---
title: "What's new in RubyGems and Bundler 4.1"
publication: "Ruby Weekly"
issue: 826
published_at: "2026-11-12"
canonical_url: "https://rubyweekly.com/issues/826"
---

Plus how Rails shares generated code, a closer look at last week's Active Storage bug, and RubyLLM gets sandboxed code execution.        

#​826 — November 12, 2026 

[Read on the Web](https://rubyweekly.com/issues/826)  

Together with [![AppSignal logo\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_1280,h_372/co_white,e_outline:7/nl4ksfby2hmtz6vx5vzw.png)](https://www.appsignal.com/alternative/new-relic-alternative?utm_medium=paid&utm_campaign=rubyweekly&utm_source=rubyweekly&utm_content=primary&utm_term=1112)   

Ruby Weekly 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/icywalpivxv4dho6ohgc.jpg)](https://railsatscale.com/2026-11-09-metaprogramming-on-a-budget/)  

[Metaprogramming on a Budget](https://railsatscale.com/2026-11-09-metaprogramming-on-a-budget/) — A _"peek behind the curtain of Rails' metaprogramming magic!"_ Active Record generates 21 methods for every column, which _could_ eat a lot of memory, but a little `define_method` trick allows methods to share compiled instruction sequences… 

Hartley McGuire (Rails at Scale)  

💡 The follow-up Hartley mentions at the end has just been merged: Aaron Patterson's PR [stores Active Record attributes in an array](https://github.com/rails/rails/pull/59141) so reader methods can be shared by column position, with the reading of attributes getting up to 1.3x faster.  [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/26abe793.png)](https://www.appsignal.com/alternative/new-relic-alternative?utm_medium=paid&utm_campaign=rubyweekly&utm_source=rubyweekly&utm_content=primary&utm_term=1112) 

[Leaving New Relic? No NRQL, No Regex, No API Calls Required](https://www.appsignal.com/alternative/new-relic-alternative?utm_medium=paid&utm_campaign=rubyweekly&utm_source=rubyweekly&utm_content=primary&utm_term=1112) — AppSignal skips the query language: tags filter in the UI, deploy markers work out of the box, and sensitive data is scrubbed with a simple denylist. Errors, N+1s, Sidekiq and logs in one Ruby gem. [Unlimited users, 30-day trial](https://www.appsignal.com/alternative/new-relic-alternative?utm_medium=paid&utm_campaign=rubyweekly&utm_source=rubyweekly&utm_content=primary&utm_term=1112). 

AppSignal sponsor   

[What's New in RubyGems and Bundler 4.1](https://dev.to/hsbt/whats-new-in-rubygemsbundler-41-part-3-unifying-rubygems-and-bundler-and-what-gem-install-no-300h) — RubyGems' maintainer wraps up a three-part tour of version 4.1, currently in beta. In this final part, Hiroshi focuses on `gem install`'s improved efficiency, but if you want to go back, [part 1](https://dev.to/hsbt/whats-new-in-rubygemsbundler-41-part-1-override-and-prune-2ngn) covers `override` (to rewrite version constraints) and `prune` (for cleaning up after installs), and [part 2](https://dev.to/hsbt/whats-new-in-rubygemsbundler-41-part-2-defenses-against-supply-chain-attacks-e70) focuses on supply chain defenses like cooldown. 

Hiroshi Shibata   

**⚡️ IN BRIEF:** 

- 🇺🇸 Those earlybird tickets for [RubyConf 2027](https://rubyconf.org/) (in Portland next May) we mentioned last week are now on sale! Also, [Blue Ridge Ruby](https://blueridgeruby.com/) is returning to Asheville on April 29-30 and [the CFP is open](https://blueridgeruby.com/cfp/) until January 29.
- 🔒 [Rails 8.0 left security support](https://rubyonrails.org/maintenance) on November 7, making last week's 8.0.5.2 its final fix. Rails 8.1 is covered until October 2027. I hope 8.2 is out by then…! 😅
- 🔒 Earlier this month, a malicious gem called `strutil-core` [ran a credential-stealing worm at `gem install` time](https://socket.dev/blog/shai-hulud-descendant-malicious-ruby-gem) via its `extconf.rb`. RubyGems pulled it within hours and Socket knows of no victims.
- 📘 Eustáquio Rangel has been updating [Brazil's first Ruby book](https://leanpub.com/conhecendo-ruby) for over 20 years. It's now in English as [_Meet Ruby_](https://leanpub.com/meet-ruby), a "live book" that keeps evolving with the language, and covers fundamentals through to Ractors and RubyLLM.
- The [Bridgetown](https://www.bridgetownrb.com/) Ruby site generator is [looking for sponsors](https://www.bridgetownrb.com/news/fundraising-to-save-bridgetown/) to help keep development going.   

[Releasing Gems with OIDC and GitHub Actions](https://code.dblock.org/2026/11/07/releasing-ruby-gems-with-oidc-and-github-actions.html) — Releasing a gem has always involved numerous steps and modern security concerns have added a few more… but automation can help. [ruby-gem-release](https://github.com/dblock/ruby-gem-release) does it all from a GitHub Actions workflow, using Trusted Publishing so no RubyGems API key is needed. 

Daniel Doubrovkine   

[Hand-Coding a Feature in a Ruby Gem](https://fpsvogel.com/posts/2026/hand-coding-ruby-no-ai) — After a year off from technical blogging, Felipe comes back with a tale of adding a feature to his personal reading log gem and the benefits he got from _not_ using AI. 

Felipe Vogel   

[A Closer Look at the Critical Active Storage ImageMagick Issue](https://greg.molnar.io/blog/the-critical-active-storage-imagemagick-issue/) — Greg reproduces the 9.8-rated bug fixed in last week's Rails releases by showing how crafted uploads can expose files like `master.key` in a vulnerable app using MiniMagick and local disk storage. 

Greg Molnar   

[🚨 Rails 8.0 Support Has Ended. Get Your Upgrade on Autopilot](https://go.fastruby.io/ynl) — Join the beta to get access to our AI agent + a free 8.1 readiness check; get small green PRs you can review and merge. 

FastRuby.io® | AI-native Rails Maintenance sponsor   

📄 [Drawing an SVG Sky Map with Ruby and Astronoby](https://blog.rhannequ.in/posts/svg-sky-map-with-ruby-and-astronoby) – Plot the sky for any date and place with a star catalogue and a little trigonometry. Rémy Hannequin 

📄 [Going All-In on Sorbet: Typing an Entire Rails App in Four Days](https://docspring.com/blog/posts/going-all-in-on-sorbet/) Nathan Broadbent (DocSpring) 

🤖 [How Can You Be Responsible for Code You Don't Understand?](https://naildrivin5.com/blog/2026/11/11/how-can-you-be-responsible-for-code-you-don-t-understand.html) David Bryant Copeland 

📄 [Writing Ruby Extensions in Odin](https://citizen428.net/blog/writing-ruby-extensions-odin/) Michael Kohl  

🛠 Code & Tools  

🤖 [RubyLLM 2.2: Sandboxed Code Execution, Skills, and More](https://paolino.me/rubyllm-2-2/) — The AI framework now lets models run code they write in a sandbox (using Bubblewrap on Linux or macOS's native sandbox). Also new are skills, tools that can pause to ask questions, and four more providers. [What's New in 2.2](https://rubyllm.com/whats-new-in-2-2/) has the full laundry list! 

Carmine Paolino   

[Deleting Old Rows Shouldn’t Be Your Slowest Rake Task](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=ruby-weekly-newsletter) — TimescaleDB drops old data by the chunk, no bloat. Same Postgres, same ActiveRecord. [$1000 credit on Tiger Cloud](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=ruby-weekly-newsletter). 

Tiger Data (creators of TimescaleDB) sponsor   

[Panko 1.0: The Fast JSON Serializer Drops Its C Extension](https://github.com/yosiat/panko_serializer/releases/tag/v1.0.0) — Panko made its name as a fast JSON serializer that shipped a C extension, but v1.0 goes for a pure Ruby engine that compiles each serializer into code YJIT can optimize (and it's now faster in most cases too). [More on its design here](https://panko.dev/design-choices). 

Yosi Attias   

[protostar: Protocol Buffers in Pure Ruby](https://github.com/julik/protostar) — A _"slightly unhinged"_ take on protobufs that compiles `.proto` files without `protoc`. It's slower than native and _experimental_, but passes protobuf's conformance suite. 

Julik Tarkhanov   

- [Minitest 6.1](https://zenspider.com/releases/2026/11/minitest-version-6-1-0-has-been-released.html) – Adds `abstract_test_case!` for base test classes and supports Prism 2.0. There's also now [an official AI policy](https://github.com/minitest/minitest#ai-policy) which is… _"just NO"_.
- [rspec-rails 8.1](https://github.com/rspec/rspec-rails/blob/main/Changelog.md) – Now officially supports Rails 8.1. The dev branch already supports Rails 8.2, too, if you need that.
- [Facets 4.1](https://github.com/rubyworks/facets/releases/tag/4.1.0) – The veteran core extensions library now aligns several overlapping methods with Active Support 8.1.
- [Stripe Ruby 21.0](https://github.com/stripe/stripe-ruby) – API keys are [no longer kept in Marshal or YAML dumps](https://github.com/stripe/stripe-ruby/blob/master/.hark/migration-guides/v21.md#api-keys-are-no-longer-preserved-in-marshal-and-yaml-dumps-of-stripeobjects) of Stripe objects.  

📢 Elsewhere in the ecosystem 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/rnyicbr9ujoxh9w747fo.jpg)](https://remimercier.com/projects/ruby-stained-glass/)  

- A few months ago we linked to Rémi Mercier's project to create a Ruby-themed stained glass panel and [it's now almost ready for sale](https://remimercier.com/projects/ruby-stained-glass/). Along the way, he's been blogging about how it's coming together, including [the design of its lighting stand](https://remimercier.com/ruby-stained-glass-notes-11/).
- 🎥 Paul Irish's [chrome-capture](https://github.com/paulirish/chrome-capture) records Chrome tabs directly to MP4 at 60+ FPS, including audio. Could be handy for recording app demos or reproducing bugs, and no `ffmpeg` is required.
- 🤖 Chrome's [_Modern Web Guidance_ has reached 1.0](https://developer.chrome.com/blog/modern-web-guidance-v1), giving coding agents access to browser compatibility data, HTML, CSS and accessibility advice, and frontend best practices.
- 🔎 [Betterleaks](https://github.com/betterleaks/betterleaks), started by [Gitleaks](https://github.com/gitleaks/gitleaks)' original creator, is a Go-powered tool to scan Git repos for leaked secrets.         

Curated by [Peter Cooper](https://twitter.com/cooperx86) and [Glenn Goodrich](https://twitter.com/ruprict).
Published by [Cooperpress](https://cooperpress.com/). 

[Change your email](https://rubyweekly.com/edit_subscription/*|UID|*) or [Stop getting this newsletter.](https://rubyweekly.com/leave/*|UID|*) 

© Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom 

Other weekly newsletters we publish include [Postgres Weekly](https://postgresweekly.com/), [React Status](https://react.statuscode.com/), [Frontend Focus](https://frontendfoc.us/), and [JavaScript Weekly](https://javascriptweekly.com/).