8.0.5.2

Active Support ActiveSupport::Inflector#safe_constantize matches the constant name in a LoadError message as a literal string instead of building a Regexp from it. The name's segments were interpolated unescaped into the pattern, so input that reaches safe_constantize , such as the channel identifier in an Action Cable subscribe command, chose the source passed to the regexp compiler. [GHSA-8474-xrp6-wh69] Jeremy Daer Active Model No changes. Active Record No changes. Action View Skip attribu...