Merge pull request #3243 from basecamp/security/filter-storage-url-si…

…gnatures

Filter presigned storage signatures from logs

Merge pull request #3237 from basecamp/webhook-account-scope

Scope webhook dispatch by account as well as board

Merge pull request #3215 from basecamp/write-only-direct-upload-signer

Sign direct uploads with a write-only storage credential

Ruby 4.0.9 (#3234)

Ruby 4.0.8 lacked the Onigmo fix for CVE-2026-110264. Move every Ruby
pin to 4.0.9, re-pin the hotcell accessory to the rebuilt image, and
update `ruby/setup-ruby` to v1.334.0, the first release that lists
4.0.9.

ref: https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/

Merge pull request #3233 from basecamp/oncall/crass-rekey

Re-key cached rich text past crass 1.0.7

story accepted

"easter eggs as a peak human experience"

Merge pull request #3221 from basecamp/escape-account-name-regex

Escape the signup name when matching existing account names

Ruby 4.0.8 (#2173)

* dep: update Ruby to 4.0.8

Bump `prometheus-client-mmap` to 1.7.2, because 1.4.0 has no
precompiled gem for Ruby 4.0. Bump `rubocop` to 1.92.1, because 1.81.7
rejects a 4.0 target. Replace `CGI.parse` in the webhook delivery
tests with `URI.decode_www_form`, because Ruby 4.0 no longer has it.

Co-authored-by: Jeremy Daer <jeremy@37signals.com>

* ci: update ruby/setup-ruby to v1.333.0

v1.327.0 lists no Ruby 4.0.8 build, so every job that installs Ruby
failed with "Unknown version 4.0.8 for ruby on ubuntu-24.04".

* dep: update the hotcell image to Ruby 4.0.8

The cell image stayed on `ruby:3.4-slim` when the app moved to 4.0.8.
Pin it to 4.0.8 the way the other Dockerfiles do, re-pin the accessory
to the rebuilt image, and test that the cell's Ruby matches
`.ruby-version`.

---------

Co-authored-by: Mike Dalessio <mike@37signals.com>

Merge pull request #3219 from basecamp/oncall/canada-permanent-time

Bundle tzinfo-data so B.C., Alberta and Manitoba keep permanent time

Merge pull request #3217 from basecamp/emudhra-ca-certificates

Take the fixed ca-certificates on rebuild, and prove the eMudhra roots are gone