Bump the api-dependencies-version group in /api with 3 updates

[dependabot]

Bumps the api-dependencies-version group in /api with 3 updates: rails, csv and active_storage_validations.

Updates rails from 8.1.3 to 8.1.3.1

Release notes

Sourced from rails's releases.

8.1.3.1

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• No changes.

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• Disable libvips's unfuzzed image loaders and savers.

  libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Commits

• 3989ebf Preparing for 8.1.3.1 release
• 349e7a5 Disable libvips's unfuzzed image loaders and savers
• See full diff in compare view

Updates csv from 3.3.5 to 3.3.6

Release notes

Sourced from csv's releases.

csv 3.3.6 - 2026-07-27

Improvements

• CSV::Row#to_h: Added support for block.

  • GH-356
  • Patch by Vlad

• Ensured using path_or_io for parameter name that accepts path or IO.

  • GH-358
  • Patch by Yuto Urushima

• Changed to not using enumerator in CSV.

  • GH-361
  • GH-363
  • Reported by Cas Donoghue

Fixes

• Fixed a bug that \r in unquoted fields are rejected when row separator doesn't contain \r

  • GH-60
  • GH-346
  • Patch by Jas

• Fixed a typo in documentation.

  • GH-350
  • Patch by tmr111116

Thanks

• Jas
• tmr111116
• Vlad
• Yuto Urushima
• Cas Donoghue

Changelog

Sourced from csv's changelog.

3.3.6 - 2026-07-27

Improvements

• CSV::Row#to_h: Added support for block.

  • GH-356
  • Patch by Vlad

• Ensured using path_or_io for parameter name that accepts path or IO.

  • GH-358
  • Patch by Yuto Urushima

• Changed to not using enumerator in CSV.

  • GH-361
  • GH-363
  • Reported by Cas Donoghue

Fixes

• Fixed a bug that \r in unquoted fields are rejected when row separator doesn't contain \r

  • GH-60
  • GH-346
  • Patch by Jas

• Fixed a typo in documentation.

  • GH-350
  • Patch by tmr111116

Thanks

• Jas
• tmr111116
• Vlad
• Yuto Urushima
• Cas Donoghue

Commits

• 0873ab3 Add 3.3.6 entry
• c94763a Don't use enumerator in CSV (#363)
• b36c160 Bump actions/checkout from 6 to 7 (#360)
• c773f27 Bump rubygems/configure-rubygems-credentials from 2.0.0 to 2.1.0 (#359)
• 19c7649 Unify first parameter name to path_or_io across methods (#358)
• 79eb55a Bump rubygems/configure-rubygems-credentials from 1.0.0 to 2.0.0 (#357)
• 4a5c504 Support block in CSV::Row#to_h (#356)
• bc69827 Bump actions/checkout from 5 to 6 (#354)
• a2bda1e Link to LICENSE.txt
• 0de1bf0 Bump actions/checkout from 4 to 5 (#351)
• Additional commits viewable in compare view

Updates active_storage_validations from 3.0.5 to 3.0.6

Release notes

Sourced from active_storage_validations's releases.

3.0.6

What's Changed

• Fix processable_file rejecting formats with libvips untrusted loaders (e.g. SVG) after Rails enables Vips.block_untrusted(true) (igorkasyanchuk/active_storage_validations#423). No impact on Rails versions that do not enable this Vips change (before 7.2.3.2 / 8.0.5.1 / 8.1.3.1, unless the app blocks untrusted loaders itself). By @​Mth0158 in igorkasyanchuk/active_storage_validations#424
• Fix validation of multiple new attachables with nil blob ids by @​tmnb in igorkasyanchuk/active_storage_validations#422

New Contributors

• @​tmnb made their first contribution in igorkasyanchuk/active_storage_validations#422

Full Changelog: igorkasyanchuk/active_storage_validations@3.0.5...3.0.6

Changelog

Sourced from active_storage_validations's changelog.

• 3.0.6
  • Fix processable_file rejecting formats with libvips untrusted loaders (e.g. SVG) after Rails enables Vips.block_untrusted(true) (igorkasyanchuk/active_storage_validations#423). No impact on Rails versions that do not enable this Vips change (before 7.2.3.2 / 8.0.5.1 / 8.1.3.1, unless the app blocks untrusted loaders itself).
  • Fix validation of multiple new attachables with nil blob ids (igorkasyanchuk/active_storage_validations#422) @​tmnb

Commits

• a18b93e new version
• e21a32b chore(changes): add fix to next release
• ed2c445 Merge pull request #422 from tmnb/fix-unsaved-blob-deduplication
• fc83b7c Merge pull request #424 from igorkasyanchuk/423-processable_file-rejects-svgs...
• 7368b64 fix(ci): pin sqlite3 below 2.9 for Ruby 3.1
• 133ce8e fix(ci): pin zeitwerk below 2.7 for Ruby 3.1
• 0cc9588 fix(ci): disable AS previewers and pin Ruby 3.1-incompatible gems
• 3d338d7 fix(ci): pin minitest 5 and connection_pool 2 for Ruby 3.1
• 3b09685 chore(deps): regenerate Rails 7.1–8.0 and next gemfile locks
• fa92048 chore(deps): add CI platforms to Rails 7.1 gemfile lock
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions