Heroku has transitioned to a Sustaining Engineering model to provide a stable, secure, and reliable environment for apps and data. They will continue releasing features aligned with these goals. Today, they share three recent enhancements.
Heroku has increased the default maximum compressed slug size from 500MB to 1GB to support modern applications, especially those leveraging AI and data-heavy libraries. This reduces developer friction in evolving stacks. App slugs are container build artifacts produced by Heroku Buildpacks and run in dynos.
A podcast episode from IndieRails where the host discusses business updates and how AI has transformed his work, including Flipper Cloud's revenue growth.
This post demonstrates how to upload and download directories using Transfer Manager, customize transfers with filtering options, and handle results effectively.
Learn how to create an interactive emoji composer using HTML Canvas and Stimulus. Click emojis to add them to a canvas, drag them around, and export your creation as an image. All running in the browser with no external dependencies.
Exploratory data analysis benefits from 2D histograms, which are density maps showing where most data points cluster. This article demonstrates how to implement them in pure Ruby.
GitLab 18.10 enables Free GitLab.com teams to access Agentic AI by purchasing monthly GitLab Credits, without a subscription upgrade. Teams pay for AI usage from a shared credit pool, gaining features like planning, code generation, automated code review, and pipeline diagnosis.
GitLab 18.10 introduces AI-powered security capabilities to improve vulnerability management. Features include generally available SAST false positive detection using LLMs to prioritize real threats, and beta agentic SAST vulnerability resolution that auto-generates merge requests with fixes, reducing the need for security experts.
This week's Ruby Weekly newsletter covers RubyGems' proposed cooldown feature for new packages, a discussion on AI-generated code in production, and the release of Ruby 4.0.2 fixing a YJIT bug.
A Rails blog transpiled to JavaScript produces identical HTML. Not similar. Not close enough. Identical. Here's how I proved it and what I found along the way.
Active Record simplifies database interactions in Rails by allowing Ruby-based queries instead of SQL. As applications grow, fetching data from multiple related tables requires joins. This guide explores the Active Record query interface for joins.
Rails is much more than a framework on top of Ruby—it adds hundreds of methods, classes, and abstractions that plain Ruby simply doesn't have. This is a complete reference of everything Rails brings to the table.
The Rails Infrastructure team developed an open-source benchmarking toolkit for measuring Bundler performance improvements. They discovered that while AI excels at scaffolding tools, engineering rigor, trusting intuition when data seems off, is irreplaceable.
RubyLLM 1.14 ships a Tailwind chat UI, Rails generators for agents and tools, and a simplified config DSL. Includes a demo of the setup in under two minutes.
ZJIT's optimizer now removes redundant object loads and stores, improving JIT performance of CRuby's shape system. This post explains how the optimization works.
A zen master responds to a student's question about prioritizing tests or code with a parable about a bridge's walkway and pillars, emphasizing their interdependence.
Most developers never see the 11 pack releases shipped in the last 14 months as pack CLI maintainers. That's a good sign—it means the infrastructure just works. When a critical vulnerability emerges, the fix is shipped within days.
This podcast episode features hosts Joël Quenneville, Sally Hall, and Aji Slater recapping season 2 highlights, discussing key topics like typescripts and LLMs, and sharing updates on their work.
A Rails blog running across three browser Workers: SharedWorker for application logic, dedicated Worker for SQLite with OPFS persistence, main thread for Turbo and Stimulus. Under 600KB gzipped. No server required.
This edition of the Short Ruby Newsletter highlights the release of Herb 0.9, Ruby 3.4.9, Shopify's launch of a high-performance Ruby analyzer, and Basecamp's ONCE.
Exploring polymorphism in Rails through strategies to avoid excessive inheritance. The post discusses code smells from implicit coupling in parent-child classes, using a messaging campaign example, and proposes alternatives.
This week's Hotwire Weekly newsletter covers Herb v0.9.0 with new linter rules and language server enhancements, smooth UI animations in server-rendered Rails apps using Turbo and View Transitions API, htmx infinite scroll for photo galleries, and more.
The official Ruby team announces the release of Ruby 4.0.2, a routine update with a bugfix in YJIT for NoMethodError on Puma. The release schedule plans for updates every two months, with Ruby 4.0.3 in May.
Redesigning a Rails application is easy on paper. Making it work with real systems is harder. Here’s how Rails teams align design visions with reality.
A demo of full stack watch mode in Rails, running the complete test suite—including model, controller, and system tests—continuously on every save at 47ms per test. It's faster than jsdom, uses a real browser, and handles the tests DHH gave up on.
Hanami logging improvements completed this week, making logs beautiful. After merging the universal logger, which provides a consistent interface across the framework.
Rails's naming magic relies on inflections, but acronyms like API can cause casing issues. Use inflect.acronym in config/initializers/inflections.rb to teach Rails the correct casing, ensuring class names like API::UsersController are generated properly while file paths remain lowercase.
Exploring Ruby's potential in data science, the author tests interactive code in Jupyter and successfully renders 3D plots using ruby-libgd, overcoming initial skepticism.
Security advisory: A race condition in Devise's Confirmable module allows attackers to confirm email addresses they do not own. This impacts applications using the reconfirmable option. Patched in Devise v5.0.3. A workaround is provided.
This one goes out to all the testing neophytes who only recently realized that it's useful to have an automated means of verifying their code does what it claims to do. For the last month, I've been working on prove_it , a framework for building quality harnesses for Claude Code —primarily via its hooks system . In a recent release, I added TDD enforcement to its default configuration. First, it injects a test-first development approach into every plan Claude generates. Then, a PreToolUse hook follows up with permissionDecisionReason reminders whenever the agent deviates from the one true path (e.g., repeatedly edits source files without touching any tests, never runs a test to see it fail, etc.).
A case study on automating quarterly progress reports using an AI-powered workflow in a Rails maintenance service. It details mapping a manual process to a structured system and shares lessons learned.
A personal account of migrating a nearly ten-year-old Rails app from Heroku to Render, including upgrading Ruby and Rails versions, switching from Webpacker to ESBuild and Propshaft over Sprockets, and encountering signup issues on Fly.
An update on the experimental Claude Code verification harness, prove_it, focusing on nudging agents toward test-driven development. The author demonstrates it by having Claude Code build a terminal-based tennis game in OCaml, successfully test-driving the process.
SimpleCov's coverage report shows code coverage at a single point in time. The simplecov-compare gem helps track differences over time. It compares JSON outputs from two test runs without needing pipelines or external services, built for evaluating changes' impact on test coverage.
Introducing ruby-libgd, a library for scientific plotting in Ruby. It enables plotting mathematical functions inside Jupyter notebooks, addressing the envy of Python's Matplotlib capabilities.
The TDD cycle of red, green, refactor can promote premature abstraction. The author reflects on a realization from 20 years ago, embarrassed it took so long, sparked by meeting Ward Cunningham in Seattle between 2003 and 2005.
A Ruby Developer's Guide to TracePoint, ISeq, and why your choice of debugger affects more than just comfort. Debugging is essential for Ruby developers, from off-by-one errors in data pipelines to race conditions in Rails controllers.
Modern applications on Heroku are living ecosystems with dynos, databases, third-party APIs, and complex user interactions. As they scale, logs and metrics grow. To extract signals from noise, understand system health in context of external factors like resource constraints.
Enhance the presentations index page with video previews that play on hover, mimicking YouTube or Netflix. Using Stimulus controllers, videos play on mouseenter and pause on mouseleave, with Active Storage handling thumbnails.
This security advisory details a stored XSS vulnerability in Trix editor versions prior to 2.1.17, where malicious payloads in data-trix-serialized-attributes can bypass sanitization. Users are recommended to upgrade to version 2.1.17 or later to mitigate the risk.
This week's Ruby Weekly newsletter highlights Shopify's work on speeding up Bundler and RubyGems, including a new tool for precompiled gems, migration tips from FastRuby, and the release candidate for mruby 4.0.
A guide to setting up GitLab's Container Virtual Registry as a pull-through cache for upstream registries like Docker Hub and Docker Hardened Images. It solves credential management issues, ensures teams use hardened images, and speeds up builds by caching images locally.
A concrete example of AI-generated code pitfalls in a Ruby app. The code for closing old Slack DMs appears solid but violates Slack's 1 request per second rate limit, causing failures when processing hundreds of conversations.
Field notes on experimenting with Claude Code in real Rails projects, focusing on speeding up debugging sessions. Covers model selection, RSpec and Minitest workflows, error monitoring, and structuring CLAUDE.md for skeptical developers.
AI coding assistants are fast but often build the wrong features due to missing context on architecture, team patterns, and business rules. Traditional workflows fail for complex tasks, while TDD offers a better approach: write failing tests first, then implement until they pass.
This official Ruby release includes an update to the zlib gem addressing CVE-2026-27820, along with other bug fixes. We recommend updating your version of the zlib gem.
A comprehensive guide to handling multiline strings in Ruby, covering elegant syntax and techniques for representing text that spans multiple lines without concatenation.
A ideia de reescrever o sistema continua voltando. O impulso desacelera. Este post explora por que futuros indefinidos fazem equipes perderem ritmo muito antes de o código realmente quebrar.
Security advisory: CVE-2026-31830 in sigstore-ruby reveals a verifier bug that returns success for DSSE bundles with mismatched in-toto subject digests, potentially allowing attackers to bypass verification.
This post delves into Ruby's concurrency primitives beyond fibers, covering threads, Ractors, and true parallelism. It explains the Global Virtual Machine Lock (GVL) and its impact on CPU-bound tasks, while providing guidance on selecting the right tool for I/O-bound operations.
A look at the resurgence of terminal interfaces in 2025, highlighting frameworks like Charm (Go) and Ratatui (Rust) for building text-based UIs. It draws parallels to historical mainframe applications, such as airport check-ins and pharmacy systems, where keyboard navigation excels over mouse-driven interfaces.
In this podcast episode, Aji and Joël discuss diagrams that guide their thought processes in software development. They compare favorites, explore analysis tools, and explain how diagrams help communicate mental models with colleagues. Includes resources on visualizing RSpec and structuring conditionals.
A weekly update covering releases of dry-struct 1.8.1 and dry-schema 1.16.0, thanks to community contributions, along with ongoing work on structured tagged features.
This edition of the Short Ruby Newsletter covers Yusuke Endoh's benchmarking showing Ruby's strength for LLMs, two new releases of Rails CMS, a repository of over 200 real Rails codebases, and Shopify's internal discouragement of RSpec.
Open-source development is often a marathon, not a sprint. Today, ruby-libgd, a Ruby library for image generation, has reached an exciting milestone: 3,000 downloads. This reflects adoption and sustained effort behind dynamic image generation in Ruby.
This security advisory details a path traversal vulnerability in Camaleon CMS (a Rails-based CMS) versions 2.4.5.0 through 2.9.1. It affects the AWS S3 uploader, allowing authenticated users to read arbitrary files like /etc/passwd, bypassing an earlier fix for CVE-2024-46987.
Aggregating models into value objects with composed_of. In Rails projects, messy codebases often stem from poorly architected domain models. This series explores advanced techniques to address this.
The with_options method in Rails groups repeated options like if: conditions or only: constraints. Examples include validations, controller callbacks, and associations, reducing code duplication.
GitLab 18.9 introduces a file tree browser that adds a collapsible panel to the repository view, keeping project structure visible while navigating code. This Rails-based platform update makes browsing feel more like an IDE, eliminating repetitive back-button navigation.
For Rails apps, rack-attack is used to block bots, but for Jekyll and other sites, fail2ban scans log files and blocks clients via firewall rules. It's easy to install on Linux and configure jails in the config file.
The industry is shortening the maximum lifetime of TLS certificates to improve web security. This may require changes to certificate maintenance for Heroku apps, but Heroku Automated Certificate Management users need no action.
Cloud-native development enables resilient, flexible, and scalable apps that adapt to dynamic user needs. Traditional monolithic systems struggle with this, but Rails offers advantages for building and deploying in cloud environments.
A test helper for Turbo to avoid flaky system tests by checking DOM attributes like aria-busy during navigation, form submissions, and redirects. It ensures the webpage is in the right state for interactions.
A guide to importmap-rails, Rails' default for handling ES modules without build steps. It uses web standard import maps to resolve bare module specifiers like import { Controller } from "@hotwired/stimulus", providing absolute paths for browsers.
Ruby, known for its elegant and developer-friendly syntax, handles comments in a somewhat unique way compared to many other programming languages. While single-line comments (starting with #) are ubiquitous, multiline comments have a dedicated syntax that many Ruby developers rarely touch in day-to-day work.
A buffer overflow vulnerability in Zlib::GzipReader has been assigned CVE-2026-27820. Affected versions are zlib gem 3.2.2 or lower. Recommended to update to zlib 3.2.3 or later, with specific versions for older Ruby series.
This week's Ruby Weekly newsletter features ruby-prof 2.0 with Ruby 4.0 support and flame graphs, an article on AI constraints, and a benchmark where Ruby outperforms 12 languages in Claude Code.
Official security announcement: A buffer overflow vulnerability in Zlib::GzipReader, assigned CVE-2026-27820, can lead to memory corruption. Update the zlib gem to version 3.2.3 or later; specific versions recommended for Ruby 3.2 and 3.3 users.
This newsletter explores image processing in Ruby using GD, highlighting ruby-libgd v0.3.0 for efficient manipulation of images via bindings to the native libgd C library.
The official JRuby team announces the release of JRuby 10.0.4.0, targeting Ruby 3.4 compatibility. Key changes include moving syslog to bundled gems and making unicode_normalize thread-safe. 43 issues and PRs were resolved.
A podcast episode where hosts Joël Quenneville and Sally Hall discuss improving test suite performance times. They compare different testing methods, highlight pitfalls, and offer tips for making the most of each test suite.
An examination of Ruby Central's shift in governance for Bundler and RubyGems, claiming ownership while refusing to provide stable processes, leading to the hijacking of codebases and threats against former maintainers.
Legacy platforms hold valuable data and run critical operations but can hinder growth due to performance issues, security vulnerabilities, and scalability challenges. This post explores modernizing them with Rails.
How we cut test suite time from 40 minutes to 4 by upgrading Ruby and Rails, fixing slow tests, and enabling parallelization, dramatically improving developer experience and CI costs.
A workflow experiment streamlining Rails app error handling. Using Claude Code and AppSignal’s MCP integration, the process from alert to fix to deploy takes under five minutes, all within the terminal, minimizing context switches.
The software industry often sees quality and speed as trade-offs, but AI amplifies this by enabling rapid generation of UI, docs, tests, and scaffolding. True quality enables faster learning and safer changes, not just polished code. AI forces us to prioritize rigor for better outcomes.
Official announcement from the Rails blog: We’re excited to welcome Planning Center as a Contributing member of the Rails Foundation - the first new member in 2026!
Rails' enum DSL is great for single values, but what about multiple? We compared 4 approaches across performance, extensibility, and maintainability to find the best fit.
With April approaching, RubyKaigi 2026 is set to take place in Hakodate, Japan. For the global Ruby community, this event is more than just a conference—it's a pivotal moment that shapes technological advancements.
This week, a satisfying piece of work was completed: adding request body parsing to Hanami Action. This finishes the story started in Hanami 2.3, where significant improvements were made.
Rails models default to using their ID in URLs, but the to_param method allows customization for cleaner, readable paths. You can use a slug, hide the ID, or combine both. Examples include generating slugs from titles and prefixing with IDs for reliable lookups.
Transpiling Ruby to JavaScript is usually discussed in terms of deployment targets. But it has a second payoff: system tests that run in 75ms with zero flakiness. Same Capybara DSL. No browser required.
Exploring infinite scroll with HTMX for improved user experience in web apps. It contrasts traditional pagination using gems like Pagy, reducing server load and UI clutter while enabling endless scrolling paired with search.
This video episode explores various methods to improve page speed in Rails applications, discussing trade-offs between leaving optimizations untapped and adding premature complexity.
Rails callbacks like aftersave or aftercommit feel like magic. You save a user, and poof, a welcome email is sent. It's easy, it's fast, and it keeps your controller clean.
This official security announcement details a vulnerability in the rubyipmi gem, allowing OS command injection via malicious usernames. An authenticated attacker with host creation or update permissions can exploit this to achieve remote code execution on the system.
An official announcement from Ruby Central: Ruby will participate in Google Summer of Code 2026, offering new contributors the chance to work on impactful projects in the Ruby ecosystem, such as RubyGems.org, RubyGems, and Bundler, with guidance from experienced mentors.
A reflection on the shift from social coding to antisocial coding, driven by coding agents. The post warns of the risks of easily published open source dependencies and how agents increase team communication costs, drawing from past experiences like GitHub's tagline and a conference talk.
Ruby and Rails are undergoing rapid, multidimensional evolution. This involves coordinated advances in the runtime, framework, infrastructure tooling, and application capabilities. The shift is evident in RubyKaigi talks from 2024–2026.
The site has been rebuilt from scratch using Perron, a Rails-based static site generator, to improve consistency in style and branding. It reflects on nearly 200 articles covering Hotwire, Rails, and Tailwind CSS, plus tools and open source projects.
Enterprise mobility is becoming a mission-critical cornerstone for modern businesses by 2026, fueling operations, customer interactions, real-time decisions, and distributed workforce support. This post explores Rails' role in this evolving landscape.
This week's Ruby Weekly newsletter highlights the Rage framework's v1.21.0 release for easier adoption, CTO-ready Rails upgrade estimates, and fixes to YAML comment preservation in Ruby using Psych::Pure.
Konstantin Vinogradov and co-founders are creating the Open Source Endowment, a permanent funding model for critical open source infrastructure. The post explores why it could solve the Nebraska problem and Evil Martians' pro-bono contribution.
Rails 8, released in November 2024, offers a smooth upgrade with a focus on simplicity and performance. It removes external dependencies like Redis by introducing Solid Queue, Solid Cache, and Solid Cable, and includes built-in authentication to replace Devise. Upgrading from Rails 7.2 requires Ruby 3.4 and takes 1-2 weeks for medium-sized apps.
Exploring the development of a RAG tool in Ruby to retrieve institutional knowledge from Jira, Confluence, and GitHub, addressing forgotten past issues and decisions.
RubyMine offers context-aware search for seamless Rails navigation, a powerful analysis engine for detecting code issues, and support for popular version control systems. As AI tools gain popularity for understanding codebases and developing apps, this guide explores building LLM-friendly MCP tools with pagination, filtering, and error design.
GitLab now supports passkeys for secure, passwordless sign-in and phishing-resistant 2FA. Authenticate via fingerprint, face recognition, or PIN. Private keys stay on your device, public keys on GitLab. Compatible with major browsers and devices.
The official RubyGems blog announces RubyGems 4.0.7 and Bundler 4.0.7 releases, featuring enhancements, bug fixes, and documentation updates. Update with gem update --system [--pre] for RubyGems or gem install bundler [--pre] and bundle update --bundler=4.0.7 for Bundler.
In this podcast episode, hosts Sally Hall and Aji Slater discuss thoughtbot’s guide to best practices, focusing on coding habits, the pros and cons of complex versus simple writing, and Sally’s new repo Michel for building an appointment database.
By 2026, the Internet of Things will enable seamless connection of devices, sensors, and systems for applications like smart homes, health monitoring, logistics, and industrial analytics. Rails is highlighted for developing these sophisticated IoT applications.
Using timestamps like completed_at as boolean flags in Rails offers more metadata than true booleans. A simple concern provides methods like completed?, complete!, and complete= for easy checkbox toggles in forms.
Ruby 3.4 introduces an experimental Modular Garbage Collector API, allowing alternative GC implementations to be loaded at runtime. This represents a major architectural shift in CRuby.
GitLab extends the GPG key expiration for signing metadata of its package repositories. Originally expiring Feb. 27, 2026, it's now set for Feb. 6, 2028, to meet security policies and limit disruption. Existing users may need to check documentation.
This newsletter edition covers 37 Signals' launch of the Upright open source monitoring tool, Rubocop's experimental MCP server, using Stimulus to record videos in Rails, and RSpec v4.0.0.beta1.
This edition of the Short Ruby Newsletter covers 37 Signals launching the Upright open source monitoring tool, Rubocop's experimental MCP server, using Stimulus to record videos in Rails, and RSpec v.4.0.0.beta1.
This weekly newsletter roundup covers Hotwire topics including debounced live search in Rails with Stimulus and Turbo, bridge components with SwiftUI, video recording UI using Stimulus, and lessons from shipping Hotwire Native apps.
Testing for SQL injection on a target revealed a potential vulnerability in a websocket request. Since SQLMap doesn't support websockets, a Ruby proxy was created to convert HTTP requests into websocket ones for easier data exfiltration.
Test Double avoids chasing AI hype by not rebranding, instead adapting to how AI transforms software development while staying true to their values. They've refined their mission, vision, and values for the first time in years.
Working with maps usually means dealing with numbers for bounding boxes, like bbox = [-73.6, -55.1, -53.6, -21.7] for Argentina. This approach introduces symbolic geographic extents, allowing you to render maps by name instead.
AI agents don't reliably follow instructions. Here's how to make it hurt less in a Rails legacy codebase undergoing modernization. Using tools like GitHub Copilot with guardrails such as an AGENTS.md file and skills for RSpec and code writing.
Heroku introduces updates to Managed Inference and Agents, reducing developer friction with an expanded model catalog and streamlined deployment. The new standard plan allows a single add-on for multiple models, eliminating the need for separate provisions and config variables.
Part 2 of the Karafka to Async Journey series explores migrating WaterDrop's producer polling engine to file descriptor-based polling, boosting performance by 50% when async/fiber support was released in September 2025.
An outline of using Stimulus to record video in Rails with the MediaRecorder API, supporting webcam, screen, and picture-in-picture modes, including preview and saving to Active Storage.
A guide to recording video in Rails using Stimulus and the MediaRecorder API. Covers webcam, screen sharing, and picture-in-picture modes, with preview and saving as an Active Storage attachment. No external services needed.
A guide to speeding up Rails CI from 30 minutes to 2, based on a Kaigi on Rails 2025 talk by Hayato Okumoto. It tackles the universal pain of watching bundle exec rspec scroll by, offering techniques to optimize CI runs without cheating much.
Rails 7 shifts away from Node.js, introducing Import Maps, Hotwire (Turbo + Stimulus), and encrypted attributes for a developer-friendly experience. It requires Ruby 2.7+ and encourages Ruby 3+. This guide, part of a series, outlines a 1-3 week timeline for medium-sized apps.
Ruby Weekly newsletter highlights last week's Ruby Dev Meeting outcomes: thumbs up for trailing commas in method signatures, autoload_relative, and Dir.scan. Plus, RSpec 4.0 beta with removed deprecations and Ruby 3.0+ requirement.
Exploring LLM RAG in Rails using ActiveRecord, Postgres with the pgvector extension, and the neighbor gem. Focuses on achieving document diversity through per-document max in vector similarity searches.