The last month of the top Ruby blogs
Rails main enables ActiveSupport::EncryptedFile to attempt decryption with comma-separated keys, including those supplied via RAILSMASTERKEY. While unreleased functionality planned for Rails 8.2, this allows fallback reads without yet introducing support for multi-key writes or full credentials editing.
A guide to restricting admin routes to VPN IP addresses on Heroku using Rails advanced route constraints.
This screencast explores several examples of background jobs and demonstrates how to refactor them to handle duplicate execution from user actions or retries, highlighting practical scenarios to prevent duplicate actions.
Ruby land was quiet today.
A security announcement regarding compromised eMudhra certificates across JetBrains IDEs. Recent updates provide a fix for the runtime issue, with an additional hotfix planned for the JCEF problem. Users should update their IDEs immediately or apply the workaround to disable JCEF.
A critical security advisory was published for Trilogy, the MySQL client used by GitHub and Rails. The SQL injection vulnerability in Trilogy#escape (GHSA-744p-w4gc-m3gh) carries a CVSS score of 9.3, affects all versions up to 2.13.1, and is fixed in version 2.13.2.
A security advisory for Addressable: URI template expressions with multiple exploded variables generate regular expressions vulnerable to catastrophic backtracking. Calling Template#match or Template#extract with crafted URIs can lead to uncontrolled resource consumption and denial of service. Only template matching is affected.
A security advisory for the Addressable gem reveals that Addressable::URI#display_uri decodes Punycode labels containing bidirectional controls and invisible format characters. This flaw allows malicious domains to visually mimic trusted hosts in user-facing applications such as link previews, chat interfaces, and admin panels.
Security advisory: Addressable::URI.normalize_path resolves some paths containing .. segments differently than RFC 3986. Segments climbing above root can bypass path allowlists when an application normalizes with Addressable but delegates resolution to an RFC-compliant parser.
A security advisory for the addressable gem: Addressable::IDNA.tounicode in the pure-Ruby implementation decodes invalid Punycode A-labels when it should return them unchanged. This allows Addressable::URI#displayuri to display misleading hostnames, potentially letting attackers spoof trusted domains in UI representations or host comparisons.
A security advisory for the addressable gem: URI templates that combine several variables in one expression can generate regular expressions vulnerable to catastrophic backtracking. Invoking Template#match or Template#extract with crafted URIs can lead to uncontrolled resource consumption and denial of service.
A security advisory for the Addressable gem details a regular expression denial of service vulnerability in URI templates. Templates using the explode modifier with certain operators generate regular expressions prone to catastrophic backtracking, allowing small, maliciously crafted inputs to cause uncontrolled resource consumption.
A security advisory for the addressable gem: Addressable::URI.normalize_path takes quadratic time when handling nested dot segments. Normalizing, comparing, or joining untrusted URIs can result in uncontrolled resource consumption and denial of service across all supported Ruby implementations.
A security advisory for Rack: Rack::Request#hostwithport, #base_url, and #url return raw authority strings when validation fails. An attacker-controlled Host or Forwarded header containing invalid characters can be embedded verbatim into application-generated URLs, leading to potential redirects or allowlist bypasses.
A security advisory for Rack: Rack::Multipart::Parser reads request bodies into an internal scan buffer that fails to compact under certain multipart chunking conditions. An unauthenticated attacker can craft requests that consume worker memory proportional to request size, causing denial of service through memory exhaustion.
A security advisory for Rack: the multipart boundary guard can skip leading empty or quoted boundary parameters in the Content-Type header. This allows parser differentials and potential WAF bypasses where proxies interpret requests differently from Rack. All supported versions are affected.
header_rules Bypass via Unnormalized Dot Segments in Request Path
A security advisory for Rack: Rack::Static matches header_rules against paths that are only URL-decoded. An attacker can request files using dot segments to receive them without intended security headers such as Content-Disposition or restrictive Content-Security-Policy directives.
An official roundup of the week's changes to the Rails codebase, highlighting the latest updates, performance tweaks, and bug fixes merged into the framework. No tricks here, just treats for Rails developers.
An exploration of minimalist software design for microbilling and LLM token counting workloads, inspired by Vicente Reig's article on ledger batching. A look at how much infrastructure is actually needed to handle high-frequency writes with fewer moving parts.
A look at Hanami Icons, a wrapper around the core functionality extracted from Rails Icons into the icons Ruby gem. It brings the same interface to Hanami applications, letting you easily pull, normalize, and render SVGs from Heroicons, Lucide, Tabler, or custom local folders.
Superpowers Ruby is renamed to RubyPowers starting in version 8.0.0. Existing users will need to migrate plugin installations and update saved skill references, while existing plans and specs remain supported.
Trilogy#escape with Multibyte Encodings
A security advisory reveals that Trilogy#escape produces unsafe output for strings in multibyte encodings like Shift_JIS and Big5, allowing potential SQL injection. Rails applications using the Trilogy MySQL adapter may be affected when escaping attacker-influenced strings.
In this issue of the Ruby Weekly newsletter, a look at how quickly recent CRuby security fixes reached version managers and Docker images. Plus, building custom images locally for deployment with Kamal, and other news from across the ecosystem.
Instead of adding extra language runtimes and CI steps to check spelling, consider building plugins tailored to your existing stack. For a Jekyll site, that meant replacing a slow Python tool with a custom RuboCop plugin, turning spelling into another cop with unified configuration and CI integration.
.authorized? Checks Had Failed
A security advisory for the graphql gem: the legacy interpreter (Execution::Interpreter) renders the original, unauthorized object when .authorized? raises GraphQL::UnauthorizedError and Schema.unauthorized_object returns a replacement.
A security advisory for the graphql gem: in some cases, GraphQL::Execution::Next rendered results for objects whose .authorized? hooks indicated that the object was unauthorized.
Ruby Central brings back its open source changelog detailing ongoing work across RubyGems.org and the Ruby packaging ecosystem. A recap of recent maintenance and infrastructure updates supporting the tools Rubyists rely on every day.
When a Rails app hits production on the public internet, it encounters a firehose of garbage requests from bots and vulnerability scanners. Here is a look at common bad request exceptions that clutter monitoring tools like Sentry, and strategies to quiet down that background noise.
A weekly update on the lead-up to the next Hanami release, covering fixes for regressions in body params logging and ongoing work across the framework.
In this podcast episode, JP Camara discusses bringing background job batches to Solid Queue, allowing developers to coordinate complex workflows across groups of jobs. The conversation also explores Mission Control Jobs, implementation challenges with database transactions, and his work on YRBY.
An official release announcement: RubyGems and Bundler 4.1.0.beta3 bring several enhancements and bug fixes. Notable changes include installing Bundler 4.1.0.beta3 as a default gem, recording overrides in Gemfile.lock, and refining file lock handling and password prompts.
In this official update from Ruby Central and RubyGems, the open source team relaunches their OSS Changelog. Covering operational work across RubyGems.org and the packaging ecosystem, this issue details service monitoring, incident handling, abuse mitigation, and ways to get involved.
Key takeaways and thoughts on building agent-ready Rails applications and managing development projects following Rails World.
Moving an AI agent's reasoning loop into a Sidekiq job is the easy part. Making it safe to retry and visible while it runs is what actually takes work; here is how to achieve both within a Rails application.
gvl: false
A security advisory for the Wasmtime gem where calling Extern#to_func(gvl: false) releases Ruby's GVL, allowing WASI host paths to access Ruby objects without re-acquiring it. This unsynchronized access can corrupt memory buffers or crash the host process with a segmentation fault.
A security advisory for the wasmtime gem: Ruby values returned through externrefs from function results or hostcall arguments may be invalid references if the Ruby garbage collector is not made aware the value is still in use, potentially causing segmentation faults and crashing the host process.
A security advisory for the dalli gem where keys created via incr or decr using the memcached meta protocol can lead to forged get_multi replies. Crafted keys containing CRLF characters may inject responses, potentially triggering untrusted object deserialization.
A security advisory for sqlite3-ruby. On 64-bit platforms, casting Ruby string lengths to integers allowed strings 4 GiB or larger to wrap their length, potentially letting attackers truncate queries to drop trailing clauses. This vulnerability is patched in sqlite3 v2.10.2.
A podcast conversation on Tech for Humans covering Rails, AI, running a software consultancy, and open source. Topics include revisiting a Rails World keynote, why teams postpone Rails upgrades, and whether AI might change how we think about open source dependencies.
Simulating thousands of concurrent socket connections in Campfire revealed cache misses, unshared message fragments, and expensive cache key generation. A breakdown of three pull requests that cut Rails room page rendering from 46 ms to 11 ms, an Action Cable ordering bug, and tips for your own app.
Rails 8.2 sets config.activesupport.messageserializer to :json for applications using config.load_defaults 8.2. This change ceases acceptance of legacy Marshal payloads when reading messages through ActiveSupport::MessageVerifier and ActiveSupport::MessageEncryptor, potentially affecting older serialized tokens.
When a new security release drops for Ruby, official Docker images can take time to appear. A quick walkthrough on building your own custom Ruby image locally and deploying it with Kamal when you cannot afford to wait.
A look at how to run Bootstrap 4 and 5 side by side in a Rails app, choosing the version per controller with a dedicated layout to migrate gradually via small pull requests.
Campfire now has eight implementations and a shared benchmark that checks every response and audits every write. A survey of how each implementation caches, why single-viewer benchmarks reward whole-page caching that a busy chat deployment rarely hits, and a proposal for what the benchmark should cover next.
An official security release for Ruby 3.3. This maintenance update addresses vulnerabilities by updating the default resolv gem to 0.3.2 to fix CVE-2026-80212 and CVE-2026-80213, while also incorporating Regexp compilation bug fixes tied to several GitLab CVEs.
An official release of Ruby 3.4.12 is out, addressing bug fixes in Regexp compilation associated with multiple GitLab CVE security advisories alongside several general bug fixes.
Official security releases for Ruby 4.0.9, 3.4.12, and 3.3.13 address multiple memory corruption vulnerabilities in Ruby's Onigmo regular expression engine. Discovered via GitLab, specially crafted patterns compiled with Regexp.new could lead to remote code execution. Upgrades are strongly recommended.
An official release announcement for Ruby 4.0.9. This maintenance release includes important Regexp compilation fixes addressing security issues related to several GitLab CVEs, including CVE-2026-110264.
In this week's official Rails roundup, new applications stop falling back to Marshal for signed messages, local secret files are no longer world-readable, and SQLite column renaming gets an update, alongside other core framework changes.
A special out-of-band issue of the Ruby Weekly newsletter covers urgent security releases for CRuby versions 4.0.9, 3.4.12, and 3.3.13. The updates address memory corruption vulnerabilities in the Onigmo regular expression engine affecting regex pattern compilation.
A look at burning 1.2 billion AI tokens across ten days to open 295 pull requests and ship 30 releases across 49 repositories, including working through open-source backlogs like Mongoid, CI maintenance, library features, and application upgrades.
An official release announcement for Ruby 4.0.8, bringing a routine update that includes bug fixes and stability improvements. Check the official release notes and GitHub repository for full details.
A security advisory for the Avo gem: params[:set_locale] writes directly into Avo.configuration.locale, a global setting shared across requests in the Ruby process. This mutation occurs before authentication, leading to persistent state poisoning, application-wide language changes, or denial of service via invalid locales.
A security advisory for Avo: A missing authorization check on the association show endpoint allows authenticated users with access to a parent record to view unauthorized associated records, bypassing configured Pundit or authorization policies in Avo 2, 3, and 4.
An official Rails interview featuring Donorbox engineering manager Hussain Akram and chief architect Antonio Carlos de Souza, discussing how Rails scales effectively for real-world platforms supporting nonprofits over more than a decade.
Rails 8.2 compiles HTML+ERB templates through Herb, an HTML-aware ERB engine that rejects unclosed tags at compile time. Add bin/rails herb:check to CI to ensure broken markup never reaches production.
This issue of the Ruby Weekly newsletter features the latest Rails Community Survey results showing strong monolith and Postgres adoption, an exploration into making Rails enums 4.5x faster, and building a custom static analyzer from scratch.
A look at whether your test suite still needs DatabaseCleaner. Explores its traditional use cases, the performance and simplicity gains from removing it in modern Rails applications, and a case study from a production app.
In this podcast episode, Jessica Kerr and Avdi Grimm join David Hill to discuss the changing nature of software engineering in the age of AI. They explore developer identity, managing AI-generated code with reviewer agents, and maintaining human curiosity and satisfaction.
A security vulnerability in the crass gem allows CSS sanitizer bypasses. Incorrect tokenization of bad URLs enables malicious declarations or @import rules to slip past sanitizers like rails-html-sanitizer, Loofah, and Sanitize, which browsers may then parse and execute.
A deep dive into how Rails acts like a JIT compiler, exploring how Aaron Patterson improved ActiveRecord enum performance by dynamically generating specialized code at runtime.
An introduction to rubocop-spellcheck, a RuboCop plugin for spell checking Ruby comments, strings, identifiers, Markdown, RDoc, and plain text. Built on Kotoshu with a pure Ruby backend, it ships with an American English dictionary requiring no external system packages.
Rails 8.2 lets an Active Record type define the SQL expression every query compares through. Write lower() once in a custom type to get case- and accent-insensitive find_by, where, order, and uniqueness validations for free.
A look at tips and tricks for writing robust black-box evals for coding agents, focusing on testing applications without seeing their underlying code. Explores UI/UX contract strategies, UI mutation testing, and gotchas with browser-based end-to-end verification.
Distributing commercial Ruby gems like geneva_drive presents unique challenges. Here is a look at Paquette, a custom-built engine designed to serve and distribute libraries privately, detailing how it works and why it was built.
A security advisory for the sanitize gem: when configured to allow elements or sanitize stylesheets directly, an attacker can bypass CSS property and URL protocol allowlists via CSS nesting. This could allow applying arbitrary CSS properties or loading resources from disallowed URLs.
A security advisory for PgHero reports that an authenticated user can kill connections and certain Postgres backend processes for other databases on the same instance if the database user has privileges to do so.
SF Ruby is an engineers' conference where attendees can meet the folks building Ruby open source, scaling Rails in production, and shaping what agentic Rails looks like next.
Version 7 of the Passenger application server is now available in preview. This release introduces support for WebSockets with Apache httpd alongside parallel rolling restarts, allowing restarts to complete faster at the cost of increased memory usage.
Reflections from attending Rails World for the first time, exploring how uncertainties about AI sparked conversations on developer roles and where the future of programming is headed.
A weekly update highlighting progress towards Hanami 3.1 readiness, detailing incremental improvements and key highlights from ongoing development on the Ruby web framework.
Version 6.2.1 of the Passenger application server is out. This release updates minimum OS support requirements, adds packages for Ubuntu 26.10, improves error reporting, and enhances compatibility with SELinux and Ruby frozen strings.
A deep dive into using bipartite graphs to detect possibly uninitialized variables via static program analysis. After demonstrating the concept with a toy language, the technique is applied directly to Ruby code.
The gems were resting today.
Rails 8.2 introduces default_order to Active Record relations, providing a fallback sort that applies only when a query has no explicit order. This eliminates the need to reach for reorder when chaining custom sort criteria onto a relation.
Roundhouse's Ruby output now runs under Falcon as well as Puma. On the Campfire benchmark, it beats Tobi Lütke's hand-written Ruby port on five of eight routes and ties on two more, with most gains coming from bypassing Rack on the hot path despite GVL hurdles.
This week's official roundup of changes in Rails highlights faster blank? checks, safer SQLite rollbacks, and several other codebase improvements and bug fixes.
The results for the Rails 2026 Community Survey are officially out. Time to dig into the latest data, trends, and perspectives gathered from developers across the ecosystem.
Following an inaugural round that funded eight projects, the Gem Fellowship returns with another $100,000 commitment to support Ruby open source maintainers. Companies and community members are invited to join as sponsors to provide crucial financial backing for vital Ruby infrastructure.
Custom elements are a great fit for server-rendered apps using Hotwire. Here is a look at building a clean, reusable tooltip component that avoids Stimulus wiring or complex data attributes by wrapping elements in a single custom tag.
The latest issue of the Ruby Weekly newsletter highlights the release of Ruby 4.1 Preview 1, featuring Module#descendants, Ractor-local GC, and YJIT on Windows. Other featured stories include Shopify running ZJIT in production to match YJIT speeds, alongside the latest community updates.
In an official announcement, RubyGems.org now displays security warnings directly on gem pages when a version is affected by known vulnerabilities. Advisories pull from sources like GitHub Advisory Database and Ruby Advisory Database, showing severity levels and summaries before you install.
A look at using AI coding agents to clear open-source backlogs across projects in the Mongoid organization. AI tools helped reproduce tricky bugs, write missing tests, and resolve a complex sharding issue in mongoid-locker that sat open since 2013.
In this podcast episode recorded at Rails World, Buzzsprout co-founder Tom Rossi discusses AI, product thinking, and the evolving role of developers. Topics include using AI to maintain older Rails applications and shifting focus from pure coding toward deciding what is actually worth building.
A security advisory for omniauthoidc 1.0.0 and 1.0.1, which verified ID tokens with whatever signing algorithm the token header specified unless clientsigningalg was set. Unsigned tokens with "alg": "none" passed verification, potentially allowing account takeover when using the implicit idtoken flow.
An official release announcement for RubyGems and Bundler 4.0.23. This version updates vendored gems, drops setuid/setgid and sticky bits when extracting gems, improves Windows path handling, and resolves issues with lockfile handling and retrying 416 responses.
Rails 8.2 adds routing, request, and test support for the HTTP QUERY verb, offering a safe and idempotent request with a body. Learn how to build a faceted product search endpoint that accepts a JSON filter body instead of an unwieldy query string.
A guide on deploying a Rails application compiled into a binary using Roundhouse and Spinel, demonstrating how straightforward the process can be when paired with Kamal.
In this podcast episode, Joël and Aji ponder technical risk as a different lens on the idea of technical debt, exploring the perils inherent with introducing debt into a system and how to keep projects from blowing up.
Based on Ryan Sherlock's talk at Rails World '26, an exploration of how Fin cut CI time, handles automatic rollbacks, and uses an AI agent named Shrek to approve pull requests.
An update from the official Rails blog on the Agents on Rails benchmark. Stage 3 introduces large, multi-step tasks to test how well an AI model can build on its own work across multiple sessions without degrading code quality, alongside an expanded variety of test applications.
A security advisory for the datadog gem: a regular expression used to obfuscate URL query strings can consume excessive CPU on crafted input, causing a denial of service. Only Ruby versions below 3.2 are affected, and the feature is disabled by default.
Thor offers better argument handling than Rake, and Rails uses it for built-in commands like bin/rails generate. While gems and engines easily auto-discover commands in lib/commands, Rails applications need a small tweak in config/boot.rb to unlock the same behavior.
Large Language Models are transforming how businesses build software, automate operations, and deliver digital products. A guide examining how technical leaders can evaluate and integrate LLMs into existing Rails applications for features like intelligent customer support, document analysis, and workflow automation.
Roundhouse's Futamura target leaves Rails applications intact while removing ahead-of-time work normally done on every request. For verified routes, requests skip Rails entirely: a plain-Ruby version answers directly inside the process in a Ruby::Box, running 2.3 to 4.7 times faster.
A reflection on DHH's Rails World keynote and panel discussion with Matz, examining disagreements regarding Rust and black-box code, alongside reasons to remain bullish on the future of Rails.
When adding a search box backed by a LIKE or ILIKE query, user input containing characters like % or can unintentionally alter the search pattern. Active Record's sanitizesql_like properly escapes these wildcards before wrapping queries in your own patterns.
The official release announcement for Ruby 4.1.0-preview1. This preview introduces Ruby Box and ZJIT, along with various language improvements, updates to Ractor, and bug fixes around refinements and module method aliases.
Reflections on DHH's Rails World keynote and what it signals for the ecosystem. Even if prominent leaders seem jaded or lose interest in the framework, the community does not need to follow suit; stepping back simply creates room for others to build.
Reflections on David Heinemeier Hansson's opening keynote at Rails World, where he discussed building HEY and asked whether the tech stack is truly becoming irrelevant for modern development teams, offering perspective from an established Rails shop.
Longtime Ruby author and gem maintainer Ryan Bigg reflects on the brutal state of the tech job market, the mental toll of widespread hiring rejections, and his decision to step away from tech after twenty years in software development.
Using the Lobsters benchmark created by Shopify's Rails at Scale team, an exploration into what Rails does on every request that an ahead-of-time compiler could resolve beforehand. While YJIT and ahead-of-time compilation remove different costs, much of the remaining overhead falls outside what a JIT can optimize.
The gems were resting today.
Slides and speaker notes from Deccan Queen on Rails exploring the idea that Rails has been a fourth-generation language all along. While 4GLs historically struggled because their compilers cost too much, modern tooling has made them cheap, leaving its future to the keepers.
In this edition of This Week in Rails from the official Rails blog, explore the latest changes across the Rails codebase, including improved S3 ACL control in Active Storage alongside other recent fixes and enhancements.
A look at a failed bike trip, a rubber-ducking session with a friend, and charting a new direction for the Ruby Stained Glass project.
A behind-the-scenes look at the backstory of the Rails World keynote, "The Most Valuable Engineer Isn't Shipping Features." Robby shares how an initial retreat to draft tangible codebase tactics for humans and AI agents evolved into an entirely different talk.
Following infrastructure deployment updates, Shopify rolled out regions of its storefront renderer running on ZJIT. Early production benchmarks show promising numbers, with Ruby's experimental compiler now matching YJIT performance across real-world workloads.
A recap of Deccan Queen on Rails in Pune, celebrating the intersection of local culture and the international Rails community. The event welcomed guests with traditional Maharashtrian hospitality, an all-women dhol-tasha pathak, and ceremonies bringing together developers from around the world.
Generative AI is transforming how companies build digital products and automate workflows. Combining Generative AI with Rails provides a flexible foundation for integrating features like AI chatbots, content generation, intelligent document processing, and personalized recommendations into modern web applications.
Generative AI is transforming how teams build digital products, automate workflows, and process information. An exploration of practical ways to integrate generative AI into applications, covering AI chatbots, content generation, and document processing using Rails as a flexible foundation.
RubyLLM 2.1 introduces an MCP client shaped in Ruby, typed judgments, evaluations, tool progress, and OpenTelemetry tracing, all while reducing the overhead required on every call.
A look at building <paused-gif>, a lightweight custom element designed to make looping GIFs accessible. It renders a still poster frame with a play button by default, addressing common motion and WCAG compliance issues for animated content.
An official release announcement for RubyGems and Bundler 4.1.0.beta2, introducing support for content-addressable gems in Gem::PackageTask, permissions cleanup when extracting gems, improved handling of invalid Windows paths, and breaking changes when building platform gems.
In this issue of the Ruby Weekly newsletter, highlights include warming up the Puma master before forking at Basecamp, DHH porting Campfire to Elixir and Rust, plus other notable articles and updates across the Ruby community.
A security advisory for mechanize: credentials can leak to a redirect target when an HTTP redirect crosses to another host. Headers configured via Mechanize#request_headers= bypassed redirect stripping entirely, potentially exposing Authorization and other sensitive headers across domains.
A security advisory for the mechanize gem: when Mechanize#followmetarefresh is enabled, the agent fails to apply a trust boundary across origins. This allows credentials configured via request_headers= to leak to external origins following a meta refresh.
In this podcast episode recorded at Rails World, Marco Roth discusses Herb's integration into Rails 8.2, improved HTML+ERB tooling, and ReactionView. He explains how ReactionView brings fine-grained reactivity to Rails templates without needing to manually wire Turbo Frames, Turbo Streams, and Stimulus controllers.
Notes from Mike Dalessio's Rails World talk detailing how an AI agent chained together seven minor bugs into CVE-2026-66066, alongside an exploration of how Hot Cell provides sandboxing for Active Storage.
An exploration of the coding style in grubby, a minimal static site generator for git repositories written in Ruby. The project embraces a straightforward, unrolled approach using available tools without premature optimization.
PostgreSQL does not guarantee row order without ORDER BY. A look into using Rails 8.2 or pg_disorder to shuffle unordered SELECT results, exposing hidden order dependencies, flaky tests, and application bugs through database chaos engineering.
A security advisory for the cssparser gem: when parsing CSS containing an @import rule with a :basedir option, an attacker can trigger arbitrary local file reads via path traversal or absolute paths due to missing containment checks in load_file!.
Tobi Lütke ported Campfire to Ruby without Rails and made it 15 to 27 times faster. A conversation about Roundhouse explores achieving similar speed by deterministically transpiling Rails to plain Ruby while preserving gem dependencies, how this approach fits Shopify-scale apps, and current progress.
In this podcast episode recorded at Rails World, Rachael Wright-Munn discusses her project indexing global Ruby events, augmenting developer workflows using classic Rails generators instead of LLMs, and why AI might not always be the right solution for every problem.
A recap of Aaron Patterson's Rails World presentation on the as-if rule, exploring how it shapes Ractor safety in Ruby 4.1 and detailing how it explains a real-world RubyGems.org security incident.
Hot Cell v1.0 secures Rails applications by moving Active Storage's image, video, and PDF processing out of the main app and into a locked-down sidecar container, reducing the attack surface from third-party media parsing libraries.
A weekly update covering fixes for Hanami Minitest scheduled build failures caused by ongoing work on Hanami's reloading support, alongside efforts to get the test suite green on JRuby.
A security advisory for the dalli gem details vulnerabilities where values flagged as compressed were inflated without size limits, and unconstrained reply sizes allowed memory exhaustion. Patched versions introduce a decompressedmaxbytes configuration option and reject reply sizes over 1 GiB.
A security advisory for the Dalli memcached gem addresses routing token vulnerabilities that permit arbitrary meta flag injection, endless retry loops on failed requests, and improper error handling in get_multi blocks. Upgrading or avoiding untrusted input in routing tokens is recommended.
A security advisory for the dalli gem: when configured with a namespace, transient network errors can cause retried requests to apply the namespace twice (turning app:x into app:app:x). This allows retried reads or writes to target unexpected keys, potentially exposing or overwriting cached data.
A security advisory for the Dalli gem: pipelined get_multi can return another key's value after receiving an error reply. If any part of a cache key comes from user input, an attacker could trigger this behavior and view another user's cached data in Rails applications.
A security advisory for Dalli explains how forking can cause buffered request bytes in Ruby's IO write buffer to be inherited and flushed by child processes. This can duplicate writes, desynchronize connection replies, or tear down TLS sessions, particularly impacting pre-forking servers and background job runners.
A security advisory for Dalli reveals that per-request raw: true and serializer: JSON fail to prevent unsafe deserialization, falling back to Marshal.load or JSON.load. Patched versions address this by introducing Dalli::JSONSerializer using JSON.parse.
An overview of RubyLLM 2.0, introducing resumable agents with human approval, support for video, speech, OCR, reranking, provider tools, citations, a cost ledger, batches, caching across seventeen providers, and the upgrade path from version 1.16.
A security advisory for Katello: a flaw in the Content View History API fails to properly enforce authorization. An authenticated user permitted to view Content Views in one organization may access lifecycle history belonging to another organization, resulting in unauthorized disclosure of publication and promotion events, users, and timestamps.
A security advisory for net-ssh: loading a crafted ed25519 private key containing an excessive number of rounds causes an infinite CPU loop, hanging the Ruby process indefinitely and resulting in a denial of service.
A security advisory for net-ssh. Net::SSH::Transport::ServerVersion#read! appends received bytes without enforcing a maximum line length or byte cap. A malicious server sending a long identification line without a newline causes unbounded client memory growth pre-authentication, leading to a denial of service.
A security advisory for net-ssh: Net::SSH::Service::Forward#initialize unconditionally registers server-initiated auth-agent channel handlers. As a result, standard port forwarding silently exposes the local SSH agent even when forward_agent: false is set, allowing a compromised server to access the agent.
A security advisory for net-ssh: the transport packet reader trusts the 4-byte wire packet length without capping it against RFC 4253 §6.1. Pre-KEX, a malicious server can declare an arbitrarily large packet length and stream data, causing unbounded client memory growth before authentication.
A security advisory for net-ssh: Net::SSH::Transport::Session#poll_message pushes packets received during key exchange into an unbounded queue with no size cap. A malicious server can flood non-allowed packet types, causing the client to queue them all in a pre-authentication memory-exhaustion DoS.
A GraphQL schema is a typed contract that graphql-ruby enforces on incoming queries, but whether the Ruby backing each field honors that contract usually only surfaces at runtime. Roundhouse now checks this statically without booting the app, revealing type mismatches across different Rails applications.
When testing Rails applications with the Rack::Test driver, Capybara defaults to parsing HTML as HTML4. This can hide real-world markup issues such as nested form tags. You can ensure your test suite catches modern HTML5 parser quirks by setting Capybara.usehtml5parsing = true.
An exploration into combining Hifumi, which turns a sentence into a Rails 8 app, with Roundhouse to compile Rails apps. A breakdown of what it takes to put them together, navigating Rails 8 authentication generator quirks, and where a compiler fits into Hifumi's pipeline.
A look at setting up and running 37signals' Rails-based Campfire chat application using Roundhouse and Spinel.
kamal-backup 1.1 adds a dump command that pulls a database dump directly out of Kamal backups over SSH without restoring anything, along with a fix for restoring specific snapshots.
In this video episode, walk through a cool little project you can create and build upon: taking a full-length URL and squishing it down into a shortened link.
Two ports of 37signals' Campfire now exist: Roundhouse and a Rust rewrite. While both translated the server, neither touched the client-side JavaScript. Rust parsers like Oxc for JavaScript and Herb for ERB could change that, opening up new possibilities for analyzing and porting the frontend.