--- title: "A Ruby 4.0 double: JRuby 10.1 and mruby 4.0" publication: "Ruby Weekly" issue: 797 published_at: "2026-04-23" canonical_url: "https://rubyweekly.com/issues/797" --- Plus a new chapter for Ruby Central, an ERB vulnerability, and a new `git history` command. #​797 — April 23, 2026 [Read on the Web](https://rubyweekly.com/issues/797) Together with [![Memetria\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_600,h_145/e_make_transparent/co_white,e_outline:7/vvpdctzacmq3xehpvwps.png)](https://dashboard.memetria.com/rubyweekly/) Ruby Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/bmbrf7ykp5cmxaeefph3.jpg)](https://www.jruby.org/2026/04/21/jruby-10-1-0-0.html) [JRuby 10.1 Released with Ruby 4.0 Compatibility](https://www.jruby.org/2026/04/21/jruby-10-1-0-0.html) — The first major release of the popular JVM-based Ruby implementation “_since catching up with Ruby compatibility_” gets Ruby 4.0 compatibility and shifts to a biennial LTS release cycle. There are memory improvements too: every object is 8 bytes smaller, plus tighter numeric representations. Charles Oliver Nutter [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/13ae90fe.png)](https://dashboard.memetria.com/rubyweekly/) [Memetria K/V: Efficient Redis & Valkey Hosting](https://dashboard.memetria.com/rubyweekly/) — Memetria K/V hosts Redis OSS and Valkey for Ruby apps, featuring large key tracking and detailed analytics. Memetria sponsor [A New Chapter for Ruby Central](https://rubycentral.org/news/a-new-chapter-for-ruby-central/) — After a year in post as Executive Director, Shan Cureton has left Ruby Central, along with its CFO, as the organization finds itself in financial jeopardy. When one door closes, another opens, however, and some positive, long-needed changes are coming in and you can get involved. Jey Flores and Ran Craycraft 💡 There are also [some changes to this year's RubyConf](https://rubycentral.org/news/rubyconf-updates/). [ERB Has a Deserialization Vulnerability (CVE-2026-41316)](https://www.ruby-lang.org/en/news/2026/04/21/erb-cve-2026-41316/) — Any app that calls `Marshal.load` on untrusted data _and_ has both `erb` and `activesupport` loaded is vulnerable to arbitrary code execution. Upgrade your [`erb` gem](https://rubygems.org/gems/erb) to version 4.0.3.1, 4.0.4.1, 6.0.1.1, 6.0.4 or later. Takashi Kokubun **⚡️ IN BRIEF:** - [Ruby 4.0.3 has been released](https://www.ruby-lang.org/en/news/2026/04/21/ruby-4-0-3-released/). It's a minor release to update ERB to v6.0.1.1 as a fix for the ERB vulnerability_(above)_. - 🕹️ The [DragonRuby](https://dragonruby.org/) project has [shared an update as it celebrates its 7th birthday](https://dragonruby.itch.io/dragonruby-gtk/devlog/1497015/dragonrubys-seventh-year-where-we-started-and-where-were-going) with an SDL3-powered update of the Ruby-based game toolkit just around the corner. - In [The Missing Bundler Features](https://byroot.github.io/ruby/bundler/2026/04/20/bundle-features.html), Jean Boussier makes the case that Bundler's real ergonomic problems have nothing to do with its speed and are more about user control. - 🎤 On [the latest _On Rails_ podcast](https://podcast.rubyonrails.org/2462975/episodes/19060786-brian-scanlan-building-ai-first-at-intercom), Intercom's Brian Scanlan talks about his team's 'AI-first' approach to working on their 15-year-old Rails app. [Optimizing Ruby Path Methods](https://byroot.github.io/ruby/performance/2026/04/18/faster-paths.html) — _byroot_ has been speeding up path methods (e.g. `File.expand_path`), with `File.join` now faster than string interpolation! A beautifully technical tour through Bootsnap internals, Ruby 4.1’s forthcoming `Dir.scan`, and why [Shift JIS](https://en.wikipedia.org/wiki/Shift_JIS) made all of this slower than it needed to be. Jean Boussier [Selective Test Execution at Stripe: Fast CI for a 50M-Line Ruby Monorepo](https://stripe.dev/blog/selective-test-execution-at-stripe-fast-ci-for-a-50m-line-ruby-monorepo) — How Stripe runs only ~5% of their full 1.2-million-test suite on each build using a variety of techniques like dependecy-graph analysis and heuristics for test selection. Aditya Anchuri (Stripe) [How a Solo SaaS Founder Stopped Worrying About Rails Maintenance](https://go.fastruby.io/oov) — See how [Bonsai](https://go.fastruby.io/gg4) helped Tim go from chasing contractors to peace of mind. Hand over the hard tech debt to the experts. 🚀 Bonsai by FastRuby.io® sponsor 📄 [Let's Enable MFA for All Ruby Gems](https://thoughtbot.com/blog/lets-enable-mfa-for-all-ruby-gems) – It takes a community effort to make the ecosystem safer. Matheus Richard 📺 [Monitoring Cron Jobs with Whenever](https://gorails.com/episodes/monitoring-cron-jobs-with-whenever) – A 12-minute screencast. Chris Oliver (GoRails) 📄 [PII Filtering for RubyLLM with Top Secret](https://thoughtbot.com/blog/ruby-llm-top-secret) Steve Polito 🛠 Code & Tools [mruby 4.0 Released](https://mruby.org/releases/2026/04/20/mruby-4.0.0-released.html) — Built by [a team](https://mruby.org/team/) led by Matz himself, [mruby](https://mruby.org/) is a lightweight, embeddable Ruby implementation for constrained environments. v4.0 focuses on pattern matching support and adds read-only method tables for lower memory use, `mirb` improvements, and [new gems](https://github.com/mruby/mruby/blob/master/NEWS.md#new-gems) for multitasking, benchmarking, plus a `strftime` implementation. The mruby Team 💡 There's an official tutorial on all [the different ways you can run mruby code.](https://mruby.org/docs/articles/executing-ruby-code-with-mruby.html) [Your Rails App Has an N+1 Problem. AppSignal Will Show You Where](https://www.appsignal.com/?utm_source=newsletter&utm_medium=paid&utm_campaign=rubyweekly&utm_term=4-23&utm_content=sponsoredlink) — AppSignal auto-detects N+1 queries and leaks. Get Sidekiq, ActionView, Puma metrics. One gem, minutes to monitor. Free 30-day trial, no card. AppSignal sponsor [Informers 1.3: Run Modern Transformers Models from Ruby](https://github.com/ankane/informers) — [Transformers.rb](https://github.com/ankane/transformers-ruby) can run Transformers-compatible models from Ruby, but if a model has an ONNX variant, Informers makes it faster and easier. I’ve been running embedding models in milliseconds with this, but you can also do things like reranking and image classification. Andrew Kane - [oj 3.17](https://github.com/ohler55/oj) – Fast JSON parser and object marshaller. v3.17 adds [a safe parser mode](https://github.com/ohler55/oj/pull/1007) that enforces various limits to protect from large or heavily nested payloads. - [Faker 3.8](https://github.com/faker-ruby/faker/releases/tag/v3.8.0) – The long-standing artificial data generation library adds [lazy loading](https://github.com/faker-ruby/faker/blob/main/experiments/lazy_load.md), making it far faster to load. - 🌐 [LibGD-GIS 0.5](https://github.com/ggerman/libgd-gis) – GIS and map-rendering engine built on `ruby-libgd`, supporting GeoJSON layers and tiles. - [Spreadsheet 1.3.5](https://github.com/zdavatz/spreadsheet) – Library for reading, writing and modifying Excel (XLS) spreadsheets. GPL 3.0 licensed. - [Single Cov 2.1](https://github.com/grosser/single_cov) – Produce code coverage reports for Ruby code and tests. - ✉️ [Roadie 5.3](https://github.com/Mange/roadie) – Inlines CSS and rewrites relative URLs for HTML emails. - [RSpec Tracer 1.1](https://github.com/avmnu-sng/rspec-tracer) – Specs dependency analyzer and flaky-test detector. - [RatatuiRuby 1.5](https://www.ratatui-ruby.dev/) – Cook up impressive TUI interfaces with Ruby. - [Versionaire 15.2](https://github.com/bkuhlmann/versionaire) – Immutable, semantic version type. 📰 Classifieds [Faster CI without rewriting your workflows](https://fandf.co/4cLdCe5). Depot CI supports GitHub Actions syntax — just faster. --- 🧪 Claude Code writes better tests with a coverage feedback loop. [Read about the experiment](https://undercover-ci.com/blog/claude-code-experiment). 📢 Elsewhere in the ecosystem [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/pj5ib5ql9y2bzgwzu9tr.jpg)](https://supmua.dev/) - ✉️ [Sup](https://supmua.dev/) is a Ruby-powered terminal-based email client with Gmail-like thread-centered archiving, tagging and muting, plus [you can write hooks in Ruby.](https://github.com/sup-heliotrope/sup/wiki/Hooks) It's nearly twenty years old, but v1.4 just landed. - [Git 2.54 has been released](https://github.blog/open-source/git/highlights-from-git-2-54/). `git history` offers a new, easy way to edit commit messages or interactively split a commit into two. You can now also define hooks in config files rather than just in `.git/hooks` and run multiple hooks for the same event in this way. - Cloudflare has released [a preview of a new `cf` tool](https://blog.cloudflare.com/cf-cli-local-explorer/) for working with its various services from the terminal. - 🐘 [The first draft of the PostgreSQL 19 release notes](https://www.postgresql.org/docs/devel/release-19.html) has been written. The final release is expected in September. - 🇯🇵 I'm looking forward to covering some of the [RubyKaigi](https://rubykaigi.org/2026/) news next week (it's currently taking place in Japan) especially after seeing [this cryptic X post by k0kubun](https://x.com/k0kubun/status/2047188893691424787) saying _"Ruby is faster than C"_ (!) Curated by [Peter Cooper](https://twitter.com/cooperx86) and [Glenn Goodrich](https://twitter.com/ruprict). Published by [Cooperpress](https://cooperpress.com/). [Change your email](https://rubyweekly.com/edit_subscription/*|UID|*) or [Stop getting this newsletter.](https://rubyweekly.com/leave/*|UID|*) © Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom Other weekly newsletters we publish include [Postgres Weekly](https://postgresweekly.com/), [React Status](https://react.statuscode.com/), [Frontend Focus](https://frontendfoc.us/), and [JavaScript Weekly](https://javascriptweekly.com/).