Download Latest Version v5.0.2 source code.zip (894.8 kB) Google Add to Preferred Sources
Home / v4.4.3
Name Modified Size InfoDownloads / Week
Parent folder
README.md 2026-09-22 407 Bytes
v4.4.3 source code.tar.gz 2026-09-22 817.8 kB
v4.4.3 source code.zip 2026-09-22 876.1 kB
Totals: 3 Items   1.7 MB 0

Security release.

Fixes a denial of service: a crafted search key (a very long q[...] condition key or q[s] sort value) was parsed in quadratic time, letting an unauthenticated request exhaust CPU. Ransack now rejects an over-long key as invalid. Applies to any endpoint calling ransack; not mitigated by attribute allowlisting.

GHSA-j3f8-w227-4hh8. Also released as 5.0.2 (and fixed in 6.0.0).

Source: README.md, updated 2026-09-22