--- title: "How fast can you actually patch Ruby?" publication: "Ruby Weekly" issue: 824 published_at: "2026-10-29" canonical_url: "https://rubyweekly.com/issues/824" --- Plus an experiment in memory-safe Ruby, Spree 6.0's big rewrite, and quieting bot noise in Rails. #โ€‹824 โ€” October 29, 2026 [Read on the Web](https://rubyweekly.com/issues/824) ๐Ÿ”’ Last Friday we sent out [a special issue about some CRuby security releases](https://rubyweekly.com/issues/823) which fixed a few nasty regexp bugs. If you haven't updated yet, it's worth a read to see if you're affected and what to check! __ _Your editor, Peter Cooper_ Together with [![Tiger Data logo\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_1280,h_282/e_make_transparent/co_white,e_outline:30/px1u7kjyvz7xnbm6ytir.png)](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=ruby-weekly-newsletter) Ruby Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/cblgc1ggermkssfawdvg.jpg)](https://paagman.dev/how-fast-can-you-patch-ruby/) [How Fast Can You Actually Patch Ruby?](https://paagman.dev/how-fast-can-you-patch-ruby/) โ€” When the Ruby security fixes shipped last week, Dennis timed how long they took to reach version managers, Docker images, CI services and hosts. The core team's image took eight minutes, while Docker's official image (Rails and Kamal's default) took ~16 hours. Dennis Paagman ๐Ÿ’ก Things are improving, though, as Ruby core team members now have commit access to Docker's Ruby image repo and are [looking into automating updates](https://github.com/docker-library/official-images/issues/22616). Meanwhile, Greg Molnar shows how to [build your own image locally and deploy it with Kamal](https://greg.molnar.io/blog/deploying-with-kamal-using-a-locally-built-ruby-image/). [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/999fbf1c.png)](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=ruby-weekly-newsletter) [Your Dashboard Shouldnโ€™t Wait for a Cron Job](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=ruby-weekly-newsletter) โ€” The nightly job rolls up yesterdayโ€™s rows so the dashboard loads. Numbers lag a day and the job keeps growing. TimescaleDB continuous aggregates refresh rollups inside Postgres, so ActiveRecord reads fresh totals. [Get $1000 credit to start](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=ruby-weekly-newsletter). Tiger Data (creators of TimescaleDB) sponsor [Bad Requests and the Dream of a Quiet Rails App](https://island94.org/2026/10/bad-requests-and-the-dream-of-a-quiet-rails-app) โ€” Requests for `/.env` and `/wp-admin`, binary bytes in `User-Agent` headers, made-up MIME typesโ€ฆ Ben walks through the Rails middleware stack to show why some junk requests become 500s, and why even 'handled' ones can still set off your error monitor. Ben Sheldon [What's New at RubyGems.org: Ruby Central's Changelog Returns](https://rubycentral.org/news/ruby-centrals-oss-changelog-october-2026/) โ€” Ruby Central catches us up on RubyGems.org and Bundler 4.1 work. Its AI scans of popular gems are a highlight: reviewers rejected 90% of the findings they looked into, though one was a critical [auth bypass in `rubyntlm`](https://github.com/WinRb/rubyntlm/security/advisories/GHSA-cx24-f932-rr55). Kirk Haines (Ruby Central) [Thank You, But I Prefer It My Way](https://blog.julik.nl/2026/10/thanks-but-i-prefer-it-my-way) โ€” If an LLM can just rewrite a library, is it worth persuading a maintainer about your PR or do you just route around it? Julik ponders the complexities and offers some practical ways forward. Julik Tarkhanov [I Get 215 GitHub Notifications a Day, So I Built a Bot to Triage Them](https://paolino.me/copilot-triage/) โ€” A look at how the creator of [RubyLLM](https://rubyllm.com/) built a RubyLLM-powered agent to label issues and PRs, reply only when useful, and sort the rest onto a board. Carmine Paolino ๐Ÿ“„ [Parsing JSON-Structured Docker Logs with the OpenTelemetry Collector](https://dev.37signals.com/parsing-json-docker-logs-with-opentelemetry-collector/) โ€“ How 37signals unwraps the JSON-in-JSON logs from its Kamal-deployed Rails apps. Lewis Buckley (37signals) ๐Ÿ“„ [Benchmarking Campfire with Many Users](https://intertwingly.net/blog/2026/10/25/Benchmarking-Campfire-with-Many-Users.html) โ€“ Sam load-tests Campfire with up to 3,000 users, opens three PRs, and compares Rails with his Roundhouse-transpiled build on Falcon. Sam Ruby ๐Ÿ“„ [React Server Components on a Gumroad Fork: From 53 to 86 on Mobile PageSpeed](https://shakacode.com/blog/gumroad-inertia-react-server-components/) โ€“ Compares live RSC and Inertia versions of a product page, using the commercial [React on Rails Pro](https://reactonrails.com/docs/pro/). Justin Gordon (ShakaCode) ๐Ÿ“„ [Making AI Agents Safe to Retry](https://www.fastruby.io/blog/making-ai-agents-safe-to-retry.html) โ€“ Moving an LLM agent into a Sidekiq job without retries repeating its actions. Mateus Pereira (FastRuby.io) ๐Ÿ›  Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/jz0wih3pg2u5ksrgecxq.jpg)](https://carton.dtcristo.com/) [Carton: Real Boundaries for Ruby](https://carton.dtcristo.com/) โ€” Built on Ruby 4's experimental [`Ruby::Box`](https://docs.ruby-lang.org/en/master/Ruby/Box.html), Carton enforces module boundaries at runtime where only what a 'carton' `export`s is visible outside it, monkey patches to core classes stay contained, and each carton can bring [its own gem versions](https://carton.dtcristo.com/guides/examples/). David Cristofaro [๐Ÿšจ Rails 8.0 Support Ends Nov 7 | Get AI Upgrades on Autopilot](https://go.fastruby.io/fb7) โ€” Our AI agent ships small upgrade PRs that pass your tests; nothing merges without you. [Join the beta waitlist](https://go.fastruby.io/fb7). FastRuby.ioยฎ | AI-Native Rails Maintenance sponsor [Spree 6.0: A Rewrite of the Rails E-Commerce Platform](https://github.com/spree/spree/releases/tag/v6.0.0) โ€” Marketplace, B2B, tax and inventory features are now in the open source core, carts and orders are separate models, and the checkout state machines are gone. Note that Rails now powers only the backend, with a React admin and Next.js storefront. Spree Commerce [GenevaDrive: Durable, Step-Based Workflows for Rails](https://geneva-drive.dev/) โ€” Define multi-step workflows tied to a record, with waits, resumable steps over large collections, and signals from webhooks. State lives in your database, with steps surviving restarts and duplicate job runs being skipped. Julik Tarkhanov โฑ๏ธ [Horologium: Scientific Time Library for Ruby](https://blog.rhannequ.in/posts/introducing-horologium) โ€” A new gem, extracted from [Astronoby](https://github.com/rhannequin/astronoby), that handles eight time scales including TAI, TT, TDB, UTC and UT1, plus leap seconds (which `Time` can't represent) and precise Julian dates. Rรฉmy Hannequin - โญ [RubyGems and Bundler 4.1.0.beta3](https://blog.rubygems.org/2026/10/28/4.1.0.beta3-released.html) renames Bundler's new `override` keys to `in:` and `with:`, and records overrides in a new `OVERRIDES` section of `Gemfile.lock`. - [Prosopite 2.5](https://github.com/charkost/prosopite/blob/main/CHANGELOG.md) โ€“ N+1 query detector. Now suggests fixes, adds RSpec and Minitest assertions, and can ignore known N+1s while you adopt it gradually. - [OmniAuth 2.2 / 2.3](https://github.com/omniauth/omniauth/blob/master/CHANGELOG.md) โ€“ Multi-provider auth. The first new minor versions since 2022 add `allowed_hosts` and support for concurrent sign-ins. - [The Git Gem 6.0](https://github.com/ruby-git/ruby-git/releases/tag/v6.0.0) โ€“ Ruby interface to the `git` command line. A big breaking release that removes the old object model and requires Git 2.43+. - [ruby-duckdb 2.0](https://github.com/suketa/ruby-duckdb/blob/main/CHANGELOG.md) โ€“ Ruby client for the DuckDB analytical database, now tracking [DuckDB 2.0](https://duckdb.org/2026/10/21/announcing-duckdb-200.html) and dropping several deprecated APIs. - [Rage 1.29](https://github.com/rage-rb/rage/releases/tag/v1.29.0) โ€“ Fiber-based, Rails-compatible API framework, now ready for Ruby 4.1's fiber scheduler changes. ๐Ÿ“ข Elsewhere in the ecosystem - Sean Goedecke argues that [software is slow because of bad design, not slow languages](https://seangoedecke.com/software-is-slow-because-of-bad-design-not-slow-languages/), drawing on his experience of staring at Ruby flamegraphs and profiling Rails endpoints. - Nate Berkopec ported [Ruby 4.0.9](https://github.com/nateberkopec/ruby-filc) to [Fil-C](https://github.com/pizlonator/fil-c), a memory-safe C toolchain. It ran real programs like Puma, but was ~5x slower and used far more memory, so Nate has ๐• [declared the experiment over](https://x.com/nateberkopec/status/2115326361351135339). - Python's experimental JIT [is likely to be removed](https://lwn.net/SubscriberLink/1102102/0c00e4d550f25f8c/). Ruby came up a lot [in the related Hacker News thread](https://news.ycombinator.com/item?id=50257419), where Jean Boussier [credited Matz](https://news.ycombinator.com/item?id=50261513) for supporting work on Ruby's JITs. - Sentry has [given $1m to open source maintainers](https://blog.sentry.io/another-year-another-1-000-000-to-open-source-maintainers/) this year, up from $750k, with $40,000 going to Ruby Central. Curated by [Peter Cooper](https://twitter.com/cooperx86) and [Glenn Goodrich](https://twitter.com/ruprict). Published by [Cooperpress](https://cooperpress.com/). [Change your email](https://rubyweekly.com/edit_subscription/*|UID|*) or [Stop getting this newsletter.](https://rubyweekly.com/leave/*|UID|*) ยฉ Cooper Press Ltd ยท Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom Other weekly newsletters we publish include [Postgres Weekly](https://postgresweekly.com/), [React Status](https://react.statuscode.com/), [Frontend Focus](https://frontendfoc.us/), and [JavaScript Weekly](https://javascriptweekly.com/).