Planet Ruby

The Case of the Readable Dead Connection: A Ruby Mystery

An investigation into why a readable TLS socket can still be a dead HTTP/1 connection, and how using a layered non-blocking peek exposes the truth behind socket states in Ruby.

Function Calling

This video episode demonstrates how to add function calling and tool use to a Rails application when making generative text LLM requests, allowing models to interact with external APIs.

Big Sky Dev Con 2026

A recap of Big Sky Dev Con 2026, featuring notes and takeaways from various presentations. Highlights include discussions on htmx view transitions, falling in love with SQL, and using Milestoner for project releases.

Making Failure More Predictable in Ruby Systems

A look at recent developments in the Ruby and Falcon ecosystem, focusing on designing systems for predictable failure handling, implementing lower-memory MIME lookup, and configuring load-aware Falcon multi-process clusters for better performance.

Running Code When the Rails Webserver Boots

An exploration of the best ways to run code in a Rails application specifically when the webserver boots, avoiding execution during rake tasks or console sessions. It covers using the Railtie#server hook introduced in Rails 6.1 and configuring config.ru properly.

Rails for Enterprise Automation Solutions

An exploration of how enterprises can leverage Rails to automate repetitive tasks across departments like finance, HR, and customer support. By replacing manual processes, Rails-based automation helps organizations reduce operational costs, minimize errors, and improve overall productivity.

Understanding the Rails Middleware Stack

Middleware is one of the core building blocks of every Rails application, yet many developers never interact with it directly. This guide explores how incoming HTTP requests pass through a chain of middleware before reaching your routes and controllers.

Faster I18n Loading, Thread-Safe Routes, and More

A weekly round-up of recent developments in the Rails codebase, featuring faster internationalization loading, thread-safe route generation, and various other performance improvements and bug fixes.

It Doesn't Matter Whether 'Matz Is Nice'

The latest issue of the Awesome Ruby newsletter, featuring community discussions, curated links, and updates from the Ruby ecosystem.

Migrating from sass-rails to Dart Sass

With LibSass at end-of-life, it is time to move Rails applications off sass-rails. This guide covers how to migrate to Dart Sass, including what breaks, how the migrator tool helps, and Rails-specific gotchas to watch out for.

AI Assistant for Our Blog Writing Process

Not every AI solution needs to be a custom agent. A look at building a Model Context Protocol (MCP) server and Claude Code plugin to streamline a blog writing workflow in about ten hours.

Ruby Runway Spotlight: Michael Carroll of Coolhand Labs

An interview with Michael Carroll of Coolhand Labs, part of a series celebrating the founders who participated in the inaugural Ruby Runway Showcase at RubyConf. Discover how builders are turning Ruby into successful, real-world businesses.

Courrier: A Gem to Send Emails Without SMTP

Courrier is a Ruby gem that provides a unified API for thirteen transactional email providers and seven newsletter platforms, eliminating the need for SMTP or provider-specific SDKs. It includes a companion gem for Rails with generators, ActiveJob support, and browser-based inbox previews.

Ruby Central's Destructive Legacy

An overview of the ongoing dispute regarding Ruby Central, the funding of core open-source projects like RubyGems and Bundler, and the historical context of community contributions. It addresses the current state of the organization, unresolved conflicts, and steps developers can take.

You Need to Upgrade Rails 7.x and 8.x Now

The latest issue of Ruby Weekly highlights a critical Active Storage vulnerability in Rails 7.x and 8.x. A specially crafted image upload can expose arbitrary files on the server via the vips processor. Patches are available in Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1.

Rails Versions 7.2.3.2, 8.0.5.1, and 8.1.3.1 Have Been Released

Official security and bugfix releases for Rails are now available. Applications running the 7.2, 8.0, or 8.1 series should update to versions 7.2.3.2, 8.0.5.1, and 8.1.3.1 respectively to ensure stability and security.

Post-RubyConf Conversation with Neha Abraham

In this podcast episode, Neha Abraham joins the host to discuss their experiences at RubyConf, mental health, data aggregation, and the joy of making new connections within the Ruby community.

GitLab Patch Release: 19.2.1, 19.1.3, 19.0.5

Nominations Open for the 2026 Rails Luminary Awards

Nominations are now open for the 2026 Rails Luminary Awards, celebrating the exceptional contributors who help make Rails better, faster, and easier to work with. Share your nominations to honor those driving the ecosystem forward.

CVE-2026-66066: Arbitrary File Read and Remote Code Execution in Active Storage Variant Processing

A security vulnerability in Active Storage variant processing allows unauthenticated attackers to read arbitrary files and potentially execute remote code. Applications using libvips for image processing are affected. Workarounds include setting the VIPSBLOCKUNTRUSTED environment variable.

Possible Path Traversal in activerecord-tenanted

A security advisory for activerecord-tenanted details a path traversal vulnerability in DiskService#path_for. If untrusted blob keys are used, it could allow arbitrary file operations on the server. Users should upgrade to version 0.7.0 or later.

What Happens After You IPO?

An exploration of how Rails' "convention over configuration" serves as a powerful foundation for AI coding agents. The project targets porting a real application, Lobsters, measuring progress against speed benchmarks and test suite fidelity.

Instrumenting LLM Calls in Rails with Rails.event.notify

A hands-on guide to instrumenting LLM calls in a Rails application using the Rails 8.1 Event Reporter to track token usage, latency, and cost per request.

Ruby Association Activity Report 2026: Matz, Fastly, and Ruby Grant Projects Take the Stage

The Ruby Association has announced its 2026 Activity Report event in Tokyo, Japan. The in-person gathering will showcase recent developments across the ecosystem, featuring keynotes, invited talks, and the results of the 2025 development grant program.

Alchemy CMS: Stored XSS via Unsanitized SVG Attachment Replacement

A security advisory for alchemy_cms details a stored XSS vulnerability. The SVG sanitizer only runs on creation, allowing authenticated editors to replace existing attachments with malicious SVGs. This can lead to arbitrary JavaScript execution when visitors view the attachment.

The Inliner Is Yielding Benefits for ZJIT

A look at how ZJIT's new method inliner helps specialize even megamorphic block invocations, bringing performance improvements to Ruby's experimental JIT compiler.

CVE-2026-54659: Pagy I18n Locale Option Not Validated Before Use in File Path

A security vulnerability in the Pagy gem allows information disclosure when untrusted input is assigned to Pagy::I18n.locale. Without validation, this input can influence which YAML file Pagy attempts to load, potentially exposing file existence on the host.

Scholars & Guides Spotlight: Madeline Caples on Learning to Code Alongside AI

Every year, Ruby Central's Scholars & Guides Program pairs aspiring Rubyists with experienced mentors for a week of learning and growth at RubyConf. In this spotlight, scholar Madeline Caples shares her experience navigating the conference and learning to code alongside AI.

Continuations 2026/30: Big Triage

A status update on open-source Ruby development. After some time away, work resumes on triaging issues, sharing new code, and getting development efforts back into gear.

Rails Isn't Getting Bigger, It's Getting Sharper

An analysis of recent changes in Rails, suggesting a broader trend in how the framework is evolving. Instead of shipping large, bloated features, the focus has shifted toward refinement, making the framework sharper and more cohesive.

Blazer: Stored XSS Vulnerability

A security advisory for the Blazer gem details a stored XSS vulnerability. An authenticated user can create a malicious query that executes arbitrary JavaScript when another user edits it, potentially allowing unauthorized actions on the same origin.

Theme Builder and Semantic Component Themes

Rails Blocks has launched a new Theme Builder featuring coordinated accent and base palettes, live light and dark previews, and copy-ready Tailwind CSS. This release also updates the checkbox, radio, and tooltip components to support the new theme contract.

Why Your Sidekiq Jobs Are Slower Than You Think

An exploration of why Sidekiq jobs might perform slower than expected. Discover how to pinpoint common performance bottlenecks like N+1 queries, missing database indexes, and Redis spikes to optimize background processing.

Optimizing Ruby's JSON, Part 8

An update on the ongoing efforts to optimize Ruby's standard JSON library, picking up eighteen months after the previous series concluded. This installment explores recent performance improvements, refactoring, and the current state of JSON parsing in Ruby.

Overriding Rails' Default Error Message Format

A look at how to override the default Rails error message format during internationalization (i18n) without leaving standard error messages as incomplete sentences.

Where_is_waldo Authenticates ActionCable Connections From Client-Supplied subject_id

A security advisory for the whereiswaldo gem. The built-in ActionCable connection authenticated connections from client-controlled parameters when no authenticate_proc was configured, allowing impersonation. This vulnerability is fixed in version 0.1.6.

Ruby Argentina July Meetup

A recap of the Ruby Argentina July meetup, featuring discussions on the hidden costs of using UUIDs as primary keys and the practical work required to make AI coding agents truly useful in development workflows.

10 Things You Might Not Know About Rails i18n

An exploration of the useful abstractions within the Rails i18n framework. Learn how these features can help make your codebase more maintainable, even when you are not actively translating your application into multiple languages.

Happy Anniversary Rails!

A special anniversary edition of the weekly roundup from the official Rails blog, featuring the latest updates, bug fixes, and community contributions from the Rails world.

New Rails Reference App Library Published

The official Rails website has launched a new Reference Apps page, featuring a hand-picked library of real, open-source Rails applications. This curated collection serves as an excellent resource for developers looking to study production-ready codebases.

RubyGems.org Security Advisory: Possible Leak of Legacy API Keys via Improper Cache Configuration

Recreating Stimulus: How data-controller Works Under the Hood

An exploration of how Stimulus works under the hood by rebuilding it from scratch. This first part of a two-part series focuses on the core foundation: watching the DOM for data-controller attributes and connecting them to JavaScript classes using modern browser APIs.

Rake Beyond Rails: A Build Tool You Know

Discover the untapped potential of Rake as a powerful, general-purpose build tool beyond its common use in Rails. Learn how to streamline non-Rails workflows, manage tasks, and leverage Ruby's build utility for broader development projects.

Breaking Change Podcast v54: Hot Sleeper

Justin Searls returns with a new episode of the Breaking Change podcast after a summer hiatus. This episode covers various tech topics and includes a call for listener mailbag participation.

Have Less Stuff

An argument for minimalist development culture, resisting platform sprawl, and keeping systems simple. Drawing from experiences at Cheddar and Shopify, this approach favors relying on Rails built-ins over complex frontend bundling, Kubernetes, and unnecessary microservices.

Rails 8 Introduces Kamal 2 for Zero-Downtime Deployments

Rails 8 ships with Kamal 2 pre-configured, enabling zero-downtime deployments to any Linux server with automatic SSL out of the box. This integration eliminates the need for expensive PaaS solutions by automating Docker-based deployments.

Why RubyGems Just Revoked Every Legacy API Key

This issue of the Ruby Weekly newsletter covers RubyGems revoking legacy API keys following a CDN caching bug that could have exposed them to other users. Also featured is a technical writeup of the exploit and an article on testing membership with Bloom filters.

Security Advisory: Possible Leak of Legacy API Keys via Improper Cache Configuration

An official security advisory from the RubyGems team regarding a CDN caching bug on RubyGems.org that could have exposed legacy API keys. In response, all legacy keys have been revoked, and users are advised to check their gems.

Rails on Roda

A look at a new converter that translates a Rails application into a Roda and Sequel application. Following feedback from Jeremy Evans, the --target roda tool successfully converts the Rails blog template into a functional Roda and Sequel app, passing most compatibility checks.

RubyConf 2026 Hallway Track

A podcast episode featuring quick interviews from the hallway track at RubyConf. Hear from attendees and volunteers, including Charles Nutter, Miguel Filho, Cameron Dutro, and Nico Roulston, as they share their experiences from the conference.

Ruby May Finally Fix the Famous 'Norway Problem'

The Ruby ecosystem may soon take an important step toward modern YAML support. Ruby core developer Hiroshi Shibata has introduced an experimental backend for the Psych library based on libfyaml, bringing full YAML 1.2 compliance closer to the language.

Stored XSS in Alchemy CMS SelectView via Missing Server-Side Option Validation

A security advisory for Alchemy CMS details a stored XSS vulnerability in SelectView. Due to missing server-side validation of allowed options, an authenticated author can bypass the admin UI dropdown via direct API requests to inject arbitrary HTML, which is then rendered unescaped on public pages.

Stored XSS in Alchemy CMS PictureView via html_safe

A security advisory for Alchemy CMS. A stored XSS vulnerability exists in Alchemy::Ingredients::PictureView#caption where user-supplied caption values are marked as html_safe without sanitization, bypassing Rails' automatic HTML escaping and allowing arbitrary script execution.

RubyGems and Bundler 4.0.17 Released

An official update from the RubyGems team announcing the release of RubyGems and Bundler 4.0.17. This release brings several bug fixes and enhancements, including spec name validation, Windows path preservation, and fixes for Homebrew-installed Ruby binstubs.

Using OpenSpec in Rails Applications

An exploration of how OpenSpec reshapes a Rails workflow. This retrospective covers what paid off, what failed, and key lessons learned from integrating the tool into development practices.

JRuby 10.1.1.0 Released

The JRuby community has released JRuby 10.1.1.0, targeting Ruby 4.0 compatibility. This release includes performance improvements for string-to-double parsing, updates to jruby-openssl and erb to address security CVEs, OpenBSD support, and optimized Java integration.

Workflow Automation with Rails: A Practical Guide

An exploration of how workflow automation can streamline repetitive tasks, reduce manual effort, and improve business efficiency. This guide covers implementing automated workflows in Rails for processes like customer onboarding, invoice processing, and inventory tracking.

Ruby Runway Spotlight: Paresh Sharma of Viveture

The first in a series of Ruby Runway Spotlights celebrating the founders who took part in the inaugural Ruby Runway Showcase at RubyConf. This spotlight features Paresh Sharma of Viveture, sharing insights on turning Ruby into real, live businesses.

You Can't Rewrite Your Way Out of Big-O

A look at Matz's rewrite of Spinel, his ahead-of-time Ruby compiler, from Ruby to C. While the rewrite faithfully translated an O(N²) complexity into a faster language, algorithmic profiling and fixes were ultimately required to solve the performance bottleneck.

RubyMine 2026.2: Agentic Debugging, Native GitHub Copilot Integration, and Default Symbol-Based Code Insight

The latest RubyMine release introduces agentic debugging, native GitHub Copilot integration, AI completion with third-party providers, and symbol-based code insight enabled by default. It also brings various improvements across the Ruby ecosystem and everyday IDE workflows.

Automate Tech Debt Audits with Claude Code

A guide on writing a Claude Code skill to automate tech debt audits for Rails applications. This approach combines security, dependency updates, test coverage, and code complexity analysis into a streamlined workflow.

Beyond tenant_id: Treating Multi-Tenancy as a Database Invariant

Most Rails applications that become SaaS products follow the same trajectory. They begin with a single customer, acquire more, and eventually add a tenant_id column to every table, requiring every query to filter by tenant.

Which AI Actually Reads Your Site? Two Months of LLM Traffic, Measured

An analysis of two months of server-side LLM traffic to measure how AI agents interact with web content. Discover which agents read HTML versus Markdown, the actual impact of llms.txt, and which optimization techniques failed to receive any hits.

Authorization Bypass in GraphQL-Ruby Execution::Next

A security vulnerability in the graphql-ruby gem prior to version 2.6.6 allows authorization bypass when using Execution::Next. Authorization failures did not properly halt execution for fields using GraphQL::Schema::Resolver subclasses. Applications using this configuration should upgrade immediately.

ATProto in Practice #1: Identity

A practical guide to working with the AT Protocol using Ruby. This first installment of a new series focuses on user identity, explaining how Decentralized Identifiers (DIDs) and handles function behind the scenes in the protocol.

Passenger 6.1.8

Passenger 6.1.8 has been released. This update addresses an ABI compatibility break in Enterprise Linux (RHEL, Rocky, and Alma) Nginx packages.

Roda on Spinel

An idiomatic Roda and Sequel application now transpiles to the same intermediate representation as its Rails twin using Spinel, Matz's ahead-of-time Ruby compiler. Compiling to a 559 KB native binary, it boots in ten milliseconds with 4.5 MB of memory, melting away the frameworks at build time.

ActiveModel Conditional Validations

An exploration of modeling domain rules using ActiveModel::Validations. Using a parking validation system as an example, this guide demonstrates how to implement conditional validations for scenarios where rules, like expiration times, only apply under certain conditions.

Broken Access Control in spree_api (IDOR)

A security advisory for spree_api details a broken access control vulnerability in the cart association endpoint. Authenticated users can associate arbitrary guest carts to their accounts by exploiting predictable prefixed IDs, potentially exposing sensitive checkout addresses.

Learning a Few Things About Running SQLite

A practical look into operating SQLite in production, covering WAL mode, query performance, and the importance of running ANALYZE. While SQLite is highly capable for smaller web applications, it still requires database administration knowledge as your ORM makes it do more work.

What Time Is It? Rails Time!

A weekly digest of the latest activity and major changes in the Rails codebase, highlighting recent updates, bug fixes, and performance improvements from the community.

Rebuilding My Homelab with Compose, Ruby, IPv6, and No Kubernetes

The latest issue of the Awesome Ruby newsletter features a deep dive into rebuilding a homelab using Docker Compose, Ruby, and IPv6 instead of Kubernetes, alongside a curated collection of the week's best Ruby tools, libraries, and articles.

When You Build Fast, People Get Lost: Rethinking an Onboarding Journey

A user's journey through your application matters just as much as the new features you are building. This article explores the process of rethinking and refining the onboarding flow for a Rails application to improve user retention and clarity.

How to Set Up a Staging Environment on Heroku

Testing on localhost is a good start, but a near-identical replica of production is essential to catch bugs before code goes live. Learn how Heroku pipelines handle the infrastructure layout to keep your deployment workflow clean and automated.

There Is No Server

A presentation from RubyConf, "There Is No Server: Beautiful Ruby, Weird Ruby, and the Robots We Live With," is now available online. This resource includes slides, full speaker notes, and embedded live demos, featuring a reproducible breakpoint in a Rails controller.

Three Compilers, One Concern Each

A deep dive into a three-compiler stack: typed Ruby to Spinel, Spinel to C, and C to machine code. By tracing a single line of Rails, has_many :comments, down to the struct layout and GC shadow stack, this post explores why keeping compilers single-purpose makes them surprisingly easy to build.

Three Example Process Managers in Rails

An exploration of mapping business processes into code using RailsEventStore. This post introduces the new rubyeventstore-process_manager library and walks through three practical examples, including handling payment releases on order expiration.

Add Newsletter Subscriptions to Rails 8 Signups

Learn how to capture newsletter subscriptions during user signup in Rails 8. This guide uses the railsvault gem to store user preferences and railscourrier to manage API-powered email delivery through services like Mailgun, Postmark, or Resend.

Ruby 3.3.12 Released

An official announcement that Ruby 3.3.12 has been released. This security update addresses an ERB deserialization bypass (CVE-2026-41316) and includes an update to the net-imap gem to resolve multiple vulnerabilities.

GitLab 19.2 Released

The latest release of the Rails-powered DevOps platform is now available, bringing new features, security updates, and performance improvements to self-managed and cloud instances.

How Do You Stay Familiar With Code Written by an LLM?

Using an LLM to write code can boost productivity, but it raises questions about long-term code familiarity. This article explores the challenges of maintaining, debugging, and understanding AI-generated code over time, and how developers can stay connected to their codebase.

Matz's 'Extreme Vibe Coding' Opens RubyConf

The latest issue of the Ruby Weekly newsletter highlights snapshot testing with Insta, Rails 7.2 approaching its end of life, and the lobste.rs link aggregator successfully migrating its Rails application from MariaDB to SQLite.

Announcing the RubyGems.org Supporters Program in Japan

We re excited to share some big news from our partners at the Ruby Association: the launch of the RubyGems.org Supporters Program in Japan. Starting this October, the Ruby Association will serve as a local liaison for Japanese companies who wish to support RubyGems.org. This means their

Detecting Full Table Scans With SQLite

Inspired by a Lobsters post, this guide demonstrates how to detect full table scans in SQLite. By leveraging SQLite's API for prepared statement statistics, you can programmatically identify inefficient queries in your test suite without relying on EXPLAIN.

Rails 8.1: Deprecated Associations and How to Fix Them

Rails 8.1 introduces the ability to mark old associations as deprecated. Learn what changed, why this feature matters, and how to clean up your codebase without breaking your application.

Mike Dalton and Authentication Hell

In this podcast episode, Mike Dalton joins the show to discuss the complexities of authentication in Rails, sharing insights on navigating security challenges, managing user sessions, and avoiding common pitfalls in modern web development.

World Cup Fever Hits the Ruby Community

As the FIFA World Cup reaches its final stages, developers in the Ruby community are building and sharing open-source Ruby and Rails applications to track matches, analyze stats, and celebrate the tournament.

Possible XSS Vulnerability in Rails HTML Sanitizer

A security advisory for rails-html-sanitizer details a possible cross-site scripting vulnerability when configured to allow SVG reference elements. This mirrors a related vulnerability in the underlying Loofah library.

SVG href Attribute Bypasses Local-Reference Restriction in Loofah

A security vulnerability in Loofah's HTML5 sanitizer allows SVG elements to bypass local-reference restrictions. While xlink:href was restricted, browsers also accept a plain href attribute which Loofah failed to constrain, potentially allowing arbitrary external document references.

Loofah Vulnerability: allowed_uri? Fails to Detect javascript: URIs Split by Named Whitespace Character References

A security vulnerability in Loofah allows javascript: URIs to bypass sanitization when the scheme is split or prefixed by HTML5 named character references like tab or line feed. This bypasses the previous fix for GHSA-46fp-8f5p-pf2m.

Security Vulnerability in Loofah: Bypass of URI Validation (GHSA-5qhf-9phg-95m2)

A security vulnerability in Loofah allows javascript: URIs to bypass validation when split by numeric character references without semicolons. This can lead to cross-site scripting (XSS) in applications using Loofah::HTML5::Scrub.allowed_uri? or Rails Action Text markdown link validation.

CVE-2026-50276 (datadog): dd-trace-rb - Improper Parsing of W3C Baggage Headers May Lead to DoS

A security vulnerability in the dd-trace-rb gem allows remote, unauthenticated attackers to cause a Denial of Service. The tracer parses incoming W3C baggage HTTP headers without enforcing item-count or byte-size limits on extraction, leading to unbounded CPU and memory consumption.

When Broadcasting a Turbo Refresh Is Not Enough: Faster UX With Versioned Immediate Updates

The simplest way to make a page collaborative with Hotwire and Rails is to subscribe to changes and broadcast a refresh when models update. However, this approach can introduce latency. Explore the refresh approach, the problems it causes, and how to fix them.

The Muppet Software Team

In this episode of the podcast, hosts Sally Hall and Aji Slater take a listener suggestion to Muppet-cast a software development team. They discuss which Muppets would fit best as content designers, QA engineers, and who gets to play the human.

Never Escape This Ruby Loop. Also, Here's How.

An exploration of how to define a loop in Ruby that cannot be escaped, even when using break, return, or raise. The post demonstrates how Ruby's flexible syntax and exception handling can be pushed to its absolute limits.

Ruby 4.0.6 Released

An official announcement for the release of Ruby 4.0.6, a routine update containing bugfixes. The official release schedule aims for stable updates every two months, with Ruby 4.0.7 planned for September and 4.0.8 for November.

The Joy of Inertia Rails: Painting Your Own with 50 Happy Little Lines

Inertia is like Turbolinks with one twist: it renders JSON instead of HTML on the second visit. Rebuild the entire protocol on a real Rails app with a 50-line client and a 16-line server, then audit what the official gem adds on top.

Taste Over Tooling: Craftsmanship in the Post-Execution Era

As AI agents commoditize the execution of code, software craftsmanship is shifting. Reflecting on the "happy coder" mentality heavily evangelized by the Rails community, this article explores how the value of development moves from writing syntax to directing autonomous machines and exercising taste.

From AI Opportunity to AI Feature: Where to Start in Rails Applications

After identifying a valuable AI opportunity, learn which AI features Rails teams should build first and why simpler solutions often deliver more value at scale.

Continuations 2026/28: Bloom of the Undying

Tim Riley joins Jared on the Dead Code podcast to discuss the evolution of the Ruby ecosystem, Hanami, Dry-rb, and the long-term sustainability of open-source software development.

CVE-2026-45086: Decidim Forms Admin Question Editor Lacks Authorization

A security vulnerability in the decidim-demographics gem allows low-privilege users to access questionnaire-admin interfaces and make unauthorized changes. This issue was discovered during a security audit of the Decidim platform.

CVE-2026-45330 (decidim-verifications): Decidim Verification Admins Can Access Supplied IDs From Other Organizations

A security vulnerability in Decidim allows verification admins to access, verify, and reject participant records from other tenant organizations. The flaw affects the verification admin mutation flow, exposing sensitive identity documents across tenants.

CVE-2026-45376: Decidim Admin User Search Allows SQL Injection

A vulnerability in Decidim's admin organization user search allows SQL injection through similarity-based sorting. An authenticated admin can inject arbitrary SQL expressions into the ORDER BY clause, potentially inferring data from other tables using time-based payloads.

CVE-2026-45377 (decidim-core): Private Exports Can Be Downloaded Through Reusable Links

A vulnerability in Decidim allows private data exports to be downloaded without authentication. While the standard flow requires the owner to be logged in, the resulting Active Storage redirect URL can be replayed by anyone who obtains it.

CVE-2026-45378 (decidim-verifications): Decidim Verification Documents Exposed via Reusable Active Storage Links

A security vulnerability in Decidim allows scanned identity-document images to be exposed through signed Active Storage disk URLs. Anyone obtaining these links can retrieve the documents without authentication for up to seven days, raising risks of data leakage.

CVE-2026-45414: Decidim JWT-Backed Authentication Replay Vulnerability

A security vulnerability in Decidim allows a JWT issued for one organization to be replayed successfully against another organization's API. This flaw can be exploited to retrieve sensitive participant details and access restricted mutation paths.

CVE-2026-45415: Decidim CSV Census Record Endpoints Improper Authorization

A security vulnerability in decidim-verifications allows participant managers to access and modify CSV census record admin forms. Any participant admin can create, alter, or remove CSV census rows, potentially corrupting verification data relied on by authorization workflows.

CVE-2026-45572 (decidim-core): Decidim HTML Content Blocks Allow Stored Script Execution

A security vulnerability in Decidim allows privileged administrators to store arbitrary HTML or JavaScript in landing page blocks, which is then rendered without escaping. While requiring administrative access, it creates a browser-execution primitive on trusted surfaces.

CVE-2026-45573 (decidim-core): Decidim Push Subscriptions Can Be Abused for Server-Side Requests

A security vulnerability in Decidim allows authenticated users to register unauthorized HTTPS URLs via the push-subscription endpoint. When VAPID delivery is enabled, this creates a stored, mostly blind SSRF primitive that can target internal services or leak notification metadata.

10 Things You Might Not Know About Rails i18n

A Brighton Ruby conference talk exploring internationalization in Rails, demonstrating how the i18n framework remains incredibly useful even when you are not translating your application into other languages.

Dynamic Dispatch

An exploration of how Rails applications use send for dynamic dispatch. By analyzing real-world code, we can recover dispatch tables and rewrite dynamic calls into static case statements, allowing ahead-of-time compilers to optimize what normally defeats whole-program resolution.

A Bigger Fixture

An analysis of running the lobste.rs benchmark against transpiled Ruby, comparing its performance to Rails. While the transpiled code achieves 3.03× the throughput of Rails on identical hardware, a deep dive into the profiler reveals why this multiple differs from smaller applications.

RubyGems and Bundler 4.0.16 Released

The official RubyGems team has released version 4.0.16 of both RubyGems and Bundler. This release includes bug fixes for BSD make and Windows paths, alongside enhancements like installing Bundler 4.0.16 as a default gem and adding PQC support to the fetcher.

Date.this_quarter? and More

A weekly roundup of recent changes in the Rails codebase, featuring the addition of the Date.this_quarter? helper and other updates from the development team.

JRuby at RubyConf 2026

Marking twenty years of full-time work on JRuby and two years of independent funding through Headius Enterprises, this is a perfect time to return to RubyConf 2026 and showcase what JRuby can do for modern Rubyists.

Reverse-Engineering Codemasters' BIGF Archive Format in Ruby

The latest issue of the Awesome Ruby newsletter features a deep dive into reverse-engineering the BIGF archive format using Ruby, alongside a curated collection of the week's best Ruby and Rails articles, tools, and library updates.

How to Configure Linux with Drop-in Configs

A guide on using drop-in configuration files in Linux to manage services and applications cleanly. This approach helps Ruby developers maintain modular, version-controlled server configurations without modifying default upstream files.

Permission UI the Rails Way

A look at implementing a flexible helper to manage feature access and upsell UI in Rails. The helper wraps content to hide it, redirect, or render a partial when access is denied, offering an elegant API that integrates seamlessly with your views.

Open-Source and Self-Hosted APM Tools for Rails

Learn how to self-host traces, metrics, and logs using OpenTelemetry to set up an open-source APM for Rails without relying on third-party vendors, allowing you to maintain full control over your data.

Why Ruby's Issue Tracker Still Links to a 1991 Paper About Floating-Point Numbers

An exploration of floating-point arithmetic in Ruby, explaining why (2.0 - 1.1) == 0.9 evaluates to false. Discover why this behavior is not a bug and why the official Ruby issue tracker still references a classic 1991 computer science paper to explain it.

Ruby Weekly Issue 808

This week's newsletter highlights a major new design for RubyGems.org featuring light and dark modes, an official ParadeDB gem for full-text search in ActiveRecord, and progress on getting Mastodon running on Spinel, Matz's ahead-of-time Ruby compiler.

Hotwire Native v1.3

The latest release of Hotwire Native brings lazy loading tabs, UISearchTab support, Large Titles, custom error views, and a variety of bug fixes to the mobile framework.

Episode 542: Kyle D'Oliveira and the Fibonacci Funhouse

In this podcast episode, Kyle D'Oliveira joins the show to discuss his journey with Rails, building creative side projects, and the unique challenges of managing complex logic in web applications.

What Happens When Your Dotfiles Get Ideas

Robby Russell joins the Scaling DevTools podcast to discuss how Oh My Zsh evolved from a simple configuration shared among coworkers into a widely used open-source developer tool. The conversation covers its origins, the introduction of themes and plugins, and early developer tool design.

Let's Talk About Tools (Ruby Stained Glass Notes #04)

In this fourth episode of the Ruby Stained Glass Notes newsletter, the focus shifts to the physical tools used in the process of building a custom stained glass panel celebrating the Ruby programming language.

How GitLab Used AI Agents to Migrate Rate Limiting

A small team at GitLab shares how they used AI agents to migrate part of their legacy rate-limiting system to a unified implementation in labkit-ruby. Discover how they structured the work, what worked, and how the loop and observability mattered more than the agents.

GitLab Patch Release: 19.1.2, 19.0.4, and 18.11.7

GitLab has released security patches and bug fixes for versions 19.1.2, 19.0.4, and 18.11.7. These updates resolve several critical vulnerabilities and regressions in the Ruby-based DevOps platform. Immediate upgrade is highly recommended for self-hosted instances.

Your Solo Developer Deserves Backup

An exploration of the risks associated with relying on a single developer to maintain your Rails application, and why providing them with external support or backup is crucial for long-term project health.

Mastodon on Spinel

A detailed roadmap to compile and run Mastodon using Spinel by the end of 2026. The plan focuses on decomposing the application into subsystems, starting with a highly memory-efficient replacement for the Node.js streaming server, alongside upstream Rails fixes and compiler improvements.

Recharge at RubyConf with Fullscript

Fullscript is sponsoring the Relax Lounge at RubyConf this year. The Ruby community has given us a lot, not just the tools we build on, but the people and community who have shaped how we work.

What Is a Principal or Staff Engineer?

In this podcast episode, Joël Quenneville and Sally Hall discuss the different ways to interpret the role of a principal or staff engineer. They explore career progression, staff archetypes, and the importance of having principal engineers involved in AI discussions.

Migrating from Secrets to Credentials

Rails 7.1 deprecated secrets.yml in favor of encrypted credentials. Learn why this change happened and follow a step-by-step guide to migrate your application safely.

Surviving Rolling Deploys When Sidekiq Meets an Unknown Class

A tiny Sidekiq middleware that requeues jobs whose class is not loaded yet, preventing NameError exceptions during rolling deploys. Includes a detailed look at how the middleware works under the hood.

Flow Analysis for Rails

A look at how tracking flow in Rails applications enables static N+1 query detection and request tracerouting. By analyzing which actions assign instance variables and feed templates, this static analysis tool finds bugs without booting the application or running tests.

Unbounded Session Retention in StreamableHTTPTransport Allows Memory Exhaustion

A security advisory for the mcp gem. In its default configuration, MCP::Server::Transports::StreamableHTTPTransport never expires sessions. An unauthenticated attacker can repeatedly initialize new sessions and immediately disconnect, forcing the server to retain an unbounded number of objects until memory is exhausted.

Ruby SSE Session Poisoning Vulnerability in MCP SDK

A security advisory for the Ruby MCP SDK. A missing session ownership validation in the Streamable and SSE HTTP transport implementation allows attackers with a stolen session ID to silently execute tools using a victim's session.

Unbounded Line Buffer in MCP Stdio Transports Leads to Memory Exhaustion (DoS)

A security vulnerability in the mcp gem's stdio transports allows for denial of service. Using IO#gets without a limit argument to read newline-delimited JSON-RPC frames can cause unbounded memory accumulation and trigger the operating system's out-of-memory killer.

Unbounded JSON-RPC Request Body Causes Uncontrolled Memory Allocation in StreamableHTTPTransport

A security advisory for the Model Context Protocol (MCP) Ruby SDK. An unauthenticated remote attacker can force servers using StreamableHTTPTransport to allocate gigabytes of memory via a single oversized JSON-RPC POST, leading to a denial of service.

Security Vulnerability in mcp Gem: Streamable HTTP Transport Lacks DNS-Rebinding Protection

A security advisory for the mcp gem. The Rack-mountable MCP::Server::Transports::StreamableHTTPTransport processes incoming JSON-RPC requests without inspecting HTTP Host or Origin headers. This lack of validation allows attackers to perform DNS-rebinding attacks and access local servers.

Calling All RUG Organizers: Want to MC Rails World This Year?

The Rails Foundation is looking for two Ruby User Group organizers to MC Rails World this year. If you are already hosting monthly community events, this is an opportunity to bring that energy to the big stage.

Passenger 6.1.7

Passenger 6.1.7 has been released. This update addresses an ABI break in EL9 (RHEL, Rocky, and Alma) Nginx packages to ensure compatibility for Ruby deployments.

Meet Spinel

An introduction to Spinel Cooperative, a new developer-owned consultancy founded by long-time Ruby and Bundler contributor André Arko. Learn about the mission, the team, and the philosophy behind this new cooperative venture.

Continuations 2026/27: Hanami 3.0

Hanami 3.0 has been released. This major version brings new mailers, built-in internationalization, Minitest support, and significant performance improvements to make your web applications much faster.

An IDE You Don't Install

An exploration into Roundhouse's capabilities by analyzing the entire Mastodon codebase directly in the browser. This web-based IDE provides type inference, auto-completion, and static analysis, revealing performance insights and paving the way for future features like static N+1 query detection.

Audit a Rails Project with the Thoughtbot Audit Skill

A look at turning a Claude skill audit report into a labeled, severity-tiered GitHub backlog, including what the skill discovered when run against a small Rails 8 application.

Claude Skills

A video episode exploring how to create Claude slash commands. These can be useful when dealing with complicated tasks or trying to extract specific information from a Rails application.