{"id":14864,"date":"2026-09-24T17:30:00","date_gmt":"2026-09-24T12:00:00","guid":{"rendered":"https:\/\/www.allerin.com\/blog\/?p=14864"},"modified":"2026-09-23T10:28:20","modified_gmt":"2026-09-23T04:58:20","slug":"active-storage-libvips-matrix","status":"publish","type":"post","link":"https:\/\/www.allerin.com\/blog\/active-storage-libvips-matrix\/","title":{"rendered":"Active Storage libvips checks before deployment"},"content":{"rendered":"

A patched Active Storage bundle can still refuse to boot against an older native library. These Active Storage libvips checks connect the package version listed for your base image with the library Ruby actually loads.<\/p>\n

The July advisory reports a possible arbitrary file read and remote code execution in Active Storage. Patched releases are 7.2.3.2, 8.0.5.1 and 8.1.3.1<\/strong>. Their protection requires libvips 8.13 or later and ruby-vips 2.2.1 or later<\/strong>. Updating only one layer does not establish that the application can start. Rails advisory<\/a>, patched Active Storage code<\/a>.<\/p>\n

The advisory applies to applications that use libvips for Active Storage processing and accept image uploads from untrusted users. Generating a variant is not a separate requirement. For affected applications, it also directs changing secret_key_base<\/code> and every secret readable by the application process, without retaining exposed secrets as fallbacks. Keep that response work separate from the compatibility checks below.<\/p>\n

The matrix compares published package versions<\/h2>\n

Sources checked 7 September 2026.<\/strong> This table compares package-page versions with the 8.13 native-library floor. A package page does not guarantee that its download is still available. \u201cAbove\u201d means that version meets this particular minimum. It does not mean a deployed application is patched, correctly configured or unaffected.<\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Platform or explicit image<\/th>\nPackage page version<\/th>\nAgainst 8.13<\/th>\nRuntime check<\/th>\n<\/tr>\n<\/thead>\n
Debian 11 bullseye<\/a><\/td>\nlibvips42 8.10.5-2+deb11u1<\/code><\/a><\/td>\nBelow<\/td>\nbundle exec ruby script\/check_vips_floor.rb<\/code><\/td>\n<\/tr>\n
Debian 12 bookworm<\/a><\/td>\nlibvips42 8.14.1-3+deb12u3<\/code><\/a><\/td>\nAbove<\/td>\nbundle exec ruby script\/check_vips_floor.rb<\/code><\/td>\n<\/tr>\n
Debian 13 trixie<\/a><\/td>\nlibvips42t64 8.16.1-1+deb13u1<\/code><\/a><\/td>\nAbove<\/td>\nbundle exec ruby script\/check_vips_floor.rb<\/code><\/td>\n<\/tr>\n
Ubuntu 22.04 jammy<\/a><\/td>\nlibvips42 8.12.1-1build1<\/code><\/a><\/td>\nBelow<\/td>\nbundle exec ruby script\/check_vips_floor.rb<\/code><\/td>\n<\/tr>\n
Ubuntu 24.04 noble<\/a><\/td>\nlibvips42t64 8.15.1-1.1build4<\/code><\/a><\/td>\nAbove<\/td>\nbundle exec ruby script\/check_vips_floor.rb<\/code><\/td>\n<\/tr>\n
Alpine 3.23 (x86_64, community)<\/a><\/td>\nvips 8.17.3-r1<\/code><\/a><\/td>\nAbove<\/td>\nbundle exec ruby script\/check_vips_floor.rb<\/code><\/td>\n<\/tr>\n
Official ruby:3.4.10-slim-bookworm<\/a><\/td>\nlibvips42 8.14.1-3+deb12u3<\/code><\/a><\/td>\nAbove<\/td>\nbundle exec ruby script\/check_vips_floor.rb<\/code><\/td>\n<\/tr>\n
Official ruby:3.4.10-slim-trixie<\/a><\/td>\nlibvips42t64 8.16.1-1+deb13u1<\/code><\/a><\/td>\nAbove<\/td>\nbundle exec ruby script\/check_vips_floor.rb<\/code><\/td>\n<\/tr>\n
Heroku-22<\/a><\/td>\nlibvips42 8.12.1-1build1<\/code><\/a><\/td>\nBelow in Ubuntu archive; app unknown<\/td>\nbundle exec ruby script\/check_vips_floor.rb<\/code><\/td>\n<\/tr>\n
Heroku-24<\/a><\/td>\nlibvips42t64 8.15.1-1.1build4<\/code><\/a><\/td>\nAbove in Ubuntu archive; app unknown<\/td>\nbundle exec ruby script\/check_vips_floor.rb<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

Run the check in the final container or dyno with its bundle and library search path. A missing vips<\/code> CLI does not establish that the library is absent.<\/p>\n

The official Ruby rows show the base’s listed package, not a preinstalled library. ruby:3.4-slim<\/code> currently maps to trixie; a Ruby minor tag does not fix the operating system. Record an explicit tag and deployed digest. Official Ruby image list<\/a>.<\/p>\n

FastRuby’s 3 August analysis<\/a> covered the bullseye\/bookworm problem. The checks below connect the package, final image and Ruby’s loaded library, including buildpack applications.<\/p>\n

The patch can stop boot before a variant is requested<\/h2>\n

The patched Active Storage code loads ruby-vips and checks whether it exposes Vips.block_untrusted<\/code>. When the binding loads but that method is unavailable, Rails raises a RuntimeError<\/code>. This is a startup failure, not a warning that can be deferred until the next thumbnail request. The three patched branches record the fix in their changelogs. 7.2.3.2<\/a>, 8.0.5.1<\/a>, 8.1.3.1<\/a>.<\/p>\n

An excerpt of the actual diagnostic preserves both prerequisites. The full message is retained with the execution evidence.<\/p>\n

Disabling them requires libvips 8.13 or later and ruby-vips 2.2.1 or later.<\/p><\/blockquote>\n

In Rails 7.2.3.2, 8.0.5.1 and 8.1.3.1, setting the variant processor to MiniMagick does not, by itself, avoid this check while ruby-vips remains available. The check runs when Active Storage loads the binding. First establish whether the application still needs that dependency for analysis, transformation or another library.<\/p>\n

Rails main has since changed where these checks run. PR #58734<\/a> allows a MiniMagick application to boot with an installed but unsupported libvips or ruby-vips; the guard still raises when the Vips transformer loads or the Vips analyzer reads an image. PR #58743<\/a> separately lets an application boot when the native libraries cannot load, without making vips processing available. As checked on 23 September 2026, neither change is in the released versions above or their stable branches. These development changes do not remove the two library prerequisites for Active Storage’s protected libvips processing.<\/p>\n

For libvips at or above 8.13, the advisory documents two ways to enable the protection before processing starts. Set VIPS_BLOCK_UNTRUSTED<\/code> in the process environment before libvips initializes, as described in the libvips 8.13 release notes<\/a>, or use Vips.block_untrusted(true)<\/code> with ruby-vips 2.2.1 or later<\/a>. The patched Rails code makes that call itself. Verify the application\u2019s patch and startup state after applying a mitigation.<\/p>\n

Below 8.13, that capability is unavailable. The advisory’s remaining option is removing the libvips dependency. Moving variant processing to MiniMagick may form part of that change, but it also requires removing ruby-vips where the bundle and application permit it, provisioning ImageMagick, and exercising analysis and transformations. Merely adding an initializer or environment variable cannot supply a missing native-library capability.<\/p>\n

Check the bundle and the loaded library together<\/h2>\n

Start with the two quick inventory checks. Keep both outputs with the final image digest and deployment record.<\/p>\n

vips --version\r\nbundle list\r\n<\/code><\/pre>\n
The executable reports its own libvips version; the bundle reports resolved gems. Neither proves that they describe the same process. The following check asks the Ruby binding for its loaded library version and reports the Active Storage and ruby-vips versions selected by Bundler.<\/p>\n
Save it as script\/check_vips_floor.rb<\/code> and run it under the application’s bundle. It loads Active Storage’s vips initialization without booting a full Rails application, reporting the dependency versions before attempting the component’s guard.<\/p>\n
#!\/usr\/bin\/env ruby\r\n# Compatibility gate for GHSA-xr9x-r78c-5hrm, checked 7 September 2026.\r\n# Run in the deployed application's bundle and image. No upload is processed.\r\nrequire \"rubygems\"\r\nrequire \"open3\"\r\nrequire \"openssl\" # A standalone check has not run Rails' normal boot requires.\r\n\r\nputs \"ruby=#{RUBY_VERSION} platform=#{RUBY_PLATFORM}\"\r\nbegin\r\n  storage = Gem.loaded_specs[\"activestorage\"] || Gem::Specification.find_by_name(\"activestorage\")\r\n  binding = Gem.loaded_specs[\"ruby-vips\"] || Gem::Specification.find_by_name(\"ruby-vips\")\r\n  gem \"activestorage\", storage.version.to_s\r\n  gem \"ruby-vips\", binding.version.to_s\r\n  puts \"activestorage=#{storage.version} ruby-vips=#{binding.version}\"\r\nrescue Gem::LoadError => error\r\n  warn \"MISSING_GEM #{error.message.lines.first.strip}\"\r\n  exit 2\r\nend\r\n\r\nbegin\r\n  require \"nokogiri\" # Match Active Storage's libxml2 load order.\r\n  require \"ruby-vips\"\r\nrescue LoadError => error\r\n  warn \"LIBRARY_LOAD_FAILED #{error.message.lines.first.strip}\"\r\n  exit 2\r\nend\r\n\r\nruntime = Gem::Version.new([Vips.version(0), Vips.version(1), Vips.version(2)].join(\".\"))\r\nputs \"libvips_runtime=#{runtime} block_untrusted_available=#{Vips.respond_to?(:block_untrusted)}\"\r\nbegin\r\n  cli, status = Open3.capture2e(\"vips\", \"--version\")\r\n  puts \"vips_cli=#{cli.strip} status=#{status.exitstatus}\"\r\n  cli_version = cli[\/vips-(\\d+\\.\\d+\\.\\d+)\/, 1]\r\n  mismatch = !status.success? || (cli_version && Gem::Version.new(cli_version) != runtime)\r\nrescue Errno::ENOENT\r\n  puts \"vips_cli=not_installed (runtime library check continues)\"\r\n  mismatch = false\r\nend\r\n\r\nerrors = []\r\nfloor = {\"7.2\" => \"7.2.3.2\", \"8.0\" => \"8.0.5.1\", \"8.1\" => \"8.1.3.1\"}[storage.version.segments.first(2).join(\".\")]\r\nerrors << \"Active Storage series is outside this check's verified patch list\" unless floor\r\nerrors << \"Active Storage is below #{floor}\" if floor && storage.version < Gem::Version.new(floor)\r\nerrors << \"Loaded libvips #{runtime} is below 8.13\" if runtime < Gem::Version.new(\"8.13\")\r\nerrors << \"ruby-vips #{binding.version} is below 2.2.1\" if binding.version < Gem::Version.new(\"2.2.1\")\r\nerrors << \"CLI and loaded library disagree, or the CLI failed\" if mismatch\r\n\r\nbegin\r\n  require \"active_storage\/vips\"\r\n  puts \"active_storage_vips_load=ok\"\r\nrescue LoadError, StandardError => error\r\n  warn \"active_storage_vips_load=#{error.class}: #{error.message.gsub(\/\\s+\/, ' ').strip}\"\r\n  errors << \"Active Storage's vips initialization failed\"\r\nend\r\nerrors << \"The loaded binding does not expose block_untrusted\" unless Vips.respond_to?(:block_untrusted)\r\nif errors.any?\r\n  errors.each { |message| warn \"FAIL #{message}\" }\r\n  exit 1\r\nend\r\nputs \"PASS verified patch floors and Active Storage vips initialization only\"\r\nputs \"This does not verify application configuration, all dependencies, or past exposure.\"\r\n<\/code><\/pre>\n
bundle exec ruby script\/check_vips_floor.rb\r\n<\/code><\/pre>\n
The independent local run used Ruby 3.4.10, Active Storage 8.1.3.1, ruby-vips 2.2.1 and libvips 8.18.5. It exited successfully. A separate control kept that native library but selected ruby-vips 2.2.0; Active Storage raised the diagnostic above. Selecting MiniMagick while retaining that older binding still failed. These controls isolate the binding prerequisite; the native-library comparison follows below.<\/p>\n
A nonzero exit means a failed or incomplete check. A pass does not verify application configuration, initializers or accepted uploads. Boot the application separately and test upload, analysis and variant paths. Applications deliberately using no ruby-vips need a different check.<\/p>\n
Change the runtime stage and test what it contains<\/h2>\n
Installing a newer library in a builder stage does not update a final stage that starts from an older base. Inspect each FROM<\/code>, the copied native dependencies and the image that actually runs the web and worker processes.<\/p>\n
Debian reproduction, applied to the supplied test fixture. The old fixture uses Debian\u2019s signed 1 September snapshot because live security-package downloads returned 404. The diff removes that historical repository setup when moving to bookworm; it is not a deployment instruction to retain an expired repository.<\/p>\n
--- Dockerfile.debian.before\r\n+++ Dockerfile.debian.after\r\n@@ -1,17 +1,4 @@\r\n-# Historical failure fixture only. Keep archive transport and signatures verified.\r\n-FROM debian:bookworm-slim AS archive-certificates\r\n-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \\\r\n-    && rm -rf \/var\/lib\/apt\/lists\/*\r\n-\r\n-FROM debian:bullseye-slim\r\n-COPY --from=archive-certificates \/etc\/ssl\/certs\/ca-certificates.crt \/etc\/ssl\/certs\/ca-certificates.crt\r\n-# Freeze the final LTS repository state for reproduction, not deployment.\r\n-# Only the historical timestamp check is waived; signatures and TLS stay enabled.\r\n-RUN printf '%s\\n' \\\r\n-    'deb [check-valid-until=no signed-by=\/usr\/share\/keyrings\/debian-archive-keyring.gpg] https:\/\/snapshot.debian.org\/archive\/debian\/20260901T000000Z\/ bullseye main' \\\r\n-    'deb [check-valid-until=no signed-by=\/usr\/share\/keyrings\/debian-archive-keyring.gpg] https:\/\/snapshot.debian.org\/archive\/debian-security\/20260901T000000Z\/ bullseye-security main' \\\r\n-    > \/etc\/apt\/sources.list \\\r\n-    && rm -f \/etc\/apt\/sources.list.d\/debian.sources\r\n+FROM debian:bookworm-slim\r\n ARG RUBY_VERSION=3.4.10\r\n ARG RUBY_SHA256=ecee2d072a14f2d14347dd56dfd8fe5c3130abf5117bfaacbda0f4ef9cc429ec\r\n RUN apt-get update && apt-get install -y --no-install-recommends \\\r\n<\/code><\/pre>\n
Ubuntu base change, applied to the supplied test fixture.<\/p>\n
--- Dockerfile.ubuntu.before\r\n+++ Dockerfile.ubuntu.after\r\n@@ -1,4 +1,4 @@\r\n-FROM ubuntu:22.04\r\n+FROM ubuntu:24.04\r\n ARG DEBIAN_FRONTEND=noninteractive\r\n ARG RUBY_VERSION=3.4.10\r\n ARG RUBY_SHA256=ecee2d072a14f2d14347dd56dfd8fe5c3130abf5117bfaacbda0f4ef9cc429ec\r\n<\/code><\/pre>\n
The Linux x86_64 runs used Ruby 3.4.10, Active Storage 8.1.3.1 and ruby-vips 2.2.1 throughout. Both diffs were applied and checked before building.<\/p>\n
\n\n\n\n\n\n\n\n\n
Fixture<\/th>\nLoaded libvips<\/th>\nComponent result<\/th>\nExit<\/th>\n<\/tr>\n<\/thead>\n
Bullseye before<\/td>\n8.10.5<\/td>\nRuntimeError<\/td>\n1<\/td>\n<\/tr>\n
Bookworm after<\/td>\n8.14.1<\/td>\nInitialized<\/td>\n0<\/td>\n<\/tr>\n
Ubuntu 22.04 before<\/td>\n8.12.1<\/td>\nRuntimeError<\/td>\n1<\/td>\n<\/tr>\n
Ubuntu 24.04 after<\/td>\n8.15.1<\/td>\nInitialized<\/td>\n0<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
These are four isolated fixture results, not tests of every deployment or platform in the matrix.<\/p>\n
The downloadable fixtures<\/a> contain the full Dockerfiles, diffs, locked bundle and driver, with no sign-up. They isolate the native-library check. Application images also need Ruby, native gem, database adapter and image-fixture tests. Retain results from the rebuilt final runtime.<\/p>\n
Heroku needs a check inside the application<\/h2>\n
Heroku-22<\/a> uses Ubuntu 22.04 and reaches end of life on 30 April 2027<\/strong>. Jammy’s package is below the floor, but buildpacks can supply another library. Heroku’s package table<\/a> describes the base, not every application dependency.<\/p>\n
The APT buildpack<\/a> extracts packages under .apt<\/code> and changes the library search path. Those packages need not appear in the system database, so check the built application environment.<\/p>\n
Retain the buildpack versions and how libvips entered the build. Heroku-24<\/a> uses Ubuntu 24.04, whose package is above the floor; check the rebuilt application’s loaded library. Track Heroku-22’s end-of-life date separately from this immediate patch check.<\/p>\n
The image pipeline carries several generations of defaults<\/h2>\n
Active Storage shipped with Rails 5.2 in 2018<\/a>, bringing file attachments into Rails. Its original variant implementation<\/a> used MiniMagick directly. An application from that period can still carry transformation options written for ImageMagick even after several framework upgrades.<\/p>\n
Rails 6.0 in 2019<\/a> introduced the ImageProcessing interface and the libvips option. It retained MiniMagick as the default and even had a transitional fallback when image_processing<\/code> was missing. The shared interface made another backend possible; processor-specific transformation options still need review. Check the actual bundle and transformation hashes before changing processors.<\/p>\n
Rails 7.0 changed the default for new applications in 2021 to reduce processing time and resource use. See the upgrade guide<\/a> and load_defaults \"7.0\"<\/code><\/a>. Upgrading a gem does not advance application defaults, and overrides still matter. Read the effective processor from a successfully booted application.<\/p>\n
Marcel was already an Active Storage dependency in 5.2<\/a>. The March 2021 mimemagic licensing incident broke dependency resolution for affected lockfiles<\/a>. The 26 March patches<\/a> moved that existing dependency to Marcel 1.0, packaging Apache Tika-derived MIME data directly. Retain dependency provenance and verify clean bundle installation even when application code is unchanged.<\/p>\n
There is another content-type change to examine now. Marcel 2.0<\/a> was released in August 2026 and requires Ruby 3.3 or later, while the Rails integration in PR #58549<\/a> is merged on main. At this check date, released Rails 8.1.3.1 still requires Marcel ~> 1.0<\/code><\/a>. Do not describe the integration as released Rails behavior or assign it to a future release without checking.<\/p>\n
Marcel 2 can change canonical MIME results for newly identified content without rewriting stored blob types. The Rails PR describes newly identified YAML changing from text\/x-yaml<\/code> to application\/yaml<\/code>. Test exact comparisons and allowlists against both. Upload workflows can depend on MIME identification and image processing, so review them together.<\/p>\n
What to do this week<\/h2>\n
    \n
  1. Record the final image or stack, resolved bundle and loaded libvips version for both web and worker environments. Keep missing information visible.<\/li>\n
  2. Choose a documented path that supplies the native-library and binding prerequisites, or removes the libvips dependency where the application permits it. Verify startup after the change.<\/li>\n
  3. Exercise representative uploads, analysis and existing transformation options. Include content-type comparisons and stored blob metadata in the review before adopting Marcel 2.<\/li>\n
  4. Recheck the dated package rows before deployment. Track framework support and stack end of life separately in the Rails support calendar<\/a>.<\/li>\n<\/ol>\n
    For an application upgrade, the Rails upgrades guide<\/a> puts these native dependencies alongside the changes between framework versions.<\/p>\n
    Sources and execution scope<\/h2>\n
    Sources were checked on 7 September 2026 and are linked beside their claims. AI assisted source comparison, code execution and drafting. The recorded experiments are isolated checks, not results from an Allerin client system.<\/p>\n