---
title: Shrine 3.8.0
---

## Security

* The `file_system` storage now prevents path traversal outside of the storage
  directory. Previously, an id containing `../` sequences (e.g. coming from
  attacker-controlled data) could resolve to a location outside of the
  configured storage directory. Now `Shrine::Error` is raised whenever an id
  would resolve outside of the storage directory:

  ```rb
  storage = Shrine::Storage::FileSystem.new("uploads")
  storage.open("../../etc/passwd") #~> Shrine::Error
  ```

## New features

* The `derivatives` plugin now forwards options passed to `Attacher#promote`
  into `Attacher#upload_derivatives`. This means options such as upload options
  reach the derivatives upload as well, not just the main file.

  ```rb
  attacher.promote(upload_options: { acl: "public-read" })
  # the same options are now forwarded when uploading derivatives
  ```

## Other improvements

* The `s3` storage again uses single-request uploads for smaller files, instead
  of always using multipart uploads. In Shrine 3.7.0, when a `TransferManager`
  was available, it was used for uploads of any size, but `TransferManager`
  uploads via multipart unconditionally, which is inefficient for smaller files.
  Now files at or below the multipart threshold (`:upload`, 15MB by default) are
  uploaded in a single request, and only larger files use multipart upload via
  the `TransferManager` (falling back to the older API when it's not available).
