Bump the ruby group with 5 updates

[dependabot]

Bumps the ruby group with 5 updates:

Package	From	To
activestorage	8.1.3	8.1.3.1
solid_cable	4.0.0	4.0.2
solid_queue	1.4.0	1.5.0
activesupport	8.1.3	8.1.3.1
railties	8.1.3	8.1.3.1

Updates activestorage from 8.1.3 to 8.1.3.1

Release notes

Sourced from activestorage's releases.

8.1.3.1

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• No changes.

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• Disable libvips's unfuzzed image loaders and savers.

  libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Changelog

Sourced from activestorage's changelog.

Rails 8.1.3.1 (July 29, 2026)

• Disable libvips's unfuzzed image loaders and savers.

  libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

  This is a breaking change for applications that process image types with an unfuzzed loader or saver. Variant transformation of BMP, ICO, and PSD attachments will raise Vips::Error, and analysis of these and other types such as SVG, JPEG XL, JPEG 2000, and Netpbm will no longer record width and height. Requesting an unfuzzed output format, typically FITS, JXL, or anything delegated to ImageMagick, will also raise Vips::Error. Attaching, storing, and downloading are unchanged.

  An application seeing Vips::Error raised during image transformation may wish to remove the affected content types from config.active_storage.variable_content_types in an initializer. Active Storage will then treat those attachments as not variable and will not generate variants for them. This most often matters to an application that transforms images during a request rather than in a background job, where the failure surfaces as an error response instead of a failed job.

  Rails.application.config.active_storage.variable_content_types -=
    %w[ image/bmp image/vnd.microsoft.icon image/vnd.adobe.photoshop ]

  Applications using the :mini_magick variant processor will see no change in how their attachments are processed, but the loaders and savers will be disabled process-wide whenever ruby-vips is installed, and the version requirements below will still apply. Such an application may remove ruby-vips from its Gemfile to avoid both.

  The minimum supported version of libvips is now 8.13, and the minimum supported version of ruby-vips is now 2.2.1. These are the earliest versions that are capable of disabling untrusted operations. When ruby-vips is installed and either minimum is not met, Active Storage will raise a RuntimeError while booting rather than run in an unsecurable environment.

  [GHSA-xr9x-r78c-5hrm] [CVE-2026-66066]

  Mike Dalessio

Commits

• 3989ebf Preparing for 8.1.3.1 release
• 349e7a5 Disable libvips's unfuzzed image loaders and savers
• See full diff in compare view

Updates solid_cable from 4.0.0 to 4.0.2

Release notes

Sourced from solid_cable's releases.

v4.0.2

What's Changed

• Reset retry counter on each successful poll by @​npezza93 in rails/solid_cable#84

Full Changelog: rails/solid_cable@v4.0.1...v4.0.2

v4.0.1

What's Changed

• Run ci against different rails versions by @​npezza93 in rails/solid_cable#79
• Update adapter to handle ActionCable adapterization in 8.2 by @​npezza93 in rails/solid_cable#80
• Reset reconnect_attempt after successfuly accessing the DB. by @​pascalbetz in rails/solid_cable#82

New Contributors

• @​pascalbetz made their first contribution in rails/solid_cable#82

Full Changelog: rails/solid_cable@v4.0.0...v4.0.1

Commits

• 4a41ec8 Version bump
• f781e4d Reset retry counter on each successful poll (#84)
• cf0695c Version bump
• c968ba7 Reset reconnect_attempt after successfuly accessing the DB. (#82)
• 5ea0f55 Update adapter to handle ActionCable adapterization in 8.2 (#80)
• 89d34d7 Run ci against different rails versions (#79)
• See full diff in compare view

Updates solid_queue from 1.4.0 to 1.5.0

Release notes

Sourced from solid_queue's releases.

v1.5.0

Lots of bugfixes in this one, thanks to a bunch of new contributors!

Notable changes in this release:

• Drop support for Ruby 3.1, which has been EOL for a while
• Improve DISTINCT queries used for polling with not specific queue names in PostgreSQL
• Change polling interval default to 1 second
• New bin/job check to validate configuration
• Support setting a default time zone for recurring tasks

What's Changed

• Accept optional job argument in stopping? by @​thoughtless in rails/solid_queue#747
• docs: use single splat in key argument for limits_concurrency by @​G-Rath in rails/solid_queue#749
• Warn instead of raising when the connection pool is smaller than the thread pool by @​ajaynomics in rails/solid_queue#753
• add bin/jobs check to validate config before starting by @​alexanderadam in rails/solid_queue#745
• Refactor errors and warnings when parsing configuration by @​rosa in rails/solid_queue#759
• Remove trapping QUIT on Windows by @​andyundso in rails/solid_queue#727
• Change default polling_interval to 1 sec by @​hachi8833 in rails/solid_queue#721
• Memoize Runnable#mode to stop allocating a String + StringInquirer pe… by @​s01ipsist in rails/solid_queue#744
• Avoid reloading job rows after dispatch and schedule by @​ImDineshSaini in rails/solid_queue#742
• Fix recurring task logging as if it enqueued the same job twice by @​ghiculescu in rails/solid_queue#731
• Improve DISTINCT queries on PostgreSQL via recursive CTE by @​bubiche in rails/solid_queue#730
• Automatically use Rails or a default timezone for the schedule by @​andyjeffries in rails/solid_queue#750
• Fix flaky concurrency controls test by @​diogovernier in rails/solid_queue#734
• Reduce flaky integration test failures from timing and PK reuse by @​rafael-pissardo in rails/solid_queue#758
• Add compatibility with strict_loading_by_default by @​JoeDupuis in rails/solid_queue#375
• Report rescued recurring enqueue errors to Rails.error by @​rafael-pissardo in rails/solid_queue#756
• Drop support for Ruby 3.1 by @​rosa in rails/solid_queue#762
• Prevent concurrency lock leaks that cause duplicate job execution by @​rosa in rails/solid_queue#761

New Contributors

• @​thoughtless made their first contribution in rails/solid_queue#747
• @​ajaynomics made their first contribution in rails/solid_queue#753
• @​hachi8833 made their first contribution in rails/solid_queue#721
• @​s01ipsist made their first contribution in rails/solid_queue#744
• @​ImDineshSaini made their first contribution in rails/solid_queue#742
• @​ghiculescu made their first contribution in rails/solid_queue#731
• @​bubiche made their first contribution in rails/solid_queue#730
• @​andyjeffries made their first contribution in rails/solid_queue#750
• @​rafael-pissardo made their first contribution in rails/solid_queue#758
• @​JoeDupuis made their first contribution in rails/solid_queue#375

Full Changelog: rails/solid_queue@v1.4.0...v1.5.0

Commits

• 61a9f08 Bump solid_queue to 1.5.0
• 4f263b2 Prevent wrong release of blocked jobs and semaphore corruption
• 2124a51 Guard signal_all against incrementing semaphore beyond its limit
• 42db567 Drop support for Ruby 3.1
• dfc3644 Report rescued recurring enqueue errors to Rails.error
• 23100e0 Support running with strict_loading_by_default enabled
• 142d2ac Reduce flaky integration test failures from timing and PK reuse
• 952d852 Bypass JobResult's query cache in skip_active_record_query_cache
• a19771d Fix flaky concurrency controls test
• 546864f Automatically use Rails or a default timezone for the schedule
• Additional commits viewable in compare view

Updates activesupport from 8.1.3 to 8.1.3.1

Release notes

Sourced from activesupport's releases.

8.1.3.1

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• No changes.

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• Disable libvips's unfuzzed image loaders and savers.

  libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Changelog

Sourced from activesupport's changelog.

Rails 8.1.3.1 (July 29, 2026)

• No changes.

Commits

• 3989ebf Preparing for 8.1.3.1 release
• See full diff in compare view

Updates railties from 8.1.3 to 8.1.3.1

Release notes

Sourced from railties's releases.

8.1.3.1

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• No changes.

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• Disable libvips's unfuzzed image loaders and savers.

  libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Changelog

Sourced from railties's changelog.

Rails 8.1.3.1 (July 29, 2026)

• No changes.

Commits

• 3989ebf Preparing for 8.1.3.1 release
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.