Issue #826: What's new in RubyGems and Bundler 4.1

#826 — November 12, 2026

Together with

Metaprogramming on a Budget — A "peek behind the curtain of Rails' metaprogramming magic!" Active Record generates 21 methods for every column, which could eat a lot of memory, but a little define_method trick allows methods to share compiled instruction sequences…

Hartley McGuire (Rails at Scale)

💡 The follow-up Hartley mentions at the end has just been merged: Aaron Patterson's PR stores Active Record attributes in an array so reader methods can be shared by column position, with the reading of attributes getting up to 1.3x faster.

Leaving New Relic? No NRQL, No Regex, No API Calls Required — AppSignal skips the query language: tags filter in the UI, deploy markers work out of the box, and sensitive data is scrubbed with a simple denylist. Errors, N+1s, Sidekiq and logs in one Ruby gem. Unlimited users, 30-day trial.

AppSignal sponsor

What's New in RubyGems and Bundler 4.1 — RubyGems' maintainer wraps up a three-part tour of version 4.1, currently in beta. In this final part, Hiroshi focuses on gem install's improved efficiency, but if you want to go back, part 1 covers override (to rewrite version constraints) and prune (for cleaning up after installs), and part 2 focuses on supply chain defenses like cooldown.

Hiroshi Shibata

⚡️ IN BRIEF:

🇺🇸 Those earlybird tickets for RubyConf 2027 (in Portland next May) we mentioned last week are now on sale! Also, Blue Ridge Ruby is returning to Asheville on April 29-30 and the CFP is open until January 29.
🔒 Rails 8.0 left security support on November 7, making last week's 8.0.5.2 its final fix. Rails 8.1 is covered until October 2027. I hope 8.2 is out by then…! 😅
🔒 Earlier this month, a malicious gem called strutil-core ran a credential-stealing worm at gem install time via its extconf.rb. RubyGems pulled it within hours and Socket knows of no victims.
📘 Eustáquio Rangel has been updating Brazil's first Ruby book for over 20 years. It's now in English as Meet Ruby, a "live book" that keeps evolving with the language, and covers fundamentals through to Ractors and RubyLLM.
The Bridgetown Ruby site generator is looking for sponsors to help keep development going.

Releasing Gems with OIDC and GitHub Actions — Releasing a gem has always involved numerous steps and modern security concerns have added a few more… but automation can help. ruby-gem-release does it all from a GitHub Actions workflow, using Trusted Publishing so no RubyGems API key is needed.

Daniel Doubrovkine

Hand-Coding a Feature in a Ruby Gem — After a year off from technical blogging, Felipe comes back with a tale of adding a feature to his personal reading log gem and the benefits he got from not using AI.

Felipe Vogel

A Closer Look at the Critical Active Storage ImageMagick Issue — Greg reproduces the 9.8-rated bug fixed in last week's Rails releases by showing how crafted uploads can expose files like master.key in a vulnerable app using MiniMagick and local disk storage.

Greg Molnar

🚨 Rails 8.0 Support Has Ended. Get Your Upgrade on Autopilot — Join the beta to get access to our AI agent + a free 8.1 readiness check; get small green PRs you can review and merge.

FastRuby.io® | AI-native Rails Maintenance sponsor

📄 Drawing an SVG Sky Map with Ruby and Astronoby – Plot the sky for any date and place with a star catalogue and a little trigonometry. Rémy Hannequin

📄 Going All-In on Sorbet: Typing an Entire Rails App in Four Days Nathan Broadbent (DocSpring)

🤖 How Can You Be Responsible for Code You Don't Understand? David Bryant Copeland

📄 Writing Ruby Extensions in Odin Michael Kohl

🛠 Code & Tools

🤖 RubyLLM 2.2: Sandboxed Code Execution, Skills, and More — The AI framework now lets models run code they write in a sandbox (using Bubblewrap on Linux or macOS's native sandbox). Also new are skills, tools that can pause to ask questions, and four more providers. What's New in 2.2 has the full laundry list!

Carmine Paolino

Deleting Old Rows Shouldn’t Be Your Slowest Rake Task — TimescaleDB drops old data by the chunk, no bloat. Same Postgres, same ActiveRecord. $1000 credit on Tiger Cloud.

Tiger Data (creators of TimescaleDB) sponsor

Panko 1.0: The Fast JSON Serializer Drops Its C Extension — Panko made its name as a fast JSON serializer that shipped a C extension, but v1.0 goes for a pure Ruby engine that compiles each serializer into code YJIT can optimize (and it's now faster in most cases too). More on its design here.

Yosi Attias

protostar: Protocol Buffers in Pure Ruby — A "slightly unhinged" take on protobufs that compiles .proto files without protoc. It's slower than native and experimental, but passes protobuf's conformance suite.

Julik Tarkhanov

Minitest 6.1 – Adds abstract_test_case! for base test classes and supports Prism 2.0. There's also now an official AI policy which is… "just NO".
rspec-rails 8.1 – Now officially supports Rails 8.1. The dev branch already supports Rails 8.2, too, if you need that.
Facets 4.1 – The veteran core extensions library now aligns several overlapping methods with Active Support 8.1.
Stripe Ruby 21.0 – API keys are no longer kept in Marshal or YAML dumps of Stripe objects.

📢 Elsewhere in the ecosystem

A few months ago we linked to Rémi Mercier's project to create a Ruby-themed stained glass panel and it's now almost ready for sale. Along the way, he's been blogging about how it's coming together, including the design of its lighting stand.
🎥 Paul Irish's chrome-capture records Chrome tabs directly to MP4 at 60+ FPS, including audio. Could be handy for recording app demos or reproducing bugs, and no ffmpeg is required.
🤖 Chrome's Modern Web Guidance has reached 1.0, giving coding agents access to browser compatibility data, HTML, CSS and accessibility advice, and frontend best practices.
🔎 Betterleaks, started by Gitleaks' original creator, is a Go-powered tool to scan Git repos for leaked secrets.