Bump active_storage_validations from 3.0.5 to 4.1.1

[dependabot]

Bumps active_storage_validations from 3.0.5 to 4.1.1.

Release notes

Sourced from active_storage_validations's releases.

4.1.0

What's Changed

• feat(with_audio): add audio-track validator by @​Guflly in igorkasyanchuk/active_storage_validations#428

New Contributors

• @​Guflly made their first contribution in igorkasyanchuk/active_storage_validations#428

Full Changelog: igorkasyanchuk/active_storage_validations@4.0.0...4.1.0

4.0.0

What's Changed

• BREAKING

  • Drop support for Rails 6.1.4, 7.0.0 (we keep support for Rails >= 7.0.1)
  • Drop support for Ruby < 3.3 (required_ruby_version is now >= 3.3.0)
  • FormBuilder#file_field now automatically sets the HTML accept attribute from content_type validators (igorkasyanchuk/active_storage_validations#415). Disable globally with ActiveStorageValidations.infer_file_field_accept = false, or per field with infer_accept: false
  • Analyzer commands (ffprobe, pdfinfo, file, ImageMagick identify, libvips) now default to a 10s command_timeout (igorkasyanchuk/active_storage_validations#410). Most apps are unaffected; this is breaking for uploads whose metadata analysis legitimately takes longer than 10s (e.g. very large videos on slow/network storage). Raise globally, per validator with timeout:, or set nil to restore unbounded waits — see upgrade guide

• ADDED

  • Add #except_on matcher option to support Rails :except_on validation option (available since Rails 8.0) (igorkasyanchuk/active_storage_validations#380)
  • Add optional per-validator timeout: and timeout.active_storage_validations instrumentation for analyzer commands. Timed-out analysis fails closed using existing validation errors
  • Add #timeout matcher option for metadata validators (dimension, aspect_ratio, duration, pages, processable_file) and content_type
  • Add spoofing_protection: :magika backend (Google Magika CLI) for content_type; true still means :file. Cache stores asv_content_type_backend. Matcher: #spoofing_protection / #spoofing_protection(:magika) (igorkasyanchuk/active_storage_validations#404)

• FIXED

  • Fix dimension: { min:, max: } when both top-level bounds are set together (previously the second bound overwrote the first in process_options)
  • Fix Proc options with arity 0 (e.g. -> { 2.kilobytes..7.kilobytes }) being called with the record argument
  • Fix metadata matchers (aspect_ratio, dimension, …) crashing with NoMethodError when the same attribute also has content_type spoofing protection (matcher Analyzer stub now responds to #content_type)

• MISC

  • Add support for Ruby 4.0 in CI matrix
  • Add AGENTS.md with codebase guide for AI coding agents
  • Add informational benchmark/ suite for metadata validators (cold vs cached asv_*, vips vs mini_magick) with CI job and checked-in baseline
  • Migrate the gem test suite from Minitest to RSpec; add rubocop-rspec (igorkasyanchuk/active_storage_validations#307). Consumer matcher APIs for RSpec and Minitest/shoulda are unchanged
  • Strengthen validator specs: comparison Proc options, total_size multi-file sums, media_metadata_missing / attachment_missing, duration/pages several-checks validity, Rails :except_on
  • Correct spoofing_protection docs: file/libmagic does not load the whole file into RAM; remote blobs are still streamed to a tempfile (igorkasyanchuk/active_storage_validations#376)

New Contributors

• @​pardeyke made their first contribution in igorkasyanchuk/active_storage_validations#415

Full Changelog: igorkasyanchuk/active_storage_validations@3.0.6...4.0.0

3.0.6

What's Changed

• Fix processable_file rejecting formats with libvips untrusted loaders (e.g. SVG) after Rails enables Vips.block_untrusted(true) (igorkasyanchuk/active_storage_validations#423). No impact on Rails versions that do not enable this Vips change (before 7.2.3.2 / 8.0.5.1 / 8.1.3.1, unless the app blocks untrusted loaders itself). By @​Mth0158 in igorkasyanchuk/active_storage_validations#424
• Fix validation of multiple new attachables with nil blob ids by @​tmnb in igorkasyanchuk/active_storage_validations#422

New Contributors

• @​tmnb made their first contribution in igorkasyanchuk/active_storage_validations#422

... (truncated)

Changelog

Sourced from active_storage_validations's changelog.

• 4.1.1

  • FIXED
    • Fix size / metadata matchers raising on Minitest 6 after Minitest::Mock was extracted (igorkasyanchuk/active_storage_validations#430). Matchers now stub via a singleton method and do not need minitest-mock
    • Fix Swedish aspect_ratio interpolation placeholders (authorized_aspect_ratios)
    • Fix filename error option for UploadedFile / File / Pathname attachables
    • Fix with_audio rejecting audio files: the audio analyzer now reports an audio metadata key, so with_audio works on audio attachments and not only on videos
    • Fix metadata analysis running again on every validation when the analyzer cannot extract the requested key (e.g. duration on an image). Unavailable metadata is now memoized on the blob, so those files are analyzed once. Files that yield no metadata at all (missing command-line tool, timed out command, unreadable file) are still retried
    • Fix processable_file accepting unprocessable files when content_type with spoofing_protection was declared on the same attribute. The cached asv_content_type counted as a successful analysis, so the media analyzer never ran. Content-type keys are no longer visible to the metadata validators
    • Fix duration rejecting media shorter than one second. The guard meant to catch unreadable metadata truncated the duration to an integer, so a 0.5s file reported media_metadata_missing instead of being compared against the bounds
    • Fix content_type and aspect_ratio keeping per-validation state on the validator instance. Active Model reuses one validator per class across threads, so concurrent validations could report another record's content type or aspect ratio — and, with spoofing_protection, compare a file against another file's detected type
    • Fix PDF first-page dimensions for sizes with two or more fractional digits (e.g. A4 595.276 x 841.89). The pdfinfo parser used to split extra digits into a second number, so height became 8
    • Fix ImageAnalyzer support cache being keyed by instance. A new analyzer is built per attachable, so the cache never hit and retained every instance (and its attachable) for the process lifetime. It is now keyed by analyzer class
    • Fix validate_limits_of / validate_processable_file_of #allow_blank being a no-op (the matchers included the concern but never called it). #allow_blank now checks the validator option
    • Fix comparison matcher #equal_to matching looser bounds (e.g. less_than_or_equal_to). It now also requires exact ± the smallest unit to fail
    • Fix comparison matchers #less_than_or_equal_to / #greater_than_or_equal_to / #between matching exclusive bounds (e.g. less_than). They now require the inclusive endpoint itself to pass
    • Stop inserting an active_storage_blobs row from a bare valid? on a new record. asv_* metadata stays in memory on the unsaved blob and is written when the record is saved. Already-persisted blobs still save! so the cache survives reload

• MISC

  • Add a locale key / interpolation contract spec; include ru in I18n.available_locales
  • Clarify why file_field skips Proc content_type options when inferring the HTML accept attribute
  • Document the analyze.active_storage_validations notification alongside timeout.active_storage_validations
  • Remove an unreachable de-duplication guard in ASVErrorable#add_error; every offending file already gets its own error
  • Resolve the declared content type once per attachable instead of twice, saving a find_signed! query for attachables passed as a signed id
  • Collapse attachable type dispatch (Blob / UploadedFile / Hash / File / Pathname / signed id) into ASVAttachableAdapter used by validators, analyzers, and error filenames
  • Add Dependabot for GitHub Actions and the root Gemfile; upload SimpleCov from the Ruby 3.4 / Rails 8.1 / vips CI job (artifact only; Codecov upload removed)
  • Bump CI GitHub Actions to latest majors (actions/checkout@v7, actions/upload-artifact@v7)
  • Bump development gems (mini_magick, rubocop, rubocop-performance, simplecov, sqlite3, webmock, vernier) and the local Rails pin to 8.1.3.1
  • Remove invalid validate_attached_of(...).allow_blank matcher example (attached rejects :allow_blank)
  • Align bench workflow Actions with CI (checkout / upload-artifact v7); pin Magika CLI to cli/v1.1.0; run apt-get update once per job
  • Raise CommandLineToolNotInstalledError from a shared ContentTypeAnalyzer ancestor so both file and magika backends can be rescued together
  • Fail the suite when SimpleCov line coverage drops below 50% (spec/spec_helper.rb)

• 4.1.0

  • ADDED
    • Add with_audio validator and validate_with_audio_of matcher for requiring or forbidding an audio track in video files (igorkasyanchuk/active_storage_validations#303). Use with_audio: true to require audio or with_audio: { with: false } to forbid it. Supports per-validator timeout: and matcher #timeout.

• 4.0.0

  • BREAKING
    • Drop support for Rails 6.1.4, 7.0.0 (we keep support for Rails >= 7.0.1)
    • Drop support for Ruby < 3.3 (required_ruby_version is now >= 3.3.0)
    • FormBuilder#file_field now automatically sets the HTML accept attribute from content_type validators (igorkasyanchuk/active_storage_validations#415). Disable globally with ActiveStorageValidations.infer_file_field_accept = false, or per field with infer_accept: false
    • Analyzer commands (ffprobe, pdfinfo, file, ImageMagick identify, libvips) now default to a 10s command_timeout (igorkasyanchuk/active_storage_validations#410). Most apps are unaffected; this is breaking for uploads whose metadata analysis legitimately takes longer than 10s (e.g. very large videos on slow/network storage). Raise globally, per validator with timeout:, or set nil to restore unbounded waits — see upgrade guide
  • ADDED
    • Add #except_on matcher option to support Rails :except_on validation option (available since Rails 8.0) (igorkasyanchuk/active_storage_validations#380)
    • Add optional per-validator timeout: and timeout.active_storage_validations instrumentation for analyzer commands. Timed-out analysis fails closed using existing validation errors
    • Add #timeout matcher option for metadata validators (dimension, aspect_ratio, duration, pages, processable_file) and content_type
    • Add spoofing_protection: :magika backend (Google Magika CLI) for content_type; true still means :file. Cache stores asv_content_type_backend. Matcher: #spoofing_protection / #spoofing_protection(:magika) (igorkasyanchuk/active_storage_validations#404)
  • FIXED
    • Fix dimension: { min:, max: } when both top-level bounds are set together (previously the second bound overwrote the first in process_options)
    • Fix Proc options with arity 0 (e.g. -> { 2.kilobytes..7.kilobytes }) being called with the record argument
    • Fix metadata matchers (aspect_ratio, dimension, …) crashing with NoMethodError when the same attribute also has content_type spoofing protection (matcher Analyzer stub now responds to #content_type)

... (truncated)

Commits

• See full diff in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	active_storage_validations@​3.0.5 ⏵ 4.1.1

View full report

[northeastprince]

@dependabot rebase