Ruby Weekly

A new attempt to fork Rails

Thu, 13 Aug 2026 00:00:00 +0000

#813 — August 13, 2026

🗓️ A scheduling note: We're taking a summer break next week, so we'll be back on August 27. Catch you then!
__
Your editor, Peter Cooper

Ruby Weekly

Ruby 2D 1.0: SDL3, WebAssembly, and a Comeback Story — After three years dormant, Tom Black's "Square.new-and-it-appears" graphics gem gets a rewrite with SDL3-powered GPU rendering and the ability to compile experiences to WebAssembly (live examples). Learn how to use its DSL here or read Tom's story of resurrecting the project.

Tom Black

😅 I tested it out by making a little Mario Paint-inspired paint app (above) and I learnt I can't draw the Ruby logo at all!

🚨 We Audited 137 Rails Apps. 98% Had a Critical KEV — Rails 7.2 went EOL this week, so it's a good time to look at what’s running in production. We map your images, runtimes, and K8s workloads against CISA's KEV catalog and write the verdicts up as VEX.

FastRuby.io® | Infrastructure Assessments sponsor

json 3.0.0 RC1 Released for Testing — A big, intentionally breaking release of Ruby's default JSON gem that Jean wants you to test before its release next month. create_additions is gone, so JSON.load and JSON.dump are safe by default, but beware that unknown options now raise instead of being ignored.

Jean Boussier

💡 Jean has also just dropped Speeding Up (small) Ruby Hashes.

⚡️ IN BRIEF:

👀 Lucas Dohmen has announced Amiko, a community-run fork of Rails 8, arguing Rails' core has changed little since 6.0 and that DHH's view of the world is incompatible with his own. Ryan Bigg is unconvinced by the idea and thinks Hanami is the way forward.
Matz has proposed letting String#tr accept character replacement options in a hash style.
As of August 9, Rails 7.2 no longer (officially) gets security support, and Rails 8.0 reaches a similar end on November 7. More details here.
🇨🇿 Euruko 2026 is taking place next month (September 17-18) in Brno, Czechia, with speakers including Matz, Koichi Sasada, Hitoshi Hasumi (the creator of PicoRuby), Charles Oliver Nutter, and Benoît Daloze.
🇺🇸 Matz is keeping busy next month as he's also going to be at Rails World 2026 doing a fireside chat with DHH. The event's full agenda is now up too.

🔒 A Guide to Security for Gem Authors and Users — RubyGems' guide to protecting your account, hardening your gems, and reporting vulnerabilities has been updated for 2026 to cover MFA, Trusted Publishing, lockfile checksums, and cooldowns.

RubyGems Guides

Ruby and Rails Performance Roundup: The Backlog Edition — A followup to Maciej's recent look at PRs which sped up Ruby, this time tackling 40 more Ruby and Rails perf-related PRs, complete with the numbers.

Maciej Mensfeld

Blog Post: Now Watching Your Cron and Sidekiq Jobs: AppSignal Launch Week Recap — Process monitoring for Sidekiq & cron, hosted MCP, a new CLI, sharper log queries, and dark mode.

AppSignal sponsor

Fair by Design: Orchestrating Background Jobs in Ruby — What to do when one tenant's giant job batch starves everyone else's queue. Compares four strategies and why no Ruby job processor handles it out of the box.

Alexander Baygeldin (Evil Martians)

🤖 One Week of Building and Reviewing Code with LLM Agents – Hard numbers from a week of agent-driven Rails work showing that diversity of checks and tests beats throwing more agents at a problem. Lucian Ghinda

📄 How to Use Playwright in Ruby for Scraping and Testing Jakub Zielinski (ScrapingBee)

📄 What Active Record Transactions Actually Protect Syed Aslam

🛠 Code & Tools

DragonRuby Releases a 'Free to All' Jam License — DragonRuby is a Ruby-powered 2D engine built on mruby and SDL. It's a commercial product, but there's now a free option for building games to distribute on the Web (even commercially). Desktop, Steam and mobile use remain paid.

DragonRuby Team

Solid Objects: Cloudflare Durable Objects for Rails — Durable, addressable actors (a la Cloudflare's Durable Objects) for Rails backed by your existing database, with a reactive ERB helper that live-updates every browser without writing channels, Stimulus or JavaScript.

Lucas Carlson

AI Shouldn't Cost More Than It Saves — We can find where LLMs pay off, validate with real data, and tune for cost/effectiveness. Need help? Let's talk.

SINAPTIA sponsor

RubyLLM::Schema is Now Schematist: A JSON Schema DSL for Ruby — A general purpose JSON Schema DSL, spun out of RubyLLM and now covering the full Draft 2020-12 vocabulary. Values can be procs resolved at render time, and to_json_schema finally returns a real schema document.

Carmine Paolino

Dentaku 4.0: Math and Logic Formula Parser and Evaluator — Allows run-time binding of values to variables referenced in user supplied formulas. Intended to safely evaluate untrusted expressions.

Solomon White

Haml 7.3 – The templating engine that simplifies writing HTML by using indentation and elegant syntax now replaces Ripper with Prism.
Reline 0.7 – Official pure-Ruby library with the same API as readline.
Delayed 4.0 – Multi-threaded, SQL-driven Active Job backend.
✉️ Ahoy Email 4.0 – First-party email analytics for Rails apps.
Brakeman 8.0.6 – Vulnerability scanner for Rails apps.

📰 Classifieds

Analytics on your Rails data without a second database? TimescaleDB extends the Postgres you run.

💎 Is your Rails app fine? Probably. AppSignal tells you for sure — errors, N+1s, Sidekiq jobs, host metrics, one gem.

We'll be back in two weeks on August 27 – see you then! Unless you're a Go Weekly or React Status subscriber too, then we'll see you tomorrow ;-)

RuboCop goes project-wide with Rubydex

Thu, 6 Aug 2026 00:00:00 +0000

#812 — August 6, 2026

Read on the Web

Ruby Weekly

Shrinking Ruby Hashes — Hash uses 2-4x the memory of a Struct holding the same data. Ruby committer Jean Boussier digs into why, looking at the layout changes from Ruby 2.3 to now, and shows off the patches that could shrink small hashes in Ruby 4.1.

Jean Boussier

Make Your Next Rails Crash Make Sense — Errors, N+1 queries, slow SQL, Sidekiq jobs, and host metrics in one Ruby gem. Every feature on every plan, predictable pricing, and real engineers on support. 30-day free trial, no credit card, two-minute install.

AppSignal sponsor

▶ Tenderlove on Ractors, JIT Compilers, and Installing Gems Faster — If you're an Aaron Patterson fan, there's much to enjoy in this 80-minute chat, covering his pre-Ruby background, Ractors, opinions on databases, making gems faster to install, and why he still can't trust AI code like a teammate's.

Robby Russell and Aaron Patterson

⚡️ IN BRIEF:

Hiroshi Shibata discovered that lazy loading Ruby's error extension gems speeds up boot time. Matz accepted the proposal, saying: "A 3.8x boot time improvement with no regression on the error path is a clear win."
mise, a popular dev tool installer/manager I'm somewhat in love with, has a new release out that makes precompiled Ruby binaries the default.
If you thought the Ruby Central dispute wound down after Bundler and RubyGems were passed to Ruby core's stewardship last year, André Arko says otherwise in his latest account of where things stand.
Jean Boussier proposes letting CGI.escapeHTML accept a custom escape table.

Making RubyGems Guides Friendly to Humans and AI — Append .md to any of the guides' URLs for raw Markdown, or point an agent at llms.txt for an index of them all. The guides have had a broader overhaul too, with a new Concepts section and Cmd+K search.

Hiroshi Shibata

Rails 7.2 Security Support Ends Aug 9. Need to Upgrade Fast? — “FastRuby.io successfully upgraded our application to Rails 8.1 and Ruby 3.4 on time and on budget.”

FastRuby.io® | Rails Upgrade Services sponsor

🤖 Tell the Agent to Write Its Scripts in Ruby – Scripts have always been a sweet spot for Ruby, so why not have your agents use it, too? Lucian Ghinda

📄 Running Code When the Rails Web Server Boots – That is, only under Puma, say, and not in rake tasks or the console. Ben Sheldon

📄 How to Install Any Ruby Version in Seconds Using rv Javier Cervantes

📄 Running a Ruby MCP Server in Production Amanda Bizzinotto

🛠 Code & Tools

Rubydex-Powered Project-Wide Analysis with RuboCop 1.89 — RuboCop has traditionally analyzed one file at a time, but its expanded, opt-in Rubydex support gives it a project-wide index, so cops can catch things like duplicate methods across files and typos in constant and method names.

Bozhidar Batsov

💡 Lovro Bikić also digs into how RuboCop 1.89.0 now loads cops lazily rather than requiring all 600+ at startup, for a 10-25% startup speedup.

redis-rb 6.0: The Official Ruby Client for Redis — Now speaks Redis' latest wire protocol RESP3 by default, adds first-class support for the Redis Query Engine and the JSON module, new Redis 6.2-8.10 commands, and more. Note that Ruby 3.2+ is now required.

Redis Ltd

🤖 Ask Your AI Editor What Broke — AppSignal's MCP server feeds live Rails errors, traces & metrics into Claude, Cursor & Copilot.

AppSignal sponsor

Humid 1.0: React Server-Side Rendering in Rails without Node.js — React on Rails was too heavy, and a Node sidecar didn't appeal… so Johny built a solution using mini_racer's embedded V8 to render React with no Node process to manage at runtime.

Johny Ho (Thoughtbot)

📊 Flightdeck: A Featureful Dashboard for Solid Queue — A more visual, dashboard-like alternative to Mission Control, with throughput charts, failure grouping, bulk retry, and queue pause/resume. Drops in with no migrations or asset configuration.

Carl Mercier

Karafka 2.6 – Powerful multi-threaded, efficient Kafka processing framework.
RubyGems and Bundler 4.0.18 – Cooldowns have now been extended to bundle lock and bundle cache.
The Git Gem 5.0 – The git wrapper designed for use from Ruby has breaking changes to be aware of.
Closure Tree 9.8 – Easily make your Active Record models support hierarchies.
Active Storage Validations 4.0 – Add validations to Active Storage attributes. Now requires Rails 7.0.1+ and Ruby 3.3+.
Rouge 5.1 – Pure Ruby Pygments-compatible syntax highlighter.
Statesman 13.3 – Opinionated state machine library.

📰 Classifieds

💎 Shipping Ruby code with AI agents? Undercover CI catches untested methods in your PRs before you merge. Coverage percentages won't.

📢 Elsewhere in the ecosystem

Joe Masilotti's Ruby Native, a way to deploy Rails apps to mobile app stores without touching Swift or Xcode, now supports Android in addition to iOS.
🇯🇵 PicoRubyKaigi is an event taking place in Tokyo this October, focused on the PicoRuby Ruby implementation for one-chip microcontrollers.
🇯🇵 In other Ruby event news, tickets for Kaigi on Rails 2026, also taking place in October, are now available.
📺 SQLite's Richard Hipp gave ▶️ a detailed 50-minute talk on SQLite's reliability and the tools, practices, and design choices that have given it its strong reputation.
Ryan Lopopolo explains why he wound down his Artichoke Ruby project – Artichoke was an attempt at building a Ruby implementation in Rust.

You need to upgrade Rails 7.x and 8.x now

Thu, 30 Jul 2026 00:00:00 +0000

#811 — July 30, 2026

Read on the Web

Ruby Weekly

A Critical Active Storage Vulnerability in Rails — A specially crafted 'image' uploaded to Rails 7.x or 8.x apps in their default configuration can potentially expose arbitrary files on the server via Active Storage's vips processor. Patched in Rails 7.2.3.2, 8.0.5.1 and 8.1.3.1. You may also need to upgrade libvips. Rails 6.x isn't affected by default.

Rafael França and Rails Core

💡 The team that discovered the vulnerability has dubbed it KindaRails2Shell and explains more about it. Also note, if you're using Bundler's new cooldown protection, bundle update rails --cooldown 0 may be needed.

Rails Experts You Like & Trust, Now Embedded in Your Team 🚀 — Since 2017, companies have trusted FastRuby.io with their most complex Rails upgrades. Now those same senior engineers can scale your team fast: shipping features, fixing bugs, accelerating delivery, and using AI effectively. Let's talk!

FastRuby.io® | Staff Augmentation sponsor

The Inliner is Yielding Benefits for ZJIT — ZJIT, the experimental just-in-time compiler written in Rust, has added inlining capabilities. This post shows how method inlining speeds up block-heavy code such as Array#each. Early microbenchmarks are striking, with up to 35x speed gains in one case.

Max Bernstein

⚡️ IN BRIEF:

🔎 Go to the official ruby-lang.org site and hit Cmd/Ctrl+K – it has search!
🏆 Nominations have opened for this year's Rails Luminary Awards. Last year's winner was Marco Roth of Herb fame.
🇪🇺 The sale of early bird tickets for Euruko, taking place this September in Czechia, ends this Saturday.
🎂 Rails is celebrating the 22nd anniversary of its first public release: v0.5.0 on July 24, 2004.

Finding 105 Vulnerabilities in the Ruby Ecosystem — An app security firm turned its scanner on gems with native C extensions. A Nokogiri out-of-bounds read of 17 years' vintage is a particular highlight.

Yu, Thakur, Wu, and Lin (Depthfirst)

Golfing Ruby with Codex: From 250 Bytes to 90 — I tell the tale of pushing GPT-5.6 Sol to make a Roman numeral generator smaller, ending at 90 bytes. Along the way, many Ruby features popped out: character literals, endless methods, a 1.% exception trick, and a (not so) novel algorithm from 1976.

Peter Cooper

Why Your Sidekiq Jobs Are Slower Than You Think (And How to Fix It) — N+1s hide inside your jobs. AppSignal ranks your slowest Sidekiq jobs and queries so you fix the right one. (Blog post.)

AppSignal sponsor

Curiosity Reduced the Heap Size by 60% — Agents are often good at diagnosing warnings and errors, but in this case an agent's attempts to ignore a warning led Paweł to a striking memory use saving.

Paweł Pacana

📄 Spec-tacular: Ways to Think About Writing Expressive RSpec Simon Fish (FreeAgent)

📄 Rake Beyond Rails: A Build Tool You Know – A reminder of Rake's versatility. Francois Buys

📄 Overriding Rails' Default Validation Error Message Format Tekin Süleyman

🛠 Code & Tools

RubyLens: Turn Your Ruby Project into a Galaxy Visualization — A gem that turns a Ruby codebase into a galaxy, in either HTML or video form, built on top of Rubydex which performs the analysis. The site contains a few pre-built examples to enjoy. GitHub repo.

Stan Lo

4 Ways to Steer Your Agents Towards Better Tests — Agents quit when the happy path is green. Undercover keeps them honest with local tools and CI checks for your team.

Undercover CI sponsor

Courrier 1.0: A Gem to Send Emails Without SMTP — Brings the ability to send email through 13 providers and 7 newsletter platforms into a single library. There's also a Rails integration which brings generators and Active Job support.

Rails Designer

🤖 Automating Ruby Tech Debt Audits with Claude Code — Introduces a Claude Code skill (which you can read here) that strings together a variety of tools to produce a scored, one-shot quality report for Ruby projects.

Ernesto Tagwerker

Solid Queue 1.5 – DB-based queuing backend for Active Job. Lots of bugfixes, polling interval now defaults to 1 second, and there's a new bin/jobs check command to validate your config.
RBS 4.1 – The official language for writing type signatures for Ruby now supports JRuby and adds a Rewriter API.
🖼️ RMagick 7.1 – The long-standing ImageMagick bindings get bug fixes, plus big changes to how text strings drawn by Draw#annotate are handled.
SimpleCov 1.0.3 – Code coverage tool. If you missed the big 1.0 release, check it out as the new report UI is great.
telegram-bot-ruby 2.8 – Ruby wrapper for Telegram Bot API 10.x.
MCP Ruby SDK 1.0 – Official Ruby SDK for the Model Context Protocol.
Gibbon 4.0 – MailChimp Marketing API wrapper for Ruby.

Why RubyGems just revoked every legacy API key

Thu, 23 Jul 2026 00:00:00 +0000

#810 — July 23, 2026

Read on the Web

Ruby Weekly

🔒 RubyGems Revokes Legacy API Keys After Possible Cache Leak — A CDN caching bug, which has existed for years, could have served accounts' legacy API keys to other users. There's no evidence of malicious use, but it's worth affected owners checking their gems over nonetheless.

Colby Swandale (Ruby Central)

💡 Luke Marshall, from Truffle Security, discovered this bug and did a full technical writeup of how the bug could have been exploited.

All-in-One Ruby & Rails Monitoring — Errors + Performance — Track errors, N+1 queries, slow SQL, Sidekiq jobs, and host metrics — all in one Ruby gem. AppSignal gives Rails teams every feature on every plan, with predictable pricing and real engineers on support. 30-day free trial, no credit card.

AppSignal sponsor

Beyond Enumerable: Testing Membership with Bloom Filters — When include? over a huge collection gets expensive, a Bloom filter can answer 'definitely not present' with fixed memory and constant-time lookups. Brandon builds one in Ruby, covering all the details.

Brandon Weaver

💡 If you want to understand how Bloom filters work at a high level, Sam Rose's visual Bloom filter explainer is fantastic.

⚡️ IN BRIEF:

Matz has accepted a proposal to bring more bit-level operations to String, including bit_count, bit_get and bit_set (PR here).
No RubyConf videos yet, but Confreaks has uploaded seventeen videos from Blastoff Rails 2026, an event that took place in Albuquerque last month.
RubyMine 2026.2 has been released. It's the latest version of JetBrains' commercial Ruby IDE with RBS, code insight, and AI-related enhancements.
The CFP for SF Ruby, taking place in San Francisco this November, closes on July 27 (next Monday). Tickets are now on sale too.

▶ RuboCop 2.0: Where Do We Go Now? — At RubyConf Austria (all the videos are here) the creator of RuboCop gave a dense state of the union update on the project and how it's continuing to improve.

Bozhidar Batsov

🤖 How I Stopped Running out of Tokens — A Rubyist whose company uses Claude Enterprise shares numerous tools you can use (such as rtk) to get the most out of assigned limits.

Daniela Baron

Using OpenSpec in Rails Applications — See how OpenSpec is reshaping our Rails workflow. What paid off, what failed, and what we’d do differently.

SINAPTIA sponsor

📄 Active Model Conditional Validations – A tour of conditional validations, from custom contexts to validation_context, plus a case for splitting divergent behavior into separate classes instead. Kevin Murphy

📄 A Proposal for Deprecating ruby2_keywords – Dropping the compatibility mechanism introduced for the Ruby 2-to-3 keyword arguments separation seems obvious, but will have knock-on effects. Shugo Maeda

📄 'Poor Man's Escape Analysis': A Proposed CRuby Optimization Yusuke Endoh

🛠 Code & Tools

TableTennis 1.0: Stylish Terminal Tables — A library for printing tabular data on the terminal that includes theming, automatic layout, automatic formatting of dates and numbers, coloring of numeric values, and more.

Adam Doppelt

JRuby 10.1.1.0: Faster Number Parsing and Security Fixes — The Ruby 4.0-targeting JVM implementation gains faster number parsing, OpenBSD support, and OpenSSL and ERB security fixes.

Charles Oliver Nutter et al.

Need More Rails Capacity? Speed Up Your Product Roadmap Next Week 🚀 — Rails devs who integrate fast, ship quality code & help your team deliver more each sprint. We vet them, you ship more.

FastRuby.io® | Rails Staff Aug sponsor

Audition: See if a Ruby Program Can Run Inside Ractors — A tool you can point at a Ruby script, gem, Rack or Rails app, and it tells you if it can run within Ractors, Ruby's experimental actor-based parallel execution mechanism. And if not, it explains why.

Yaroslav Markin

Rigor: Type-Aware Ruby Static Analyzer and Bug Finder — Unlike Sorbet or Steep, no annotations are required. Rigor infers types from the values your code produces, while treating any RBS you have as authoritative.

Usami et al.

Pygments.rb 5.0: A Ruby Wrapper for the Pygments Syntax Highlighter — Pygments is one of the best syntax highlighters out there, but it's Python-based. This library makes it easier to call. v5.0 bumps Pygments up to the latest version.

Nyman, Gupta and Radchenko

💡 Alternatively, Rouge is a pure Ruby Pygments-compatible code highlighter.

React on Rails 17.0 – A complete way to integrate React into Rails apps. Now with full support for React 19 and streaming server rendering. (Homepage)
RuboCop Minitest 0.40 – Extension for enforcing Minitest best practices and coding conventions.
Gemsmith 26.0 – CLI tool for creating and managing Ruby gems following common best practices.
Rack::Proxy 1.0 – Request/response rewriting HTTP proxy for Rack apps.
RubyGems and Bundler 4.0.17

📰 Classifieds

🤖 No vibes, just vitals. AppSignal's MCP server brings Rails errors, traces & metrics into Claude, Cursor & Copilot. Debug in your editor.

Your Rails app logs events all day. TimescaleDB turns them into real-time analytics, right in the Postgres you already run.

😅 An Old/New Ruby Discovery of the Week

I recently got the itch to see what I'm getting for Christmas. Well, what's coming in Ruby 4.1, anyway. It's not going to be a big release syntax-wise, but there are a variety of new methods and features I'll share in coming weeks.

My first surprise, though, was the enhancement of a method added back in Ruby 2.4 that I had not noticed: String#unpack1

unpack1 is basically unpack that only returns the first extracted value. You'd use these methods when working with packed data, perhaps when parsing binary files, random protocols, network data, and the like.

So if, like me, you didn't know about unpack1 or the Ruby docs' surprisingly thorough Packed Data page which is *ahem* packed with examples, now you do.

The Ruby 4.1 change? unpack/unpack1 are getting new directives:

R for unsigned LEB128 (Little Endian Base 128) as used in DWARF and WASM.
r for signed LEB128.
^ to return the current byte offset (more useful than it sounds).
x! and @! are new alignment directives to handle padding in binary formats by advancing the cursor to aligned byte positions, relative to the record's starting offset (e.g. x!4) and the whole string (@!4) respectively.

If you're not tinkering around with packing and unpacking data, you might not have any use for these, but for my sins I enjoy low-level noodling with binary data in Ruby, so am looking forward to experimenting more.

This is a niche topic, but I learnt something, this is my newsletter, and hopefully I'll get to some more useful Ruby 4.1 additions for you next time ;-)