Ruby Weekly

How fast can you actually patch Ruby?

Thu, 29 Oct 2026 00:00:00 +0000

#824 — October 29, 2026

🔒 Last Friday we sent out a special issue about some CRuby security releases which fixed a few nasty regexp bugs. If you haven't updated yet, it's worth a read to see if you're affected and what to check!
__
Your editor, Peter Cooper

Ruby Weekly

How Fast Can You Actually Patch Ruby? — When the Ruby security fixes shipped last week, Dennis timed how long they took to reach version managers, Docker images, CI services and hosts. The core team's image took eight minutes, while Docker's official image (Rails and Kamal's default) took ~16 hours.

Dennis Paagman

💡 Things are improving, though, as Ruby core team members now have commit access to Docker's Ruby image repo and are looking into automating updates. Meanwhile, Greg Molnar shows how to build your own image locally and deploy it with Kamal.

Your Dashboard Shouldn’t Wait for a Cron Job — The nightly job rolls up yesterday’s rows so the dashboard loads. Numbers lag a day and the job keeps growing. TimescaleDB continuous aggregates refresh rollups inside Postgres, so ActiveRecord reads fresh totals. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

Bad Requests and the Dream of a Quiet Rails App — Requests for /.env and /wp-admin, binary bytes in User-Agent headers, made-up MIME types… Ben walks through the Rails middleware stack to show why some junk requests become 500s, and why even 'handled' ones can still set off your error monitor.

Ben Sheldon

What's New at RubyGems.org: Ruby Central's Changelog Returns — Ruby Central catches us up on RubyGems.org and Bundler 4.1 work. Its AI scans of popular gems are a highlight: reviewers rejected 90% of the findings they looked into, though one was a critical auth bypass in rubyntlm.

Kirk Haines (Ruby Central)

Thank You, But I Prefer It My Way — If an LLM can just rewrite a library, is it worth persuading a maintainer about your PR or do you just route around it? Julik ponders the complexities and offers some practical ways forward.

Julik Tarkhanov

I Get 215 GitHub Notifications a Day, So I Built a Bot to Triage Them — A look at how the creator of RubyLLM built a RubyLLM-powered agent to label issues and PRs, reply only when useful, and sort the rest onto a board.

Carmine Paolino

📄 Parsing JSON-Structured Docker Logs with the OpenTelemetry Collector – How 37signals unwraps the JSON-in-JSON logs from its Kamal-deployed Rails apps. Lewis Buckley (37signals)

📄 Benchmarking Campfire with Many Users – Sam load-tests Campfire with up to 3,000 users, opens three PRs, and compares Rails with his Roundhouse-transpiled build on Falcon. Sam Ruby

📄 React Server Components on a Gumroad Fork: From 53 to 86 on Mobile PageSpeed – Compares live RSC and Inertia versions of a product page, using the commercial React on Rails Pro. Justin Gordon (ShakaCode)

📄 Making AI Agents Safe to Retry – Moving an LLM agent into a Sidekiq job without retries repeating its actions. Mateus Pereira (FastRuby.io)

🛠 Code & Tools

Carton: Real Boundaries for Ruby — Built on Ruby 4's experimental Ruby::Box, Carton enforces module boundaries at runtime where only what a 'carton' exports is visible outside it, monkey patches to core classes stay contained, and each carton can bring its own gem versions.

David Cristofaro

🚨 Rails 8.0 Support Ends Nov 7 | Get AI Upgrades on Autopilot — Our AI agent ships small upgrade PRs that pass your tests; nothing merges without you. Join the beta waitlist.

FastRuby.io® | AI-Native Rails Maintenance sponsor

Spree 6.0: A Rewrite of the Rails E-Commerce Platform — Marketplace, B2B, tax and inventory features are now in the open source core, carts and orders are separate models, and the checkout state machines are gone. Note that Rails now powers only the backend, with a React admin and Next.js storefront.

Spree Commerce

GenevaDrive: Durable, Step-Based Workflows for Rails — Define multi-step workflows tied to a record, with waits, resumable steps over large collections, and signals from webhooks. State lives in your database, with steps surviving restarts and duplicate job runs being skipped.

Julik Tarkhanov

⏱️ Horologium: Scientific Time Library for Ruby — A new gem, extracted from Astronoby, that handles eight time scales including TAI, TT, TDB, UTC and UT1, plus leap seconds (which Time can't represent) and precise Julian dates.

Rémy Hannequin

⭐ RubyGems and Bundler 4.1.0.beta3 renames Bundler's new override keys to in: and with:, and records overrides in a new OVERRIDES section of Gemfile.lock.
Prosopite 2.5 – N+1 query detector. Now suggests fixes, adds RSpec and Minitest assertions, and can ignore known N+1s while you adopt it gradually.
OmniAuth 2.2 / 2.3 – Multi-provider auth. The first new minor versions since 2022 add allowed_hosts and support for concurrent sign-ins.
The Git Gem 6.0 – Ruby interface to the git command line. A big breaking release that removes the old object model and requires Git 2.43+.
ruby-duckdb 2.0 – Ruby client for the DuckDB analytical database, now tracking DuckDB 2.0 and dropping several deprecated APIs.
Rage 1.29 – Fiber-based, Rails-compatible API framework, now ready for Ruby 4.1's fiber scheduler changes.

📢 Elsewhere in the ecosystem

Sean Goedecke argues that software is slow because of bad design, not slow languages, drawing on his experience of staring at Ruby flamegraphs and profiling Rails endpoints.
Nate Berkopec ported Ruby 4.0.9 to Fil-C, a memory-safe C toolchain. It ran real programs like Puma, but was ~5x slower and used far more memory, so Nate has 𝕏 declared the experiment over.
Python's experimental JIT is likely to be removed. Ruby came up a lot in the related Hacker News thread, where Jean Boussier credited Matz for supporting work on Ruby's JITs.
Sentry has given $1m to open source maintainers this year, up from $750k, with $40,000 going to Ruby Central.

Ruby regexp security fixes: a newsflash

Fri, 23 Oct 2026 00:00:00 +0000

#823 — October 23, 2026

Read on the Web

Ruby Weekly

Ruby regexp security fixes
Who needs to update?

It's very rare I'll do an out-of-band issue of Ruby Weekly but after digging into today's security releases of CRuby, I felt it was prudent to spread the word.

Ruby 4.0.9, 3.4.12, and 3.3.13 have all been released today with fixes for regexp bugs behind four GitLab-assigned CVEs. If you can update, do so. But I'll explain what the issues are below and you can determine if they affect you.

Takashi Kokubun's official advisory has the full story, if you want to go direct to the most official source.

Note: These bugs are specific to CRuby's Onigmo engine. JRuby and TruffleRuby use different regex engines and aren't affected by these fixes.

What are the bugs?

There were three bugs in Onigmo, Ruby's regular expression engine, that could corrupt memory while a regex pattern is being compiled:

A double free when parsing a pattern fails after an alternation. Ruby 4.0 has had this fix since 4.0.0.
An integer overflow in the size of a compiled pattern, first fixed in 4.0.8 – released yesterday.
An overflow of internal IDs in patterns with many repeats, fixed in 4.0.9.

So if you moved to 4.0.8, which I featured yesterday, you need one more bump.

GitLab found these bugs could enable remote code execution on GitLab servers, including attacks that require no login. It assigned four CVEs rated Critical (CVSS 9.9 or 10.0) and patched the Ruby it ships. Ruby hasn't requested separate CVEs for these fixes so far; its advisory asks users to track them under GitLab's identifiers.

Is your code affected?

You're exposed if your application (or a dependency, alas) compiles regex patterns whose structure a third party can control. For example:

Regexp.new or Regexp.compile called on user input.
Interpolating input into a regex literal, like /#{params[:q]}/. Interpolation doesn't escape, so the user can supply a pattern.

Think regex-powered search boxes, user-defined validation rules, or filters in CI and webhook tools. If every regex in your stack is written by you/your team, you're in a better position.

Two things that won't help: Regexp.timeout, since the damage happens during compilation before matching starts, and limits on pattern length, because some of the bugs can be triggered by short patterns. Before the compiled-size fix, for instance, Regexp.new("(?:.{90000,}){90000}") was enough to lock up the process.

What should you do?

Upgrade to Ruby 4.0.9, 3.4.12 or 3.3.13. (Ruby 3.3 normally gets only vulnerability fixes now; the core team backported these as an exception, since GitLab, not Ruby, is the one treating them as CVEs.)
Find the risky spots in your code by looking for Regexp.new, Regexp.compile, Regexp.union and /#{ constructions, and checking where their input comes from.
Can't upgrade yet? The official best practice is to avoid compiling regexes from untrusted input at all. How you do that is up to you: Regexp.escape turns user input into a literal-only pattern, and a plain substring match (e.g. include?) can be enough for many situations.
On Ruby 3.2 or older? Older versions are end-of-life and won't get official fixes, so step 3 is your main option for now.

I'll be back next Thursday with, I hope, a regular issue… 😅

___
Peter Cooper, editor of Ruby Weekly

How Rails made its enums 4.5x faster

Thu, 22 Oct 2026 00:00:00 +0000

#822 — October 22, 2026

Read on the Web

Ruby Weekly

📊 The 2026 Rails Community Survey Results — The results show a community favoring a familiar core stack (monolith, Postgres, Puma), a huge jump in adoption of mise, RSpec remaining the most popular testing framework, and widespread AI adoption, while half worry about the long-term value of their skills.

Planet Argon

💡 If you want something to read or listen to, you can also find out what people's favorite Ruby books and favorite Ruby podcasts are.

🚨 Rails 8.0 Support Ends Nov 7. Upgrade on Autopilot — Our AI agent opens small upgrade PRs only when your own CI is green, and dual-boots your application with next_rails. You review and merge; you stay in control. Beta from $497/mo, month-to-month. Join the waitlist today.

FastRuby.io® | AI-native Upgrades on Autopilot sponsor

Static Analysis for the Uninitialized — Aaron, working through a static analysis textbook, builds an analyzer from scratch to find "possibly uninitialized variables" in Ruby. Sounds in the weeds, but by the end it parses real Ruby with Prism and flags a NameError before running.

Aaron 'Tenderlove' Patterson

💡 On the topic of Prism, there's some big news this week – see Code & Tools.

⚡️ IN BRIEF:

💎 Ruby 4.0.8 has been released. It's billed as "routine", but is kinda significant as it fixes forked children hanging on hostname lookups on Linux, Ruby failing to build against the macOS 27 SDK, and a ZJIT bug that swapped keyword arguments.
📊 Erik Berlin has opened some PRs to speed up core methods, including pattern-defeating quicksort for numeric arrays (4-9x faster) and quicker Array#include?, Range, String and Time operations. Core members are considering which will land in 4.1.
A long-time gem author has archived all his Ruby gems, saying the "for humans" era of Ruby is over. An intense discussion ensued on Hacker News.
Rails has merged config.zjit, so ZJIT can be switched on after boot (as YJIT can). The PR's numbers show ~18MB less JIT memory used per worker.

Rails is a JIT Compiler (Or: How Aaron Made Enums 4.5x Faster) — Rails' enum predicates are built with define_method and public_send that JITs struggle to optimize. Aaron Patterson has made them real generated methods that are ~4.5x faster under YJIT in his benchmark. Coming to Rails 8.2.

Max Bernstein (Rails at Scale)

Rails Analytics on the Postgres You Already Know — TimescaleDB extends the Postgres behind your app so dashboards stay fast as data grows. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

📄 Does Rails Still Make Sense? – Spoiler: yes. A good retort to anyone asking why you don't just get an LLM to rewrite all your apps in Rust. Dirk Jonker

📄 Eight Months in Next.js: A Rails Developer's Field Notes – An even-handed look at what Rails hands you for free. Werner Petrick (Puzzl)

📄 Short Written Summaries of 24 Rails World 2026 Talks – Handy if you skipped the videos! Yaroslav Shmarov

🛠 Code & Tools

Prism 2.0: Ruby's Parser Gets Its First Major Release in Two Years — Prism now underpins CRuby, Ruby LSP and RuboCop, so you're using it even if you never call it directly. It's now faster and leaner, with precompiled platform gems, complete RBS and RBI definitions, a C++ API, and Ruby 4.1 syntax support. There's also a Web-based playground where you can give it a spin.

Kevin Newton et al.

Net::SSH 8.0: The Pure Ruby SSH Client Library — The first major release since 2022. Ed25519, X25519 and ChaCha20 now come from the openssl gem, so separate gems are no longer needed. Defaults now track OpenSSH (e.g. SHA-1 RSA and DSA are off by default), plus ControlMaster reuse (i.e. connection sharing) and FIDO key support.

Miklós Fazekas et al.

Tired of Writing NRQL? AppSignal Builds Your Rails Dashboards for You — Dashboards that build themselves, plus deploy markers and uptime checks. Unlimited users, 30-day trial, no credit card.

AppSignal sponsor

Introducing RuboCop Spellcheck — A RuboCop plugin for checking spelling in Ruby comments, strings, identifiers, Markdown, RDoc, AsciiDoc, and plain text.

Daniel Doubrovkine

Passenger 7 Preview – The first major version since 2018. The headline is WebSocket support for Apache, and the minimum Ruby rises to 3.0.
WhatLanguage 3.0 – My pure Ruby natural language detector changes a few of the ISO codes it returns and gets a lot faster.
Logster 3.0 – Discourse's embedded log viewer for Rack apps (screenshot). Drops support for Ruby <3.3, Rack <3.1 and Rails <8.
Aruba 3.0 – Test CLI apps with Cucumber, RSpec or Minitest. Every scenario now gets its own working directory.
ViewComponent 4.17 – Now works under Rails' experimental Ractor mode.
Truemail 4.0 – Email address validation library. Now supports Ruby 4.

🪏 Digging into Ruby's past…

I've been working with Ruby for 22 years, but last week I noticed Ryan Davis (of Seattle.rb and Minitest fame) celebrating his 26th anniversary of using Ruby, and it got me thinking about Ruby's history which goes far beyond even that.

Ruby's 33 years old, so there's plenty of history to go over if you can find it amid the linkrot. Last week I discovered a new lead: a site which archives hundreds of programming mailing lists all the way back to the 90s. ruby-talk's on there and its archives go back to the very first post by Matz in 1998.

Today, ruby-talk is a quiet list with the Ruby Users Forum largely taking over its role, but at the list's peak in 2006 it hit over 6000 messages a month, so there's tons to go through.

I've been (very) slowly going through the archives to find interesting tidbits, so I wanted to share a few bits from the late 90s I enjoyed:

Matz shared the history of the Ruby project saying it was 'born' on February 23, 1993 (though it didn't get a public release till December 1995), explained his background as a programmer, and why Ruby came to be.
There was no RubyGems back then, so people would ask if Ruby should have its own central archive for modules with Matz saying he had a 'vague hope' to have such a thing 'someday'. The first attempt (the "RAA") appeared soon thereafter.
Ruby was getting ready for IPv6 as early as 1999. 27 years later, my ISP still doesn't support it… 😅
Dave Thomas, of Programming Ruby (Pickaxe) fame, first appeared in December 1999 asking a question about yield vs block.call.
Even in 1999, Matz was pondering a future where Ruby scripts could be frozen into executables.
Two years before JRuby started, Bryce Dooley came up with its name.

If you have any interesting data dumps, archives, or similar things relating to Ruby's ancient history – especially community stuff – hit reply and let me know, as I'd love to unearth any interesting gems, ideas, or discussions going on back in the day.

Ruby 4.1's first preview is here

Thu, 15 Oct 2026 00:00:00 +0000

#821 — October 15, 2026

Read on the Web

Ruby Weekly

Ruby 4.1 Preview 1 Released — Two months out from its final release, we get a 4.1 preview to play with, complete with Module#descendants, Ractor-local GC, YJIT on Windows, and a raft of smaller changes. Worth testing to shake out the effects of things like Symbol#to_s returning frozen strings and all Regexp instances being frozen too.

Yui Naruse

Your Rails App Doesn’t Need a Data Warehouse — Slow Rails reports usually get a warehouse and an ETL job. Now numbers lag and you run two systems. TimescaleDB extends the Postgres your app already uses, so analytics run on live data with plain ActiveRecord. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

📊 ZJIT is Now as Fast as YJIT — Shopify is now running the ZJIT compiler in production, where it matches or edges out YJIT on response time while using about 20% less JIT memory. Early and directional only, but a neat milestone.

Max Bernstein

⚡️ IN BRIEF:

🔒 RubyGems.org now shows security warnings on gem version pages, with known advisories from OSV and malware labels on malicious releases.
There's a proposal to speed up Struct and Data to narrow the performance gap with equivalent hand-written classes.
gem.coop's 2027 Gem Fellowship aims to fund 15 Ruby open source projects. Applications open December 1.
🇧🇷 Tropical on Rails has announced its 2027 dates: March 18-19 in São Paulo.

Living in a Booming Time for Ruby — Responding to DHH's Rails World keynote, Julik argues that the Ruby world is in the midst of a creative boom where the community is using AI to fix things and plug gaps that have sat open for years.

Julik Tarkhanov

🚨 Rails 8.0 Support Ends Nov 7. Upgrades on Autopilot With AI — Our AI agent ships small upgrade PRs that pass your test suite; you stay in control. Starting at $497/mo. Join the beta.

FastRuby.io® | AI-native Upgrades on Autopilot sponsor

📄 Adding Custom Thor Commands to Your Rails App – One line in config/boot.rb enables discovery of commands in lib/commands. Ben Sheldon

📄 Escape LIKE Wildcards with sanitize_sql_like – Otherwise a search for % can match all rows… Andy Croll

📄 Deploying a Roundhouse App with Kamal – Shipping Campfire as a Spinel-compiled binary. Greg Molnar

🛠 Code & Tools

RuboCop 1.92 Makes Agents More Welcome — There's a strong focus on making RuboCop easier for coding agents to drive, with richer JSON output, offense caps, an --explain option and a better MCP server. There's a 'mountain' of autocorrection fixes to help humans too.

Bozhidar Batsov

💡 RuboCop's homepage has also been rebuilt and now features a new playground (pictured above) that runs RuboCop in your browser (thanks to ruby.wasm).

The New Relic Alternative With One Price and Every Feature Included — Errors, N+1s, Sidekiq, logs and host metrics in one gem. Unlimited users, free dev-to-dev support, 30-day trial.

AppSignal sponsor

Hot Cell 1.0: Securing Active Storage in the Age of AI — A way to run risky file processing operations in a container with no network and a read-only filesystem. Your app passes it open file handles over a Unix socket. The upcoming Rails 8.2's Active Storage can switch to using it with a config change.

Mike Dalessio (37signals)

Iodine 0.8: A C-Powered Ruby Server Built for Long-Lived Connections — A big rewrite, with network I/O handled by a C event loop outside the GVL. Supports Rack apps, plus the author's event-driven NeoRack API for streaming without tying up Ruby worker threads.

Boaz Segev

💡 Falcon is another option for handling many concurrent connections that uses fibers and the async gem, and supports HTTP/2.

scrap4rb: Find the Messy Tests in a Ruby Project — A small tool, based on Uncle Bob's SCRAP, that scores Minitest tests for smells like missing assertions, heavy mocking and hidden helper work, then gives one piece of advice per file.

Robert Hopman

RailsPreFlight 0.1 – Reads a Rails app and tells you what stands between it and the Rails version you want.
sqlite3-ruby 2.10 – Ruby's SQLite bindings. Now bundles SQLite 3.54.0 and adds Database#serialize and #deserialize to return or populate a database with a binary string.
Bullet 8.3 – Detects N+1 queries and unused eager loading. Now supports the upcoming Active Record 8.2.
Solid Errors 0.8 – Self-hosted, database-backed error tracker for Rails.
Cucumber 12.0 – The plain-language BDD test tool.

📰 Classifieds

Cut your Ruby CI times in half. WarpBuild runs GitHub Actions twice as fast at half the cost. Get $50 in free credits with code START50.

Keep up to date with key releases in numerous tagged programming language ecosystems with the GitHub Release Tracker.

📢 Elsewhere in the ecosystem

🎮 RedGem is an experimental 3D game engine, with its own editor, where you write the gameplay in Ruby (via mruby). Exports games for Linux, Windows and Android. (GitHub repo)
🔒 Trail of Bits tested whether 25 package managers notice a malicious repository tampering with packages. Bundler passes if your Gemfile.lock has a CHECKSUMS section (the default for new lockfiles since Bundler 4), but plain gem install has nothing to check against.
🤖 If you want something like Claude Code/Codex but independent, open and supporting a wider range of models, OpenCode 2.0 is a great option – you can get started here. Pi is also good if you want something minimal.
Lea Verou shows off a neat way to use icons in web UIs and do all the inserting and tweaking with CSS with no HTML involved.
Ryan Bigg, author of several Rails books and Rails contributor, is stepping away from tech after a wave of job rejections.