---
title: "You need to upgrade Rails 7.x and 8.x now"
publication: "Ruby Weekly"
issue: 811
published_at: "2026-07-30"
canonical_url: "https://rubyweekly.com/issues/811"
---

Plus big ZJIT inlining performance wins, a Ruby code-golfing journey, and RBS now supports JRuby.        

#​811 — July 30, 2026 

[Read on the Web](https://rubyweekly.com/issues/811)  

Together with [![FastRuby.io\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_467,h_106/e_make_transparent/co_white,e_outline:14/y65nyff19ylf5udphsq4.png)](https://go.fastruby.io/9xu)   

Ruby Weekly 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/thd7ahu0hk8zyue7p5am.jpg)](https://discuss.rubyonrails.org/t/cve-2026-66066-possible-arbitrary-file-read-and-remote-code-execution-in-active-storage-variant-processing/91432)  

[A Critical Active Storage Vulnerability in Rails](https://discuss.rubyonrails.org/t/cve-2026-66066-possible-arbitrary-file-read-and-remote-code-execution-in-active-storage-variant-processing/91432) — A specially crafted 'image' uploaded to Rails 7.x or 8.x apps in their default configuration can potentially expose arbitrary files on the server via Active Storage's `vips` processor. Patched in [Rails 7.2.3.2, 8.0.5.1 and 8.1.3.1](https://rubyonrails.org/2026/7/29/Rails-Versions-7-2-3-2-8-0-5-1-and-8-1-3-1-have-been-released). You may also need to upgrade `libvips`. Rails 6.x isn't affected _by default_. 

Rafael França and Rails Core  

💡 The team that discovered the vulnerability has [dubbed it _KindaRails2Shell_](https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066) and explains more about it. Also note, if you're using Bundler's new [cooldown protection](https://blog.rubygems.org/2026/06/03/cooldown-let-new-gems-be-vetted.html), `bundle update rails --cooldown 0` may be needed.  [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/56cf97f0.png)](https://go.fastruby.io/9xu) 

[Rails Experts You Like & Trust, Now Embedded in Your Team 🚀](https://go.fastruby.io/9xu) — Since 2017, companies have trusted [FastRuby.io](https://FastRuby.io) with their most complex Rails upgrades. Now those same senior engineers can scale your team fast: shipping features, fixing bugs, accelerating delivery, and using AI effectively. Let's talk! 

FastRuby.io® | Staff Augmentation sponsor   

[The Inliner is Yielding Benefits for ZJIT](https://railsatscale.com/2026-07-28-the-inliner-is-yielding-benefits/) — [ZJIT](https://docs.ruby-lang.org/en/master/jit/zjit_md.html), the experimental just-in-time compiler written in Rust, has added inlining capabilities. This post shows how method inlining speeds up block-heavy code such as `Array#each`. Early microbenchmarks are striking, with up to 35x speed gains in one case. 

Max Bernstein   

**⚡️ IN BRIEF:** 

- 🔎 Go to [the official ruby-lang.org site](https://www.ruby-lang.org/en/) and hit Cmd/Ctrl+K – it has search!
- 🏆 [Nominations have opened](https://rubyonrails.org/2026/7/29/nominations-2026-rails-luminary) for this year's _Rails Luminary Awards_. [Last year's winner](https://rubyonrails.org/2025/12/17/marco-roth-2025-rails-luminary) was Marco Roth of [Herb](https://herb-tools.dev/) fame.
- 🇪🇺 The sale of [early bird tickets](https://2026.euruko.org/register.html) for [Euruko](https://2026.euruko.org/), taking place this September in Czechia, ends this Saturday.
- 🎂 Rails is celebrating the 22nd anniversary of its first public release: v0.5.0 on July 24, 2004.   

[Finding 105 Vulnerabilities in the Ruby Ecosystem](https://depthfirst.com/research/behind-the-gitlab-rce-a-depthfirst-journey-into-the-ruby-ecosystem) — An app security firm turned its scanner on gems with native C extensions. A Nokogiri out-of-bounds read of 17 years' vintage is a particular highlight. 

Yu, Thakur, Wu, and Lin (Depthfirst)   

[Golfing Ruby with Codex: From 250 Bytes to 90](https://rubyinside.com/romangolf/) — I tell the tale of pushing GPT-5.6 Sol to make a Roman numeral generator smaller, ending at 90 bytes. Along the way, many Ruby features popped out: character literals, endless methods, a `1.%` exception trick, and a (not so) novel algorithm from 1976. 

Peter Cooper   

[Why Your Sidekiq Jobs Are Slower Than You Think (And How to Fix It)](https://blog.appsignal.com/2026/07/27/why-your-sidekiq-jobs-are-slower-than-you-think-and-how-appsignal-fixes-that.html?utm_medium=paid&utm_campaign=rubyweekly&utm_source=rubyweekly&utm_content=sponsored-link) — N+1s hide inside your jobs. AppSignal ranks your slowest Sidekiq jobs and queries so you fix the right one. _(Blog post.)_ 

AppSignal sponsor   

[Curiosity Reduced the Heap Size by 60%](https://mostlyobvio.us/2026/07/curiosity-reduced-the-heap-size-by-60/) — Agents are often good at diagnosing warnings and errors, but in this case an agent's attempts to _ignore_ a warning led Paweł to a striking memory use saving. 

Paweł Pacana   

📄 [Spec-tacular: Ways to Think About Writing Expressive RSpec](https://engineering.freeagent.com/2026/07/07/spec-tacular-ways-to-think-about-writing-expressive-rspec/) Simon Fish (FreeAgent) 

📄 [Rake Beyond Rails: A Build Tool You Know](https://www.fastruby.io/blog/rake-beyond-rails-the-build-tool-you-already-know.html) – A reminder of Rake's versatility. Francois Buys 

📄 [Overriding Rails' Default Validation Error Message Format](https://tekin.co.uk/2026/07/overriding-the-default-rails-error-message-format) Tekin Süleyman  

🛠 Code & Tools 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/hthtq6rhsl5iuzfzrqwm.jpg)](https://st0012.dev/ruby-galaxies/)  

[RubyLens: Turn Your Ruby Project into a Galaxy Visualization](https://st0012.dev/ruby-galaxies/) — A gem that turns a Ruby codebase into a galaxy, in either HTML or video form, built on top of [Rubydex](https://github.com/shopify/rubydex) which performs the analysis. The site contains a few pre-built examples to enjoy. [GitHub repo](https://github.com/st0012/rubylens). 

Stan Lo   

[4 Ways to Steer Your Agents Towards Better Tests](https://undercover-ci.com/blog/feedback-loops-for-agentic-coding) — Agents quit when the happy path is green. Undercover keeps them honest with local tools and CI checks for your team. 

Undercover CI sponsor   

[Courrier 1.0: A Gem to Send Emails Without SMTP](https://railsdesigner.com/new-rails-courrier/) — Brings the ability to send email through 13 providers and 7 newsletter platforms into a single library. There's also a Rails integration which brings generators and Active Job support. 

Rails Designer   

🤖 [Automating Ruby Tech Debt Audits with Claude Code](https://www.fastruby.io/blog/tech-debt-audit-with-claude-code.html) — Introduces a Claude Code skill (which [you can read here](https://github.com/fastruby/tech-debt-skill/blob/main/.claude/skills/tech-debt-audit/SKILL.md)) that strings together a variety of tools to produce a scored, one-shot quality report for Ruby projects. 

Ernesto Tagwerker   

- [Solid Queue 1.5](https://github.com/rails/solid_queue/releases/tag/v1.5.0) – DB-based queuing backend for Active Job. Lots of bugfixes, polling interval now defaults to 1 second, and there's a new `bin/jobs check` command to validate your config.
- [RBS 4.1](https://github.com/ruby/rbs/releases/tag/v4.1.0) – The official language for writing type signatures for Ruby now supports JRuby and adds a `Rewriter`API.
- 🖼️ [RMagick 7.1](https://github.com/rmagick/rmagick/releases/tag/RMagick_7-1-0) – The long-standing ImageMagick bindings get bug fixes, plus big changes to how text strings drawn by `Draw#annotate` are handled.
- [SimpleCov 1.0.3](https://github.com/simplecov-ruby/simplecov) – Code coverage tool. If you missed the big [1.0 release](https://github.com/simplecov-ruby/simplecov/releases/tag/v1.0.0), check it out as the new report UI is great.
- [telegram-bot-ruby 2.8](https://github.com/atipugin/telegram-bot-ruby) – Ruby wrapper for [Telegram Bot API](https://core.telegram.org/bots/api) 10.x.
- [MCP Ruby SDK 1.0](https://github.com/modelcontextprotocol/ruby-sdk) – Official Ruby SDK for the [Model Context Protocol](https://modelcontextprotocol.io/docs/2026-07-28/getting-started/intro).
- [Gibbon 4.0](https://github.com/amro/gibbon) – MailChimp Marketing API wrapper for Ruby.         

Curated by [Peter Cooper](https://twitter.com/cooperx86) and [Glenn Goodrich](https://twitter.com/ruprict).
Published by [Cooperpress](https://cooperpress.com/). 

[Change your email](https://rubyweekly.com/edit_subscription/*|UID|*) or [Stop getting this newsletter.](https://rubyweekly.com/leave/*|UID|*) 

© Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom 

Other weekly newsletters we publish include [Postgres Weekly](https://postgresweekly.com/), [React Status](https://react.statuscode.com/), [Frontend Focus](https://frontendfoc.us/), and [JavaScript Weekly](https://javascriptweekly.com/).