---
title: "Why RubyGems just revoked every legacy API key"
publication: "Ruby Weekly"
issue: 810
published_at: "2026-07-23"
canonical_url: "https://rubyweekly.com/issues/810"
---

Plus String to get bit-level ops, type-aware bug finding, and can your code run in Ractors?        

#​810 — July 23, 2026 

[Read on the Web](https://rubyweekly.com/issues/810)  

Together with [![AppSignal logo\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_1280,h_372/co_white,e_outline:7/nl4ksfby2hmtz6vx5vzw.png)](https://www.appsignal.com/ruby?utm_medium=paid&utm_campaign=rubyweekly&utm_source=rubyweekly&utm_content=primary)   

Ruby Weekly 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/bddtb2tsghzwsjwlzkys.jpg)](https://blog.rubygems.org/2026/07/22/security-advisory-legacy-api-key-leak.html)  

🔒 [RubyGems Revokes Legacy API Keys After Possible Cache Leak](https://blog.rubygems.org/2026/07/22/security-advisory-legacy-api-key-leak.html) — A CDN caching bug, which has existed for years, could have served accounts' legacy API keys to other users. There's no evidence of malicious use, but it's worth affected owners checking their gems over nonetheless. 

Colby Swandale (Ruby Central)  

💡 Luke Marshall, from Truffle Security, discovered this bug and did [a full technical writeup](https://trufflesecurity.com/blog/rubygems-cache-vulnerability) of how the bug could have been exploited.  [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/ab08b8fa.png)](https://www.appsignal.com/ruby?utm_medium=paid&utm_campaign=rubyweekly&utm_source=rubyweekly&utm_content=primary) 

[All-in-One Ruby & Rails Monitoring — Errors + Performance](https://www.appsignal.com/ruby?utm_medium=paid&utm_campaign=rubyweekly&utm_source=rubyweekly&utm_content=primary) — Track errors, N+1 queries, slow SQL, Sidekiq jobs, and host metrics — all in one Ruby gem. AppSignal gives Rails teams every feature on every plan, with predictable pricing and real engineers on support. [30-day free trial, no credit card](https://www.appsignal.com/ruby?utm_medium=paid&utm_campaign=rubyweekly&utm_source=rubyweekly&utm_content=primary). 

AppSignal sponsor   

[Beyond Enumerable: Testing Membership with Bloom Filters](https://baweaver.com/writing/2026/07/20/beyond-enumerable-testing-membership-with-bloom-filters/) — When `include?` over a huge collection gets expensive, a [Bloom filter](https://samwho.dev/bloom-filters/) can answer 'definitely _not_ present' with fixed memory and constant-time lookups. Brandon builds one in Ruby, covering all the details. 

Brandon Weaver  

💡 If you want to understand how Bloom filters work at a high level, [Sam Rose's visual Bloom filter explainer](https://samwho.dev/bloom-filters/) is fantastic.  

**⚡️ IN BRIEF:** 

- Matz has accepted [a proposal to bring more bit-level operations to `String`](https://bugs.ruby-lang.org/issues/22118), including `bit_count`, `bit_get` and `bit_set` ([PR here](https://github.com/ruby/ruby/pull/17353)).
- No RubyConf videos _yet_, but Confreaks has uploaded [seventeen videos from _Blastoff Rails 2026_](https://www.youtube.com/playlist?list=PLc0IiJsPvtsg), an event that took place in Albuquerque last month.
- [RubyMine 2026.2 has been released](https://blog.jetbrains.com/ruby/2026/07/rubymine-2026-2-agentic-debugging-native-github-copilot-integration-default-symbol-based-code-insight-and-more/). It's the latest version of JetBrains' commercial Ruby IDE with RBS, code insight, and AI-related enhancements.
- The [CFP for _SF Ruby_](https://cfp.sfruby.com/), taking place in San Francisco this November, closes on July 27 (next Monday). Tickets are now on sale too.   

▶[RuboCop 2.0: Where Do We Go Now?](https://www.youtube.com/watch?v=h_NazJbUBPA&list=PLfo_lSts5dBhAdoXZH9Akq0cUCF6L8Bm2&index=9) — At RubyConf Austria ([all the videos are here](https://www.youtube.com/playlist?list=PLfo_lSts5dBhAdoXZH9Akq0cUCF6L8Bm2)) the creator of [RuboCop](https://rubocop.org/) gave a dense state of the union update on the project and how it's continuing to improve. 

Bozhidar Batsov   

🤖 [How I Stopped Running out of Tokens](https://danielabaron.me/blog/how-i-stopped-running-out-of-tokens/) — A Rubyist whose company uses Claude Enterprise shares numerous tools you can use (such as [rtk](https://github.com/rtk-ai/rtk)) to get the most out of assigned limits. 

Daniela Baron   

[Using OpenSpec in Rails Applications](https://sinaptia.dev/posts/using-openspec-in-rails-applications/?utm_source=cooperpress&utm_medium=newsletter&utm_campaign=rubyweekly-2026q3&utm_content=sponsored) — See how OpenSpec is reshaping our Rails workflow. What paid off, what failed, and what we’d do differently. 

SINAPTIA sponsor   

📄 [Active Model Conditional Validations](https://kevinjmurphy.com/posts/activemodel-conditional-validations/) – A tour of conditional validations, from [custom contexts](https://guides.rubyonrails.org/active_record_validations.html#custom-contexts) to `validation_context`, plus a case for splitting divergent behavior into separate classes instead. Kevin Murphy 

📄 [A Proposal for Deprecating `ruby2_keywords`](https://bugs.ruby-lang.org/issues/22205) – Dropping the compatibility mechanism introduced for the Ruby 2-to-3 keyword arguments separation seems obvious, but will have knock-on effects. Shugo Maeda 

📄 ['Poor Man's Escape Analysis': A Proposed CRuby Optimization](https://bugs.ruby-lang.org/issues/22182) Yusuke Endoh  

🛠 Code & Tools 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/an0xnckaandro7uetvrt.jpg)](https://github.com/gurgeous/table_tennis)   

[TableTennis 1.0: Stylish Terminal Tables](https://github.com/gurgeous/table_tennis) — A library for printing tabular data on the terminal that includes theming, automatic layout, automatic formatting of dates and numbers, coloring of numeric values, and more. 

Adam Doppelt   

[JRuby 10.1.1.0: Faster Number Parsing and Security Fixes](https://www.jruby.org/2026/07/22/jruby-10-1-1-0.html) — The Ruby 4.0-targeting JVM implementation gains faster number parsing, OpenBSD support, and OpenSSL and ERB security fixes. 

Charles Oliver Nutter et al.   

[Need More Rails Capacity? Speed Up Your Product Roadmap Next Week 🚀](https://go.fastruby.io/veh) — Rails devs who integrate fast, ship quality code & help your team deliver more each sprint. We vet them, you ship more. 

FastRuby.io® | Rails Staff Aug sponsor   

[Audition: See if a Ruby Program Can Run Inside Ractors](https://github.com/yaroslav/audition) — A tool you can point at a Ruby script, gem, Rack or Rails app, and it tells you if it can run within [Ractors](https://docs.ruby-lang.org/en/3.4/ractor_md.html), Ruby's experimental actor-based parallel execution mechanism. And if not, it explains why. 

Yaroslav Markin   

[Rigor: Type-Aware Ruby Static Analyzer and Bug Finder](https://rigor.typedduck.fail/) — Unlike Sorbet or Steep, no annotations are required. Rigor infers types from the values your code produces, while treating any RBS you have as authoritative. 

Usami et al.   

[Pygments.rb 5.0: A Ruby Wrapper for the Pygments Syntax Highlighter](https://github.com/pygments/pygments.rb) — [Pygments](https://pygments.org/) is one of the best syntax highlighters out there, but it's Python-based. This library makes it easier to call. v5.0 bumps Pygments up to the latest version. 

Nyman, Gupta and Radchenko  

💡 Alternatively, [Rouge](https://github.com/rouge-ruby/rouge) is a pure Ruby Pygments-compatible code highlighter.  

- [React on Rails 17.0](https://github.com/shakacode/react_on_rails/releases/tag/v17.0.0) – A complete way to integrate React into Rails apps. Now with full support for React 19 and streaming server rendering. ([Homepage](https://reactonrails.com/))
- [RuboCop Minitest 0.40](https://github.com/rubocop/rubocop-minitest) – Extension for enforcing Minitest best practices and coding conventions.
- [Gemsmith 26.0](https://github.com/bkuhlmann/gemsmith) – CLI tool for creating and managing Ruby gems following common best practices.
- [Rack::Proxy 1.0](https://github.com/ncr/rack-proxy/releases/tag/v1.0.0) – Request/response rewriting HTTP proxy for Rack apps.
- [RubyGems and Bundler 4.0.17](https://blog.rubygems.org/2026/07/22/4.0.17-released.html)       

📰 Classifieds   

🤖 No vibes, just vitals. [AppSignal's MCP server](https://www.appsignal.com/tour/mcp-server?utm_medium=paid&utm_campaign=rubyweekly&utm_source=rubyweekly&utm_content=classified) brings Rails errors, traces & metrics into Claude, Cursor & Copilot. Debug in your editor. 

--- 

Your Rails app logs events all day. [TimescaleDB](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=ruby-weekly-newsletter) turns them into real-time analytics, right in the Postgres you already run.    

😅 An Old/New Ruby Discovery of the Week  

I recently got the itch to see what I'm getting for Christmas. Well, what's coming in Ruby 4.1, anyway. It's not going to be a _big_ release syntax-wise, but there are a variety of new methods and features I'll share in coming weeks. 

My first surprise, though, was the enhancement of a method added back in Ruby 2.4 that I had not noticed: [`String#unpack1`](https://docs.ruby-lang.org/en/master/String.html#method-i-unpack1) 

`unpack1` is basically `unpack` that only returns the first extracted value. You'd use these methods [when working with packed data](https://docs.ruby-lang.org/en/master/language/packed_data_md.html#packing-and-unpacking), perhaps when parsing binary files, random protocols, network data, and the like. 

So if, like me, you didn't know about `unpack1` or the Ruby docs' surprisingly thorough [Packed Data page](https://docs.ruby-lang.org/en/master/language/packed_data_md.html) which is _*ahem*_ _packed_ with examples, now you do. 

The Ruby 4.1 change? `unpack`/`unpack1` are getting new directives: 

- `R` for unsigned [LEB128](https://en.wikipedia.org/wiki/LEB128) (Little Endian Base 128) as used in DWARF and WASM.
- `r` for signed LEB128.
- `^` to return the current byte offset (more useful than it sounds).
- `x!` and `@!` are new alignment directives to handle padding in binary formats by advancing the cursor to aligned byte positions, relative to the record's starting offset (e.g. `x!4`) and the whole string (`@!4`) respectively. 

If you're not tinkering around with packing and unpacking data, you might not have any use for these, but for my sins I enjoy low-level noodling with binary data in Ruby, so am looking forward to experimenting more. 

This is a niche topic, but I learnt something, this is my newsletter, and hopefully I'll get to some more useful Ruby 4.1 additions for you next time ;-)         

Curated by [Peter Cooper](https://twitter.com/cooperx86) and [Glenn Goodrich](https://twitter.com/ruprict).
Published by [Cooperpress](https://cooperpress.com/). 

[Change your email](https://rubyweekly.com/edit_subscription/*|UID|*) or [Stop getting this newsletter.](https://rubyweekly.com/leave/*|UID|*) 

© Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom 

Other weekly newsletters we publish include [Postgres Weekly](https://postgresweekly.com/), [React Status](https://react.statuscode.com/), [Frontend Focus](https://frontendfoc.us/), and [JavaScript Weekly](https://javascriptweekly.com/).