[dependabot]

Bumps actionpack from 8.1.4 to 8.1.4.1.

Release notes

Sourced from actionpack's releases.

8.1.4.1

Active Support

• ActiveSupport::MessagePack no longer deserializes an unsafe ActiveSupport::SafeBuffer as html_safe.

  A SafeBuffer that was no longer html_safe?, for example after an in-place gsub!, was deserialized as an html_safe SafeBuffer. It is now serialized with an unsafe marker and deserialized as a String. Earlier versions of Rails cannot read an unsafe buffer serialized this way.

  [GHSA-2w9f-fxwj-w2qf]

  Jean Boussier

• ActiveSupport::Inflector#safe_constantize matches the constant name in a LoadError message as a literal string instead of building a Regexp from it.

  The name's segments were interpolated unescaped into the pattern, so input that reaches safe_constantize, such as the channel identifier in an Action Cable subscribe command, chose the source passed to the regexp compiler.

  [GHSA-8474-xrp6-wh69]

  Jeremy Daer

Active Model

• No changes.

Active Record

• No changes.

Action View

• Skip attribute names in tag helpers that are blank once converted to a string.

  A Symbol such as :" " is not blank, because Symbol#blank? is Symbol#empty?, so it reached the escaping step and produced an attribute with no name. The asset helpers symbolize their keys, so an ordinary String key reached the same place.

  [GHSA-68p9-83h6-5wpj]

  Mike Dalessio

... (truncated)

Changelog

Sourced from actionpack's changelog.

Rails 8.1.4.1 (November 03, 2026)

• Apply config.action_dispatch.cookies_same_site_protection to every session store.

  ActionDispatch::Session::CacheStore, MemCacheStore and third-party stores built on AbstractStore or the session mixins sent session cookies with no SameSite attribute. Only CookieStore applied the configured default.

  [GHSA-gmj8-hvj3-49mw]

  Jean Boussier

• Prevent ActionController::Live streams from blocking when a full buffer is closed or aborted.

  [GHSA-rwvh-fw6r-pwvp]

  Jeremy Daer

• Set and extend the Vary header for rendered responses according to the request headers used in format negotiation.

  Vary: Accept was only added when the request carried a usable Accept header. A response to a request without one, negotiated to HTML or JavaScript, could be stored by a shared cache and served to later clients that requested a different representation.

  Responses now vary on Accept and X-Requested-With whenever the format is not given by the URL. XHR requests without Accept also vary on Content-Type, which Rails uses as a legacy format fallback. When config.action_dispatch.ignore_accept_header is enabled, responses vary only on X-Requested-With.

  These fields are appended to an existing Vary value without duplicating fields case-insensitively. Vary: * remains unchanged.

  [GHSA-r9jg-fmfx-2gv6]

  Jeremy Daer

• Skip writing a CacheStore session that another request deleted while this one ran.

  A request that loaded a session from ActionDispatch::Session::CacheStore wrote it back when it finished, even after a concurrent reset_session or a server-side delete had removed it, so the old session ID worked again.

  [GHSA-2586-8ghr-69fj]

... (truncated)

Commits

• 3f290b7 Preparing for 8.1.4.1 release
• 2d9f502 Apply cookies_same_site_protection to every session store
• ccbfc09 Avoid blocking Live buffer termination
• 7a955ca Vary rendered responses by negotiation headers
• d479192 Skip writing a CacheStore session deleted mid-request
• 849a6c3 Don't write upgraded cookies to a response that skips the session
• 2a01a5a Detect conflicts in Forwarded and X-Forwarded-For in ActionDispatch::RemoteIp
• 8ba746e Return self from Parameters#each_key with a block
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Looks like actionpack is up-to-date now, so this is no longer needed.