs a specific loader or saver may re-enable it in an
  initializer.

  This is a breaking change for applications that process image types with an unfuzzed loader or
  saver. Variant transformation of BMP, ICO, and PSD attachments will raise Vips::Error, and
  analysis of these and other types such as SVG, JPEG XL, JPEG 2000, and Netpbm will no longer
  record width and height. Requesting an unfuzzed output format, typically FITS, JXL, or
  anything delegated to ImageMagick, will also raise Vips::Error. Attaching, storing, and
  downloading are unchanged.

  An application seeing Vips::Error raised during image transformation may wish to remove the
  affected content types from config.active_storage.variable_content_types in an initializer.
  Active Storage will then treat those attachments as not variable and will not generate variants
  for them. This most often matters to an application that transforms images during a request
  rather than in a background job, where the failure surfaces as an error response instead of a
  failed job.

  Rails.application.config.active_storage.variable_content_types -=
    %w[ image/bmp image/vnd.microsoft.icon image/vnd.adobe.photoshop ]

  Applications using the :mini_magick variant processor will see no change in how their
  attachments are processed, but the loaders and savers will be disabled process-wide whenever
  ruby-vips is installed, and the version requirements below will still apply. Such an application
  may remove ruby-vips from its Gemfile to avoid both.

  The minimum supported version of libvips is now 8.13, and the minimum supported version of
  ruby-vips is now 2.2.1. These are the earliest versions that are capable of disabling untrusted
  operations. When ruby-vips is installed and either minimum is not met, Active Storage will raise
  a RuntimeError while booting rather than run in an unsecurable environment.

  [GHSA-xr9x-r78c-5hrm]
  [CVE-2026-66066]

  Mike Dalessio

Action Mailbox

• No changes.

Action Text

• No changes.

Railties

• No changes.

Guides

• No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 1 commit:

• Preparing for 8.1.3.1 release

↗️ actioncable (indirect, 8.1.3 → 8.1.3.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 1 commit:

• Preparing for 8.1.3.1 release

↗️ actionmailbox (indirect, 8.1.3 → 8.1.3.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 1 commit:

• Preparing for 8.1.3.1 release

↗️ actionmailer (indirect, 8.1.3 → 8.1.3.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 1 commit:

• Preparing for 8.1.3.1 release

↗️ actionpack (indirect, 8.1.3 → 8.1.3.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 1 commit:

• Preparing for 8.1.3.1 release

↗️ actiontext (indirect, 8.1.3 → 8.1.3.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 1 commit:

• Preparing for 8.1.3.1 release

↗️ actionview (indirect, 8.1.3 → 8.1.3.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 1 commit:

• Preparing for 8.1.3.1 release

↗️ activejob (indirect, 8.1.3 → 8.1.3.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 1 commit:

• Preparing for 8.1.3.1 release

↗️ activemodel (indirect, 8.1.3 → 8.1.3.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 1 commit:

• Preparing for 8.1.3.1 release

↗️ activerecord (indirect, 8.1.3 → 8.1.3.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 1 commit:

• Preparing for 8.1.3.1 release

↗️ activestorage (indirect, 8.1.3 → 8.1.3.1) · Repo · Changelog

Security Advisories 🚨

🚨 Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing

Impact

In its default configuration, a Rails application that displays image variants may allow an
unauthenticated attacker to read arbitrary files from the server, including the process environment.
That environment typically holds secret_key_base and often credentials for external systems, which
may in turn allow escalation to remote code execution or lateral movement to those systems.

Details

libvips reads and writes file formats through "loaders" and "savers" (or more generally
"operations"), many of which are backed by third-party libraries. It marks some of these operations
as "unfuzzed", meaning they are unsafe for untrusted content, and several handle formats unrelated
to web images. Active Storage did not disable the unfuzzed operations, so an attacker who can upload
a crafted file and cause a variant to be generated from it may be able to invoke one.

We are aware of a mechanism by which an attacker, by uploading a crafted file, is able to cause
disclosure of the contents of arbitrary files accessible on the filesystem of the targeted
application. One specific attack chain has been reported to us (see "Disclosure" below), but we do
not assume it is the only one that exists.

Affected applications

An application is affected if it meets all of these requirements:

• Uses libvips for Active Storage image processing. This is config.active_storage.variant_processor = :vips,
  which load_defaults 7.0 set and no later default has changed.
• Allows image uploads from untrusted users.

Generating variants is not a separate requirement.

Mitigation

• Upgrade to a fixed version of activestorage.
• The minimum version of libvips must be upgraded to >= 8.13.
• Change secret_key_base and change any secrets accessible in the application environment (see "Expire and change secrets" below)

Earlier versions of libvips (< 8.13) cannot disable unfuzzed operations at all, and Active Storage
will raise an exception during boot in such an unsecurable environment.

Expire and change secrets

Upgrading closes the vulnerability but does not undo an exfiltrated secret if that already
occurred. An affected application should treat every secret readable by the application process as
potentially exposed and change it, including:

• secret_key_base
• The master key, whether stored in config/master.key or supplied as RAILS_MASTER_KEY, along
  with everything in config/credentials.yml.enc that it decrypts
• Credentials for the Active Storage service, such as S3, GCS, or Azure keys
• Database credentials
• Tokens and keys for any third-party service the application calls

Changing secret_key_base expires active sessions and requires users to log in again. Encrypted
cookies, signed cookies, signed global IDs, and Active Storage URLs are also affected.

Rotation should only be used as an intermediate step if necessary. Do not retain an exposed secret
as a fallback.

Workarounds

If libvips < 8.13 is being used, there are no workarounds available other than removing the
dependency on libvips from the application. Some applications may have ruby-vips declared as a
dependency only for image analysis, and those applications may be able to simply remove ruby-vips
from the Gemfile to remove libvips from the application. Applications that do not use Active Storage
can remove ruby-vips from the Gemfile to avoid the boot-time checks.

If libvips >= 8.13 is present on the system, applications can disable the unfuzzed operations
without upgrading Rails by setting the VIPS_BLOCK_UNTRUSTED environment variable, which libvips
reads while initializing.

Applications also running ruby-vips >= 2.2.1 or later can instead call
Vips.block_untrusted(true) from an initializer.

Releases

The fixed releases are available at the normal locations.

Versions affected

• activestorage < 7.2.3.2
• activestorage >= 8.0, < 8.0.5.1
• activestorage >= 8.1, < 8.1.3.1

Disclosure

Technical details of the attack chain are intentionally omitted from this advisory. They would add
nothing to an administrator's decision to upgrade, while making it substantially easier to attack
applications that have not yet done so.

Details will be disclosed no later than 2026-08-28, via the Rails Security
Announcements forum.

Credit

This issue was responsibly reported by 0xacb, s3np41k1r1t0 and castilho from Ethiack, and RyotaK from GMO Flatt Security Inc..

References

• libvips 8.13 release notes, blocking of unfuzzed loaders
• W.A. Arbaugh, W.L. Fithen, and J. McHugh, "Windows of Vulnerability: A Case Study
  Analysis", IEEE Computer 33(12), December 2000
• https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve
• https://blog.flatt.tech/entry/kindarails2shell_rails

Commits

See the full diff on Github. The new version differs by 1 commit:

• Preparing for 8.1.3.1 release

↗️ activesupport (indirect, 8.1.3 → 8.1.3.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 1 commit:

• Preparing for 8.1.3.1 release

↗️ railties (indirect, 8.1.3 → 8.1.3.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 1 commit:

• Preparing for 8.1.3.1 release

↗️ rbs (indirect, 4.0.3 → 4.1.1) · Repo · Changelog

Release Notes

4.1.0

Release note

RBS 4.1 ships with JRuby support. The RBS parser is written in plain C without depending on the Ruby C API, so it is compiled to WebAssembly and runs on a Wasm runtime, with the parsed AST serialized in a binary format and decoded into RBS objects. The full test suite runs on JRuby in CI.

The inline RBS syntax gets three new features: singleton method definitions (def self.), the module-self constraint, and instance variable annotations in module declarations. Note that RBS inline is still experimental and may change in future releases.

This release also introduces RBS::Rewriter, an API to edit RBS source text while preserving the surrounding content, which rbs annotate is now built on. Parsing performance is improved by interning type names in a shared trie and reducing allocations per node.

RBS::Prototype::Runtime, the RDoc plugin parser, and the top-level float type alias are deprecated in this release.

Signature updates

Updated classes/modules/methods: ARGF, Array, CSV, Class, Delegator, Digest, ERB, Enumerable, Enumerator, Enumerator::Product, Etc, File, File::Constants, File::Stat, FileUtils, Float, Gem, Hash, IO, IPAddr, Integer, JSON, Kernel, MatchData, Module, Monitor, Numeric, ObjectSpace::WeakKeyMap, OpenSSL, Pathname, RBS::Ops, Ractor, Range, Resolv, RubyVM::InstructionSequence, Set, Shellwords, String, StringIO, StringScanner, Struct, Tempfile, Thread, Timeout, TSort, URI::Generic, Zlib::GzipReader, Zlib::ZStream

• Remove stale Float constants and add a constant drift test (#2994)
• Update RDoc comments with Ruby 4.0.6 (#3035)
• Add a dependency on tempfile. (#3025)
• Support %a{implicitly-returns-nil} on MatchData#[] (#2990)
• Update Array (#2987)
• Allow nil output buffers for reader methods (#3002)
• Add stdlib signature tests for #2967 (#2989)
• Update Integer, phase 1 (#2995)
• Add RBS::Ops (#2934)
• Update Module (#2933)
• Correct core/stdlib signatures to match Ruby 4.0 (#2967)
• Revert Digest::Class method changes (#2980)
• Add stdlib tests for updated StringScanner signatures (#2968)
• Update StringScanner signatures to match strscan 3.1.6 (#2959)
• Remove StringScanner methods absent from the latest Ruby release (#2961)
• Fix Resolv#initialize signature: array of resolvers + use_ipv6: (#2960)
• [Hash] Update Hash's signatures and tests to be correct (#2694)
• update rbs signatures to be more consistent with generics (#2867)
• Use top-level path in fileutils.rbs to suppress deprecation warning (#2949)
• Update File::Constants and File::Stat (#2942)
• Add signature for RubyVM::InstructionSequence.of (#2916)
• fix OpenSSL#session_new_cb signature (#2924)
• [Class] update class.rbs (#2898)
• Deprecate top-level float (#2695)
• [Kernel] Updated querying methods (#2685)

Library changes

• Convert character offset to byte offset in parse_inline_*_annotation (#2945)
• Guard against underflow when sysconf(_SC_PAGESIZE) returns 0 (#3031)
• Report invalid UTF-8 byte in a comment as a parsing error (#2983)
• Fetch Chicory/ASM jars from Maven instead of bundling in gem (#3019)
• Add write barrier protection to RBS Location objects (#3022)
• Rename parameter in rbs_intern_type_name for clarity (#3023)
• Deprecate RDoc plugin parser (#3016)
• Run the test suite on JRuby (JRuby support, step 4) (#3008)
• Run the RBS parser on JRuby via WebAssembly (JRuby support, step 3) (#3000)
• Add binary serialization of the parsed AST (JRuby support, step 2) (#2999)
• Build the RBS parser as a WebAssembly module (JRuby support, step 1) (#2998)
• Reject reversed position ranges in parser/lexer entrypoints (#2974)
• Fix lexer infinite loop / abort on invalid UTF-8 byte (#2973)
• Flyweight TypeName / Namespace cached in a shared trie (#2957)
• Reduce Hash allocation per Node creation (#2946)
• Tidy ast_translation.c (#2947)
• Auto-generate rbs_ast_ruby_annotations_t union from config.yml (#2939)
• Speed up RBS::InlineParser on large sources with non-ASCII characters (#2950)
• Support def self.method_name singleton method in inline parser (#2935)
• This is not prism (#2951)
• Add RBS::Rewriter and use it in rbs annotate (#2927)
• Add nullability annotations to AST pointer types (#2922)
• Support module-self inline annotation (#2921)
• Inline instance variable annotation in module declaration (#2919)

rbs prototype

• Fix nested declarations in rbs prototype rbi (#3029)
• Deprecate prototype runtime (#2956)

rbs collection

• Clean up partial clone before falling back to full clone (#2978)
• Suppress spurious warning for non-gem stdlib libraries (#2929)

Miscellaneous

• Fix Lint/DuplicateMethods in StringIO_test.rb (#3010)
• Compressed files must be opened in binary mode (#2981)
• Fix flaky DirSingletonTest GC failures in test_fchdir and test_for_fd (#3004)
• Add TruffleRuby CI job (#2996)
• Update the target Ruby version notes to the latest release (#2962)
• Update docs/inline.md to match current inline parser behavior (#2953)
• ci: skip Gemfile.lock BUNDLED WITH on ruby-head (#2952)
• Remove logger from sig dependencies (#2904)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)