build(deps): bump activestorage from 8.0.3 to 8.0.4.1

[dependabot]

Bumps activestorage from 8.0.3 to 8.0.4.1.

Release notes

Sourced from activestorage's releases.

8.0.4.1

Active Support

• Reject scientific notation in NumberConverter

  [CVE-2026-33176]

  Jean Boussier

• Fix SafeBuffer#% to preserve unsafe status

  [CVE-2026-33170]

  Jean Boussier

• Improve performance of NumberToDelimitedConverter

  [CVE-2026-33169]

  Jean Boussier

Active Model

• No changes.

Active Record

• No changes.

Action View

• Skip blank attribute names in tag helpers to avoid generating invalid HTML.

  [CVE-2026-33168]

  Mike Dalessio

Action Pack

• No changes.

Active Job

• No changes.

... (truncated)

Commits

• a79efed Preparing for 8.0.4.1 release
• ac7979b Update changelog
• 955284d Prevent glob injection in ActiveStorage DiskService#delete_prefixed
• a290c8a Prevent path traversal in ActiveStorage DiskService
• 8fcb934 Active Storage: Filter user supplied metadata in DirectUploadController
• d7da4ef ActiveStorage::Streaming limit range requests to a single range
• 2cd933c Configurable maxmimum streaming chunk size
• 624fe3c Preparing for 8.0.4 release
• 82f2c96 Disable GCS tests in CI
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

@dependabot merge

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

This PR updates activestorage from 8.0.3 to 8.0.4.1 to address critical security vulnerabilities, including path traversal and glob injection. While the implementation fulfills the stated requirement and Codacy reports the PR is up to standards, the update is currently unverified by new automated test cases.

Note that the quality analysis identified additional high-severity security vulnerabilities in net-imap and yard within the Gemfile.lock. Although these are outside the immediate scope of the ActiveStorage update, they present significant risks (command injection and path traversal) and should be addressed in a subsequent or expanded update.

2 comments outside of the diff

Gemfile.lock

_{line 155 🔴 HIGH RISK}
Version 0.5.10 of net-imap is vulnerable to critical security issues (CVE-2026-42257, CVE-2026-42258) allowing command injection. Since you are already updating dependencies, upgrading this gem to 0.5.14 or 0.6.4 is strongly advised. Try running the following prompt in your IDE agent: > Run bundle update net-imap to upgrade to version 0.5.14 or later to fix critical security vulnerabilities.

_{line 441 🔴 HIGH RISK}
The yard gem (v0.9.37) has a high-severity path traversal vulnerability (CVE-2026-41493). It is recommended to update to version 0.9.42 or higher. Try running the following prompt in your IDE agent: > Run bundle update yard to upgrade to version 0.9.42 or later to address CVE-2026-41493.

Test suggestions

• Verify that the application's dependency resolution is successful and the build completes without version conflicts.
• Verify that ActiveStorage DiskService functionality (upload/delete) remains stable with the new security constraints.
• Confirm that DirectUploadController still accepts legitimate uploads while applying the new metadata filters.
• Test file streaming to ensure single-range request limits do not break existing media playback or downloads.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that the application's dependency resolution is successful and the build completes without version conflicts.
2. Verify that ActiveStorage DiskService functionality (upload/delete) remains stable with the new security constraints.
3. Confirm that DirectUploadController still accepts legitimate uploads while applying the new metadata filters.
4. Test file streaming to ensure single-range request limits do not break existing media playback or downloads.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}