Upgrade image_processing to 2.0.3 with explicit mini_magick backend - #2843
Merged
Conversation
image_processing 2.0 made mini_magick and ruby-vips soft dependencies. Depending on them transitively (as 1.x did) meant the dependabot bump dropped both from the lockfile, which broke boot (ruby-vips) and would break avatar/image uploads (mini_magick). Add mini_magick as a direct dependency for the CarrierWave::MiniMagick uploaders, and pin Active Storage's variant processor to :mini_magick so the vips backend and its native libvips dependency are never loaded. Active Storage variants are unused by this app. ruby-vips is therefore not needed anywhere.
olleolleolle
approved these changes
Sep 3, 2026
olleolleolle
left a comment
olleolleolle
left a comment
Collaborator
There was a problem hiding this comment.
Very clear, thanks!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upgrading image_processing to 2.0.3 breaks this app on its own: 2.0 made the mini_magick and ruby-vips backends soft dependencies, so dependabot's re-resolution (#2840) dropped both from the lockfile, Active Storage's boot path failed without ruby-vips, and the first avatar or image upload would fail without mini_magick. This PR takes the upgrade with the two changes image_processing 2.0's migration requires, scoped so the vips backend and its native libvips system dependency are never needed.
Key changes:
gem "mini_magick"added as a direct dependency —CarrierWave::MiniMagick(avatar_uploader.rb,image_uploader.rb) processes every avatar and event image upload through it. Depending on it transitively is what let the lockfile drop it.config.active_storage.variant_processor = :mini_magickinconfig/application.rb— Active Storage variants are unused by this app, so the transformer keeps the same backend CarrierWave already uses and the vips backend (which needs a native libvips install in CI and production) is never loaded.ruby-vipsis therefore not needed anywhere and stays out of the lockfile.Why this upgrade is worth taking
image_processing 2.0.1-2.0.3 fix several remote-code-execution paths (shell execution through loader/saver options, operation names from user input). The app never calls ImageProcessing directly and uses no Active Storage variants, so the vulnerable surface is not reachable today; the upgrade keeps the gem current and closes those paths if variant processing is ever adopted. Replacing dependabot PR #2840, whose lockfile dropped the backends and failed to boot.