Ruby Weekly

Patch Rails now: 21 security fixes in one release

Thu, 5 Nov 2026 00:00:00 +0000

#825 — November 5, 2026

Ruby Weekly

🔒 Rails 8.0.5.2 and 8.1.4.1 Released to Fix 21 Security Issues — A rare 21-advisory release, led by a critical Active Storage bug (when using ImageMagick/mini_magick) where attaching a specially crafted image can let an uploader write (and sometimes read) arbitrary files. A Strong Parameters bypass, remote_ip spoofing in 8.1, and more make this a key update.

Mike Dalessio (Rails Core)

💡 Christine Seeman's walkthrough covers the advisories you may want to give a closer look, what can break on upgrade, and workarounds if you can't upgrade.

🚨 Rails 8.0 Security Support Ends Nov 7. Upgrade with AI — Our AI agent works on your own CI and opens small PRs only when your suite is green. It dual-boots with `next_rails`. Nothing merges without your review. Join the beta waitlist and get a free Rails 8.1 readiness check.

FastRuby.io® | AI-native Rails Maintenance sponsor

Moment of Ruby: An Argument for Nothing — How can you tell "no argument was supplied" from an explicit nil or false without a sentinel constant? Here's a cute, small Ruby idiom to do it.

Chris Zempel (Aha!)

⚡️ IN BRIEF:

📘 Programming Ruby 4, the sixth edition of the Pickaxe, is now in print!
🇺🇸 RubyConf 2027 is heading to Portland, Oregon on May 24-26, with early-bird tickets going on sale November 11.
On Ruby 4.0, defining a method in a module costs more for each class that includes it, up to 4x slower than 3.4. Rails route helpers, in particular, run into this, and a backport to 4.0 has been requested.
🇧🇪 Ruby is returning to FOSDEM with a 'Ruby Beyond Rails'-themed devroom on January 30 in Brussels. The CFP closes December 1.
RubyMine 2026.3, JetBrains' popular commercial Ruby IDE, has been released.

⚠️ Trilogy Fixes an SQL Injection in Rails' Favored MySQL Client — Trilogy, the MySQL client GitHub built and Rails recommends, had a 9.3-rated SQL injection vulnerability which has been fixed and requires an upgrade to v2.13.2+, if you're using it. Greg Molnar built a vulnerable app to see how bad the vulnerability is and found it's worse than he first thought.

Trilogy maintainers

🔒 It's a busy time for security releases, so I've included a section at the end of the issue rounding up some releases that have landed to fix numerous vulnerabilities.

A Look at Lemans, the Harness Behind the Agents on Rails Benchmark — A tour of the Ruby harness Evil Martians built for the Rails Foundation's coding agent benchmark, plus some fun in how agents have tried to cheat at it…

Dementyev and Petrov (Evil Martians)

Don't Make a Human Do What AI Is Amazing At — John shares Nunebot, the markdown prompt he uses to sweep his apps and gems, pick one fix per repo, prove the fix with a failing-then-passing test, and open a PR.

John Nunemaker

💡 Along similar lines, David Bryant Copeland asks why review AI-generated code at all, arguing the effort is better spent on tooling that catches problems mechanically.

Painless Web Scraping With The New SerpApi's Extract API — Scrape any public webpage or add search to your Ruby application with one developer-friendly API built by Ruby engineers.

SerpApi sponsor

📄 Modernizing a Rails App from 2018 – How an ancient Rails 5 app was ported by moving it into a fresh app rather than upgrading in place. I did an upgrade the hard way recently, and I don't blame them! Kevin Campusano

📺 When Rails Met Fibers: Migrating Sidekick from Puma to Falcon – A 42-minute keynote on moving Shopify's AI assistant onto Falcon. Williams, Lawhorn and Barnes

📄 When Two Background Jobs Target the Same Record – A lost-update reproduction under Solid Queue, and a look at where to fix it. Syed Aslam

📄 IP-Based Route Restrictions on Heroku with Rails Daniela Baron

📺 DHH's Kaigi on Rails 2026 Keynote: Where the Tracks Go Next

🛠 Code & Tools

Spinel 2026.10.25: Matz's Ruby Compiler Continues to Advance — The second dated release of Matz's ahead-of-time Ruby-to-native compiler brings in a ton of stuff since I reviewed it six months ago! It's faster, offers a new WASM target, supports more of the standard library, and strings now behave as single shared objects like in CRuby. It's a great time to play with it!

Yukihiro Matsumoto

💡 Stan Lo's new, one-page Spinel intro rounds the project up generally, and explains how it differs to CRuby, what it can't compile, and its ruby-bench results.

group_by_day Shouldn't Time Out on Your Biggest Table — TimescaleDB extends Postgres so daily counts stay fast on huge tables. Same ActiveRecord. Get $1000 credit.

Tiger Data (creators of TimescaleDB) sponsor

JRuby 10.1.3.0 Released with Many Fixes and Improvements — A big release for JRuby's Ruby 4.0-compatible line. Mutex, Queue and sockets now go through the Fiber scheduler, method and branch coverage are implemented (so SimpleCov's branch mode can work), and Prism is now merged into JRuby itself.

JRuby Team

💡 JRuby 10.0.8.0 also landed for those on the Ruby 3.4-compatible line.

Duel: Fail CI When Your Code Gets Slower — Runs your benchmarks on two versions of your code side by side and fails if the new code is slower.

Erik Berlin

QueryStash: Cache Hot, Slow-Changing Queries Below Active Record — Caches lookups of your choosing across requests at the adapter level (so your calls don't need to change) with TTLs calculated from each result.

Persona

rails-query-command: Use Rails 8.2's bin/rails query on 7.2 to 8.1 — A backport of Rails 8.2's forthcoming bin/rails query command that runs on older Rails versions. It runs Active Record expressions or SQL with database-write protection and returns paginated JSON, which is ideal for agents and scripts.

Lázaro Nixon

TaskProgress: Progress Bars for Task Trees, from Terminal to Browser — Track nested task trees spread across threads, Fibers, subprocesses and Ractors (on Ruby 4) and render them to a terminal/log/browser with SSE/Turbo.

Julik Tarkhanov

RubyGems and Bundler 4.0.24 – Bundler can now read the Ruby version from mise.toml's inline table form and reports which locked gems can't be materialized on your platform.
Ferrum 0.20 and Cuprite 0.20 – The Chrome/CDP driver and its Capybara adapter add page.console message collection and real Logger support.
Grover 2.0 – Security release for the library that transforms HTML into PDFs, PNGs or JPEGs using Puppeteer and Chromium.
Net::SSH 8.1 – Three breaking changes, including no interactive prompts when stdin isn't a TTY.

📰 Classifieds

More AI commits and more test runs mean more waiting. WarpBuild runs your Ruby CI 2x faster at half the cost. Get $50 in free credits with START50.

🔺 Made a library? Written a blog post? Found a useful tutorial? Share it with the Ruby community on RubyFlow, the Ruby and Rails community linklog.

⚠️ A recent wave of Ruby security news

Following the regexp fixes we covered in our emergency issue, k0kubun has asked Ruby core to decide whether compiling untrusted strings into a Regexp should be supported at all, and if so, to request CVEs for them. It goes to the November 12 dev meeting. Meanwhile, Infield shows how to probe an end-of-life Ruby for the bugs.
A dozen advisories have hit Ruby's HTML sanitizing stack: Loofah 2.25.3, Nokogiri 1.19.5+, rails-html-sanitizer 1.7.2 and Sanitize 7.0.2. The big one is a mutation XSS in Loofah's HTML5 scrubbers that affects the default allowlist.
Rack 3.2.8, 3.1.23 and 2.2.25 fix four issues, the biggest being a multipart parser that retained parsed data in its scan buffer, so a malicious upload could exhaust memory.
Addressable 2.9.1 ships fixes for seven advisories, two of them reported by Ruby Central's new gem security effort.
v0.9.2 of the brotli gem bundles the patched Brotli 1.2.1, closing an actively exploited decoder RCE that's recently hit Node and browsers.
Ransack 6.0.1 (plus 5.0.3 and 4.4.4) stops sort_link passing URL options like script_name through from params, an open redirect and XSS.

How fast can you actually patch Ruby?

Thu, 29 Oct 2026 00:00:00 +0000

#824 — October 29, 2026

Read on the Web

🔒 Last Friday we sent out a special issue about some CRuby security releases which fixed a few nasty regexp bugs. If you haven't updated yet, it's worth a read to see if you're affected and what to check!
__
Your editor, Peter Cooper

Ruby Weekly

How Fast Can You Actually Patch Ruby? — When the Ruby security fixes shipped last week, Dennis timed how long they took to reach version managers, Docker images, CI services and hosts. The core team's image took eight minutes, while Docker's official image (Rails and Kamal's default) took ~16 hours.

Dennis Paagman

💡 Things are improving, though, as Ruby core team members now have commit access to Docker's Ruby image repo and are looking into automating updates. Meanwhile, Greg Molnar shows how to build your own image locally and deploy it with Kamal.

Your Dashboard Shouldn’t Wait for a Cron Job — The nightly job rolls up yesterday’s rows so the dashboard loads. Numbers lag a day and the job keeps growing. TimescaleDB continuous aggregates refresh rollups inside Postgres, so ActiveRecord reads fresh totals. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

Bad Requests and the Dream of a Quiet Rails App — Requests for /.env and /wp-admin, binary bytes in User-Agent headers, made-up MIME types… Ben walks through the Rails middleware stack to show why some junk requests become 500s, and why even 'handled' ones can still set off your error monitor.

Ben Sheldon

What's New at RubyGems.org: Ruby Central's Changelog Returns — Ruby Central catches us up on RubyGems.org and Bundler 4.1 work. Its AI scans of popular gems are a highlight: reviewers rejected 90% of the findings they looked into, though one was a critical auth bypass in rubyntlm.

Kirk Haines (Ruby Central)

Thank You, But I Prefer It My Way — If an LLM can just rewrite a library, is it worth persuading a maintainer about your PR or do you just route around it? Julik ponders the complexities and offers some practical ways forward.

Julik Tarkhanov

I Get 215 GitHub Notifications a Day, So I Built a Bot to Triage Them — A look at how the creator of RubyLLM built a RubyLLM-powered agent to label issues and PRs, reply only when useful, and sort the rest onto a board.

Carmine Paolino

📄 Parsing JSON-Structured Docker Logs with the OpenTelemetry Collector – How 37signals unwraps the JSON-in-JSON logs from its Kamal-deployed Rails apps. Lewis Buckley (37signals)

📄 Benchmarking Campfire with Many Users – Sam load-tests Campfire with up to 3,000 users, opens three PRs, and compares Rails with his Roundhouse-transpiled build on Falcon. Sam Ruby

📄 React Server Components on a Gumroad Fork: From 53 to 86 on Mobile PageSpeed – Compares live RSC and Inertia versions of a product page, using the commercial React on Rails Pro. Justin Gordon (ShakaCode)

📄 Making AI Agents Safe to Retry – Moving an LLM agent into a Sidekiq job without retries repeating its actions. Mateus Pereira (FastRuby.io)

🛠 Code & Tools

Carton: Real Boundaries for Ruby — Built on Ruby 4's experimental Ruby::Box, Carton enforces module boundaries at runtime where only what a 'carton' exports is visible outside it, monkey patches to core classes stay contained, and each carton can bring its own gem versions.

David Cristofaro

🚨 Rails 8.0 Support Ends Nov 7 | Get AI Upgrades on Autopilot — Our AI agent ships small upgrade PRs that pass your tests; nothing merges without you. Join the beta waitlist.

FastRuby.io® | AI-Native Rails Maintenance sponsor

Spree 6.0: A Rewrite of the Rails E-Commerce Platform — Marketplace, B2B, tax and inventory features are now in the open source core, carts and orders are separate models, and the checkout state machines are gone. Note that Rails now powers only the backend, with a React admin and Next.js storefront.

Spree Commerce

GenevaDrive: Durable, Step-Based Workflows for Rails — Define multi-step workflows tied to a record, with waits, resumable steps over large collections, and signals from webhooks. State lives in your database, with steps surviving restarts and duplicate job runs being skipped.

Julik Tarkhanov

⏱️ Horologium: Scientific Time Library for Ruby — A new gem, extracted from Astronoby, that handles eight time scales including TAI, TT, TDB, UTC and UT1, plus leap seconds (which Time can't represent) and precise Julian dates.

Rémy Hannequin

⭐ RubyGems and Bundler 4.1.0.beta3 renames Bundler's new override keys to in: and with:, and records overrides in a new OVERRIDES section of Gemfile.lock.
Prosopite 2.5 – N+1 query detector. Now suggests fixes, adds RSpec and Minitest assertions, and can ignore known N+1s while you adopt it gradually.
OmniAuth 2.2 / 2.3 – Multi-provider auth. The first new minor versions since 2022 add allowed_hosts and support for concurrent sign-ins.
The Git Gem 6.0 – Ruby interface to the git command line. A big breaking release that removes the old object model and requires Git 2.43+.
ruby-duckdb 2.0 – Ruby client for the DuckDB analytical database, now tracking DuckDB 2.0 and dropping several deprecated APIs.
Rage 1.29 – Fiber-based, Rails-compatible API framework, now ready for Ruby 4.1's fiber scheduler changes.

📢 Elsewhere in the ecosystem

Sean Goedecke argues that software is slow because of bad design, not slow languages, drawing on his experience of staring at Ruby flamegraphs and profiling Rails endpoints.
Nate Berkopec ported Ruby 4.0.9 to Fil-C, a memory-safe C toolchain. It ran real programs like Puma, but was ~5x slower and used far more memory, so Nate has 𝕏 declared the experiment over.
Python's experimental JIT is likely to be removed. Ruby came up a lot in the related Hacker News thread, where Jean Boussier credited Matz for supporting work on Ruby's JITs.
Sentry has given $1m to open source maintainers this year, up from $750k, with $40,000 going to Ruby Central.

Ruby regexp security fixes: a newsflash

Fri, 23 Oct 2026 00:00:00 +0000

#823 — October 23, 2026

Read on the Web

Ruby Weekly

Ruby regexp security fixes
Who needs to update?

It's very rare I'll do an out-of-band issue of Ruby Weekly but after digging into today's security releases of CRuby, I felt it was prudent to spread the word.

Ruby 4.0.9, 3.4.12, and 3.3.13 have all been released today with fixes for regexp bugs behind four GitLab-assigned CVEs. If you can update, do so. But I'll explain what the issues are below and you can determine if they affect you.

Takashi Kokubun's official advisory has the full story, if you want to go direct to the most official source.

Note: These bugs are specific to CRuby's Onigmo engine. JRuby and TruffleRuby use different regex engines and aren't affected by these fixes.

What are the bugs?

There were three bugs in Onigmo, Ruby's regular expression engine, that could corrupt memory while a regex pattern is being compiled:

A double free when parsing a pattern fails after an alternation. Ruby 4.0 has had this fix since 4.0.0.
An integer overflow in the size of a compiled pattern, first fixed in 4.0.8 – released yesterday.
An overflow of internal IDs in patterns with many repeats, fixed in 4.0.9.

So if you moved to 4.0.8, which I featured yesterday, you need one more bump.

GitLab found these bugs could enable remote code execution on GitLab servers, including attacks that require no login. It assigned four CVEs rated Critical (CVSS 9.9 or 10.0) and patched the Ruby it ships. Ruby hasn't requested separate CVEs for these fixes so far; its advisory asks users to track them under GitLab's identifiers.

Is your code affected?

You're exposed if your application (or a dependency, alas) compiles regex patterns whose structure a third party can control. For example:

Regexp.new or Regexp.compile called on user input.
Interpolating input into a regex literal, like /#{params[:q]}/. Interpolation doesn't escape, so the user can supply a pattern.

Think regex-powered search boxes, user-defined validation rules, or filters in CI and webhook tools. If every regex in your stack is written by you/your team, you're in a better position.

Two things that won't help: Regexp.timeout, since the damage happens during compilation before matching starts, and limits on pattern length, because some of the bugs can be triggered by short patterns. Before the compiled-size fix, for instance, Regexp.new("(?:.{90000,}){90000}") was enough to lock up the process.

What should you do?

Upgrade to Ruby 4.0.9, 3.4.12 or 3.3.13. (Ruby 3.3 normally gets only vulnerability fixes now; the core team backported these as an exception, since GitLab, not Ruby, is the one treating them as CVEs.)
Find the risky spots in your code by looking for Regexp.new, Regexp.compile, Regexp.union and /#{ constructions, and checking where their input comes from.
Can't upgrade yet? The official best practice is to avoid compiling regexes from untrusted input at all. How you do that is up to you: Regexp.escape turns user input into a literal-only pattern, and a plain substring match (e.g. include?) can be enough for many situations.
On Ruby 3.2 or older? Older versions are end-of-life and won't get official fixes, so step 3 is your main option for now.

I'll be back next Thursday with, I hope, a regular issue… 😅

___
Peter Cooper, editor of Ruby Weekly

How Rails made its enums 4.5x faster

Thu, 22 Oct 2026 00:00:00 +0000

#822 — October 22, 2026

Read on the Web

Ruby Weekly

📊 The 2026 Rails Community Survey Results — The results show a community favoring a familiar core stack (monolith, Postgres, Puma), a huge jump in adoption of mise, RSpec remaining the most popular testing framework, and widespread AI adoption, while half worry about the long-term value of their skills.

Planet Argon

💡 If you want something to read or listen to, you can also find out what people's favorite Ruby books and favorite Ruby podcasts are.

🚨 Rails 8.0 Support Ends Nov 7. Upgrade on Autopilot — Our AI agent opens small upgrade PRs only when your own CI is green, and dual-boots your application with next_rails. You review and merge; you stay in control. Beta from $497/mo, month-to-month. Join the waitlist today.

FastRuby.io® | AI-native Upgrades on Autopilot sponsor

Static Analysis for the Uninitialized — Aaron, working through a static analysis textbook, builds an analyzer from scratch to find "possibly uninitialized variables" in Ruby. Sounds in the weeds, but by the end it parses real Ruby with Prism and flags a NameError before running.

Aaron 'Tenderlove' Patterson

💡 On the topic of Prism, there's some big news this week – see Code & Tools.

⚡️ IN BRIEF:

💎 Ruby 4.0.8 has been released. It's billed as "routine", but is kinda significant as it fixes forked children hanging on hostname lookups on Linux, Ruby failing to build against the macOS 27 SDK, and a ZJIT bug that swapped keyword arguments.
📊 Erik Berlin has opened some PRs to speed up core methods, including pattern-defeating quicksort for numeric arrays (4-9x faster) and quicker Array#include?, Range, String and Time operations. Core members are considering which will land in 4.1.
A long-time gem author has archived all his Ruby gems, saying the "for humans" era of Ruby is over. An intense discussion ensued on Hacker News.
Rails has merged config.zjit, so ZJIT can be switched on after boot (as YJIT can). The PR's numbers show ~18MB less JIT memory used per worker.

Rails is a JIT Compiler (Or: How Aaron Made Enums 4.5x Faster) — Rails' enum predicates are built with define_method and public_send that JITs struggle to optimize. Aaron Patterson has made them real generated methods that are ~4.5x faster under YJIT in his benchmark. Coming to Rails 8.2.

Max Bernstein (Rails at Scale)

Rails Analytics on the Postgres You Already Know — TimescaleDB extends the Postgres behind your app so dashboards stay fast as data grows. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

📄 Does Rails Still Make Sense? – Spoiler: yes. A good retort to anyone asking why you don't just get an LLM to rewrite all your apps in Rust. Dirk Jonker

📄 Eight Months in Next.js: A Rails Developer's Field Notes – An even-handed look at what Rails hands you for free. Werner Petrick (Puzzl)

📄 Short Written Summaries of 24 Rails World 2026 Talks – Handy if you skipped the videos! Yaroslav Shmarov

🛠 Code & Tools

Prism 2.0: Ruby's Parser Gets Its First Major Release in Two Years — Prism now underpins CRuby, Ruby LSP and RuboCop, so you're using it even if you never call it directly. It's now faster and leaner, with precompiled platform gems, complete RBS and RBI definitions, a C++ API, and Ruby 4.1 syntax support. There's also a Web-based playground where you can give it a spin.

Kevin Newton et al.

Net::SSH 8.0: The Pure Ruby SSH Client Library — The first major release since 2022. Ed25519, X25519 and ChaCha20 now come from the openssl gem, so separate gems are no longer needed. Defaults now track OpenSSH (e.g. SHA-1 RSA and DSA are off by default), plus ControlMaster reuse (i.e. connection sharing) and FIDO key support.

Miklós Fazekas et al.

Tired of Writing NRQL? AppSignal Builds Your Rails Dashboards for You — Dashboards that build themselves, plus deploy markers and uptime checks. Unlimited users, 30-day trial, no credit card.

AppSignal sponsor

Introducing RuboCop Spellcheck — A RuboCop plugin for checking spelling in Ruby comments, strings, identifiers, Markdown, RDoc, AsciiDoc, and plain text.

Daniel Doubrovkine

Passenger 7 Preview – The first major version since 2018. The headline is WebSocket support for Apache, and the minimum Ruby rises to 3.0.
WhatLanguage 3.0 – My pure Ruby natural language detector changes a few of the ISO codes it returns and gets a lot faster.
Logster 3.0 – Discourse's embedded log viewer for Rack apps (screenshot). Drops support for Ruby <3.3, Rack <3.1 and Rails <8.
Aruba 3.0 – Test CLI apps with Cucumber, RSpec or Minitest. Every scenario now gets its own working directory.
ViewComponent 4.17 – Now works under Rails' experimental Ractor mode.
Truemail 4.0 – Email address validation library. Now supports Ruby 4.

🪏 Digging into Ruby's past…

I've been working with Ruby for 22 years, but last week I noticed Ryan Davis (of Seattle.rb and Minitest fame) celebrating his 26th anniversary of using Ruby, and it got me thinking about Ruby's history which goes far beyond even that.

Ruby's 33 years old, so there's plenty of history to go over if you can find it amid the linkrot. Last week I discovered a new lead: a site which archives hundreds of programming mailing lists all the way back to the 90s. ruby-talk's on there and its archives go back to the very first post by Matz in 1998.

Today, ruby-talk is a quiet list with the Ruby Users Forum largely taking over its role, but at the list's peak in 2006 it hit over 6000 messages a month, so there's tons to go through.

I've been (very) slowly going through the archives to find interesting tidbits, so I wanted to share a few bits from the late 90s I enjoyed:

Matz shared the history of the Ruby project saying it was 'born' on February 23, 1993 (though it didn't get a public release till December 1995), explained his background as a programmer, and why Ruby came to be.
There was no RubyGems back then, so people would ask if Ruby should have its own central archive for modules with Matz saying he had a 'vague hope' to have such a thing 'someday'. The first attempt (the "RAA") appeared soon thereafter.
Ruby was getting ready for IPv6 as early as 1999. 27 years later, my ISP still doesn't support it… 😅
Dave Thomas, of Programming Ruby (Pickaxe) fame, first appeared in December 1999 asking a question about yield vs block.call.
Even in 1999, Matz was pondering a future where Ruby scripts could be frozen into executables.
Two years before JRuby started, Bryce Dooley came up with its name.

If you have any interesting data dumps, archives, or similar things relating to Ruby's ancient history – especially community stuff – hit reply and let me know, as I'd love to unearth any interesting gems, ideas, or discussions going on back in the day.