Bump active_storage_validations from 3.0.6 to 4.0.0

[dependabot]

Bumps active_storage_validations from 3.0.6 to 4.0.0.

Release notes

Sourced from active_storage_validations's releases.

4.0.0

What's Changed

• BREAKING

  • Drop support for Rails 6.1.4, 7.0.0 (we keep support for Rails >= 7.0.1)
  • Drop support for Ruby < 3.3 (required_ruby_version is now >= 3.3.0)
  • FormBuilder#file_field now automatically sets the HTML accept attribute from content_type validators (igorkasyanchuk/active_storage_validations#415). Disable globally with ActiveStorageValidations.infer_file_field_accept = false, or per field with infer_accept: false
  • Analyzer commands (ffprobe, pdfinfo, file, ImageMagick identify, libvips) now default to a 10s command_timeout (igorkasyanchuk/active_storage_validations#410). Most apps are unaffected; this is breaking for uploads whose metadata analysis legitimately takes longer than 10s (e.g. very large videos on slow/network storage). Raise globally, per validator with timeout:, or set nil to restore unbounded waits — see upgrade guide

• ADDED

  • Add #except_on matcher option to support Rails :except_on validation option (available since Rails 8.0) (igorkasyanchuk/active_storage_validations#380)
  • Add optional per-validator timeout: and timeout.active_storage_validations instrumentation for analyzer commands. Timed-out analysis fails closed using existing validation errors
  • Add #timeout matcher option for metadata validators (dimension, aspect_ratio, duration, pages, processable_file) and content_type
  • Add spoofing_protection: :magika backend (Google Magika CLI) for content_type; true still means :file. Cache stores asv_content_type_backend. Matcher: #spoofing_protection / #spoofing_protection(:magika) (igorkasyanchuk/active_storage_validations#404)

• FIXED

  • Fix dimension: { min:, max: } when both top-level bounds are set together (previously the second bound overwrote the first in process_options)
  • Fix Proc options with arity 0 (e.g. -> { 2.kilobytes..7.kilobytes }) being called with the record argument
  • Fix metadata matchers (aspect_ratio, dimension, …) crashing with NoMethodError when the same attribute also has content_type spoofing protection (matcher Analyzer stub now responds to #content_type)

• MISC

  • Add support for Ruby 4.0 in CI matrix
  • Add AGENTS.md with codebase guide for AI coding agents
  • Add informational benchmark/ suite for metadata validators (cold vs cached asv_*, vips vs mini_magick) with CI job and checked-in baseline
  • Migrate the gem test suite from Minitest to RSpec; add rubocop-rspec (igorkasyanchuk/active_storage_validations#307). Consumer matcher APIs for RSpec and Minitest/shoulda are unchanged
  • Strengthen validator specs: comparison Proc options, total_size multi-file sums, media_metadata_missing / attachment_missing, duration/pages several-checks validity, Rails :except_on
  • Correct spoofing_protection docs: file/libmagic does not load the whole file into RAM; remote blobs are still streamed to a tempfile (igorkasyanchuk/active_storage_validations#376)

New Contributors

• @​pardeyke made their first contribution in igorkasyanchuk/active_storage_validations#415

Full Changelog: igorkasyanchuk/active_storage_validations@3.0.6...4.0.0

Changelog

Sourced from active_storage_validations's changelog.

• 4.0.0

  • BREAKING

    • Drop support for Rails 6.1.4, 7.0.0 (we keep support for Rails >= 7.0.1)
    • Drop support for Ruby < 3.3 (required_ruby_version is now >= 3.3.0)
    • FormBuilder#file_field now automatically sets the HTML accept attribute from content_type validators (igorkasyanchuk/active_storage_validations#415). Disable globally with ActiveStorageValidations.infer_file_field_accept = false, or per field with infer_accept: false
    • Analyzer commands (ffprobe, pdfinfo, file, ImageMagick identify, libvips) now default to a 10s command_timeout (igorkasyanchuk/active_storage_validations#410). Most apps are unaffected; this is breaking for uploads whose metadata analysis legitimately takes longer than 10s (e.g. very large videos on slow/network storage). Raise globally, per validator with timeout:, or set nil to restore unbounded waits — see upgrade guide

  • ADDED

    • Add #except_on matcher option to support Rails :except_on validation option (available since Rails 8.0) (igorkasyanchuk/active_storage_validations#380)
    • Add optional per-validator timeout: and timeout.active_storage_validations instrumentation for analyzer commands. Timed-out analysis fails closed using existing validation errors
    • Add #timeout matcher option for metadata validators (dimension, aspect_ratio, duration, pages, processable_file) and content_type
    • Add spoofing_protection: :magika backend (Google Magika CLI) for content_type; true still means :file. Cache stores asv_content_type_backend. Matcher: #spoofing_protection / #spoofing_protection(:magika) (igorkasyanchuk/active_storage_validations#404)

  • FIXED

    • Fix dimension: { min:, max: } when both top-level bounds are set together (previously the second bound overwrote the first in process_options)
    • Fix Proc options with arity 0 (e.g. -> { 2.kilobytes..7.kilobytes }) being called with the record argument
    • Fix metadata matchers (aspect_ratio, dimension, …) crashing with NoMethodError when the same attribute also has content_type spoofing protection (matcher Analyzer stub now responds to #content_type)

  • MISC

    • Add support for Ruby 4.0 in CI matrix
    • Add https://github.com/igorkasyanchuk/active_storage_validations/blob/master/AGENTS.md with codebase guide for AI coding agents
    • Add informational benchmark/ suite for metadata validators (cold vs cached asv_*, vips vs mini_magick) with CI job and checked-in baseline
    • Migrate the gem test suite from Minitest to RSpec; add rubocop-rspec (igorkasyanchuk/active_storage_validations#307). Consumer matcher APIs for RSpec and Minitest/shoulda are unchanged
    • Strengthen validator specs: comparison Proc options, total_size multi-file sums, media_metadata_missing / attachment_missing, duration/pages several-checks validity, Rails :except_on
    • Correct spoofing_protection docs: file/libmagic does not load the whole file into RAM; remote blobs are still streamed to a tempfile (igorkasyanchuk/active_storage_validations#376)

  • To upgrade from version 3.x to 4.x, please read the upgrade guide

Commits

• 2a5abfe chore: update changes.md
• e759453 new release
• c650724 docs(agents): sync guide with Magika and v4 features
• 6c689aa docs(readme): polish v4 requirements and processable_file notes
• 1899adc Merge pull request #427 from igorkasyanchuk/404-replace-content_type-spoofing...
• 5f65069 docs(readme): document Magika brew install and spoofing matcher
• d0899a0 Merge pull request #426 from igorkasyanchuk/404-replace-content_type-spoofing...
• f192ad0 test(analyzers): gate specs by IMAGE_PROCESSOR metadata filter
• 0883ab8 fix(matchers): respond to content_type on Analyzer metadata stub
• d839853 test(content_type): cover leading-space PDF for Magika vs file
• Additional commits viewable in compare view