Plus the newest Pickaxe is in print, a neat Ruby idiom, and a big update for Spinel with a new WASM target.

#​825 — November 5, 2026

Read on the Web
Together with  FastRuby.io

Ruby Weekly

🔒 Rails 8.0.5.2 and 8.1.4.1 Released to Fix 21 Security Issues — A rare 21-advisory release, led by a critical Active Storage bug (when using ImageMagick/mini_magick) where attaching a specially crafted image can let an uploader write (and sometimes read) arbitrary files. A Strong Parameters bypass, remote_ip spoofing in 8.1, and more make this a key update.

Mike Dalessio (Rails Core)

💡 Christine Seeman's walkthrough covers the advisories you may want to give a closer look, what can break on upgrade, and workarounds if you can't upgrade.

🚨 Rails 8.0 Security Support Ends Nov 7. Upgrade with AI — Our AI agent works on your own CI and opens small PRs only when your suite is green. It dual-boots with `next_rails`. Nothing merges without your review. Join the beta waitlist and get a free Rails 8.1 readiness check.

FastRuby.io® | AI-native Rails Maintenance sponsor

Moment of Ruby: An Argument for Nothing — How can you tell "no argument was supplied" from an explicit nil or false without a sentinel constant? Here's a cute, small Ruby idiom to do it.

Chris Zempel (Aha!)

⚡️ IN BRIEF:

  • 📘 Programming Ruby 4, the sixth edition of the Pickaxe, is now in print!

  • 🇺🇸 RubyConf 2027 is heading to Portland, Oregon on May 24-26, with early-bird tickets going on sale November 11.

  • On Ruby 4.0, defining a method in a module costs more for each class that includes it, up to 4x slower than 3.4. Rails route helpers, in particular, run into this, and a backport to 4.0 has been requested.

  • 🇧🇪 Ruby is returning to FOSDEM with a 'Ruby Beyond Rails'-themed devroom on January 30 in Brussels. The CFP closes December 1.

  • RubyMine 2026.3, JetBrains' popular commercial Ruby IDE, has been released.

⚠️ Trilogy Fixes an SQL Injection in Rails' Favored MySQL Client — Trilogy, the MySQL client GitHub built and Rails recommends, had a 9.3-rated SQL injection vulnerability which has been fixed and requires an upgrade to v2.13.2+, if you're using it. Greg Molnar built a vulnerable app to see how bad the vulnerability is and found it's worse than he first thought.

Trilogy maintainers

🔒 It's a busy time for security releases, so I've included a section at the end of the issue rounding up some releases that have landed to fix numerous vulnerabilities.

A Look at Lemans, the Harness Behind the Agents on Rails Benchmark — A tour of the Ruby harness Evil Martians built for the Rails Foundation's coding agent benchmark, plus some fun in how agents have tried to cheat at it…

Dementyev and Petrov (Evil Martians)

Don't Make a Human Do What AI Is Amazing At — John shares Nunebot, the markdown prompt he uses to sweep his apps and gems, pick one fix per repo, prove the fix with a failing-then-passing test, and open a PR.

John Nunemaker

💡 Along similar lines, David Bryant Copeland asks why review AI-generated code at all, arguing the effort is better spent on tooling that catches problems mechanically.

Painless Web Scraping With The New SerpApi's Extract API — Scrape any public webpage or add search to your Ruby application with one developer-friendly API built by Ruby engineers.

SerpApi sponsor

📄 Modernizing a Rails App from 2018 – How an ancient Rails 5 app was ported by moving it into a fresh app rather than upgrading in place. I did an upgrade the hard way recently, and I don't blame them! Kevin Campusano

📺 When Rails Met Fibers: Migrating Sidekick from Puma to Falcon – A 42-minute keynote on moving Shopify's AI assistant onto Falcon. Williams, Lawhorn and Barnes

📄 When Two Background Jobs Target the Same Record – A lost-update reproduction under Solid Queue, and a look at where to fix it. Syed Aslam

📄 IP-Based Route Restrictions on Heroku with Rails Daniela Baron

📺 DHH's Kaigi on Rails 2026 Keynote: Where the Tracks Go Next

🛠 Code & Tools

Spinel 2026.10.25: Matz's Ruby Compiler Continues to Advance — The second dated release of Matz's ahead-of-time Ruby-to-native compiler brings in a ton of stuff since I reviewed it six months ago! It's faster, offers a new WASM target, supports more of the standard library, and strings now behave as single shared objects like in CRuby. It's a great time to play with it!

Yukihiro Matsumoto

💡 Stan Lo's new, one-page Spinel intro rounds the project up generally, and explains how it differs to CRuby, what it can't compile, and its ruby-bench results.

group_by_day Shouldn't Time Out on Your Biggest Table — TimescaleDB extends Postgres so daily counts stay fast on huge tables. Same ActiveRecord. Get $1000 credit.

Tiger Data (creators of TimescaleDB) sponsor

JRuby 10.1.3.0 Released with Many Fixes and Improvements — A big release for JRuby's Ruby 4.0-compatible line. Mutex, Queue and sockets now go through the Fiber scheduler, method and branch coverage are implemented (so SimpleCov's branch mode can work), and Prism is now merged into JRuby itself.

JRuby Team

💡 JRuby 10.0.8.0 also landed for those on the Ruby 3.4-compatible line.

Duel: Fail CI When Your Code Gets Slower — Runs your benchmarks on two versions of your code side by side and fails if the new code is slower.

Erik Berlin

QueryStash: Cache Hot, Slow-Changing Queries Below Active Record — Caches lookups of your choosing across requests at the adapter level (so your calls don't need to change) with TTLs calculated from each result.

Persona

rails-query-command: Use Rails 8.2's bin/rails query on 7.2 to 8.1 — A backport of Rails 8.2's forthcoming bin/rails query command that runs on older Rails versions. It runs Active Record expressions or SQL with database-write protection and returns paginated JSON, which is ideal for agents and scripts.

Lázaro Nixon

TaskProgress: Progress Bars for Task Trees, from Terminal to Browser — Track nested task trees spread across threads, Fibers, subprocesses and Ractors (on Ruby 4) and render them to a terminal/log/browser with SSE/Turbo.

Julik Tarkhanov

  • RubyGems and Bundler 4.0.24 – Bundler can now read the Ruby version from mise.toml's inline table form and reports which locked gems can't be materialized on your platform.

  • Ferrum 0.20 and Cuprite 0.20 – The Chrome/CDP driver and its Capybara adapter add page.console message collection and real Logger support.

  • Grover 2.0 – Security release for the library that transforms HTML into PDFs, PNGs or JPEGs using Puppeteer and Chromium.

  • Net::SSH 8.1 – Three breaking changes, including no interactive prompts when stdin isn't a TTY.

📰 Classifieds

More AI commits and more test runs mean more waiting. WarpBuild runs your Ruby CI 2x faster at half the cost. Get $50 in free credits with START50.

🔺 Made a library? Written a blog post? Found a useful tutorial? Share it with the Ruby community on RubyFlow, the Ruby and Rails community linklog.

⚠️ A recent wave of Ruby security news