--- title: "#364: Multiple Vulnerabilities in RubyGems" publication: "Ruby Weekly" issue: 364 published_at: "2017-08-31" canonical_url: "https://rubyweekly.com/issues/364" --- #364: Multiple Vulnerabilities in RubyGems This week's Ruby and Rails news[Read this e-mail on the Web](http://rubyweekly.com/issues/364) Ruby WeeklyIssue 364 — August 31, 2017 Brandur Leach[The Limits of Copy-on-Write: How Ruby Allocates Memory](https://brandur.org/ruby-memory)How heap and object allocation work in Ruby, often leading to bloated sub-processes, and what’s on the roadmap to help. ruby-lang.org[Multiple Vulnerabilities in RubyGems, Upgrade Now](https://www.ruby-lang.org/en/news/2017/08/29/multiple-vulnerabilities-in-rubygems/)It’s time to run `gem update --system` and get up to [RubyGems 2.6.13](http://blog.rubygems.org/2017/08/27/2.6.13-released.html) as there’s a DoS vulnerability, a DNS request vulnerability, and others. Alex Wood[Amazon Unveils A More Modular AWS SDK for Ruby with Version 3](https://aws.amazon.com/blogs/developer/announcing-the-modularized-aws-sdk-for-ruby-version-3/)The stable version 3 of the AWS SDK for Ruby is now out with a new modular approach. I’ve found loading the AWS SDK a bit quirky in the past so this should help a lot. OpsCare by reinteractiveSponsored[We’ve solved the problems of traditional Ops](https://reinteractive.com/enquiries/new?code=ops_care&sid=133)Our out-source DevOps solves the problems associated with ROR development. Plus our blue/green pre-baked deployment process means that you can deploy your app as often as you want. Get started today – start enjoying OpsCare®. [![OpsCare by reinteractive\](https://copm.s3.amazonaws.com/c38bca9b.png)](https://reinteractive.com/enquiries/new?code=ops_care&sid=133) Evil Martians[Gem Check: A Checklist for Gem Authors](http://gemcheck.evilmartians.io/)A comprehensive checklist that will make your gem more maintainable and you a better open source citizen. Riding Rails[Webpacker 3.0: Now Even Easier to Use Webpack with Rails](http://weblog.rubyonrails.org/2017/8/30/webpacker-3-0/)The result of a large refactoring, webpacker 3.0 moves all the config out of Rails and over to the npm module. Anderson Dias[Writing Slack Command APIs in Ruby](https://medium.com/little-programming-joys/writing-slack-command-apis-in-ruby-7d98588c1c31)A four-part series on creating a Slack command using Sinatra and Heroku. Jobs - [Senior Full-Stack Developer at Razeware (Remote)](https://authenticjobs.com/jobs/29672/senior-fullstack-developer?utm_source=rubyweekly&utm_medium=email)We're seeking an engineer to help overhaul [raywenderlich.com.](http://raywenderlich.com/) Join our team and help bring the site to the next level. Razeware LLC - [Remote Ruby on Rails Developer at Silverfin](https://www.getsilverfin.com/ruby-developer?utm_source=rubyweekly&utm_medium=email)You're looking for hands on RoR work where you have impact, in a tight knit remote team? Come build @getsilverfin with us. Silverfin In brief - [The Structure and Interpretation of Ruby Programs](https://www.nasseri.io/posts/1.html?utm_source=rubyweekly&utm_medium=email) tutorial An explanation covering the tokenization, parsing, and compilation of Ruby programs. Dean Nasseri - [Integrating a Third Party API with Rails 5](https://revs.runtime-revolution.com/integrating-a-third-party-api-with-rails-5-134f960ddbba?utm_source=rubyweekly&utm_medium=email) tutorial Includes requests with Faraday and caching. Runtime Revolution - [Integrating Elm with Rails](https://blog.redpanthers.co/integrating-elm-rails/?utm_source=rubyweekly&utm_medium=email) tutorial [Elm](http://elm-lang.org/) is a function language that compiles to JavaScript. Nimmy Vipin - [Keep Your Specs Up With the Times](https://medium.com/@eliavlavi/everything-in-its-right-place-keeping-your-specs-up-with-the-times-6f3d358c842a?utm_source=rubyweekly&utm_medium=email) tutorial Coding your tests to interfaces, just like your classes, can keep your specs nice and fresh. Eliav Lavi - [Using the Facade Design Pattern in Rails](https://medium.com/kkempin/facade-design-pattern-in-ruby-on-rails-710aa88326f?utm_source=rubyweekly&utm_medium=email) tutorial Use this pattern to hide data prep and other components from the controller. Krzysztof Kempiński - [What I Learned Reading the spreadsheet_architect Code](http://blog.arkency.com/a-word-about-spreadsheet-architect/?utm_source=rubyweekly&utm_medium=email) tutorial In short, a trick on how to limit the scope of an ActiveRecord query. Arkency Blog - [Quick Tip: Get The Version Number of a Rails App in Production](http://lasslo.xyz/articles/get-version-of-rails-application-in-production/?utm_source=rubyweekly&utm_medium=email) tutorial Lorenzo Sinisi - [How to Make Ajax Calls The Rails Way](https://m.patrikonrails.com/how-to-make-ajax-calls-the-rails-way-20174715d176?utm_source=rubyweekly&utm_medium=email) tutorial A follow-up to an article about Ajax and Rails we linked [last week](http://rubyweekly.com/issues/363). Patrik Bóna - [An In-Depth Look at Ruby's Exception System](https://honeybadger.leadpages.co/exceptions/?utm_source=rubyweekly&utm_medium=email) Ruby's exception system is more powerful than many people realize. This book shows you how to get the most from it. HoneybadgerSponsored - [How I Lost 17,000 GitHub Auth Tokens in One Night](https://www.schneems.com/2017/08/30/how-i-lost-17000-github-auth-tokens-in-one-night/?utm_source=rubyweekly&utm_medium=email) story Richard Schneeman - [Careful What You Measure: MJIT vs TruffleRuby](https://pragtob.wordpress.com/2017/08/29/careful-what-you-measure-2-1-times-slower-to-4-2-times-faster-mjit-versus-truffle-ruby/?utm_source=rubyweekly&utm_medium=email) opinion Tobias Pfeiffer - [Roll Your Own Private Gem Server on Google Cloud Platform](https://cloudplatform.googleblog.com/2017/08/rolling-your-own-private-Ruby-gem-server-on-Google-Cloud-Platform.html?utm_source=rubyweekly&utm_medium=email) tools Google has released a gem enabling the creation of a gem server on GCP with a single command. Google Cloud Platform Blog - [Real-time monitoring for Ruby apps](https://www.datadoghq.com/dg/apm/ruby-tracing/?utm_source=Advertisement&utm_medium=CooperPress&utm_campaign=CooperPress-RubyAPMS) tools Troubleshoot performance issues with end-to-end traces, interactive flame graphs, and sophisticated alerts. [Try free](https://www.datadoghq.com/dg/apm/ruby-tracing/?utm_source=Advertisement&utm_medium=CooperPress&utm_campaign=CooperPress-RubyAPMS). DatadogSponsored - [async: A Composable Asynchronous I/O Framework for Ruby](https://github.com/socketry/async?utm_source=rubyweekly&utm_medium=email) code Based on [nio4r](https://github.com/socketry/nio4r) and [timers.](https://github.com/socketry/timers) Socketry - [Yard-Junk: Get Rid of The Junk in Your YARD Docs](https://github.com/zverok/yard-junk?utm_source=rubyweekly&utm_medium=email) code Think of it as a linter for YARD docs. Victor Shepelev - [zen-rails-base-app: A Base Application for Rails 5.1 Projects](https://github.com/brunofacca/zen-rails-base-app?utm_source=rubyweekly&utm_medium=email) code Includes several development, test, and other gems to bootstrap your Rails app efficiently. Bruno Facca - [BatchLoader: A Generic Lazy Batching Mechanism to Avoid N+1 Queries](https://github.com/exaspark/batch-loader?utm_source=rubyweekly&utm_medium=email) code - [“CircleCI 2.0 is fast. We reduced builds from minutes to 12 seconds.”](https://circleci.com/?utm_source=cooperpress&utm_medium=newsletter&utm_campaign=august&utm_content=ruby-weekly) CircleCISponsored Curated by [Peter Cooper](https://twitter.com/peterc) and [Glenn Goodrich](https://twitter.com/ruprict), and published by [Cooperpress](https://cooperpress.com/). Send feedback by simply replying to this mail. Want to sponsor an issue? See our [media kit.](https://cooperpress.com/mediakit) Want to post a job? Email us or [use our self-serve system.](https://booking.cooperpress.com/jobs) [Unsubscribe](*|UNSUB|*) | [Change email address](*|UPDATE_PROFILE|*) | [Read this issue on the Web](http://rubyweekly.com/issues/364) © Cooperpress Ltd. Office 30, Lincoln Way, Louth, LN11 0LS, UK [Email policy](https://cooperpress.com/spam.html) [Privacy policy](https://cooperpress.com/privacy.html)