Skip to content

Bump activestorage from 7.2.3 to 7.2.3.1#327

Merged
matt-bernhardt merged 1 commit into
mainfrom
dependabot/bundler/activestorage-7.2.3.1
Apr 1, 2026
Merged

Bump activestorage from 7.2.3 to 7.2.3.1#327
matt-bernhardt merged 1 commit into
mainfrom
dependabot/bundler/activestorage-7.2.3.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 24, 2026

Copy link
Copy Markdown
Contributor

Bumps activestorage from 7.2.3 to 7.2.3.1.

Release notes

Sourced from activestorage's releases.

7.2.3.1

Active Support

  • Reject scientific notation in NumberConverter

    [CVE-2026-33176]

    Jean Boussier

  • Fix SafeBuffer#% to preserve unsafe status

    [CVE-2026-33170]

    Jean Boussier

  • Improve performance of NumberToDelimitedConverter

    [CVE-2026-33169]

    Jean Boussier

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • Skip blank attribute names in tag helpers to avoid generating invalid HTML.

    [CVE-2026-33168]

    Mike Dalessio

Action Pack

  • No changes.

Active Job

  • No changes.

... (truncated)

Commits
  • ba76fca Preparing for 7.2.3.1 release
  • 8a379f4 Update changelog
  • fa19073 Prevent glob injection in ActiveStorage DiskService#delete_prefixed
  • 4933c1e Prevent path traversal in ActiveStorage DiskService
  • 707c0f1 Active Storage: Filter user supplied metadata in DirectUploadController
  • b8a1665 ActiveStorage::Streaming limit range requests to a single range
  • 8159a9c Configurable maxmimum streaming chunk size
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Mar 24, 2026
@mitlib mitlib temporarily deployed to tacos-api-pipeline-pr-327 March 24, 2026 00:04 Inactive
@matt-bernhardt

Copy link
Copy Markdown
Member

@dependabot rebase

Bumps [activestorage](https://github.com/rails/rails) from 7.2.3 to 7.2.3.1.
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.2.1/activestorage/CHANGELOG.md)
- [Commits](rails/rails@v7.2.3...v7.2.3.1)

---
updated-dependencies:
- dependency-name: activestorage
  dependency-version: 7.2.3.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/bundler/activestorage-7.2.3.1 branch from acaba8f to e65c6b0 Compare April 1, 2026 17:17
@matt-bernhardt matt-bernhardt merged commit 42ea5f4 into main Apr 1, 2026
3 checks passed
@dependabot dependabot Bot deleted the dependabot/bundler/activestorage-7.2.3.1 branch April 1, 2026 17:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants