Issue #810: Why RubyGems just revoked every legacy API key

#810 — July 23, 2026

Together with

🔒 RubyGems Revokes Legacy API Keys After Possible Cache Leak — A CDN caching bug, which has existed for years, could have served accounts' legacy API keys to other users. There's no evidence of malicious use, but it's worth affected owners checking their gems over nonetheless.

Colby Swandale (Ruby Central)

💡 Luke Marshall, from Truffle Security, discovered this bug and did a full technical writeup of how the bug could have been exploited.

All-in-One Ruby & Rails Monitoring — Errors + Performance — Track errors, N+1 queries, slow SQL, Sidekiq jobs, and host metrics — all in one Ruby gem. AppSignal gives Rails teams every feature on every plan, with predictable pricing and real engineers on support. 30-day free trial, no credit card.

AppSignal sponsor

Beyond Enumerable: Testing Membership with Bloom Filters — When include? over a huge collection gets expensive, a Bloom filter can answer 'definitely not present' with fixed memory and constant-time lookups. Brandon builds one in Ruby, covering all the details.

Brandon Weaver

💡 If you want to understand how Bloom filters work at a high level, Sam Rose's visual Bloom filter explainer is fantastic.

⚡️ IN BRIEF:

Matz has accepted a proposal to bring more bit-level operations to String, including bit_count, bit_get and bit_set (PR here).
No RubyConf videos yet, but Confreaks has uploaded seventeen videos from Blastoff Rails 2026, an event that took place in Albuquerque last month.
RubyMine 2026.2 has been released. It's the latest version of JetBrains' commercial Ruby IDE with RBS, code insight, and AI-related enhancements.
The CFP for SF Ruby, taking place in San Francisco this November, closes on July 27 (next Monday). Tickets are now on sale too.

▶ RuboCop 2.0: Where Do We Go Now? — At RubyConf Austria (all the videos are here) the creator of RuboCop gave a dense state of the union update on the project and how it's continuing to improve.

Bozhidar Batsov

🤖 How I Stopped Running out of Tokens — A Rubyist whose company uses Claude Enterprise shares numerous tools (such as rtk) you can use to get the most out of assigned limits.

Daniela Baron

Using OpenSpec in Rails Applications — See how OpenSpec is reshaping our Rails workflow. What paid off, what failed, and what we’d do differently.

SINAPTIA sponsor

📄 Active Model Conditional Validations – A tour of conditional validations, from custom contexts to validation_context, plus a case for splitting divergent behavior into separate classes instead. Kevin Murphy

📄 A Proposal for Deprecating ruby2_keywords – Dropping the compatibility mechanism introduced for the Ruby 2-to-3 keyword arguments separation seems obvious, but will have knock-on effects. Shugo Maeda

📄 'Poor Man's Escape Analysis': A Proposed CRuby Optimization Yusuke Endoh

🛠 Code & Tools

TableTennis 1.0: Stylish Terminal Tables — A library for printing tabular data on the terminal that includes theming, automatic layout, automatic formatting of dates and numbers, coloring of numeric values, and more.

Adam Doppelt

JRuby 10.1.1.0: Faster Number Parsing and Security Fixes — The Ruby 4.0-targeting JVM implementation gains faster number parsing, OpenBSD support, and OpenSSL and ERB security fixes.

Charles Oliver Nutter et al.

Need More Rails Capacity? Speed Up Your Product Roadmap Next Week 🚀 — Rails devs who integrate fast, ship quality code & help your team deliver more each sprint. We vet them, you ship more.

FastRuby.io® | Rails Staff Aug sponsor

Audition: See if a Ruby Program Can Run Inside Ractors — A tool you can point at a Ruby script, gem, Rack or Rails app, and it tells you if it can run within Ractors, Ruby's experimental actor-based parallel execution mechanism. And if not, it explains why.

Yaroslav Markin

Rigor: Type-Aware Ruby Static Analyzer and Bug Finder — Unlike Sorbet or Steep, no annotations are required. Rigor infers types from the values your code produces, while treating any RBS you have as authoritative.

Usami et al.

Pygments.rb 5.0: A Ruby Wrapper for the Pygments Syntax Highlighter — Pygments is one of the best syntax highlighters out there, but it's Python-based. This library makes it easier to call. v5.0 bumps Pygments up to the latest version.

Nyman, Gupta and Radchenko

💡 Alternatively, Rouge is a pure Ruby Pygments-compatible code highlighter.

React on Rails 17.0 – A complete way to integrate React into Rails apps. Now with full support for React 19 and streaming server rendering. (Homepage)
RuboCop Minitest 0.40 – Extension for enforcing Minitest best practices and coding conventions.
Gemsmith 26.0 – CLI tool for creating and managing Ruby gems following common best practices.
Rack::Proxy 1.0 – Request/response rewriting HTTP proxy for Rack apps.
RubyGems and Bundler 4.0.17

📰 Classifieds

🤖 No vibes, just vitals. AppSignal's MCP server brings Rails errors, traces & metrics into Claude, Cursor & Copilot. Debug in your editor.

Your Rails app logs events all day. TimescaleDB turns them into real-time analytics, right in the Postgres you already run.

😅 An Old/New Ruby Discovery of the Week

I recently got the itch to see what I'm getting for Christmas. Well, what's coming in Ruby 4.1, anyway. It's not going to be a big release syntax-wise, but there are a variety of new methods and features I'll share in coming weeks.

My first surprise, though, was the enhancement of a method added back in Ruby 2.4 that I had not noticed: String#unpack1

unpack1 is basically unpack that only returns the first extracted value. You'd use these methods when working with packed data, perhaps when parsing binary files, random protocols, network data, and the like.

So if, like me, you didn't know about unpack1 or the Ruby docs' surprisingly thorough Packed Data page which is *ahem* packed with examples, now you do.

The Ruby 4.1 change? unpack/unpack1 are getting new directives:

R for unsigned LEB128 (Little Endian Base 128) as used in DWARF and WASM.
r for signed LEB128.
^ to return the current byte offset (more useful than it sounds).
x! and @! are new alignment directives to handle padding in binary formats by advancing the cursor to aligned byte positions, relative to the record's starting offset (e.g. x!4) and the whole string (@!4) respectively.

If you're not tinkering around with packing and unpacking data, you might not have any use for these, but for my sins I enjoy low-level noodling with binary data in Ruby, so am looking forward to experimenting more.

This is a niche topic, but I learnt something, this is my newsletter, and hopefully I'll get to some more useful Ruby 4.1 additions for you next time ;-)