Ruby Weekly
Latest Issue All Issues Subscribe
Plus a new mutation tester for Ruby, how to get Rails running under Ractors, and RuboCop's data-driven road to 2.0.

#​817 — September 17, 2026

Read on the Web
Together with  FastRuby.io

Ruby Weekly

Researchers Tie RubyGems' 'GemStuffer' Campaign to OpenAI Agents — Researchers say May's RubyGems spam flood came from OpenAI agents that ran code on RubyDoc.info and probed a key-leaking CDN bug. OpenAI has confirmed its agents were involved, but describes their actions as "benign tasks", while Ruby Central finds no evidence of successful key theft.

Kitts, Larsen, and Von Arx

💡 Truffle Security, which disclosed the caching bug in July, digs into the code from May that targeted it.

Upgrading Rails Is Dead Simple Now. So Why Are You Behind? — Wouldn't it be easier to have Rails upgrades on autopilot? Our AI tooling plus 60,000 dev hours of upgrade experience ships them in half the time, for a fixed monthly fee. Rails 8.0 loses security support Nov 7. Our clients have peace of mind.

🌳 Bonsai by FastRuby.io sponsor

Ractor-age Rails: A How-To Guide — A lot of work is being done to make Ractors a practical route to true parallelism in Ruby, but making Rails Ractor-able is a huge challenge. Hartley shares the patterns Shopify’s team is using to get there.

Hartley McGuire

Ruby 4.0.7 Released — A routine scheduled update with numerous bug fixes, like addressing a string corruption issue during automatic GC compaction and a YJIT perf issue when using multiple Ractors.

Takashi Kokubun (Ruby Core Team)

⚡️ IN BRIEF:

  • RubyGems and Bundler 4.0.21 add some hardening, including rejecting redirects that downgrade HTTPS to HTTP. bundle update --bundler also no longer pulls in prereleases unless you ask specifically.

  • TruffleRuby 40 has just dropped as we go to press – I'll be checking it out and featuring it next week!

  • 🤖 Agents on Rails Stage 2 goes beyond Stage 1's small tasks by having models build real features for 37signals' Fizzy app. GPT-6 Astra came out on top.

  • Ruby 4.1 will let method_defined? match private methods too using a new include_all third argument, saving a second lookup that Jean Boussier found took ~1% of a big Rails app's boot time.

  • Kevin Menard is now a Ruby core committer, with Matz greeting the nomination with "Sounds legit! Welcome to the core committer."

RuboCop 1.91: The Journey to 2.0 Begins — RuboCop's creator explains the new 'preview' mode and a shift to having fewer default cops enabled in 2.0, based on how popular Ruby projects configure it. He also has a request: “Run rubocop --preview on your codebase and tell us what you think.”

Bozhidar Batsov

▶  Building the Next-Generation Garbage Collector in Ruby — A RubyConf talk exploring Ruby’s modular garbage collector support and progress made on its MMTk-based alternative.

Peter Zhu

💡 This is just one of the many RubyConf videos that have landed on YouTube recently. I'll be covering more in coming weeks.

Switching APM? Compare AppSignal to Datadog, New Relic and Sentry — Side-by-side comparisons for Rails teams. Every feature on every plan, unlimited users, one predictable bill.

AppSignal sponsor

📄 Porting a Ruby Discord Bot to Microsoft Teams with AI – A before-and-after of porting the same Ruby bot twice, by hand in 2023 and with Copilot this week (token usage and sneaky bugs included). Daniel Doubrovkine

📄 Setting Boundaries: A Type for Ranges in Rails Kushagra Singh

📄 Innocent Looking Ruby Can Be Dangerous Greg Molnar

🛠 Code & Tools

Mutineer: Find Code Changes Your Tests Fail to Notice — A mutation tester that changes your code (using Prism) to find weaknesses in your tests. Supports Minitest and RSpec and is guided by code coverage to only run the test files that reach the mutated code each time.

David Teren

AI Shouldn't Cost More Than It Saves — We can find where LLMs pay off, validate with real data, and tune for cost/effectiveness. Need help? Let's talk.

SINAPTIA sponsor

Minitest Heat: A Way to Spot Where Test Failures Cluster — A reporter that makes it easier to identify patterns and hot spots when testing. More detail and an example here. v2.2 supports Minitest 6 with explicit plugin activation using Minitest.load :heat.

Garrett Dimon

pg_search 2.4: Active Record Named Scopes for Postgres Full Text Search — The README is packed with examples, but the basic idea is you get a DSL to lean on Postgres’s FTS features in Rails apps. Now requires Ruby 3.3+ and Active Record 8.0+.

CaseBook

  • Resque 3.1 – The popular Redis-backed background job library is back with a "Clearing the PR Queue Release" closing almost a decade of PRs… 😅

  • Mission Control - Jobs 1.3 – The official Rails dashboard for Solid Queue (and Resque!) now shows batches.

  • JWT 3.3 – Implementation of the RFC 7519 OAuth JSON Web Token (JWT) standard.

  • parallel_tests 5.8 – Faster Minitest, RSpec, and more, by running in parallel on multiple cores.

  • Amoeba 3.4 – Easily clone Active Record objects including their associations.

  • SimpleCov 1.3

📰 Classifieds

You already trust Postgres for Rails. TimescaleDB extends it for time-series and analytics, no second database. Get $1000 credit.

At Rails World? Wed 9/23, 6-8pm in Austin: Tacos at sunset with AppSignal. Donut tower, swag, nerdy ice breakers. RSVP.

📢  Elsewhere in the ecosystem

Issue 816 #817