Upgrade Rails to fix security issues

[zetter-rpf]

This is to patch [CVE-2026-66066] in activestorage

[Copilot]

Pull request overview

Updates the application’s Rails dependency to a patched 8.1.x release in order to address the Active Storage security issue referenced in the PR description (CVE-2026-66066).

Changes:

• Bump the Rails gem requirement from ~> 8.1.3 to ~> 8.1.3.1.
• Update Gemfile.lock so all Rails framework components (including activestorage) resolve to 8.1.3.1.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
Gemfile	Updates the Rails version constraint to ~> 8.1.3.1.
Gemfile.lock	Locks Rails and related framework gems (incl. Active Storage) to 8.1.3.1.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Test coverage

92.18% line coverage reported by SimpleCov.
Run: https://github.com/RaspberryPiFoundation/editor-api/actions/runs/30524070845

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ab10583. Configure here.}

[cursor]

Possible Heroku boot failure risk

High Severity

Rails 8.1.3.1 makes Active Storage raise a RuntimeError at boot when ruby-vips is present and system libvips is older than 8.13. This app declares ruby-vips and runs on Heroku; heroku-22 still ships libvips 8.12.x, so a deploy on that stack can fail to start after this upgrade.

Additional Locations (1)

• Gemfile.lock#L68-L73

 

^{Reviewed by Cursor Bugbot for commit ab10583. Configure here.}

[zetter-rpf]

I have run Vips.version_string on production and got "8.15.1" back