---
title: "Patch Rails now: 21 security fixes in one release"
publication: "Ruby Weekly"
issue: 825
published_at: "2026-11-05"
canonical_url: "https://rubyweekly.com/issues/825"
---

Plus the newest Pickaxe is in print, a neat Ruby idiom, and a big update for Spinel with a new WASM target.        

#​825 — November 5, 2026 

[Read on the Web](https://rubyweekly.com/issues/825)  

Together with [![FastRuby.io\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_467,h_106/e_make_transparent/co_white,e_outline:14/y65nyff19ylf5udphsq4.png)](https://go.fastruby.io/pqt)   

Ruby Weekly 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/wk23kxvdsqvd7rhiqr2g.jpg)](https://rubyonrails.org/2026/11/4/Rails-8.0.5.2-and-8.1.4.1-have-been-released)  

🔒 [Rails 8.0.5.2 and 8.1.4.1 Released to Fix 21 Security Issues](https://rubyonrails.org/2026/11/4/Rails-8.0.5.2-and-8.1.4.1-have-been-released) — A rare 21-advisory release, led by a _critical_ Active Storage bug (when using ImageMagick/`mini_magick`) where attaching a specially crafted image can let an uploader write (and sometimes read) arbitrary files. A [Strong Parameters](https://api.rubyonrails.org/classes/ActionController/StrongParameters.html) bypass, `remote_ip` spoofing in 8.1, and more make this a key update. 

Mike Dalessio (Rails Core)  

💡 [Christine Seeman's walkthrough](https://christine-seeman.com/rails-8-0-5-2-and-8-1-4-1-security-releases/) covers the advisories you may want to give a closer look, what can break on upgrade, and workarounds if you _can't_ upgrade.  [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/acf02560.png)](https://go.fastruby.io/pqt) 

[🚨 Rails 8.0 Security Support Ends Nov 7. Upgrade with AI](https://go.fastruby.io/pqt) — Our AI agent works on your own CI and opens small PRs only when your suite is green. It dual-boots with `next_rails`. Nothing merges without your review. [Join the beta waitlist and get a free Rails 8.1 readiness check](https://go.fastruby.io/pqt). 

FastRuby.io® | AI-native Rails Maintenance sponsor   

[Moment of Ruby: An Argument for Nothing](https://www.aha.io/engineering/articles/moment-of-ruby-an-argument-for-nothing) — How can you tell "no argument was supplied" from an explicit `nil` or `false` without a sentinel constant? Here's a cute, small Ruby idiom to do it. 

Chris Zempel (Aha!)   

**⚡️ IN BRIEF:** 

- 📘 [Programming Ruby 4](https://pragprog.com/titles/ruby6/programming-ruby-4-6th-edition/), the sixth edition of the _Pickaxe_, is now in print!
- 🇺🇸 [RubyConf 2027](https://rubyconf.org/) is heading to Portland, Oregon on May 24-26, with early-bird tickets going on sale November 11.
- On Ruby 4.0, defining a method in a module costs more for each class that includes it, [up to 4x slower than 3.4](https://bugs.ruby-lang.org/issues/22488). Rails route helpers, in particular, run into this, and a backport to 4.0 has been requested.
- 🇧🇪 Ruby is [returning to FOSDEM](https://www.reddit.com/r/ruby/comments/1xms7e5/ruby_is_back_at_fosdem_in_2027_and_ruby_for_good/) with a _'Ruby Beyond Rails'_-themed [devroom](https://fosdem.org/2027/news/accepted-developer-rooms/) on January 30 in Brussels. [The CFP](https://pretalx.fosdem.org/fosdem-2027/cfp) closes December 1.
- [RubyMine 2026.3](https://blog.jetbrains.com/ruby/2026/11/rubymine-2026-3-jetbrains-air-native-mode-for-wsl-and-dev-containers-and-more/), JetBrains' popular commercial Ruby IDE, has been released.   

⚠️ [Trilogy Fixes an SQL Injection in Rails' Favored MySQL Client](https://github.com/trilogy-libraries/trilogy/security/advisories/GHSA-744p-w4gc-m3gh) — [Trilogy](https://github.blog/open-source/maintainers/introducing-trilogy-a-new-database-adapter-for-ruby-on-rails/), the MySQL client GitHub built and Rails recommends, had a 9.3-rated SQL injection vulnerability which has been fixed and requires an upgrade to v2.13.2+, if you're using it. Greg Molnar built a vulnerable app to see how bad the vulnerability is and [found it's worse than he first thought](https://greg.molnar.io/blog/sql-injection-in-the-trilogy-mysql-adapter/). 

Trilogy maintainers  

🔒 It's a busy time for security releases, so I've included a section at the end of the issue rounding up some releases that have landed to fix numerous vulnerabilities.  

[A Look at Lemans, the Harness Behind the _Agents on Rails_ Benchmark](https://evilmartians.com/chronicles/the-agents-on-rails-files-enter-lemans-a-ruby-harness-for-fair-agent-races) — A tour of the Ruby harness Evil Martians built for the Rails Foundation's [coding agent benchmark](https://rubyonrails.org/ai), plus some fun in how agents have tried to cheat at it… 

Dementyev and Petrov (Evil Martians)   

[Don't Make a Human Do What AI Is Amazing At](https://www.johnnunemaker.com/dont-make-a-human-do-what-ai-is-amazing-at/) — John shares [Nunebot](https://gist.github.com/jnunemaker/e421523d2508716450d41a5d785e48ce), the markdown prompt he uses to sweep his apps and gems, pick one fix per repo, prove the fix with a failing-then-passing test, and open a PR. 

John Nunemaker  

💡 Along similar lines, David Bryant Copeland asks [why review AI-generated code at all](https://naildrivin5.com/blog/2026/11/03/why-review-ai-generated-code.html), arguing the effort is better spent on tooling that catches problems mechanically.  

[Painless Web Scraping With The New SerpApi's Extract API](https://serpapi.com/cooperpress-newsletter) — Scrape any public webpage or add search to your Ruby application with one developer-friendly API built by Ruby engineers. 

SerpApi sponsor   

📄 [Modernizing a Rails App from 2018](https://www.endpointdev.com/blog/2026/10/modernizing-rails-app-from-last-decade/) – How an ancient Rails 5 app was ported by moving it into a fresh app rather than upgrading in place. I did an upgrade the hard way recently, and I don't blame them! Kevin Campusano 

📺 [When Rails Met Fibers: Migrating Sidekick from Puma to Falcon](https://www.rubyevents.org/talks/opening-keynote-when-rails-met-fibers-migrating-sidekick-from-puma-to-falcon) – A 42-minute keynote on moving Shopify's AI assistant onto[Falcon](https://github.com/socketry/falcon). Williams, Lawhorn and Barnes 

📄 [When Two Background Jobs Target the Same Record](https://railsrevelry.substack.com/p/when-two-background-jobs-target-the-same-record) – A lost-update reproduction under Solid Queue, and a look at where to fix it. Syed Aslam 

📄 [IP-Based Route Restrictions on Heroku with Rails](https://danielabaron.me/blog/ip-based-route-restrictions-on-heroku-with-rails/) Daniela Baron 

📺 [DHH's _Kaigi on Rails 2026_ Keynote: Where the Tracks Go Next](https://www.youtube.com/watch?v=ayVzHr75gls)  

🛠 Code & Tools 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/kwfopyhyzzdffb8ycbz8.jpg)](https://github.com/matz/spinel/releases/tag/2026.10.25)  

[Spinel 2026.10.25: Matz's Ruby Compiler Continues to Advance](https://github.com/matz/spinel/releases/tag/2026.10.25) — The second dated release of Matz's ahead-of-time Ruby-to-native compiler brings in a ton of stuff since [I reviewed it six months ago](https://rubyinside.com/spinel/)! It's faster, offers a new WASM target, supports more of the standard library, and strings now behave as single shared objects like in CRuby. It's a great time to play with it! 

Yukihiro Matsumoto  

💡 Stan Lo's [new, one-page Spinel intro](https://st0012.dev/spinel/?v=1) rounds the project up generally, and explains how it differs to CRuby, what it _can't_ compile, and its [ruby-bench](https://github.com/ruby/ruby-bench) results.  

[`group_by_day` Shouldn't Time Out on Your Biggest Table](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=ruby-weekly-newsletter) — TimescaleDB extends Postgres so daily counts stay fast on huge tables. Same ActiveRecord. [Get $1000 credit](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=ruby-weekly-newsletter). 

Tiger Data (creators of TimescaleDB) sponsor   

[JRuby 10.1.3.0 Released with Many Fixes and Improvements](https://www.jruby.org/2026/11/05/jruby-10-1-3-0.html) — A big release for JRuby's Ruby 4.0-compatible line. Mutex, Queue and sockets now go through the Fiber scheduler, method and branch coverage are implemented (so SimpleCov's branch mode can work), and Prism is now merged into JRuby itself. 

JRuby Team  

💡 [JRuby 10.0.8.0](https://www.jruby.org/2026/11/05/jruby-10-0-8-0.html) also landed for those on the Ruby 3.4-compatible line.  

[Duel: Fail CI When Your Code Gets Slower](https://github.com/sferik/duel-ruby) — Runs your benchmarks on two versions of your code side by side and fails if the new code is slower. 

Erik Berlin   

[QueryStash: Cache Hot, Slow-Changing Queries Below Active Record](https://github.com/persona-id/query_stash) — Caches lookups of your choosing across requests at the adapter level (so your calls don't need to change) with TTLs calculated from each result. 

Persona   

[rails-query-command: Use Rails 8.2's `bin/rails query` on 7.2 to 8.1](https://github.com/lazaronixon/rails-query-command) — A backport of Rails 8.2's forthcoming `bin/rails query` command that runs on older Rails versions. It runs Active Record expressions or SQL with database-write protection and returns paginated JSON, which is ideal for agents and scripts. 

Lázaro Nixon   

[TaskProgress: Progress Bars for Task Trees, from Terminal to Browser](https://github.com/julik/task_progress) — Track nested task trees spread across threads, Fibers, subprocesses and Ractors (on Ruby 4) and render them to a terminal/log/browser with SSE/Turbo. 

Julik Tarkhanov   

- [RubyGems and Bundler 4.0.24](https://blog.rubygems.org/2026/11/05/4.0.24-released.html) – Bundler can now read the Ruby version from `mise.toml`'s inline table form and reports which locked gems can't be materialized on your platform.
- [Ferrum 0.20](https://github.com/rubycdp/ferrum/releases/tag/v0.20.0) and [Cuprite 0.20](https://github.com/rubycdp/cuprite/releases) – The Chrome/CDP driver and its Capybara adapter add `page.console` message collection and real `Logger`support.
- [Grover 2.0](https://github.com/Studiosity/grover/blob/main/CHANGELOG.md) – Security release for the library that transforms HTML into PDFs, PNGs or JPEGs using Puppeteer and Chromium.
- [Net::SSH 8.1](https://github.com/net-ssh/net-ssh/blob/master/CHANGES.txt) – Three breaking changes, including no interactive prompts when stdin isn't a TTY.       

📰 Classifieds   

More AI commits and more test runs mean more waiting. [WarpBuild](https://www.warpbuild.com/start?utm_source=cooperpress&utm_medium=newsletter&utm_campaign=h2-2026&utm_content=rubyweekly-2026-11-05) runs your Ruby CI 2x faster at half the cost. [Get $50 in free credits](https://www.warpbuild.com/start?utm_source=cooperpress&utm_medium=newsletter&utm_campaign=h2-2026&utm_content=rubyweekly-2026-11-05) with`START50`. 

--- 

🔺 Made a library? Written a blog post? Found a useful tutorial? [Share it with the Ruby community on RubyFlow](https://rubyflow.com), the Ruby and Rails community linklog.    

⚠️ A recent wave of Ruby security news  

- Following the [regexp fixes we covered in our emergency issue](https://rubyweekly.com/issues/823), k0kubun has asked Ruby core to decide [whether compiling untrusted strings into a Regexp should be supported at all](https://bugs.ruby-lang.org/issues/22502), and if so, to request CVEs for them. It goes to the November 12 dev meeting. Meanwhile, Infield shows [how to probe an end-of-life Ruby](https://infield.ai/post/vulnerable-ruby-regex) for the bugs.
- A dozen advisories have hit Ruby's HTML sanitizing stack: [Loofah 2.25.3](https://github.com/flavorjones/loofah/releases/tag/v2.25.3), [Nokogiri 1.19.5+](https://github.com/sparklemotion/nokogiri/releases), [rails-html-sanitizer 1.7.2](https://github.com/rails/rails-html-sanitizer/releases/tag/v1.7.2) and [Sanitize 7.0.2](https://github.com/rgrove/sanitize/releases). The big one is a mutation XSS in Loofah's HTML5 scrubbers that affects the _default_ allowlist.
- [Rack 3.2.8, 3.1.23 and 2.2.25](https://github.com/rack/rack/security/advisories) fix four issues, the biggest being a multipart parser that retained parsed data in its scan buffer, so a malicious upload could exhaust memory.
- [Addressable 2.9.1](https://github.com/sporkmonger/addressable/security/advisories) ships fixes for seven advisories, two of them reported by Ruby Central's new gem security effort.
- v0.9.2 of the [`brotli` gem](https://github.com/miyucy/brotli/issues/64) bundles the patched Brotli 1.2.1, closing an [actively exploited decoder RCE](https://broccoli2shell.com/) that's recently hit Node and browsers.
- [Ransack 6.0.1](https://github.com/activerecord-hackery/ransack/releases/tag/v6.0.1) (plus 5.0.3 and 4.4.4) stops `sort_link` passing URL options like `script_name` through from params, an open redirect and XSS.         

Curated by [Peter Cooper](https://twitter.com/cooperx86) and [Glenn Goodrich](https://twitter.com/ruprict).
Published by [Cooperpress](https://cooperpress.com/). 

[Change your email](https://rubyweekly.com/edit_subscription/*|UID|*) or [Stop getting this newsletter.](https://rubyweekly.com/leave/*|UID|*) 

© Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom 

Other weekly newsletters we publish include [Postgres Weekly](https://postgresweekly.com/), [React Status](https://react.statuscode.com/), [Frontend Focus](https://frontendfoc.us/), and [JavaScript Weekly](https://javascriptweekly.com/).