Ruby on Rails 8.1.3.1

Remember when Rails 8.1 shipped with Active Storage's libvips integration and everyone said "that's neat"? Fast forward to July 29, 2026, and the Rails team has pushed 8.1.3.1 — a security release that fixes a real vulnerability in that exact integration.

Let's rewind for a second. The libvips image processing library has these things called "unfuzzed" loaders and savers. They're fast, but they don't sanitize input. And in Rails 8.1.x, Active Storage was happily using them for BMP, ICO, PSD, SVG, and JPEG XL files among others. That's tracked as CVE-2026-66066.

What Changed

Active Storage now calls Vips.block_untrusted(true) at boot time to disable all unfuzzed loaders and savers globally. This means:

• Variant transformation of BMP, ICO, and PSD attachments will raise Vips::Error
• Width/height analysis for SVG, JPEG XL, JPEG 2000, and Netpbm files won't work anymore
• Requesting unfuzzed output formats like FITS or JXL will also fail

If that sounds disruptive — it is. But the Rails team has your back with a clean workaround.

The Fix for Your App

If you're seeing Vips::Error in production, you can remove the affected content types from Active Storage's variable list in an initializer:

Rails.application.config.active_storage.variable_content_types -= %w[image/bmp image/vnd.microsoft.icon image/vnd.adobe.photoshop]

This tells Rails to treat those attachments as non-variable — no variants will be generated, but uploads and downloads still work fine.

Version Requirements

There's a catch: you now need libvips >= 8.13 and ruby-vips >= 2.2.1. If you're running older versions, Rails will raise a RuntimeError on boot. That's by design — running with unsecurable dependencies isn't an option.

If you use :mini_magick as your variant processor, you can simply remove ruby-vips from your Gemfile to sidestep the whole thing.

This patch release touches only Active Storage — everything else (Active Record, Action Pack, Action Mailer, etc.) is unchanged. That makes the upgrade as clean as security patches get.

Upgrade when you can, but don't sleep on this one — CVE-2026-66066 is a real vulnerability in a commonly used path.