v0.7.0

v0.7.0 / 2026-06-08

Security

• Fixed this gem's override of ActiveStorage::Service::DiskService#path_for to match the upstream Rails 8.1.2.1 behavior preventing path traversal. See GHSA-pmwx-rm49-xv39 for more information. @flavorjones

Dependencies

• Bumped the minimum Rails version requirement to >= 8.1.2.1 to simplify the DiskService#path_for fix. @flavorjones

Added

• Add callbacks for :with_tenant which are invoked when .with_tenant is called. @flavorjones
• Add callbacks for :set_current_tenant which are invoked when .current_tenant= is called. @flavorjones

Fixed

• .current_tenant = nil now clears the tenant context, properly setting the shard to UNTENANTED_SENTINEL instead of "" @flavorjones
• Tenanted::DiskService#path_for now handles keys without a tenant prefix (e.g., from ActiveStorage::FixtureSet.blob) by falling back to standard DiskService behavior. @flavorjones

Developer infrastructure

• Hardened Github Actions workflows. @flavorjones
• Added matrix testing against Rails 8.1 and Rails edge. @flavorjones