[dependabot]

Bumps kt-paperclip from 8.0.0 to 8.0.1.

Release notes

Sourced from kt-paperclip's releases.

v8.0.1

What's Changed

• Fix ImageMagick 7 installation in CI by @​ssinghi in kreeti/kt-paperclip#175
• Constrain json to < 3 on Rails versions that pass quirks_mode by @​ssinghi in kreeti/kt-paperclip#176
• Detect spoofed media types from file contents only (#173) by @​ssinghi in kreeti/kt-paperclip#174

Full Changelog: kreeti/kt-paperclip@v8.0.0...v8.0.1

Changelog

Sourced from kt-paperclip's changelog.

8.0.1 (2026-10-12)

• Security: Fix a content type spoof detection regression introduced in 8.0.0 (kreeti/kt-paperclip#173). Paperclip::MediaTypeSpoofDetector now determines the content type from the file contents only. 8.0.0 passed the filename to Marcel as a hint, so content without a magic number of its own -- plain text, for example -- was typed from its extension, and a text file renamed to ".jpg" was accepted as image/jpeg.
• Spoof detection now consults both magic-number detection and the Unix file utility, and accepts a file when either supports the supplied type. This keeps SVG uploads working: an SVG opening with an XML declaration has no magic number of its own.
• Spoof detection no longer rejects a file whose contents cannot be identified at all, which previously produced false positives for text uploads on systems without the file utility.
• :content_type_mappings values are again matched against the type detected from the file contents, as documented in the README. If you adjusted a mapping for 8.0.0, revert it to the content-derived value.
• Paperclip::ContentTypeDetector is unchanged: stored content types still use the filename as a hint, so .csv, .txt and .xlsm uploads keep their specific types.

Commits

• 5eeb990 Detect spoofed media types from file contents only (#173) (#174)
• 4e5755d Constrain json to < 3 on Rails versions that pass quirks_mode (#176)
• 56b05a4 Fix ImageMagick 7 installation in CI (#175)
• 75c9495 Update Ruby and Rails version requirements in README
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)