Ruby Weekly

Bringing Rails into the Ractor age

Thu, 27 Aug 2026 00:00:00 +0000

#814 — August 27, 2026

🗓️ In case you were wondering where we were last week, we took a brief summer vacation. Luckily, it's been a busy couple of weeks in the Ruby world!
__
Your editor, Peter Cooper

Ruby Weekly

Bringing Rails Into the Ractor-Age — "Ractors are now viable in production, and Ruby 4.1 will make them even better," says Edouard, who looks at what Ractors can unlock for Rails apps (nearly 7x memory savings vs Puma on a real-world app) and the steps being taken to get it all working in the near future.

Edouard Chin

😎 Over on Reddit, Charles Oliver Nutter noted "Of course you can do fully parallel shared memory concurrency in Rails today just by running on JRuby."

One Ruby Gem Replaced Their Entire Monitoring Stack — Now it's one gem. AppSignal tracks errors, N+1 queries, slow SQL, Sidekiq jobs, and host metrics for Rails — every feature on every plan, no add-on tiers. Real engineers answer support, not a ticket queue. 30-day free trial, no credit card.

AppSignal sponsor

A Ruby 4.0 Universal RCE Deserialization Gadget Chain — A new universal chain (found by elttam, a security research firm) that turns one Marshal.load call into an RCE on Ruby 4.0.6. Some fun technical details here, and a strong reminder to avoid using Marshal.load on untrusted input.

Luke Jahnke

⚡️ IN BRIEF:

You need to upgrade the resolv gem as two vulnerabilities have just been discovered – though only if you call Resolv directly or load resolv-replace; the OS resolver behind Net::HTTP isn't affected.
RubyGems and Bundler 4.0.19 now conclude install, update, and lock with a summary of which versions cooldown held back.
📺 Talks from May's Balkan Ruby 2026 event are now on YouTube. If forced to pick just one, Jean Boussier's ▶️ "Multiprocessing is the most efficient way to serve Rails apps" is particularly informative.
Rails has merged support for the HTTP QUERY method. Idempotent like GET, but the query goes in the body.
Sam Ruby's latest "get real apps running on Spinel" efforts have progressed to 37signals' Campfire chat app.

Thinking About Tests: Assertions and Matchers — Starting from first principles, a look down to the level of single assertions, what a 'matcher' is, and why lucid, composable tests matter now more than ever.

Victor Shepelev

Rails Adopts Herb as an Alternative ERB Implementation — Herb parses HTML and ERB into one syntax tree, so it understands your markup at compile time and can catch invalid Ruby or HTML output. Now merged into Action View as an Erubi alternative, though it's opt-in for now.

Marco Roth et al.

🤖 Agents on Rails: The First Benchmark Report — The Rails Foundation ran a benchmark of various AI models across 21 tasks on the Writebook app (fixing bugs, working on security issues, etc.) Find out which models 'know' Rails best.

The Rails Foundation

💡 In a follow up, the team shares lemans, the Ruby-powered harness used in the evals above. It's open source so you can now use it too.

🚨 Rails 7.2 Hit EOL Aug 9. Ready for Your SOC 2 Audit? — We map Rails, Ruby, and runtime EOL across your stack and hand your auditors evidence, not assurances.

FastRuby.io® | Infrastructure Assessment sponsor

📄 From Slow Tests to Slow Production: Debugging with Stackprof – Going from a curiously slow Rails test to the one-line root cause. Jeremy Stuckey

📄 A Fresh Look at Hanami – Love Ruby, but looking to expand beyond Rails? Some notes on doing just that. Aaron Sumner

📄 What Replacing React with Hotwire Really Costs Henrique Medeiros

🛠 Code & Tools

sghtmltopdf: HTML to PDF Without a Browser Engine — Billing itself as "the second generation of wkhtmltopdf and wicked_pdf", this is an HTML-to-PDF renderer that doesn't depend on a browser process. Built for invoices and reports, not arbitrary pages, and it'll repeat table headers across page breaks.

yo_waka

Blog Post: Your Vibe-Coded Monitoring Tool Now Needs Its Own Monitoring — 45% of AI-generated code ships an OWASP Top 10 bug. So who monitors the monitor?

AppSignal sponsor

A Guide to Using Batches in Solid Queue 1.7 — Batches have been an often-requested feature in Rails' default queue system and have finally landed. Its implementer explains here how batches behave, including callbacks, nesting, and patterns worth using.

JP Camara

Kino 0.4: A High-Perf Ractor Web Server for Ruby 4.0+ — A Ractor-based web server that uses every core in one process instead of forking. This week's release adds a Rack handler, so rails server -u kino boots (though Rails isn't Ractor-shareable yet, so it runs in a fallback mode).

Yaroslav Markin

RuboCop 1.90.0 – The code analyzer/formatter adds a long-awaited disable-next directive, a --display-suppressed option that reveals what your directive comments are hiding, and more.
RBS 4.2 – Ruby's type signature language now supports non-ASCII characters in identifiers and drops Ruby 3.2 support.
ActiveRecord-Import 2.3 – Library for efficient bulk insertion of data using Active Record.
ValidEmail2 7.1 – Validates email addresses and the domains they use.
Ferrum 0.18.0 – High-level API for controlling Chrome from Ruby.
Comma 5.0 – DSL-based CSV generator for Ruby objects.
rubyzip 3.5 – Library for reading and writing ZIP files.

📰 Classifieds

💎 Shipping Ruby code with AI agents? Undercover CI catches untested methods in your PRs before you merge. Coverage percentages won't.

🚢 Shipped a fix? Ask Claude or Cursor what AppSignal sees in the latest deploy — error rates, latency, traces, without leaving your editor.

🗓 Upcoming Ruby Events

🇺🇸 Rails Camp West (Sep 7-11 in Oregon) — A four night retreat/unconference in the wilderness.
🇨🇿 EuRuKo 2026 (Sep 17-18 in Brno, Czechia) — Europe's longest-running Ruby conference. Matz and Koichi Sasada to keynote!
🇺🇸 Rails World 2026 (Sep 23-24 in Austin, TX) — The Rails Foundation's flagship event. Here's the speaker lineup.
🇺🇸 Rocky Mountain Ruby 2026 (Sep 28-29 in Boulder, CO) — A well-regarded regional US Ruby conference.
🇫🇮 Tiny Ruby Conf (Oct 1 in Helsinki)
🇨🇦 XO Ruby (Oct 3 in Toronto)
🇯🇵 Kaigi on Rails 2026 (Oct 16-17 in Tokyo / Online) — Rails-focused conference with DHH keynoting.
🇺🇸 SF Ruby Startup Conference 2026 (Nov 10-12 in San Francisco) — The Evil Martians have written a post about why you should go.

ℹ️ Note: This list is not exhaustive, but we'll continue to mention and promote various events here from time to time.

A new attempt to fork Rails

Thu, 13 Aug 2026 00:00:00 +0000

#813 — August 13, 2026

Read on the Web

🗓️ A scheduling note: We're taking a summer break next week, so we'll be back on August 27. Catch you then!
__
Your editor, Peter Cooper

Ruby Weekly

Ruby 2D 1.0: SDL3, WebAssembly, and a Comeback Story — After three years dormant, Tom Black's "Square.new-and-it-appears" graphics gem gets a rewrite with SDL3-powered GPU rendering and the ability to compile experiences to WebAssembly (live examples). Learn how to use its DSL here or read Tom's story of resurrecting the project.

Tom Black

😅 I tested it out by making a little Mario Paint-inspired paint app (above) and I learnt I can't draw the Ruby logo at all!

🚨 We Audited 137 Rails Apps. 98% Had a Critical KEV — Rails 7.2 went EOL this week, so it's a good time to look at what’s running in production. We map your images, runtimes, and K8s workloads against CISA's KEV catalog and write the verdicts up as VEX.

FastRuby.io® | Infrastructure Assessments sponsor

json 3.0.0 RC1 Released for Testing — A big, intentionally breaking release of Ruby's default JSON gem that Jean wants you to test before its release next month. create_additions is gone, so JSON.load and JSON.dump are safe by default, but beware that unknown options now raise instead of being ignored.

Jean Boussier

💡 Jean has also just dropped Speeding Up (small) Ruby Hashes.

⚡️ IN BRIEF:

👀 Lucas Dohmen has announced Amiko, a community-run fork of Rails 8, arguing Rails' core has changed little since 6.0 and that DHH's view of the world is incompatible with his own. Ryan Bigg is unconvinced by the idea and thinks Hanami is the way forward.
Matz has proposed letting String#tr accept character replacement options in a hash style.
As of August 9, Rails 7.2 no longer (officially) gets security support, and Rails 8.0 reaches a similar end on November 7. More details here.
🇨🇿 Euruko 2026 is taking place next month (September 17-18) in Brno, Czechia, with speakers including Matz, Koichi Sasada, Hitoshi Hasumi (the creator of PicoRuby), Charles Oliver Nutter, and Benoît Daloze.
🇺🇸 Matz is keeping busy next month as he's also going to be at Rails World 2026 doing a fireside chat with DHH. The event's full agenda is now up too.

🔒 A Guide to Security for Gem Authors and Users — RubyGems' guide to protecting your account, hardening your gems, and reporting vulnerabilities has been updated for 2026 to cover MFA, Trusted Publishing, lockfile checksums, and cooldowns.

RubyGems Guides

Ruby and Rails Performance Roundup: The Backlog Edition — A followup to Maciej's recent look at PRs which sped up Ruby, this time tackling 40 more Ruby and Rails perf-related PRs, complete with the numbers.

Maciej Mensfeld

Blog Post: Now Watching Your Cron and Sidekiq Jobs: AppSignal Launch Week Recap — Process monitoring for Sidekiq & cron, hosted MCP, a new CLI, sharper log queries, and dark mode.

AppSignal sponsor

Fair by Design: Orchestrating Background Jobs in Ruby — What to do when one tenant's giant job batch starves everyone else's queue. Compares four strategies and why no Ruby job processor handles it out of the box.

Alexander Baygeldin (Evil Martians)

🤖 One Week of Building and Reviewing Code with LLM Agents – Hard numbers from a week of agent-driven Rails work showing that diversity of checks and tests beats throwing more agents at a problem. Lucian Ghinda

📄 How to Use Playwright in Ruby for Scraping and Testing Jakub Zielinski (ScrapingBee)

📄 What Active Record Transactions Actually Protect Syed Aslam

🛠 Code & Tools

DragonRuby Releases a 'Free to All' Jam License — DragonRuby is a Ruby-powered 2D engine built on mruby and SDL. It's a commercial product, but there's now a free option for building games to distribute on the Web (even commercially). Desktop, Steam and mobile use remain paid.

DragonRuby Team

Solid Objects: Cloudflare Durable Objects for Rails — Durable, addressable actors (a la Cloudflare's Durable Objects) for Rails backed by your existing database, with a reactive ERB helper that live-updates every browser without writing channels, Stimulus or JavaScript.

Lucas Carlson

AI Shouldn't Cost More Than It Saves — We can find where LLMs pay off, validate with real data, and tune for cost/effectiveness. Need help? Let's talk.

SINAPTIA sponsor

RubyLLM::Schema is Now Schematist: A JSON Schema DSL for Ruby — A general purpose JSON Schema DSL, spun out of RubyLLM and now covering the full Draft 2020-12 vocabulary. Values can be procs resolved at render time, and to_json_schema finally returns a real schema document.

Carmine Paolino

Dentaku 4.0: Math and Logic Formula Parser and Evaluator — Allows run-time binding of values to variables referenced in user supplied formulas. Intended to safely evaluate untrusted expressions.

Solomon White

Haml 7.3 – The templating engine that simplifies writing HTML by using indentation and elegant syntax now replaces Ripper with Prism.
Reline 0.7 – Official pure-Ruby library with the same API as readline.
Delayed 4.0 – Multi-threaded, SQL-driven Active Job backend.
✉️ Ahoy Email 4.0 – First-party email analytics for Rails apps.
Brakeman 8.0.6 – Vulnerability scanner for Rails apps.

📰 Classifieds

Analytics on your Rails data without a second database? TimescaleDB extends the Postgres you run.

💎 Is your Rails app fine? Probably. AppSignal tells you for sure — errors, N+1s, Sidekiq jobs, host metrics, one gem.

We'll be back in two weeks on August 27 – see you then! Unless you're a Go Weekly or React Status subscriber too, then we'll see you tomorrow ;-)

RuboCop goes project-wide with Rubydex

Thu, 6 Aug 2026 00:00:00 +0000

#812 — August 6, 2026

Read on the Web

Ruby Weekly

Shrinking Ruby Hashes — Hash uses 2-4x the memory of a Struct holding the same data. Ruby committer Jean Boussier digs into why, looking at the layout changes from Ruby 2.3 to now, and shows off the patches that could shrink small hashes in Ruby 4.1.

Jean Boussier

Make Your Next Rails Crash Make Sense — Errors, N+1 queries, slow SQL, Sidekiq jobs, and host metrics in one Ruby gem. Every feature on every plan, predictable pricing, and real engineers on support. 30-day free trial, no credit card, two-minute install.

AppSignal sponsor

▶ Tenderlove on Ractors, JIT Compilers, and Installing Gems Faster — If you're an Aaron Patterson fan, there's much to enjoy in this 80-minute chat, covering his pre-Ruby background, Ractors, opinions on databases, making gems faster to install, and why he still can't trust AI code like a teammate's.

Robby Russell and Aaron Patterson

⚡️ IN BRIEF:

Hiroshi Shibata discovered that lazy loading Ruby's error extension gems speeds up boot time. Matz accepted the proposal, saying: "A 3.8x boot time improvement with no regression on the error path is a clear win."
mise, a popular dev tool installer/manager I'm somewhat in love with, has a new release out that makes precompiled Ruby binaries the default.
If you thought the Ruby Central dispute wound down after Bundler and RubyGems were passed to Ruby core's stewardship last year, André Arko says otherwise in his latest account of where things stand.
Jean Boussier proposes letting CGI.escapeHTML accept a custom escape table.

Making RubyGems Guides Friendly to Humans and AI — Append .md to any of the guides' URLs for raw Markdown, or point an agent at llms.txt for an index of them all. The guides have had a broader overhaul too, with a new Concepts section and Cmd+K search.

Hiroshi Shibata

Rails 7.2 Security Support Ends Aug 9. Need to Upgrade Fast? — “FastRuby.io successfully upgraded our application to Rails 8.1 and Ruby 3.4 on time and on budget.”

FastRuby.io® | Rails Upgrade Services sponsor

🤖 Tell the Agent to Write Its Scripts in Ruby – Scripts have always been a sweet spot for Ruby, so why not have your agents use it, too? Lucian Ghinda

📄 Running Code When the Rails Web Server Boots – That is, only under Puma, say, and not in rake tasks or the console. Ben Sheldon

📄 How to Install Any Ruby Version in Seconds Using rv Javier Cervantes

📄 Running a Ruby MCP Server in Production Amanda Bizzinotto

🛠 Code & Tools

Rubydex-Powered Project-Wide Analysis with RuboCop 1.89 — RuboCop has traditionally analyzed one file at a time, but its expanded, opt-in Rubydex support gives it a project-wide index, so cops can catch things like duplicate methods across files and typos in constant and method names.

Bozhidar Batsov

💡 Lovro Bikić also digs into how RuboCop 1.89.0 now loads cops lazily rather than requiring all 600+ at startup, for a 10-25% startup speedup.

redis-rb 6.0: The Official Ruby Client for Redis — Now speaks Redis' latest wire protocol RESP3 by default, adds first-class support for the Redis Query Engine and the JSON module, new Redis 6.2-8.10 commands, and more. Note that Ruby 3.2+ is now required.

Redis Ltd

🤖 Ask Your AI Editor What Broke — AppSignal's MCP server feeds live Rails errors, traces & metrics into Claude, Cursor & Copilot.

AppSignal sponsor

Humid 1.0: React Server-Side Rendering in Rails without Node.js — React on Rails was too heavy, and a Node sidecar didn't appeal… so Johny built a solution using mini_racer's embedded V8 to render React with no Node process to manage at runtime.

Johny Ho (Thoughtbot)

📊 Flightdeck: A Featureful Dashboard for Solid Queue — A more visual, dashboard-like alternative to Mission Control, with throughput charts, failure grouping, bulk retry, and queue pause/resume. Drops in with no migrations or asset configuration.

Carl Mercier

Karafka 2.6 – Powerful multi-threaded, efficient Kafka processing framework.
RubyGems and Bundler 4.0.18 – Cooldowns have now been extended to bundle lock and bundle cache.
The Git Gem 5.0 – The git wrapper designed for use from Ruby has breaking changes to be aware of.
Closure Tree 9.8 – Easily make your Active Record models support hierarchies.
Active Storage Validations 4.0 – Add validations to Active Storage attributes. Now requires Rails 7.0.1+ and Ruby 3.3+.
Rouge 5.1 – Pure Ruby Pygments-compatible syntax highlighter.
Statesman 13.3 – Opinionated state machine library.

📰 Classifieds

💎 Shipping Ruby code with AI agents? Undercover CI catches untested methods in your PRs before you merge. Coverage percentages won't.

📢 Elsewhere in the ecosystem

Joe Masilotti's Ruby Native, a way to deploy Rails apps to mobile app stores without touching Swift or Xcode, now supports Android in addition to iOS.
🇯🇵 PicoRubyKaigi is an event taking place in Tokyo this October, focused on the PicoRuby Ruby implementation for one-chip microcontrollers.
🇯🇵 In other Ruby event news, tickets for Kaigi on Rails 2026, also taking place in October, are now available.
📺 SQLite's Richard Hipp gave ▶️ a detailed 50-minute talk on SQLite's reliability and the tools, practices, and design choices that have given it its strong reputation.
Ryan Lopopolo explains why he wound down his Artichoke Ruby project – Artichoke was an attempt at building a Ruby implementation in Rust.

You need to upgrade Rails 7.x and 8.x now

Thu, 30 Jul 2026 00:00:00 +0000

#811 — July 30, 2026

Read on the Web

Ruby Weekly

A Critical Active Storage Vulnerability in Rails — A specially crafted 'image' uploaded to Rails 7.x or 8.x apps in their default configuration can potentially expose arbitrary files on the server via Active Storage's vips processor. Patched in Rails 7.2.3.2, 8.0.5.1 and 8.1.3.1. You may also need to upgrade libvips. Rails 6.x isn't affected by default.

Rafael França and Rails Core

💡 The team that discovered the vulnerability has dubbed it KindaRails2Shell and explains more about it. Also note, if you're using Bundler's new cooldown protection, bundle update rails --cooldown 0 may be needed.

Rails Experts You Like & Trust, Now Embedded in Your Team 🚀 — Since 2017, companies have trusted FastRuby.io with their most complex Rails upgrades. Now those same senior engineers can scale your team fast: shipping features, fixing bugs, accelerating delivery, and using AI effectively. Let's talk!

FastRuby.io® | Staff Augmentation sponsor

The Inliner is Yielding Benefits for ZJIT — ZJIT, the experimental just-in-time compiler written in Rust, has added inlining capabilities. This post shows how method inlining speeds up block-heavy code such as Array#each. Early microbenchmarks are striking, with up to 35x speed gains in one case.

Max Bernstein

⚡️ IN BRIEF:

🔎 Go to the official ruby-lang.org site and hit Cmd/Ctrl+K – it has search!
🏆 Nominations have opened for this year's Rails Luminary Awards. Last year's winner was Marco Roth of Herb fame.
🇪🇺 The sale of early bird tickets for Euruko, taking place this September in Czechia, ends this Saturday.
🎂 Rails is celebrating the 22nd anniversary of its first public release: v0.5.0 on July 24, 2004.

Finding 105 Vulnerabilities in the Ruby Ecosystem — An app security firm turned its scanner on gems with native C extensions. A Nokogiri out-of-bounds read of 17 years' vintage is a particular highlight.

Yu, Thakur, Wu, and Lin (Depthfirst)

Golfing Ruby with Codex: From 250 Bytes to 90 — I tell the tale of pushing GPT-5.6 Sol to make a Roman numeral generator smaller, ending at 90 bytes. Along the way, many Ruby features popped out: character literals, endless methods, a 1.% exception trick, and a (not so) novel algorithm from 1976.

Peter Cooper

Why Your Sidekiq Jobs Are Slower Than You Think (And How to Fix It) — N+1s hide inside your jobs. AppSignal ranks your slowest Sidekiq jobs and queries so you fix the right one. (Blog post.)

AppSignal sponsor

Curiosity Reduced the Heap Size by 60% — Agents are often good at diagnosing warnings and errors, but in this case an agent's attempts to ignore a warning led Paweł to a striking memory use saving.

Paweł Pacana

📄 Spec-tacular: Ways to Think About Writing Expressive RSpec Simon Fish (FreeAgent)

📄 Rake Beyond Rails: A Build Tool You Know – A reminder of Rake's versatility. Francois Buys

📄 Overriding Rails' Default Validation Error Message Format Tekin Süleyman

🛠 Code & Tools

RubyLens: Turn Your Ruby Project into a Galaxy Visualization — A gem that turns a Ruby codebase into a galaxy, in either HTML or video form, built on top of Rubydex which performs the analysis. The site contains a few pre-built examples to enjoy. GitHub repo.

Stan Lo

4 Ways to Steer Your Agents Towards Better Tests — Agents quit when the happy path is green. Undercover keeps them honest with local tools and CI checks for your team.

Undercover CI sponsor

Courrier 1.0: A Gem to Send Emails Without SMTP — Brings the ability to send email through 13 providers and 7 newsletter platforms into a single library. There's also a Rails integration which brings generators and Active Job support.

Rails Designer

🤖 Automating Ruby Tech Debt Audits with Claude Code — Introduces a Claude Code skill (which you can read here) that strings together a variety of tools to produce a scored, one-shot quality report for Ruby projects.

Ernesto Tagwerker

Solid Queue 1.5 – DB-based queuing backend for Active Job. Lots of bugfixes, polling interval now defaults to 1 second, and there's a new bin/jobs check command to validate your config.
RBS 4.1 – The official language for writing type signatures for Ruby now supports JRuby and adds a Rewriter API.
🖼️ RMagick 7.1 – The long-standing ImageMagick bindings get bug fixes, plus big changes to how text strings drawn by Draw#annotate are handled.
SimpleCov 1.0.3 – Code coverage tool. If you missed the big 1.0 release, check it out as the new report UI is great.
telegram-bot-ruby 2.8 – Ruby wrapper for Telegram Bot API 10.x.
MCP Ruby SDK 1.0 – Official Ruby SDK for the Model Context Protocol.
Gibbon 4.0 – MailChimp Marketing API wrapper for Ruby.