Rails 7.1.5.2 (August 13, 2025)¶ ↑

Remove dangerous transformations

[CVE-2025-24293]

*Zack Deveau*

Rails 7.1.5.1 (December 10, 2024)¶ ↑

• No changes.

Rails 7.1.5 (October 30, 2024)¶ ↑

• No changes.

Rails 7.1.4.2 (October 23, 2024)¶ ↑

• No changes.

Rails 7.1.4.1 (October 15, 2024)¶ ↑

• No changes.

Rails 7.1.4 (August 22, 2024)¶ ↑

• Fixes race condition for multiple preprocessed video variants.

  Justin Searls

Rails 7.1.3.4 (June 04, 2024)¶ ↑

• No changes.

Rails 7.1.3.3 (May 16, 2024)¶ ↑

• No changes.

Rails 7.1.3.2 (February 21, 2024)¶ ↑

• No changes.

Rails 7.1.3.1 (February 21, 2024)¶ ↑

• No changes.

Rails 7.1.3 (January 16, 2024)¶ ↑

• Fix N+1 query when fetching preview images for non-image assets.

  Aaron Patterson & Justin Searls

• Fix all Active Storage database related models to respect ActiveRecord::Base.table_name_prefix configuration.

  Chedli Bourguiba

• Fix ActiveStorage::Representations::ProxyController not returning the proper preview image variant for previewable files.

  Chedli Bourguiba

• Fix ActiveStorage::Representations::ProxyController to proxy untracked variants.

  Chedli Bourguiba

• Fix direct upload forms when submit button contains nested elements.

  Marc Köhlbrugge

• When using the preprocessed: true option, avoid enqueuing transform jobs for blobs that are not representable.

  Chedli Bourguiba

• Process preview image variant when calling ActiveStorage::Preview#processed. For example, attached_pdf.preview(:thumb).processed will now immediately generate the full-sized preview image and the :thumb variant of it. Previously, the :thumb variant would not be generated until a further call to e.g. processed.url.

  Chedli Bourguiba and Jonathan Hefner

• Prevent ActiveRecord::StrictLoadingViolationError when strict loading is enabled and the variant of an Active Storage preview has already been processed (for example, by calling ActiveStorage::Preview#url).

  Jonathan Hefner

• Fix preprocessed: true option for named variants of previewable files.

  Nico Wenterodt

Rails 7.1.2 (November 10, 2023)¶ ↑

• No changes.

Rails 7.1.1 (October 11, 2023)¶ ↑

• No changes.

Rails 7.1.0 (October 05, 2023)¶ ↑

• No changes.

Rails 7.1.0.rc2 (October 01, 2023)¶ ↑

• No changes.

Rails 7.1.0.rc1 (September 27, 2023)¶ ↑

• Add expires_at option to ActiveStorage::Blob#signed_id.

  rails_blob_path(user.avatar, disposition: "attachment", expires_at: 30.minutes.from_now)
  <%= image_tag rails_blob_path(user.avatar.variant(resize: "100x100"), expires_at: 30.minutes.from_now) %>
  

  Aki

• Allow attaching File and Pathname when assigning attributes, e.g.

  User.create!(avatar: File.open("image.jpg"))
  User.create!(avatar: file_fixture("image.jpg"))
  

  Dorian Marié

Rails 7.1.0.beta1 (September 13, 2023)¶ ↑

• Disables the session in ActiveStorage::Blobs::ProxyController and ActiveStorage::Representations::ProxyController in order to allow caching by default in some CDNs as CloudFlare

  Fixes #44136

  Bruno Prieto

• Add tags to ActiveStorage::Analyzer::AudioAnalyzer output

  Keaton Roux

• Add an option to preprocess variants

  ActiveStorage variants are processed on the fly when they are needed but sometimes we’re sure that they are accessed and want to processed them upfront.

  preprocessed option is added when declaring variants.

  class User < ApplicationRecord
    has_one_attached :avatar do |attachable|
      attachable.variant :thumb, resize_to_limit: [100, 100], preprocessed: true
    end
  end
  

  Shouichi Kamiya

• Fix variants not included when eager loading multiple records containing a single attachment

  When using the with_attached_#{name} scope for a has_one_attached relation, attachment variants were not eagerly loaded.

  Russell Porter

• Allow an ActiveStorage attachment to be removed via a form post

  Attachments can already be removed by updating the attachment to be nil such as:

  User.find(params[:id]).update!(avatar: nil)
  

  However, a form cannot post a nil param, it can only post an empty string. But, posting an empty string would result in an ActiveSupport::MessageVerifier::InvalidSignature: mismatched digest error being raised, because it's being treated as a signed blob id.

  Now, nil and an empty string are treated as a delete, which allows attachments to be removed via:

  User.find(params[:id]).update!(params.require(:user).permit(:avatar))
  

  Nate Matykiewicz

• Remove mini_mime usage in favour of marcel.

  We have two libraries that are have similar usage. This change removes dependency on mini_mime and makes use of similar methods from marcel.

  Vipul A M

• Allow destroying active storage variants

  User.first.avatar.variant(resize_to_limit: [100, 100]).destroy
  

  Shouichi Kamiya, Yuichiro NAKAGAWA, Ryohei UEDA

• Add sample_rate to ActiveStorage::Analyzer::AudioAnalyzer output

  Matija Čupić

• Remove deprecated purge and purge_later methods from the attachments association.

  Rafael Mendonça França

• Remove deprecated behavior when assigning to a collection of attachments.

  Instead of appending to the collection, the collection is now replaced.

  Rafael Mendonça França

• Remove deprecated ActiveStorage::Current#host and ActiveStorage::Current#host= methods.

  Rafael Mendonça França

• Remove deprecated invalid default content types in Active Storage configurations.

  Rafael Mendonça França

• Add missing preview event to ActiveStorage::LogSubscriber

  A preview event is being instrumented in ActiveStorage::Previewer. However it was not added inside ActiveStorage's LogSubscriber class.

  This will allow to have logs for when a preview happens in the same fashion as all other ActiveStorage events such as upload and download inside Rails.logger.

  Chedli Bourguiba

• Fix retrieving rotation value from FFmpeg on version 5.0+.

  In FFmpeg version 5.0+ the rotation value has been removed from tags. Instead the value can be found in side_data_list. Along with this update it's possible to have values of -90, -270 to denote the video has been rotated.

  Haroon Ahmed

• Touch all corresponding model records after ActiveStorage::Blob is analyzed

  This fixes a race condition where a record can be requested and have a cache entry built, before the initial analyze_later completes, which will not be invalidated until something else updates the record. This also invalidates cache entries when a blob is re-analyzed, which is helpful if a bug is fixed in an analyzer or a new analyzer is added.

  Nate Matykiewicz

• Add ability to use pre-defined variants when calling preview or representation on an attachment.

  class User < ActiveRecord::Base
    has_one_attached :file do |attachable|
      attachable.variant :thumb, resize_to_limit: [100, 100]
    end
  end
  
  <%= image_tag user.file.representation(:thumb) %>
  

  Richard Böhme

• Method attach always returns the attachments except when the record is persisted, unchanged, and saving it fails, in which case it returns nil.

  Santiago Bartesaghi

• Fixes multiple attach calls within transaction not uploading files correctly.

  In the following example, the code failed to upload all but the last file to the configured service.

  ActiveRecord::Base.transaction do
    user.attachments.attach({
      content_type: "text/plain",
      filename: "dummy.txt",
      io: ::StringIO.new("dummy"),
    })
    user.attachments.attach({
      content_type: "text/plain",
      filename: "dummy2.txt",
      io: ::StringIO.new("dummy2"),
    })
  end
  
  assert_equal 2, user.attachments.count
  assert user.attachments.first.service.exist?(user.attachments.first.key)  # Fails
  

  This was addressed by keeping track of the subchanges pending upload, and uploading them once the transaction is committed.

  Fixes #41661

  Santiago Bartesaghi, Bruno Vezoli, Juan Roig, Abhay Nikam

• Raise an exception if config.active_storage.service is not set.

  If Active Storage is configured and config.active_storage.service is not set in the respective environment's configuration file, then an exception is raised with a meaningful message when attempting to use Active Storage.

  Ghouse Mohamed

• Fixes proxy downloads of files over 5mb

  Previously, trying to view and/or download files larger than 5mb stored in services like S3 via proxy mode could return corrupted files at around 5.2mb or cause random halts in the download. Now, ActiveStorage::Blobs::ProxyController correctly handles streaming these larger files from the service to the client without any issues.

  Fixes #44679

  Felipe Raul

• Saving attachment(s) to a record returns the blob/blobs object

  Previously, saving attachments did not return the blob/blobs that were attached. Now, saving attachments to a record with attach method returns the blob or array of blobs that were attached to the record. If it fails to save the attachment(s), then it returns false.

  Ghouse Mohamed

• Don't stream responses in redirect mode

  Previously, both redirect mode and proxy mode streamed their responses which caused a new thread to be created, and could end up leaking connections in the connection pool. But since redirect mode doesn't actually send any data, it doesn't need to be streamed.

  Luke Lau

• Safe for direct upload on Libraries or Frameworks

  Enable the use of custom headers during direct uploads, which allows for the inclusion of Authorization bearer tokens or other forms of authorization tokens through headers.

  Radamés Roriz

Please check 7-0-stable for previous changes.