[cmer]

Security update for the development/test lockfile. Rails 8.1.4.1 addresses 21 advisories announced on 2026-11-04:

https://rubyonrails.org/2026/11/4/Rails-8.0.5.2-and-8.1.4.1-have-been-released

The gemspec runtime dependency stays rails >= 7.1. Only Gemfile.lock changed. Lockfile checksums for the Rails component gems match the SHA-256 hashes published with the announcement.

Versions

Rails components, 8.1.3 → 8.1.4.1:

• actioncable 8.1.3 → 8.1.4.1
• actionmailbox 8.1.3 → 8.1.4.1
• actionmailer 8.1.3 → 8.1.4.1
• actionpack 8.1.3 → 8.1.4.1
• actiontext 8.1.3 → 8.1.4.1
• actionview 8.1.3 → 8.1.4.1
• activejob 8.1.3 → 8.1.4.1
• activemodel 8.1.3 → 8.1.4.1
• activerecord 8.1.3 → 8.1.4.1
• activestorage 8.1.3 → 8.1.4.1
• activesupport 8.1.3 → 8.1.4.1
• rails 8.1.3 → 8.1.4.1
• railties 8.1.3 → 8.1.4.1

Required by the new Action View constraint (rails-html-sanitizer ~> 1.6, >= 1.7.2) and the sanitizer's own dependencies:

• rails-html-sanitizer 1.7.1 → 1.7.2
• loofah 2.25.2 → 2.25.3
• nokogiri 1.19.4 → 1.19.7

Tests

• bin/test: assets fresh; 283 runs, 0 failures in both full and API-only host modes
• bundle exec rake test:system: 13 runs, 0 failures
• bundle exec rubocop --parallel: 91 files, no offenses