chore: update dependency activesupport to v7.2.3.1 [security]

[judo-ci]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
activesupport (source, changelog)	7.2.3 → 7.2.3.1

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

CVE-2026-33170 / GHSA-89vf-4333-qx8v

More information

Details

Impact

SafeBuffer#% does not propagate the @html_unsafe flag to the newly created buffer. If a SafeBuffer is mutated in place (e.g. via gsub!) and then formatted with % using untrusted arguments, the result incorrectly reports html_safe? == true, bypassing ERB auto-escaping and possibly leading to XSS.

Releases

The fixed releases are available at the normal locations.

Credit

This issue was responsibly reported by @​ch4n3-yoon

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v
• https://github.com/rails/rails/commit/50d732af3b7c8aaf63cbcca0becbc00279b215b7
• https://github.com/rails/rails/commit/6e8a81108001d58043de9e54a06fca58962fc2db
• https://github.com/rails/rails/commit/c1ad0e8e1972032f3395853a5e99cea035035beb
• https://github.com/rails/rails/releases/tag/v7.2.3.1
• https://github.com/rails/rails/releases/tag/v8.0.4.1
• https://github.com/rails/rails/releases/tag/v8.1.2.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-33170
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2026-33170.yml
• https://github.com/advisories/GHSA-89vf-4333-qx8v

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

CVE-2026-33169 / GHSA-cg4j-q9v8-6v38

More information

Details

Impact

NumberToDelimitedConverter used a regular expression with gsub! to insert thousands delimiters. This could produce quadratic time complexity on long digit strings.

Releases

The fixed releases are available at the normal locations.

Credit

This issue was responsibly reported by Hackerone researcher scyoon.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38
• https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11
• https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974
• https://github.com/rails/rails/commit/ec1a0e215efd27a3b3911aae6df978a80f456a49
• https://github.com/rails/rails/releases/tag/v7.2.3.1
• https://github.com/rails/rails/releases/tag/v8.0.4.1
• https://github.com/rails/rails/releases/tag/v8.1.2.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-33169
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2026-33169.yml
• https://github.com/advisories/GHSA-cg4j-q9v8-6v38

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Rails Active Support has a possible DoS vulnerability in its number helpers

CVE-2026-33176 / GHSA-2j26-frm8-cmj9

More information

Details

Impact

Active Support number helpers accept strings containing scientific notation (e.g. 1e10000), which when converted to a string could be expanded into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability.

Releases

The fixed releases are available at the normal locations.

Credit

This issue was responsibly reported by Hackerone researcher manun.

Severity

• CVSS Score: 6.6 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

• https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9
• https://github.com/rails/rails/commit/19dbab51ca086a657bb86458042bc44314916bcb
• https://github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a
• https://github.com/rails/rails/commit/ee2c59e730e5b8faed502cd2c573109df093f856
• https://github.com/rails/rails/releases/tag/v7.2.3.1
• https://github.com/rails/rails/releases/tag/v8.0.4.1
• https://github.com/rails/rails/releases/tag/v8.1.2.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-33176
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2026-33176.yml
• https://github.com/advisories/GHSA-2j26-frm8-cmj9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

rails/rails (activesupport)

v7.2.3.1: 7.2.3.1

Compare Source

Active Support

• Reject scientific notation in NumberConverter

  [CVE-2026-33176]

  Jean Boussier

• Fix SafeBuffer#% to preserve unsafe status

  [CVE-2026-33170]

  Jean Boussier

• Improve performance of NumberToDelimitedConverter

  [CVE-2026-33169]

  Jean Boussier

Active Model

• No changes.

Active Record

• No changes.

Action View

• Skip blank attribute names in tag helpers to avoid generating invalid HTML.

  [CVE-2026-33168]

  Mike Dalessio

Action Pack

• No changes.

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• Filter user supplied metadata in DirectUploadController

  [CVE-2026-33173]

  Jean Boussier

• Configurable maxmimum streaming chunk size

  Makes sure that byte ranges for blobs don't exceed 100mb by default.
  Content ranges that are too big can result in denial of service.

  [CVE-2026-33174]

  Gannon McGibbon

• Limit range requests to a single range

  [CVE-2026-33658]

  Jean Boussier

• Prevent path traversal in DiskService.

  DiskService#path_for now raises an InvalidKeyError when passed keys with dot segments (".",
  ".."), or if the resolved path is outside the storage root directory.

  #path_for also now consistently raises InvalidKeyError if the key is invalid in any way, for
  example containing null bytes or having an incompatible encoding. Previously, the exception
  raised may have been ArgumentError or Encoding::CompatibilityError.

  DiskController now explicitly rescues InvalidKeyError with appropriate HTTP status codes.

  [CVE-2026-33195]

  Mike Dalessio

• Prevent glob injection in DiskService#delete_prefixed.

  Escape glob metacharacters in the resolved path before passing to Dir.glob.

  Note that this change breaks any existing code that is relying on delete_prefixed to expand
  glob metacharacters. This change presumes that is unintended behavior (as other storage services
  do not respect these metacharacters).

  [CVE-2026-33202]

  Mike Dalessio

Action Mailbox

• No changes.

Action Text

• No changes.

Railties

• No changes.

Guides

• No changes.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[sonarqubecloud]

Quality Gate failed

Failed conditions
5 Security Hotspots
7.7% Coverage on New Code (required ≥ 80%)
4.9% Duplication on New Code (required ≤ 3%)
C Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[sonarqubecloud]

Quality Gate failed

Failed conditions
5 Security Hotspots
7.7% Coverage on New Code (required ≥ 80%)
5.3% Duplication on New Code (required ≤ 3%)
C Security Rating on New Code (required ≥ A)
C Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[sonarqubecloud]

Quality Gate failed

Failed conditions
2 Security Hotspots
7.7% Coverage on New Code (required ≥ 80%)
5.3% Duplication on New Code (required ≤ 3%)
C Security Rating on New Code (required ≥ A)
C Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE