Ruby Weekly

Why RubyGems just revoked every legacy API key

Thu, 23 Jul 2026 00:00:00 +0000

#810 — July 23, 2026

Ruby Weekly

🔒 RubyGems Revokes Legacy API Keys After Possible Cache Leak — A CDN caching bug, which has existed for years, could have served accounts' legacy API keys to other users. There's no evidence of malicious use, but it's worth affected owners checking their gems over nonetheless.

Colby Swandale (Ruby Central)

💡 Luke Marshall, from Truffle Security, discovered this bug and did a full technical writeup of how the bug could have been exploited.

All-in-One Ruby & Rails Monitoring — Errors + Performance — Track errors, N+1 queries, slow SQL, Sidekiq jobs, and host metrics — all in one Ruby gem. AppSignal gives Rails teams every feature on every plan, with predictable pricing and real engineers on support. 30-day free trial, no credit card.

AppSignal sponsor

Beyond Enumerable: Testing Membership with Bloom Filters — When include? over a huge collection gets expensive, a Bloom filter can answer 'definitely not present' with fixed memory and constant-time lookups. Brandon builds one in Ruby, covering all the details.

Brandon Weaver

💡 If you want to understand how Bloom filters work at a high level, Sam Rose's visual Bloom filter explainer is fantastic.

⚡️ IN BRIEF:

Matz has accepted a proposal to bring more bit-level operations to String, including bit_count, bit_get and bit_set (PR here).
No RubyConf videos yet, but Confreaks has uploaded seventeen videos from Blastoff Rails 2026, an event that took place in Albuquerque last month.
RubyMine 2026.2 has been released. It's the latest version of JetBrains' commercial Ruby IDE with RBS, code insight, and AI-related enhancements.
The CFP for SF Ruby, taking place in San Francisco this November, closes on July 27 (next Monday). Tickets are now on sale too.

▶ RuboCop 2.0: Where Do We Go Now? — At RubyConf Austria (all the videos are here) the creator of RuboCop gave a dense state of the union update on the project and how it's continuing to improve.

Bozhidar Batsov

🤖 How I Stopped Running out of Tokens — A Rubyist whose company uses Claude Enterprise shares numerous tools you can use (such as rtk) to get the most out of assigned limits.

Daniela Baron

Using OpenSpec in Rails Applications — See how OpenSpec is reshaping our Rails workflow. What paid off, what failed, and what we’d do differently.

SINAPTIA sponsor

📄 Active Model Conditional Validations – A tour of conditional validations, from custom contexts to validation_context, plus a case for splitting divergent behavior into separate classes instead. Kevin Murphy

📄 A Proposal for Deprecating ruby2_keywords – Dropping the compatibility mechanism introduced for the Ruby 2-to-3 keyword arguments separation seems obvious, but will have knock-on effects. Shugo Maeda

📄 'Poor Man's Escape Analysis': A Proposed CRuby Optimization Yusuke Endoh

🛠 Code & Tools

TableTennis 1.0: Stylish Terminal Tables — A library for printing tabular data on the terminal that includes theming, automatic layout, automatic formatting of dates and numbers, coloring of numeric values, and more.

Adam Doppelt

JRuby 10.1.1.0: Faster Number Parsing and Security Fixes — The Ruby 4.0-targeting JVM implementation gains faster number parsing, OpenBSD support, and OpenSSL and ERB security fixes.

Charles Oliver Nutter et al.

Need More Rails Capacity? Speed Up Your Product Roadmap Next Week 🚀 — Rails devs who integrate fast, ship quality code & help your team deliver more each sprint. We vet them, you ship more.

FastRuby.io® | Rails Staff Aug sponsor

Audition: See if a Ruby Program Can Run Inside Ractors — A tool you can point at a Ruby script, gem, Rack or Rails app, and it tells you if it can run within Ractors, Ruby's experimental actor-based parallel execution mechanism. And if not, it explains why.

Yaroslav Markin

Rigor: Type-Aware Ruby Static Analyzer and Bug Finder — Unlike Sorbet or Steep, no annotations are required. Rigor infers types from the values your code produces, while treating any RBS you have as authoritative.

Usami et al.

Pygments.rb 5.0: A Ruby Wrapper for the Pygments Syntax Highlighter — Pygments is one of the best syntax highlighters out there, but it's Python-based. This library makes it easier to call. v5.0 bumps Pygments up to the latest version.

Nyman, Gupta and Radchenko

💡 Alternatively, Rouge is a pure Ruby Pygments-compatible code highlighter.

React on Rails 17.0 – A complete way to integrate React into Rails apps. Now with full support for React 19 and streaming server rendering. (Homepage)
RuboCop Minitest 0.40 – Extension for enforcing Minitest best practices and coding conventions.
Gemsmith 26.0 – CLI tool for creating and managing Ruby gems following common best practices.
Rack::Proxy 1.0 – Request/response rewriting HTTP proxy for Rack apps.
RubyGems and Bundler 4.0.17

📰 Classifieds

🤖 No vibes, just vitals. AppSignal's MCP server brings Rails errors, traces & metrics into Claude, Cursor & Copilot. Debug in your editor.

Your Rails app logs events all day. TimescaleDB turns them into real-time analytics, right in the Postgres you already run.

😅 An Old/New Ruby Discovery of the Week

I recently got the itch to see what I'm getting for Christmas. Well, what's coming in Ruby 4.1, anyway. It's not going to be a big release syntax-wise, but there are a variety of new methods and features I'll share in coming weeks.

My first surprise, though, was the enhancement of a method added back in Ruby 2.4 that I had not noticed: String#unpack1

unpack1 is basically unpack that only returns the first extracted value. You'd use these methods when working with packed data, perhaps when parsing binary files, random protocols, network data, and the like.

So if, like me, you didn't know about unpack1 or the Ruby docs' surprisingly thorough Packed Data page which is *ahem* packed with examples, now you do.

The Ruby 4.1 change? unpack/unpack1 are getting new directives:

R for unsigned LEB128 (Little Endian Base 128) as used in DWARF and WASM.
r for signed LEB128.
^ to return the current byte offset (more useful than it sounds).
x! and @! are new alignment directives to handle padding in binary formats by advancing the cursor to aligned byte positions, relative to the record's starting offset (e.g. x!4) and the whole string (@!4) respectively.

If you're not tinkering around with packing and unpacking data, you might not have any use for these, but for my sins I enjoy low-level noodling with binary data in Ruby, so am looking forward to experimenting more.

This is a niche topic, but I learnt something, this is my newsletter, and hopefully I'll get to some more useful Ruby 4.1 additions for you next time ;-)

Matz's 'Extreme Vibe Coding' opens RubyConf

Thu, 16 Jul 2026 00:00:00 +0000

#809 — July 16, 2026

Read on the Web

Ruby Weekly

Introducing Insta: Snapshot Testing for Ruby — Instead of hand-writing expected values, tests assert against a recorded snapshot of your code's output. When it changes, an interactive CLI shows the diff for you to accept or reject. Extracted from Herb and supports Minitest and RSpec. GitHub repo.

Marco Roth

🚨 Behind on Rails? 7.2 Goes EOL in Less Than a Month… — Rails 7.2 reaches end of life next month. We've put 60,000+ hours into Rails upgrades, with real case studies and open source Claude Code skills. Upgrade with us or add capacity to your engineering team. Rails upgrades by experts, not guesswork.

FastRuby.io | Rails Upgrade Services sponsor

lobste.rs Migrates from MariaDB to SQLite — The lobste.rs programming link aggregator is built on an open source Rails app and, after a process spanning years, has now switched entirely to SQLite on a single instance. A good real-world case study for the Rails-on-SQLite era.

Dziedzic, Harkins, et al.

💡 The Lobsters team wanted to detect when SQLite was doing inefficient full table scans. Aaron Patterson comes to the rescue with how to do just that, wondering if it could be a useful warning in Rails generally.

⚡️ IN BRIEF:

Ruby 4.0.6 has been released as a minor routine release, while Ruby 3.3.12 brings security fixes for erb and net-imap.
Matz opened RubyConf this week with "Extreme Vibe Coding" where he shared his take on AI's role in development work. No video yet but it's mentioned in 𝕏 posts here, here, here, and here. Video as soon as we get it!
Spinel isn't just Matz's AOT Ruby compiler, it's also the name of the Spinel Cooperative, a group of Rubyists working on rv and other tools.

How to Start a Ruby Meetup — Fantastic advice for putting on your own Ruby get-together. The guidance is generic enough to work for technical meetups of any flavor. If you do well, there's also a guide to putting on a Ruby conference.

The Ruby Events Team

💡 If you'd rather attend a Ruby event, this RubyEvents.org page has you covered.

▶ Ten Talks from Brighton Ruby 2026 — Talks from last month's Brighton Ruby event, including ▶️ 10 Cool Things You Probably Didn't Know About Rails i18n and ▶️ From Rails 3.0 to Rails Edge, a 15 year Rails upgrade journey covering what it takes to get 300 engineers comfortable shipping on unreleased Rails versions.

YouTube

Where AI Belongs in a Rails Product — A Rails case study on RubyLLM agents, synthetic data, and knowing when not to use an LLM.

SINAPTIA sponsor

📄 Never Escape This Ruby Loop (Also, Here's How) – Is there a truly infinite loop in Ruby? Almost! Some fun poking here. Masataka Pocke Kuwabara

📄 Rails 8.1's Deprecated Associations and How to Fix Them – "Rails 8.1 lets you explicitly mark outdated or obsolete associations as deprecated." Julio Lucero

📄 A Gentle Introduction to Git Worktrees – For when you need to check out multiple branches into separate directories simultaneously. Nicholas C. Zakas

📄 6 Security Settings Every GitHub Maintainer Should Enable This Week Joseph Katsioloudes (GitHub)

🛠 Code & Tools

SimpleCov 1.0: Code Coverage for Ruby — The popular code coverage tool hits v1.0 after 15+ years at 0.x, bringing together a new report UI, redesigned configuration API, and improved parallel testing support. No release post means I might need to blog about this soon as it's a neat tool!

Berlin et al.

AppSignal for Startups: Up to 50% Off the Full Platform — Bootstrapped startups get up to 25% off ongoing; YC teams up to 50%. The full platform, not a cut-down tier.

AppSignal sponsor

Shopify’s Ruby Style Guide 3.0 — As one of the largest employers of Rubyists, Shopify is keen to enforce a particular way of writing Ruby there. This style guide is their attempt at that, and is also packed into a special RuboCop cop: rubocop-shopify. The rules have changed somewhat in this new version.

Shopify

minitest-strict: Stricter Assertions for Minitest — "Minitest's built-in assertions are lenient in ways that can mask bugs", says Erik, whose library redefines several assertions to require strict boolean values, plus adds assert_true, assert_false and assert_eql.

Erik Berlin

💡 As part of working on the http gem, Erik also made minitest-memory which provides assertions for tracking memory allocations.

BinData 3.0: A Declarative Way to Read/Write Binary Data — Rather than messing around with unpack, this makes working with data at the bit/byte level declarative and Ruby-like (example).

Dion Mendel

Torch.rb 0.25 – LibTorch-powered deep learning library from Andrew Kane, the creator of pgvector.
The Git Gem 4.4 – Wraps git to enable easier access from Ruby.
Shrine 3.9 – Popular file attachment handling toolkit.
RubyGems and Bundler 4.0.16

📰 Classifieds

🔬 Stop shipping untested AI code. Undercover CI shows 4 ways to catch it in your dev workflow.

🚀 On Hatchbox? Add AppSignal in two clicks for error tracking, host metrics & Sidekiq alerts. Hatchbox customers get 10% off.

📢 Elsewhere in the ecosystem

✨ This week, I stumbled upon this table of the top 100 starred Ruby repos on GitHub. How far can you go before you find something new to you?
Adrian Marin recently unveiled a big Avo 4 release – Avo is a powerful commercial Rails admin framework/template, though with an LGPLv3 licensed core you can use for free on hobby/personal projects.
Ollie Williams does a feature-by-feature audit of what build tools still do for frontend developers in 2026 and asks: do we still need build tools?
GitHub's Dependabot is now giving packages a three-day default cooldown before opening version update PRs, though security fixes are exempt.
A scrolling visualization of the ~200ms life of an HTTP request. Goes surprisingly deep into the details.

Getting Mastodon on Spinel

Thu, 9 Jul 2026 00:00:00 +0000

#808 — July 9, 2026

Read on the Web

Ruby Weekly

RubyGems.org Gets a New Design — The RubyGems site has received a major lick of fresh paint, much like the official Ruby site several months earlier, with a new theme in both light and dark modes. You can see the work that went on in these pull requests. I like it, though 𝕏 not everyone is a fan.

Rubygems․org

📊 The new stats page links to ClickGems, a site by ClickHouse that aggregates gem statistics and provides visualizations of gem download data (example).

Full-Text Search in ActiveRecord Without a Second System — The official ParadeDB gem brings BM25 full-text search to ActiveRecord. Query your live Postgres tables with the speed and relevance ranking of Elasticsearch. No ETL, no sync jobs.

ParadeDB sponsor

Getting Mastodon Running on Spinel — Two weeks ago we featured Sam's work on compiling a basic Rails app to run on Spinel, Matz's AOT Ruby compiler. But what about a real and large app? Work to get Mastodon running on Spinel is underway and has already yielded some neat byproducts including Spinel Redis and Postgres clients.

Sam Ruby

⚡️ IN BRIEF:

🇺🇸 The SF Ruby conference is back in November, complete with an 8-bit-inspired site and a rebranding to "San Francisco Ruby Startup Conference" with Y Combinator's Garry Tan keynoting.
🌐 Not keen on San Francisco? We've included a global Ruby and Rails events list at the end of the issue! RubyEvents.org also provides a good list.
Aaron 'tenderlove' Patterson proposes adding a new YARV instruction to CRuby to let the VM allocate 'right-sized' strings without the overhead of String.new's method dispatch.
Meanwhile, Jean Boussier proposes that Ruby 4.1's Symbol#to_s should return frozen strings.

🤖 How to Audit a Rails Project with Thoughtbot's Audit Skill — A developer runs Thoughtbot's Rails Audit skill against a mature Rails app and shows how to turn the final report into labelled, prioritized GitHub issues.

Daniela Baron

The Tale of Moving a Ruby App from Heroku to Render — A case study of moving a high traffic Ruby app. Compute costs fell but egress fees sent the bill up significantly. Render's founder replied on X saying the post offers a "good overview" and confirmed improvements are on the way.

Jon Sully (Judoscale)

💡 This is the first in a series of "Judoscale on Tour" posts with Railway, Fly, Northflank, DigitalOcean, and AWS ECS getting the same treatment soon.

💬 Once a Maintainer: Mike Dalessio — A popular interview series catches up with Rails committer and Nokogiri maintainer Mike Dalessio on how AI has changed security work, plus maintainer burnout.

Allison Pike / Once a Maintainer

Rails, Django or Laravel: Which Is Cheapest to Vibe Code? — AI-generated Rails code hides N+1s until production. We tracked the real token costs of vibe coding.

AppSignal sponsor

📄 A new official Rails tutorial: Product Reviews – Covers adding a reviews feature to the e-commerce app built in Getting Started with Rails. Chris Oliver

📄 Writing a Linter is Fun: Introducing Marcdouane – Using dry/cli, dry/configurable, dry/events and inkmark. Stéphane Maniaci

📄 Cinnamon Buns and Commit Bits: A RubyConf Story – "I still think being a Rubyist matters and going to events like RubyConf matters." Richard Schneeman

📄 Surviving Rolling Deploys When Sidekiq Meets a Class It Doesn't Know Yet Dmitry Tsepelev

🛠 Code & Tools

Lexxy: A Modern Rich Text Editor for Rails — 37signals introduced Lexxy as a replacement for Trix a year ago. It's matured significantly since, is the main editor in Basecamp, and now has a homepage of its own. It comes with Markdown support, smart links, code highlighting, and integrates with Action Text.

37signals

Extralite 3.0: A Fast, Featureful SQLite Wrapper — The "Ruby on SQLite, but better" library is now.. betterer? It adds many things sqlite3-ruby lacks, has good concurrency options, supports advanced SQLite features, and with v3.0 supports object graph transforms too, as demonstrated in this post.

Sharon Rosner

Behind on Your Product Roadmap? Scale Your Rails Team, Fast — Vetted Rails engineers embedded in your team in weeks, not months. They ship from day one. Flexible terms, no lock-in. 🚀

FastRuby.io® | Rails Staff Aug sponsor

PL/Ruby 2.5: Ruby as a Procedural Language for Postgres — Lets you write functions, triggers, event triggers, and procedures for Postgres in Ruby. Intrigued what you could do? There's a 'cookbook' covering things like email validation, triggers, and token generation.

Joshua D. Drake (Command Prompt Inc.)

💡 If you're a Postgres user, check out our Postgres Weekly newsletter.

AASM 6.0: Add State Machines to Ruby Classes — Started life as the acts_as_state_machine for Active Record, but AASM now supports plain Ruby classes as well as other libraries like Mongoid and Sequel. Ruby 2.x and Rails 6.x support are dropped in v6.0.

Barron, Böttger, et al.

phlex-reactive: Reactive Phlex Components for Rails — Get Livewire-style actions and live cross-tab updates without writing Stimulus controllers or hand-picking Turbo Stream targets.

Mikael Henriksson

📱 Hotwire Native 1.3 – A big release for the framework that turns Hotwire-powered, server-rendered apps into native iOS and Android apps.
Turbulence 1.4 – Visualize Ruby code churn versus complexity, now with improved visualizations and a data recorder for your flight logs.
Lograge 0.15.0 – Tame Rails' default policy to log everything. Now fully tested up to Rails 8.1 and Ruby 4.0.
Tilt 2.8 – Generic interface for Ruby template engines.
Nori 2.9 – Long-standing Ruby XML-to-Hash parser.

📰 Classifieds

🔌 Connect AppSignal to Claude Code, Cursor & Copilot. Get Rails errors, traces & metrics in your AI editor.

🔺 Made a library? Written a blog post? Found a useful tutorial? Share it with the Ruby community on RubyFlow, the Ruby and Rails community linklog.

🗓 Upcoming Ruby Events

🇺🇸 RubyConf 2026 (July 14–16 in Las Vegas) — Taking place next week, the flagship US Ruby conference still has tickets available.
🇯🇵 Kansai RubyKaigi 9 (July 18 in Otsu, Japan) — A regional Japanese Ruby event. Yui Naruse is one of the keynote speakers.
🇰🇪 RubyConf Africa 2026 (August 21–22 in Nairobi, Kenya) — A two-day event featuring 13 talks and a keynote by Sanmi Amos.
🇨🇿 EuRuKo 2026 (September 17–18 in Brno, Czechia) — Europe's longest-running Ruby conference.
🇺🇸 Rails World 2026 (September 23–24 in Austin, TX) — The Rails Foundation's flagship event. The speaker lineup was announced in June.
🇺🇸 Rocky Mountain Ruby 2026 (September 28–29 in Boulder, CO) — A well-regarded regional US Ruby conference.
🇯🇵 Kaigi on Rails 2026 (October 16–17 in Tokyo / Online) — A Rails-focused Japanese conference. The CFP closes in just a few days (July 12).

ℹ️ Note: This list isn't exhaustive, but we'll continue to mention and promote other events over time.

The tools RubyKaigi attendees are using

Thu, 2 Jul 2026 00:00:00 +0000

#807 — July 2, 2026

Read on the Web

Ruby Weekly

What Active Rubyists at RubyKaigi Are Using in 2026 — RubyGems's maintainer shares data based upon a survey of RubyKaigi 2026 attendees. It's an interesting sample, as RubyKaigi attendees tend to be active shippers, maintainers, and prominent Rubyists. Ruby 4.0 usage is strong, VS Code dominates, and most are using Claude Code and Docker Compose.

Hiroshi Shibata

💡 On the topic of surveys, the 2026 Ruby on Rails Community Survey closes tomorrow, so take it now if you can.

Rails Experts You Like & Trust, Now Embedded in Your Team 🚀 — Since '17, companies have trusted FastRuby.io with their most complex Rails upgrades. Now those same engineers can scale your team fast: shipping features, fixing bugs, accelerating delivery, and integrating AI effectively. Let's talk!

FastRuby.io® | Staff Augmentation sponsor

Hanami 3.0: The Ruby Framework in Full Bloom — The popular modular app framework rolls out some major features, including mailers, i18n, and Minitest support, along with performance gains. The new homepage does a great job of making Hanami's case. If you want a framework that’s super modular and lets you pick and choose what you need, it's a must-see.

Tim Riley

⚡️ IN BRIEF:

RDoc 8.0 has been released and it's a big update for the Ruby documentation tool with Prism-based parsing, RBS signatures in docs, a live preview server, and more.
Shugo Maeda has proposed Scala-like for comprehensions for Ruby. He has a proof of concept ready to run, but the reactions so far are lukewarm at best.
Async maintainer Samuel Williams proposes a fix so CRuby's SIGINT handling no longer ignores Thread.handle_interrupt masking.
Ruby 3.4.10 has been released with a wide variety of small bug fixes, plus a security update for net-imap.

Rails, The Sharp Parts: A Polymorphic Type is Not a Foreign Key — Polymorphic associations aren’t real foreign keys, says Brandon, who shows off the sharp edges around their use. “When people ask me about polymorphic relationships my answer is simply: Don’t.”

Brandon Weaver

Five Rules for Taming RSpec's let Overuse Problem — Concrete, code-backed rules for using let effectively, based on advice from RSpec maintainers and years of consulting. There’s also an agent skill you can use to enforce the idea.

Michael Toppa

Find the Slow Query Killing Your Rails App — AppSignal pinpoints N+1 queries and slow SQL in your Rails app, then shows you exactly what to fix.

AppSignal sponsor

📄 An Introduction to Server Sent Events in Ruby – How to push data in real-time over a single request with Rack 3.0. Brooke Kuhlmann

📄 The 'Constant Frozen at Boot' Bug: A Ruby Exercise for an Interview – A real production bug that makes for a good interview question. Evgeny Zhdanov

📄 When Does an Active Record Query Actually Run? – “An ActiveRecord::Relation is deferred query intent, not database truth.” Syed Aslam

📄 Getting Started with Claude Code, on macOS, with chruby and RSpec Jonathan Rochkind

🛠 Code & Tools

Skrift: A Pure Ruby TrueType Font Renderer — A port of the C-based libschrift to Ruby that rasterises TrueType/OpenType outlines. The output can then be rendered in the terminal (above) or saved to an image, etc.

Vidar Hokstad

Classifier: Bayesian and LSI Classification Algorithms — Covers Bayesian classification, logistic regression, LSI, KNN and TF-IDF, for when you want to create text classifiers (e.g. spam filtering or similarity checks) without dragging in a huge ML model.

Lucas Carlson

Jidoka: Automation with a Human Touch — Pair coding agents with senior engineers to modernize legacy code and ship faster with built-in quality.

JIDOKA by SINAPTIA sponsor

jemalloc_rb: Reviving the Alternative Malloc for Ruby — Injects jemalloc into CRuby apps for better memory usage. May be useful now that Meta has committed to working on jemalloc again.

Henrique F. Teixeira et al.

Activepad: A Rails 'Scratchpad' for macOS — A paid app you point at a Rails project (local or remote) to get a tidy editor that provides a Rails console-like experience for building and running Ruby snippets.

Cengiz Gürtusgil

Rails Semantic Logger 5.0 – Replaces the Rails default logger with Semantic Logger for structured logging.
pru 0.3 – 'Pipeable Ruby' tool that can replace grep/sed/awk, etc. and let you use Ruby expressions instead.
Crass 1.0.7 – Pure Ruby CSS parser that supports CSS Syntax Level 3 with tolerance for broken input.
rspec-openapi 0.30 – Generate OpenAPI schemas from RSpec request specs.
wasmtime-rb 46.0 – Ruby WebAssembly runtime powered by Wasmtime.
IRuby 0.8.3 – Ruby kernel for Jupyter/IPython Notebook.

📰 Classifieds

🔬 Shipping AI code? Undercover CI catches untested methods in your PRs before you merge. Coverage percentages won't. Free for open source.

🚂 Rails slow? AppSignal finds N+1s & slow queries fast.

Postgres is already your Rails database. TimescaleDB makes it your analytics database too.

📢 Elsewhere in the ecosystem

Commit History is an online tool that creates a chart of a user's total GitHub commits over time. A neat addition to your profile README, perhaps?
Git 2.55 has been released with git history fixup for 'fixing up' earlier commits, faster git status on Linux, and more.
GitHub is continuing with efforts to make project management less overwhelming in the agentic era. Now you can restrict issue creation to collaborators with write access. They've also added pull request limits.
📊 Frank Denis wanted to see the performance of WebAssembly runtimes in 2026 and pitted nine options against one another.
Talking of WebAssembly, remember that you can run CRuby on WASM – this site provides a good example with Ruby 3.4 running in the browser.