--- title: "#366: Ruby 2.4.2 Released With Multiple Security Fixes" publication: "Ruby Weekly" issue: 366 published_at: "2017-09-14" canonical_url: "https://rubyweekly.com/issues/366" --- #366: Ruby 2.4.2 Released With Multiple Security Fixes This week's Ruby and Rails news[Read this e-mail on the Web](http://rubyweekly.com/issues/366) Ruby WeeklyIssue 366 — September 14, 2017 ruby-lang.org[Ruby 2.4.2 Released With Multiple Security Fixes](https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-4-2-released/)The vulnerabilities include a [buffer under-run vuln in Kernel.sprintf](https://www.ruby-lang.org/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898/) and [RubyGems issues](https://www.ruby-lang.org/en/news/2017/08/29/multiple-vulnerabilities-in-rubygems/). Ruby [2.2.8](https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released/) and [2.3.5](https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released/) are also out for the same reason. Sandi Metz[Breaking Up the Behemoth](https://www.sandimetz.com/blog/2017/9/13/breaking-up-the-behemoth)Three metrics that can be combined to measure the maintainability of your code and find outliers of complexity. Brakeman ProSponsored[Cross-Site Scripting in Rails Applications](https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails)Cross-site scripting (XSS) is the most common web vulnerability and Rails applications are not immune. Learn how XSS can sneak into Rails apps and how to prevent it in this blog post. Want to check your code for XSS? [Brakeman Pro can help](https://brakemanpro.com/twtrial). [![Brakeman Pro\](https://copm.s3.amazonaws.com/81bea62d.png)](https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails?utm_source=rubyweekly&utm_medium=email) Michael Hoffman[A Puzzle About Ruby Constants](https://engineering.thriveglobal.com/a-puzzle-about-ruby-constants-e958d15dbada)Ruby’s algorithm for finding the definition of a constant is more complex than you might think. Brandur Leach[Using Atomic Transactions to Power an Idempotent API](https://brandur.org/http-transactions)The start of a series of posts on building more robust (and data accurate) APIs by leaning on Postgres’s transactional features. Sergii Makagon[Is Ruby Pass by Value or Pass by Reference?](http://rubyblog.pro/2017/09/pass-by-value-or-pass-by-reference)An analysis of how arguments are passed in Ruby which, as you might’ve guessed, depends on many factors. Jobs - [Senior Backend Engineer @ Capcom Beeline (Vancouver, Los Angeles)](https://bit.ly/cap-sep-job?utm_source=rubyweekly&utm_medium=email)Become a core member of our team. We are crafting the next-generation eSports platform for mobile games. Capcom Beeline - [Full stack Ruby and Rails dev (remote)](http://jobs.ably.io/o/full-stack-rails-developer?utm_source=rubyweekly&utm_medium=email)We’re a realtime platform solving complex distributed problems for the developer community. If you enjoy building web services, [apply](http://jobs.ably.io/o/full-stack-rails-developer). Ably realtime - [Ruby on Rails Full Stack Engineer (California, USA)](https://ars2.equest.com/?response_id=b8932ea7c6da0c3e7ac263d9f00d3223)The Apple Media Products Engineering team is looking for a software engineer to build and enhance algorithmic quality evaluation tools. Apple In brief - ['Effective Testing with RSpec 3' Book Has Been Released](http://rspec.info/blog/2017/09/effective-testing-with-rspec-3-released/?utm_source=rubyweekly&utm_medium=email) news RSpec.info - [Sublime Text 3.0 Released](https://www.sublimetext.com/blog/articles/sublime-text-3-point-0?utm_source=rubyweekly&utm_medium=email) news A text editor heavily used by Ruby developers in particular. Jon Skinner - [Rails 5.1.4 and 5.0.6 Released](http://weblog.rubyonrails.org/2017/9/7/Rails-5-1-4-and-5-0-6-released/?utm_source=rubyweekly&utm_medium=email) news Official Rails Blog - [14 Ruby Conferences Taking Place This Fall (2017)](https://rubygarage.org/blog/ruby-conferences-fall?utm_source=rubyweekly&utm_medium=email) news - [Basecamp Cancels Its Ruby Together Membership Over Concerns](https://twitter.com/dhh/status/908001928625364992?utm_source=rubyweekly&utm_medium=email) news DHH on Twitter - [Troubleshoot Ruby app performance with Datadog](https://www.datadoghq.com/dg/apm/ruby-tracing/?utm_source=Advertisement&utm_medium=CooperPress&utm_campaign=CooperPress-RubyAPMS) Get to the bottom of performance issues. Dive into distributed request traces, infrastructure metrics, and more. DatadogSponsored - [Improving Spec Speed in A Huge, Old Rails App](https://goiabada.blog/improving-spec-speed-in-a-huge-old-rails-app-8f3ab05a33f9?utm_source=rubyweekly&utm_medium=email) tutorial Goiabada - [Write a JSON API from Scratch with Grape](https://brewing-bits.com/blog/off-the-rails/?utm_source=rubyweekly&utm_medium=email) tutorial A Rails-free approach to a JSON API in Ruby. Brewing Bits - [How to Write Your First CLI with Thor](https://medium.com/magnetis-backstage/how-to-write-your-first-cli-with-thor-9da6636bf744?utm_source=rubyweekly&utm_medium=email) tutorial Magnetis Backstage - [How to Include Rails Associated Model Data in React Components](https://learnetto.com/blog/how-to-include-rails-associated-model-data-in-react-components?utm_source=rubyweekly&utm_medium=email) tutorial In short, jbuilder is your co-pilot. Learnetto - [Rails Best Practice: Persisting Addresses in PostgreSQL](https://medium.com/@Learn2Code/rails-best-practice-persisting-addresses-in-postgresql-e81329d3db7b?utm_source=rubyweekly&utm_medium=email) tutorial A look at several solutions to storing addresses for users. Frederick John - [Graceful Shutdown of Sidekiq Processes on Kubernetes](http://blog.bigbinary.com/2017/08/24/graceful-shutdown-of-sidekiq-processes-on-k8s.html?utm_source=rubyweekly&utm_medium=email) tutorial Rahul Mahale - [Using Docker Compose with Your Rails Apps](https://www.chrisblunt.com/rails-on-docker-using-docker-compose-with-your-ruby-on-rails-apps/?utm_source=rubyweekly&utm_medium=email) tutorial Chris Blunt - [Data Sheet: Database Performance Monitoring](https://www.vividcortex.com/hubfs/VividCortex_Overview_Data_Sheet.pdf?utm_campaign=Ruby%20Weekly&utm_source=ppc&utm_medium=Overview%20DS) VividCortex is the best way to improve your database performance, efficiency, and uptime. VividCortexSponsored - [Refactoring A Query Weighing in At 41 Lines and 2844 Chars](https://boykoc.github.io/ruby/rubyonrails/2017/09/06/that-time-i-wrote-a-query-with-chained-ruby-methods-weighing-in-at-41-lines-and-2844-chars.html?utm_source=rubyweekly&utm_medium=email) story Cody Boyko - [How Recent RubyGems Vulnerabilities Were Patched on Heroku](https://www.schneems.com/2017/09/13/how-august-2017-rubygems-vulnerabilities-were-patched-on-heroku/?utm_source=rubyweekly&utm_medium=email) story Richard Schneeman - [The 11-Minute Guide to Building an Online Store with Rails and Stripe](https://medium.com/@hrishio/the-11-minute-guide-to-building-and-launching-an-online-store-with-rails-stripe-checkout-and-206d6faec6d8?utm_source=rubyweekly&utm_medium=email) video Hrishi Mittal - [The Road to Ruby Error Domination Starts Here](https://rollbar.com/rubyweekly?utm_source=rubyweekly&utm_medium=email) ROLLBARSponsored - [strong_migrations: Catch Unsafe Migrations at Dev Time](https://github.com/ankane/strong_migrations?utm_source=rubyweekly&utm_medium=email) code Andrew Kane - [did_you: A Ruby Version-Agnostic Wrapper for the 'did_you_mean' Gem](https://github.com/zverok/did_you?utm_source=rubyweekly&utm_medium=email) code Victor Shepelev - [Karafka (Ruby + Kafka): A Framework for Kafka + Rails App Dev](https://medium.com/@maciejmensfeld/karafka-ruby-kafka-framework-1-0-0-release-notes-1b0933d47e88?utm_source=rubyweekly&utm_medium=email) code - [React Chat: A Chat App Built with React and ActionCable in Rails 5.1](https://github.com/learnetto/reactchat?utm_source=rubyweekly&utm_medium=email) code Learnetto Curated by [Peter Cooper](https://twitter.com/peterc) and [Glenn Goodrich](https://twitter.com/ruprict), and published by [Cooperpress](https://cooperpress.com/). Send feedback by simply replying to this mail. Want to sponsor an issue? See our [media kit.](https://cooperpress.com/mediakit) Want to post a job? Email us or [use our self-serve system.](https://booking.cooperpress.com/jobs) [Unsubscribe](*|UNSUB|*) | [Change email address](*|UPDATE_PROFILE|*) | [Read this issue on the Web](http://rubyweekly.com/issues/366) © Cooperpress Ltd. Office 30, Lincoln Way, Louth, LN11 0LS, UK [Email policy](https://cooperpress.com/spam.html) [Privacy policy](https://cooperpress.com/privacy.html)