build(deps): bump active_storage_validations from 3.0.5 to 4.0.0

[dependabot]

Bumps active_storage_validations from 3.0.5 to 4.0.0.

Release notes

Sourced from active_storage_validations's releases.

4.0.0

What's Changed

• BREAKING

  • Drop support for Rails 6.1.4, 7.0.0 (we keep support for Rails >= 7.0.1)
  • Drop support for Ruby < 3.3 (required_ruby_version is now >= 3.3.0)
  • FormBuilder#file_field now automatically sets the HTML accept attribute from content_type validators (igorkasyanchuk/active_storage_validations#415). Disable globally with ActiveStorageValidations.infer_file_field_accept = false, or per field with infer_accept: false
  • Analyzer commands (ffprobe, pdfinfo, file, ImageMagick identify, libvips) now default to a 10s command_timeout (igorkasyanchuk/active_storage_validations#410). Most apps are unaffected; this is breaking for uploads whose metadata analysis legitimately takes longer than 10s (e.g. very large videos on slow/network storage). Raise globally, per validator with timeout:, or set nil to restore unbounded waits — see upgrade guide

• ADDED

  • Add #except_on matcher option to support Rails :except_on validation option (available since Rails 8.0) (igorkasyanchuk/active_storage_validations#380)
  • Add optional per-validator timeout: and timeout.active_storage_validations instrumentation for analyzer commands. Timed-out analysis fails closed using existing validation errors
  • Add #timeout matcher option for metadata validators (dimension, aspect_ratio, duration, pages, processable_file) and content_type
  • Add spoofing_protection: :magika backend (Google Magika CLI) for content_type; true still means :file. Cache stores asv_content_type_backend. Matcher: #spoofing_protection / #spoofing_protection(:magika) (igorkasyanchuk/active_storage_validations#404)

• FIXED

  • Fix dimension: { min:, max: } when both top-level bounds are set together (previously the second bound overwrote the first in process_options)
  • Fix Proc options with arity 0 (e.g. -> { 2.kilobytes..7.kilobytes }) being called with the record argument
  • Fix metadata matchers (aspect_ratio, dimension, …) crashing with NoMethodError when the same attribute also has content_type spoofing protection (matcher Analyzer stub now responds to #content_type)

• MISC

  • Add support for Ruby 4.0 in CI matrix
  • Add AGENTS.md with codebase guide for AI coding agents
  • Add informational benchmark/ suite for metadata validators (cold vs cached asv_*, vips vs mini_magick) with CI job and checked-in baseline
  • Migrate the gem test suite from Minitest to RSpec; add rubocop-rspec (igorkasyanchuk/active_storage_validations#307). Consumer matcher APIs for RSpec and Minitest/shoulda are unchanged
  • Strengthen validator specs: comparison Proc options, total_size multi-file sums, media_metadata_missing / attachment_missing, duration/pages several-checks validity, Rails :except_on
  • Correct spoofing_protection docs: file/libmagic does not load the whole file into RAM; remote blobs are still streamed to a tempfile (igorkasyanchuk/active_storage_validations#376)

New Contributors

• @​pardeyke made their first contribution in igorkasyanchuk/active_storage_validations#415

Full Changelog: igorkasyanchuk/active_storage_validations@3.0.6...4.0.0

3.0.6

What's Changed

• Fix processable_file rejecting formats with libvips untrusted loaders (e.g. SVG) after Rails enables Vips.block_untrusted(true) (igorkasyanchuk/active_storage_validations#423). No impact on Rails versions that do not enable this Vips change (before 7.2.3.2 / 8.0.5.1 / 8.1.3.1, unless the app blocks untrusted loaders itself). By @​Mth0158 in igorkasyanchuk/active_storage_validations#424
• Fix validation of multiple new attachables with nil blob ids by @​tmnb in igorkasyanchuk/active_storage_validations#422

New Contributors

• @​tmnb made their first contribution in igorkasyanchuk/active_storage_validations#422

Full Changelog: igorkasyanchuk/active_storage_validations@3.0.5...3.0.6

Changelog

Sourced from active_storage_validations's changelog.

• 4.0.0

  • BREAKING

    • Drop support for Rails 6.1.4, 7.0.0 (we keep support for Rails >= 7.0.1)
    • Drop support for Ruby < 3.3 (required_ruby_version is now >= 3.3.0)
    • FormBuilder#file_field now automatically sets the HTML accept attribute from content_type validators (igorkasyanchuk/active_storage_validations#415). Disable globally with ActiveStorageValidations.infer_file_field_accept = false, or per field with infer_accept: false
    • Analyzer commands (ffprobe, pdfinfo, file, ImageMagick identify, libvips) now default to a 10s command_timeout (igorkasyanchuk/active_storage_validations#410). Most apps are unaffected; this is breaking for uploads whose metadata analysis legitimately takes longer than 10s (e.g. very large videos on slow/network storage). Raise globally, per validator with timeout:, or set nil to restore unbounded waits — see upgrade guide

  • ADDED

    • Add #except_on matcher option to support Rails :except_on validation option (available since Rails 8.0) (igorkasyanchuk/active_storage_validations#380)
    • Add optional per-validator timeout: and timeout.active_storage_validations instrumentation for analyzer commands. Timed-out analysis fails closed using existing validation errors
    • Add #timeout matcher option for metadata validators (dimension, aspect_ratio, duration, pages, processable_file) and content_type
    • Add spoofing_protection: :magika backend (Google Magika CLI) for content_type; true still means :file. Cache stores asv_content_type_backend. Matcher: #spoofing_protection / #spoofing_protection(:magika) (igorkasyanchuk/active_storage_validations#404)

  • FIXED

    • Fix dimension: { min:, max: } when both top-level bounds are set together (previously the second bound overwrote the first in process_options)
    • Fix Proc options with arity 0 (e.g. -> { 2.kilobytes..7.kilobytes }) being called with the record argument
    • Fix metadata matchers (aspect_ratio, dimension, …) crashing with NoMethodError when the same attribute also has content_type spoofing protection (matcher Analyzer stub now responds to #content_type)

  • MISC

    • Add support for Ruby 4.0 in CI matrix
    • Add https://github.com/igorkasyanchuk/active_storage_validations/blob/master/AGENTS.md with codebase guide for AI coding agents
    • Add informational benchmark/ suite for metadata validators (cold vs cached asv_*, vips vs mini_magick) with CI job and checked-in baseline
    • Migrate the gem test suite from Minitest to RSpec; add rubocop-rspec (igorkasyanchuk/active_storage_validations#307). Consumer matcher APIs for RSpec and Minitest/shoulda are unchanged
    • Strengthen validator specs: comparison Proc options, total_size multi-file sums, media_metadata_missing / attachment_missing, duration/pages several-checks validity, Rails :except_on
    • Correct spoofing_protection docs: file/libmagic does not load the whole file into RAM; remote blobs are still streamed to a tempfile (igorkasyanchuk/active_storage_validations#376)

  • To upgrade from version 3.x to 4.x, please read the upgrade guide

• 3.0.6

  • Fix processable_file rejecting formats with libvips untrusted loaders (e.g. SVG) after Rails enables Vips.block_untrusted(true) (igorkasyanchuk/active_storage_validations#423). No impact on Rails versions that do not enable this Vips change (before 7.2.3.2 / 8.0.5.1 / 8.1.3.1, unless the app blocks untrusted loaders itself).
  • Fix validation of multiple new attachables with nil blob ids (igorkasyanchuk/active_storage_validations#422) @​tmnb

Commits

• 2a5abfe chore: update changes.md
• e759453 new release
• c650724 docs(agents): sync guide with Magika and v4 features
• 6c689aa docs(readme): polish v4 requirements and processable_file notes
• 1899adc Merge pull request #427 from igorkasyanchuk/404-replace-content_type-spoofing...
• 5f65069 docs(readme): document Magika brew install and spoofing matcher
• d0899a0 Merge pull request #426 from igorkasyanchuk/404-replace-content_type-spoofing...
• f192ad0 test(analyzers): gate specs by IMAGE_PROCESSOR metadata filter
• 0883ab8 fix(matchers): respond to content_type on Analyzer metadata stub
• d839853 test(content_type): cover leading-space PDF for Magika vs file
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[0jonjo]

Holding this major (active_storage_validations 4.0) for a dedicated session — validation API breaking changes need review before merging.