What's Changed
-
BREAKING
- Drop support for Rails 6.1.4, 7.0.0 (we keep support for Rails >= 7.0.1)
- Drop support for Ruby < 3.3 (required_ruby_version is now >= 3.3.0)
- FormBuilder#file_field now automatically sets the HTML accept attribute from content_type validators (#415). Disable globally with ActiveStorageValidations.infer_file_field_accept = false, or per field with infer_accept: false
- Analyzer commands (ffprobe, pdfinfo, file, ImageMagick identify, libvips) now default to a 10s command_timeout (#410). Most apps are unaffected; this is breaking for uploads whose metadata analysis legitimately takes longer than 10s (e.g. very large videos on slow/network storage). Raise globally, per validator with timeout:, or set nil to restore unbounded waits — see upgrade guide
-
ADDED
- Add #except_on matcher option to support Rails :except_on validation option (available since Rails 8.0) (#380)
- Add optional per-validator timeout: and timeout.active_storage_validations instrumentation for analyzer commands. Timed-out analysis fails closed using existing validation errors
- Add #timeout matcher option for metadata validators (dimension, aspect_ratio, duration, pages, processable_file) and content_type
- Add spoofing_protection: :magika backend (Google Magika CLI) for content_type; true still means :file. Cache stores asv_content_type_backend. Matcher: #spoofing_protection / #spoofing_protection(:magika) (#404)
-
FIXED
- Fix dimension: { min:, max: } when both top-level bounds are set together (previously the second bound overwrote the first in process_options)
- Fix Proc options with arity 0 (e.g. -> { 2.kilobytes..7.kilobytes }) being called with the record argument
- Fix metadata matchers (aspect_ratio, dimension, …) crashing with NoMethodError when the same attribute also has content_type spoofing protection (matcher Analyzer stub now responds to #content_type)
-
MISC
- Add support for Ruby 4.0 in CI matrix
- Add AGENTS.md with codebase guide for AI coding agents
- Add informational benchmark/ suite for metadata validators (cold vs cached asv_*, vips vs mini_magick) with CI job and checked-in baseline
- Migrate the gem test suite from Minitest to RSpec; add rubocop-rspec (#307). Consumer matcher APIs for RSpec and Minitest/shoulda are unchanged
- Strengthen validator specs: comparison Proc options, total_size multi-file sums, media_metadata_missing / attachment_missing, duration/pages several-checks validity, Rails :except_on
- Correct spoofing_protection docs: file/libmagic does not load the whole file into RAM; remote blobs are still streamed to a tempfile (#376)
New Contributors
Full Changelog: 3.0.6...4.0.0