- Patched numerous security issues (CVE‑2026‑33170, ‑33176, ‑33167, ‑33168, ‑33173, ‑33174, ‑33195, ‑33202) affecting NumberConverter, SafeBuffer, view helpers, DebugExceptions, DirectUpload, streaming range limits, and DiskService.
- Improved NumberToDelimitedConverter performance and added a configurable maximum streaming chunk size (default 100 MiB) to prevent DoS via oversized byte‑range requests.
- Introduced breaking changes: DiskService now rejects keys with dot segments or invalid characters and escapes glob metacharacters in delete_prefixed, altering previous behavior.
8.1.2.1
Official Ruby on Rails changelog summary with source attribution, release tags, and community reactions.
Track this Ruby on Rails release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.
Verify the original release note
Every summary should remain traceable to the original changelog or release source.
Follow this in context
Turn this Ruby on Rails release note into a weekly digest for the tools you actually use.
Create digestMore Ruby on Rails changelog updates
Active Storage disables libvips unfuzzed image loaders/savers, causing Vips::Error for BMP, ICO, PSD, SVG, JPEG XL, JPEG 2000, Netpbm and other formats – a breaking change for apps using those types
Active Storage disables libvips “unfuzzed” image loaders and savers (e.g., BMP, ICO, PSD, SVG, JPEG‑XL, JPEG‑2000), causing Vips::Error for those formats
Active Storage now disables libvips "unfuzzed" image loaders/savers, raising Vips::Error for BMP, ICO, PSD, SVG, JPEG XL, JPEG 2000, Netpbm, FITS and similar formats – a breaking change for image‑processing applications.