Update changelog

jhawthorn · jhawthorn · commit 1c7d1cf0a1ab · 2026-03-23T11:40:10.000-07:00
diff --git a/actionview/CHANGELOG.md b/actionview/CHANGELOG.md
@@ -6,6 +6,8 @@
 
 *   Skip blank attribute names in tag helpers to avoid generating invalid HTML.
 
+    [CVE-2026-33168]
+
     *Mike Dalessio*
 
 
diff --git a/activestorage/CHANGELOG.md b/activestorage/CHANGELOG.md
@@ -1,10 +1,24 @@
+*   Filter user supplied metadata in DirectUploadController
+
+    [CVE-2026-33173]
+
+    *Jean Boussier*
+
 *   Configurable maxmimum streaming chunk size
 
     Makes sure that byte ranges for blobs don't exceed 100mb by default.
     Content ranges that are too big can result in denial of service.
 
+    [CVE-2026-33174]
+
     *Gannon McGibbon*
 
+*   Limit range requests to a single range
+
+    [CVE-2026-33658]
+
+    *Jean Boussier*
+
 
 *   Prevent path traversal in `DiskService`.
 
@@ -17,6 +31,8 @@
 
     `DiskController` now explicitly rescues `InvalidKeyError` with appropriate HTTP status codes.
 
+    [CVE-2026-33195]
+
     *Mike Dalessio*
 
 *   Prevent glob injection in `DiskService#delete_prefixed`.
@@ -27,6 +43,8 @@
     glob metacharacters. This change presumes that is unintended behavior (as other storage services
     do not respect these metacharacters).
 
+    [CVE-2026-33202]
+
     *Mike Dalessio*
 
 
diff --git a/activesupport/CHANGELOG.md b/activesupport/CHANGELOG.md
@@ -1,3 +1,22 @@
+*   Reject scientific notation in NumberConverter
+
+    [CVE-2026-33176]
+
+    *Jean Boussier*
+
+*   Fix `SafeBuffer#%` to preserve unsafe status
+
+    [CVE-2026-33170]
+
+    *Jean Boussier*
+
+*   Improve performance of NumberToDelimitedConverter
+
+    [CVE-2026-33169]
+
+    *Jean Boussier*
+
+
 ## Rails 8.1.2 (January 08, 2026) ##
 
 *   Make `delegate` and `delegate_missing_to` work in BasicObject subclasses.
