208 Rails 7.2 Changelog

November 4th, 2026: Version 7.2.4.11

• Read the announcement Show archive.org snapshot
• Backported a fix for GHSA-f3w6-w445-fwh9 - Possible arbitrary file write and read in Active Storage image analysis (ships an ImageMagick security policy for every MiniMagick process)
• Backported a fix for GHSA-v924-7rp8-4mxh - Possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing
• Backported a fix for GHSA-wm3x-v3qw-4jh3 - Possible Strong Parameters bypass in Parameters#each_key in Action Pack
• Backported a fix for GHSA-8474-xrp6-wh69 - Possible DoS vulnerability in Active Support safe_constantize
• Backported a fix for GHSA-rwvh-fw6r-pwvp - Possible DoS vulnerability in Action Controller Live streaming
• Backported a fix for GHSA-v6rj-xm57-3p59 - Possible XSS vulnerability in Action View highlight helper
• Backported a fix for GHSA-2p2f-4rq4-gjwc - Possible XSS vulnerability in Action View text helpers. The upstream fix requires Nokogiri >= 1.19.5, which needs Ruby 3.2+. Update Nokogiri if you can; on older Nokogiri, highlight and simple_format now fall back to the HTML4 sanitizer, which escapes < and > in attribute values.
• Backported a fix for GHSA-x6mj-8jx9-qhqv - Possible sensitive session information leak in Active Storage proxy mode
• Backported a fix for GHSA-rq8q-p985-fjq7 - Possible XSS vulnerability in Action View strip_tags
• Backported a fix for GHSA-68p9-83h6-5wpj - Possible XSS vulnerability in Action View tag helpers
• Backported a fix for GHSA-3w93-6hmw-whh4 - Unsigned Content-Type in Active Storage GCS direct uploads with cache_control
• Backported a fix for GHSA-hfr4-8rjc-97m2 - Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage
• Backported a fix for GHSA-p2pm-g2h6-7j5j - Possible DoS vulnerability in Active Storage filename handling
• Backported a fix for GHSA-3f4q-8x5m-76v8 - Possible local file disclosure in Active Storage video previews and analysis
• Backported a fix for GHSA-5957-c7qm-m469 - Possible signature replay in Action Mailbox Mailgun ingress
• Backported a fix for GHSA-2586-8ghr-69fj - Possible restoration of destroyed sessions in Action Dispatch CacheStore. The Dalli-based MemCacheStore has the same pattern; use Dalli >= 4.0.
• Backported a fix for GHSA-gmj8-hvj3-49mw - Missing SameSite attribute on session cookies from Action Pack session stores
• Backported a fix for GHSA-r9jg-fmfx-2gv6 - Possible cache poisoning in Action Pack content negotiation
• Bumped the Rack requirement to >= 2.2.25 (GHSA-5v64-555j-wjxm, GHSA-p8x9-v4hv-2w4g, GHSA-wvg4-6p58-3gh3). Rack 3 applications need Rack 3.1.23 or 3.2.8.
• Not affected: GHSA-4v2w-w6g6-f8f8 (Active Storage proxy streaming), GHSA-2gff-2mmg-m73p and GHSA-2w9f-fxwj-w2qf (Rails 8.1 only).

October 20th, 2026

• Confirmed that Version 7.2.4.10 already supports Ruby 4.0.

September 25th, 2026: Version 7.2.4.10

• Merged some upstream bugfixes from Rails 7.2.4.
• No security-related changes.

July 29th, 2026: Version 7.2.3.11

• Ported fix for CVE-2026-66066 (disable all untrusted libvips formats)
  • Workaround available via RAILS_LTS_ALLOW_UNTRUSTED_VIPS_OPERATIONS=1
  • Read the announcement Show archive.org snapshot

June 22nd, 2026: Version 7.2.3.10

• Initial release of the LTS version of Rails 7.2.
• This is mostly identical to the latest official 7.2 release (7.2.3.1).
• Backported a patch for CVE-2026-41316 ( Read the announcement Show archive.org snapshot )
• Supports Ruby 3.1+.
• (Skipped some tiny versions to version to stay ahead of any official 7.2.3.x community releases.)