Update dependency rails to v8.1.3.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
rails (source, changelog)	8.1.3 → 8.1.3.1

---

Release Notes

rails/rails (rails)

v8.1.3.1: 8.1.3.1

Compare Source

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• No changes.

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• Disable libvips's unfuzzed image loaders and savers.

  libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only
  safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them
  while booting. An application that needs a specific loader or saver may re-enable it in an
  initializer.

  This is a breaking change for applications that process image types with an unfuzzed loader or
  saver. Variant transformation of BMP, ICO, and PSD attachments will raise Vips::Error, and
  analysis of these and other types such as SVG, JPEG XL, JPEG 2000, and Netpbm will no longer
  record width and height. Requesting an unfuzzed output format, typically FITS, JXL, or
  anything delegated to ImageMagick, will also raise Vips::Error. Attaching, storing, and
  downloading are unchanged.

  An application seeing Vips::Error raised during image transformation may wish to remove the
  affected content types from config.active_storage.variable_content_types in an initializer.
  Active Storage will then treat those attachments as not variable and will not generate variants
  for them. This most often matters to an application that transforms images during a request
  rather than in a background job, where the failure surfaces as an error response instead of a
  failed job.

  Rails.application.config.active_storage.variable_content_types -=
    %w[ image/bmp image/vnd.microsoft.icon image/vnd.adobe.photoshop ]

  Applications using the :mini_magick variant processor will see no change in how their
  attachments are processed, but the loaders and savers will be disabled process-wide whenever
  ruby-vips is installed, and the version requirements below will still apply. Such an application
  may remove ruby-vips from its Gemfile to avoid both.

  The minimum supported version of libvips is now 8.13, and the minimum supported version of
  ruby-vips is now 2.2.1. These are the earliest versions that are capable of disabling untrusted
  operations. When ruby-vips is installed and either minimum is not met, Active Storage will raise
  a RuntimeError while booting rather than run in an unsecurable environment.

  [GHSA-xr9x-r78c-5hrm]
  [CVE-2026-66066]

  Mike Dalessio

Action Mailbox

• No changes.

Action Text

• No changes.

Railties

• No changes.

Guides

• No changes.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coveralls]

coverage: 98.25%. remained the same — renovate/ruby-on-rails-packages into main