3.1.0.beta

Added

• Add support for the crop processing method (@clickworkorange #2721)
• Add global skip_ssrf_protection configuration (@rajyan #2696, #2695)

Changed

• Show warning if #filename is safeguarded as in the pre-3.x style (@mshibuya #2718, #2708)

Fixed

• Fix version names starting with a non-alphabet character lead to NameError (@r7kamura #2748, #2722)
• Fix Rails 7.2 incompatibility due to incorrect use of ActiveSupport::Deprecation (@mshibuya b25477d, 8761240, #2751)
• Fix assigning a file with the same name not marking the column as changed (@mshibuya 47f1737, #2719)
• Fix content type magic detection for files packaged in .zip (@dzhikvas #2705, #2704)

3.0.7

Security

• Fix Content-Type allowlist bypass vulnerability remained (@mshibuya 00676e2, GHSA-vfmv-jfc5-pjjw)

2.2.6

Security

• Fix Content-Type allowlist bypass vulnerability remained (@mshibuya 4317871, GHSA-vfmv-jfc5-pjjw)

3.0.6

Fixed

• Fix #derived_versions and #active_sibling_versions returning an Array where Hash is expected (@mshibuya 46e4f20)
• Fix incompatibility with Marcel 1.0.3 (@schinery #2728, #2729)
• Fix assigning a file with the same name not marking the column as changed (@mshibuya 4c65b39, #2719)
• Fix failing to remove files with ActiveRecord 7.1 after_commit order change enabled (@mshibuya 63113e9, #2713)

3.0.5

Fixed

• Remove unnecessary if clause within #filename left in the uploader template (@rajyan #2711)

Security

• Fix Content-Type allowlist bypass vulnerability, possibly leading to XSS (@mshibuya, 863d425, GHSA-gxhx-g4fq-49hj)

2.2.5

Security

• Fix Content-Type allowlist bypass vulnerability, possibly leading to XSS (@mshibuya 39b282d, GHSA-gxhx-g4fq-49hj)

3.0.4

Fixed

• Fix model's dirty state remaining after update (@rajyan #2707, #2702)
• Fix #dup modifying the original object (@rajyan #2690, #2706, #2689, #2700)
• Fix #dup not respecting the :mount_on option, causing MissingAttributeError (@marsz #2691)

1.3.4

Fixed

• Fix incompatibility with RMagick >= 3 (@marcogregorius #2699)

3.0.3

Fixed

• Fix #dup modifying the original object (@mshibuya 37f36f7, #2687)
• Fix wrongly removing files on transaction rollback (@mshibuya, @rajyan eb03fe1, #2686, #2685)

3.0.2

Fixed

• Fix deduplicated filename not being persisted (@mshibuya #2679, #2678, #2677)