Update dependencies to v8.1.2.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
railties (source, changelog)	8.1.2 → 8.1.2.1
rubocop (source, changelog)	1.85.1 → 1.86.0

---

Release Notes

rails/rails (railties)

v8.1.2.1: 8.1.2.1

Compare Source

Active Support

• Reject scientific notation in NumberConverter

  [CVE-2026-33176]

  Jean Boussier

• Fix SafeBuffer#% to preserve unsafe status

  [CVE-2026-33170]

  Jean Boussier

• Improve performance of NumberToDelimitedConverter

  [CVE-2026-33169]

  Jean Boussier

Active Model

• No changes.

Active Record

• No changes.

Action View

• Skip blank attribute names in tag helpers to avoid generating invalid HTML.

  [CVE-2026-33168]

  Mike Dalessio

Action Pack

• Fix possible XSS in DebugExceptions middleware

  [CVE-2026-33167]

  John Hawthorn

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• Filter user supplied metadata in DirectUploadController

  [CVE-2026-33173]

  Jean Boussier

• Configurable maxmimum streaming chunk size

  Makes sure that byte ranges for blobs don't exceed 100mb by default.
  Content ranges that are too big can result in denial of service.

  [CVE-2026-33174]

  Gannon McGibbon

• Limit range requests to a single range

  [CVE-2026-33658]

  Jean Boussier

• Prevent path traversal in DiskService.

  DiskService#path_for now raises an InvalidKeyError when passed keys with dot segments (".",
  ".."), or if the resolved path is outside the storage root directory.

  #path_for also now consistently raises InvalidKeyError if the key is invalid in any way, for
  example containing null bytes or having an incompatible encoding. Previously, the exception
  raised may have been ArgumentError or Encoding::CompatibilityError.

  DiskController now explicitly rescues InvalidKeyError with appropriate HTTP status codes.

  [CVE-2026-33195]

  Mike Dalessio

• Prevent glob injection in DiskService#delete_prefixed.

  Escape glob metacharacters in the resolved path before passing to Dir.glob.

  Note that this change breaks any existing code that is relying on delete_prefixed to expand
  glob metacharacters. This change presumes that is unintended behavior (as other storage services
  do not respect these metacharacters).

  [CVE-2026-33202]

  Mike Dalessio

Action Mailbox

• No changes.

Action Text

• No changes.

Railties

• No changes.

Guides

• No changes.

rubocop/rubocop (rubocop)

v1.86.0

Compare Source

New features

• #​15000: Display ZJIT usage when running under LSP. ([@​koic][])
• #​14961: Add AllowedParentClasses option to Style/EmptyClassDefinition. ([@​hammadkhan][])
• #​14977: Support AllowedReceivers for Style/HashLookupMethod. ([@​koic][])

Bug fixes

• #​15015: Fix Style/ConcatArrayLiterals autocorrect deleting code for percent literals with interpolation. ([@​bbatsov][])
• #​14897: Detect constant reassignment after class/module definition in Lint/ConstantReassignment. ([@​ydakuka][])
• #​11829: Fix false negatives for Lint/DuplicateMethods when duplicate methods are defined in anonymous classes and modules not assigned to a constant. ([@​Darhazer][])
• #​14988: Fix false negative in Style/RedundantParentheses when redundant parentheses around range literals in block body. ([@​koic][])
• #​14916: Fix false positive for Layout/MultilineMethodCallIndentation when method chain is inside a hash pair value passed to a multiline chained method call. ([@​ydakuka][])
• #​15010: Fix a false positive for Lint/DuplicateMethods when modules blocks are passed as method arguments. ([@​5hun-s][])
• #​15028: Fix a false positive for Lint/DuplicateMethods when the same method is defined in different anonymous module blocks passed to a no-receiver call (e.g. stub_const). ([@​Darhazer][])
• #​15021: Fix false positives in Layout/EmptyLineAfterGuardClause when using a guard clause followed by a multi-line guard clause with raise, fail, return, break, or next. ([@​koic][])
• #​15001: Fix false positives in Layout/RedundantLineBreak when setting InspectBlocks: true and using rescue or ensure in the block. ([@​koic][])
• #​14997: Fix false positives in Style/FileOpen when assigning File.open to an instance variable, class variable, global variable, or constant. ([@​koic][])
• #​15019: Fix false positives in Lint/DuplicateMethods when the same method is defined in anonymous module blocks passed to different receivers. ([@​koic][])
• #​14987: Complete ERB and Haml autocorrection in a single run. ([@​alpaca-tc][])
• #​15039: Fix incorrect autocorrect in Style/IfWithSemicolon when return with value is in the else branch. ([@​koic][])
• #​14930: Fix incorrect autocorrection for Style/IfUnlessModifier when multiple if/unless modifier forms are on the same line inside a collection. ([@​ydakuka][])
• #​14985: Fix incorrect autocorrection in Lint/SafeNavigationChain when chaining a method call after safe navigation in the if branch of a ternary. ([@​koic][])
• #​15009: Fix infinite loop in Layout/EndAlignment when end is followed by || or &&. ([@​koic][])
• #​14981: Fix spurious warning "does not support Safe/SafeAutoCorrect parameter" when those parameters are set for cops that don't have them in their default configuration. ([@​dduugg][])
• #​15043: Fix an error for Lint/UselessDefaultValueArgument when fetch without a receiver is inside a fetch block. ([@​koic][])
• #​15034: Fix incorrect autocorrection in Style/IfWithSemicolon when using single-line unless / ; / end. ([@​koic][])
• #​15015: Fix Style/NonNilCheck autocorrect for receivers containing spaces. ([@​bbatsov][])
• #​15015: Fix Style/RaiseArgs to allow anonymous keyword forwarding (raise Ex.new(**)). ([@​bbatsov][])
• #​14890: Fix a false positive for Lint/RedundantCopDisableDirective when a rubocop:disable comment is used to suppress Lint/EmptyWhen, Lint/EmptyConditionalBody, Lint/EmptyInPattern, or Style/SymbolProc. ([@​eugeneius][])
• #​15015: Fix false negative in Style/RedundantPercentQ for %q strings with interpolation-like syntax. ([@​bbatsov][])
• #​14984: Fix Style/AndOr adding unnecessary parentheses around return without arguments. ([@​eugeneius][])
• #​14945: Support files with multiple modifiers in Lint/UselessConstantScoping. ([@​h-lame][])
• #​15015: Fix Style/TrailingMethodEndStatement to detect singleton methods (def self.foo). ([@​bbatsov][])
• #​10822: Don't store results in cache if there are warnings. ([@​jonas054][])

Changes

• #​14718: Allow setting MaxFilesInCache to false to entirely disable cache pruning. ([@​byroot][])
• #​14989: Make Lint/RedundantSafeNavigation aware of safe navigation in conditional true branch. ([@​koic][])
• #​15041: Remove mcp gem from runtime dependencies. ([@​koic][])

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.