Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

Bump activestorage from 7.2.2.2 to 7.2.3.1

Closed
Number: #89
Type: Pull Request
State: Closed
Author: dependabot[bot] dependabot[bot]
Association: Unknown
Comments: 1
Created: March 24, 2026 at 12:05 AM UTC
(4 months ago)
Updated: April 06, 2026 at 04:51 PM UTC
(4 months ago)
Closed: April 06, 2026 at 04:51 PM UTC
(4 months ago)
Time to Close: 14 days
Labels:
dependencies ruby
Description:

Bumps activestorage from 7.2.2.2 to 7.2.3.1.

Release notes

Sourced from activestorage's releases.

7.2.3.1

Active Support

  • Reject scientific notation in NumberConverter

    [CVE-2026-33176]

    Jean Boussier

  • Fix SafeBuffer#% to preserve unsafe status

    [CVE-2026-33170]

    Jean Boussier

  • Improve performance of NumberToDelimitedConverter

    [CVE-2026-33169]

    Jean Boussier

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • Skip blank attribute names in tag helpers to avoid generating invalid HTML.

    [CVE-2026-33168]

    Mike Dalessio

Action Pack

  • No changes.

Active Job

  • No changes.

... (truncated)

Commits
  • ba76fca Preparing for 7.2.3.1 release
  • 8a379f4 Update changelog
  • fa19073 Prevent glob injection in ActiveStorage DiskService#delete_prefixed
  • 4933c1e Prevent path traversal in ActiveStorage DiskService
  • 707c0f1 Active Storage: Filter user supplied metadata in DirectUploadController
  • b8a1665 ActiveStorage::Streaming limit range requests to a single range
  • 8159a9c Configurable maxmimum streaming chunk size
  • bb2bdef Preparing for 7.2.3 release
  • 33f9043 Disable GCS tests in CI
  • b14489e Sync CHANGELOG
  • Additional commits viewable in compare view

Package Dependencies
Package:
activestorage
Ecosystem:
rubygems
Version Change:
7.2.2.2 → 7.2.3.1
Update Type:
Patch
Security Advisories
Rails Active Support has a possible DoS vulnerability in its number helpers
GHSA-2j26-frm8-cmj9 CVE-2026-33176 MODERATE
### Impact Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which when converted to a string could be expanded into extremely large decimal representati...
Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
GHSA-89vf-4333-qx8v CVE-2026-33170 MODERATE
### Impact `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untruste...
Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
GHSA-cg4j-q9v8-6v38 CVE-2026-33169 MODERATE
### Impact `NumberToDelimitedConverter` used a regular expression with `gsub!` to insert thousands delimiters. This could produce quadratic time complexity on long digit strings. ### Releases The ...
Rails has a possible XSS vulnerability in its Action View tag helpers
GHSA-v55j-83pf-r9cq CVE-2026-33168 LOW
### Impact When a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could ...
Actions
View on GitHub View Repository All Dependabot PRs
Technical Details
ID: 15072814
UUID: 4124401946
Node ID: PR_kwDOEBGeRM7M1_8Z
Host: GitHub
Repository: NHSDigital/pseudonymisation_service