Planet Ruby

Roundhouse Released

Five months into development, Roundhouse has cut its first release. The project provides developers with a selection of analysis tools, transpilation, and compilation options.

Spinel at Your Fingertips

Spinel compiles Ruby programs by determining what to refuse and which values fall off the typed fast path. New tooling now surfaces this information interactively through an in-browser interface, a language server for code editors, and an MCP server for AI agents.

OpenAI Agents Carried Out an Undisclosed Attack on RubyGems

Custom Actions in Attractive.js: One Interface, From Small to Big

A look at writing custom actions in Attractive.js when built-in actions fall short. Covers everything from quick one-liners using the js: prefix to function-based actions registered on activation, along with newly bundled optional extensions.

Did AI Agents Attack RubyGems?

In this issue of the Ruby Weekly newsletter, researchers tie the RubyGems 'GemStuffer' spam campaign to OpenAI agents probing a CDN bug. Other featured topics include Rails upgrade workflows and practical guides for using Ractors for true parallelism in Rails.

Continuations 2026/37: Response Streaming

A personal weeknotes update sharing news on joining HotDoc in a manager and engineering role, alongside continued exploration of response streaming.

Episode 552: Hatchbox and GoRails in the Age of AI with Chris Oliver and Collin Jilbert

In this podcast episode, Chris Oliver and Collin Jilbert discuss the changing economics of building products for the Rails community in the age of AI. They explore how coding assistants impact platforms like GoRails and Jumpstart, and how developers can leverage AI to research, prototype, and refactor complex Rails code.

Porting a Discord Bot to Microsoft Teams, Entirely With AI

A look at porting the Ruby-based discord-strava bot to Microsoft Teams as teams-strava using GitHub Copilot CLI, comparing the timeline and experience of an AI-assisted port against a manual rewrite from 2023.

RubyGems 4.0.21 Released

An official release announcement for RubyGems 4.0.21 and Bundler 4.0.21. This release brings enhancements such as normalizing symlink targets during gem extraction and rejecting HTTPS to HTTP redirects, alongside bug fixes for git sources and checksum handling.

Ractor-age Rails: A How-To Guide

A deep dive into patterns, pitfalls, and pull requests encountered when exploring Ractor-based concurrency in Rails.

Stacked Vertical Slices

In this podcast episode, Aji and Joël discuss component bugs and the headspace they consume, historic heraldry versus ChatGPT anchoring bias, GitHub's stacked pull requests, and approaches to structuring conditionals when working with multi-step forms.

From Collecting Payments to Distributing Revenue: The FinTech System Behind Smily

Collecting a payment sounds like a reasonably well-defined problem: a traveler pays for a booking, the payment succeeds, and the property manager receives the money. A look into the financial complexities and architecture behind building a multi-party payment and revenue distribution system.

Ruby 4.0.7 Released

An official announcement that Ruby 4.0.7 has been released. This routine maintenance update includes various bug fixes as part of the regular bi-monthly release cycle for stable Ruby releases, with the next patch planned for November.

Rails Hyperdrive: Supercharged Agentic Development for Rails

A look at Rails Hyperdrive, a development-only Rails engine that gives AI coding agents live answers from your booted app and lets any gem in your bundle ship guidance gated to your Gemfile. Convention over configuration, applied to agent knowledge.

Irish Chess Union Upgrades to Rails 8.1

A look at upgrading the Irish Chess Union's Rails application from 7.0 to 8.1 using Claude Code and an open source Rails upgrade skill, all without pausing feature work for a single day.

Irish Chess Union Upgrades to Rails 8.1

How we used Claude Code and AI to upgrade the Irish Chess Union's Ruby on Rails app from 7.0 to 8.1, using our open source upgrade skill, without pausing feature work.

Innocent Looking Ruby Can Be Dangerous

A look into how seemingly innocent Ruby code can introduce subtle risks, prompted by an example spotted while exploring the documentation for the upcoming RubyLLM 2 release.

What a Time to Be Alive

Recent reports revealed rogue OpenAI bots targeted RubyGems.org by exploiting a caching vulnerability alongside web scraping activity on RubyDoc.info. Aaron Patterson examines the wild findings surrounding the GemStuffer campaign and attempts to upload junk gems to the Ruby ecosystem.

Ruby Native Apps Are Running on 100,000+ Devices

Ruby Native apps have crossed a milestone, now running on over 100,000 devices. Here is a look at how Herb unlocks reliable and safe mobile app updates for Rails developers.

Campfire, Dockerized

Basecamp's Campfire, transpiled from its unmodified Rails source and compiled to a native binary, now runs in Docker. It provides a minimum viable Campfire with working chat and live delivery, alongside details on how to run it, current limitations, and initial learnings.

An Update on the May Spam-Publishing Campaign on RubyGems.org

An official update from the RubyGems team addressing the spam-publishing campaign on rubygems.org. The team blocked responsible accounts and yanked over 500 malicious packages designed to abuse shared Ruby infrastructure, noting that normal gem installs and pushes remained unaffected.

Alternative Text in Attachments and More

The official Rails blog recaps the latest developments in This Week in Rails, highlighting support for alternative text in attachments alongside recent fixes and improvements across the framework.

Issue 538: Government Rails Site Hit Hours After CVE Patch

Thanking Our Individual Sponsors, Edouard de Labareyre, and a Merch Announcement

Week four of the Hanami sponsorship drive features a Q&A with long-time Hanami developer Edouard de Labareyre, a round of thanks for individual sponsors, and an announcement regarding community merch.

Attractive.js 1.0.0: Interactive HTML Without One Line of JavaScript

A look at Attractive.js 1.0.0, a set of declarative HTML actions to toggle classes, add attributes, or copy text without reaching for a complex framework. Much like Stimulus but with less ceremony, it introduces a new syntax, custom actions, and addons.

Upgrading a Deprecated Postgres on Heroku

Facing an end-of-life email from Heroku about your Postgres version? A walkthrough on upgrading a production database, estimating how much downtime to expect, and troubleshooting the commands that failed along the way.

Shopify's Structural Linter for Ruby Codebases

In this issue of the Ruby Weekly newsletter, RubyKaigi talks hit YouTube, featuring keynotes from Matz on Spinel and Charles Nutter on twenty years of JRuby, alongside Shopify engineers discussing how Falcon handled billions of requests on Black Friday, porting DOOM to Ruby, and more.

CVE-2026-88030: MongoDB Ruby Driver - Improper Neutralization of Special Elements in Data Query Logic in the GridFS Component

A security advisory for the MongoDB Ruby Driver: improper neutralization of special elements in the GridFS component allows structured file identifiers to be interpreted as query conditions. Authenticated users influencing the identifier could access unintended files or remove GridFS file chunks, rendering content unreadable.

Campfire, Buffered

A follow-up on performance optimizations where nested views append directly into the caller's buffer instead of returning a string. A look at rendering mechanics that Rails has the plumbing for but does not do, and what a compiler can achieve over a library.

Practical Hotwire with Jeremy Smith

In this podcast episode, Jeremy Smith joins to discuss recurring pitfalls with Stimulus, Turbo Drive, Frames, and Streams in real-world Rails applications ahead of his Rails World presentation. He shares his process of turning those lessons into a conference talk and tackling increasingly spicy Hotwire challenges.

Tokens, Token IDs and Array Operations in Ruby

LLMs work with the numbers behind text rather than the text itself. Two Rails class definitions one word apart encode to arrays of five token IDs that differ in a single position, showing how subtracting one from the other can return the class name.

The Rails Deprecations You Missed This Summer

A round-up of eight Active Record deprecations landing on Rails main, from a write_attribute(:id) follow-up to a scope-enforcement fix on update and update!.

RubyGems and Bundler 4.1.0.beta1 Released

The official RubyGems blog announces the release of RubyGems and Bundler 4.1.0.beta1. Highlights include support for content-addressable gems, an opt-in OS credential store, post-quantum cryptography (ML-DSA) support for gem signing, and the adoption of the compact index across gem commands.

How Do You Sell a Stained-Glass Panel? (Ruby Stained Glass Notes #07)

Episode seven of the Ruby Stained Glass Notes newsletter, documenting the process of creating a stained glass panel celebrating Ruby. This issue explores three practical questions: how to sell the finished panel, how to price it, and finding potential sponsors.

Agents on Rails: Stage 2. Can a Model Ship a Feature?

An update from the official Rails blog introducing Stage 2 of Agents on Rails. This release expands the benchmark suite with new tasks that test an AI model's ability to deliver real-world features, closely mirroring how developers work in day-to-day Rails applications.

Ruby Shield: A Reflection on Four Years of Securing the Ruby Supply Chain

A look back at Ruby Shield, the four-year partnership launched by Ruby Central and Shopify to give tools at the heart of the Ruby ecosystem sustained security investment and dedicated engineering support.

Continuations 2026/36: Cobbler’s Children

A weekly update highlighting recent work on Hanami and the latest sponsorship drive, including thanks to supporting silver sponsors.

Introducing Rubydex Linter: Structural Checks for Ruby Projects

An introduction to Rubydex linter, a built-in tool designed for writing project-specific structural rules that leverage Rubydex's semantic understanding of a Ruby codebase.

Campfire, Cached

Following up on a recent benchmark where Rails outperformed by six times, caching work has closed the performance gap. Running the same Campfire application across two runtimes helps price the two halves separately: what the lowering is worth versus what the compiler is worth.

Fair by Design: Orchestrating Background Jobs in Ruby

RubyConf 2026: Q&A with Matz Hosted by Aaron Patterson

RubyConf 2026 Closing Remarks with Ran Craycraft, Jason Swett

Convention Over Hallucination: Harness Engineering for AI-Powered...

There Is No Server

RubyConf 2026 Closing Keynote by Dave Thomas

RubyConf 2026: We Who Remember Magic

RubyConf 2026: Opening Keynote by Obie Fernandez

RubyConf 2026: Day 3 Opening Remarks with Ran Craycraft, Jason Swett

RubyConf 2026: Lightning Talks

RubyConf 2026: Ruby Runway Finals

Future of Ruby Panel

Once a Maintainer with Allison Pike, Jeremy Evans, Richard Schneeman, and Colby Swandle

Keynote: Who Are We Now?

Ruby Awards and Ruby Fellows with Ben Greenberg

Ractors in Ruby 4.0: Message Passing Without the Pain

Talking Shit About AI Agents

Weird and Wacky Machines Running Ruby

Command-Line Applications in Ruby: Design Patterns and Best Practices

Powerful Data: Making Rails Apps Faster with Aggregation

Implementing Core Set

The Anatomy of an ERB Rendering Engine

RubyConf 2026: Opening Keynote by Yukihiro Matsumoto

RubyConf 2026: Day 1 Opening Remarks with Ran Craycraft and Jason Swett

Elements of Programming, In Ruby

How to Accessibility If You’re Mostly Back-End

Building the Next-Generation Garbage Collector in Ruby

Come Discuss Ractors and Concurrency with the Dude

Artisanal Computing: Handcrafted Ruby Execution for the Modern Age

Native Dialog

In this screencast episode, explore how to use native HTML dialogs and popovers directly in a Rails application, building interactive UI elements without relying on external JavaScript libraries.

Campfire, Measured

A look at benchmarking Campfire, where deployed Rails remains six times faster on the page that matters, alongside reflections on hunting down an elusive bug suspected to be in Matz's compiler.

Converting a Ruby Block Interface to Start/Stop Methods with a Fiber

A look at bridging the gap between block-scoped APIs like Playwright.create and test lifecycle hooks that lack around hooks (such as RSpec's suite setup). Learn how a Ruby Fiber can invert control, converting block interfaces into clean start! and stop! methods.

Standardizing Exception Message Style in Ruby

A look at standardizing bare exception messages in Grape to match Ruby core conventions: lowercase and unpunctuated, meant to follow the class name and a colon. Covers cleaning up inconsistencies and automating checks to prevent regressions.

Beyond ORMs

An exploration of moving away from traditional ORMs like ActiveRecord in favor of direct database interaction. This shift highlights the limitations of ORMs and introduces Extralite, a lightweight Ruby gem designed for working directly with SQLite databases using plain SQL.

Ractor-Ready Rails, Ordered Cache Fetches, and More

A round-up of recent developments in the Rails codebase, including progress toward Ractor-ready Rails, support for ordered cache fetches, and various other performance improvements and bug fixes from the community.

Issue 537: All the Little Things

The latest issue of the Awesome Ruby newsletter, featuring a curated collection of the best Ruby links, tools, and tutorials from around the web.

Turning Audit Findings into CI Checks

A site audit is only a snapshot. This guide demonstrates how to turn thin-content, anchor-text, and page-metadata findings into automated rake tasks and specs, ensuring these issues do not reappear in your Rails application.

Re-Organized Configuration in Rails

An updated approach to organizing configuration in Rails. Instead of manually wiring environment variables and credentials in YAML files, this rebuilt solution automatically chains through multiple sources to provide a clean Config::Namespace.key API.

Ringbinder: A Tool for Personal Documents

An introduction to Ringbinder, a simple Ruby CLI tool designed to index and search personal documents using natural language queries. It allows users to easily locate files, images, and specific details like maintenance records from their local archives.

The Hidden 4GL

An exploration of the claim that Rails has been a fourth-generation language (4GL) all along, hidden inside a third-generation language. With recent shifts in compiler costs, we might finally see the realization of application development without programmers.

Continue the Argument

A follow-up to Sam Ruby's RubyConf talk, reflecting on the presentation, subsequent developments, and community metrics. Topics include Campfire's distribution, testing Spinel's garbage collector, and addressing scaling questions raised during the Q&A session.

From Raw Memory to Structured Web Applications

An open source progress report covering safer IO::Buffer ownership, bounded content parsing, structured URLs, protocol-native applications, and worker-aware load balancing across the modern Ruby async ecosystem.

CVE-2026-85396: Path Traversal Vulnerability in Rubyzip

A security advisory for the rubyzip gem. Versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract due to improper validation of extraction paths. Attackers can exploit this to write files outside the intended directory using crafted archive entry names.

After the Tests Pass

An exploration of the gap between proving code correctness through green test suites and ensuring real-world performance. This series dives into a scenario where automated tests passed but the application remained too slow for production, highlighting the difference between correctness and impact.

ZJIT Can Now Inline GC Allocations

This issue of the Ruby Weekly newsletter highlights ZJIT's new ability to inline garbage collection allocations, bringing a notable performance boost to CRuby. Also featured is work on compiling Rails apps to run on the Spinel Ruby AOT compiler.

Weird and Wacky Machines Running Ruby

A video presentation from RubyConf exploring the unusual, creative, and unexpected hardware and devices running Ruby.

XORuby with Jim Remsik

In this podcast episode, Jim Remsik, founder of Flagrant and organizer of XORuby, discusses taking a Ruby conference on the road. The conversation covers lowering barriers with inexpensive, one-day regional events, building effective AI-assisted development workflows, and the changing role of design.

Thanking Our Silver Sponsors and Carolyn Cole

An update on the Hanami 2026 sponsorship drive, featuring a Q&A with Carolyn Cole from Princeton University Libraries. Cole, an expert in porting Rails applications to Hanami, discusses her workshop at RubyConf and her team's open-source orcidprincetonhanami application.

Teaching Ruby to Rank: A Search Pipeline Story

A video presentation from RubyConf exploring the development of a search ranking pipeline. Learn how to leverage Ruby to process, rank, and optimize search results effectively.

Berlin.rb: A New Monthly Ruby Meetup in Berlin

A new monthly meetup for Berlin's Ruby community, held on the second Tuesday of every month. The inaugural event on September 8 features talks by Paweł Strzałkowski and Carmine Paolino.

RubyGems and Bundler 4.0.20 Released

The official RubyGems blog announces the release of RubyGems and Bundler 4.0.20. This update introduces various enhancements, bug fixes, and documentation updates, including printing a release notes link on system updates and avoiding duplicate relative path prefixes in bundle exec.

The Case of the Interrupt That Arrived Too Soon

An investigation into a narrow race condition between Ruby's pending-interrupt queue and an event selector entering a native wait. This deep dive explores how interrupts are handled during low-level blocking operations.

Agents on Rails: Claude Fable 5.1 and GLM 5.3 Flash

An evaluation of how the newly released Claude Fable 5.1 and GLM 5.3 Flash AI models handle real-world Rails tasks, including their latest leaderboard rankings and a look at the newly named stealth model.

Why Gusto Hired Evil Martians for Sidekiq Infrastructure

Gusto runs payroll for over 500,000 businesses on one of the largest Rails monoliths in existence. A look at why their engineering team brought in Evil Martians to optimize Sidekiq at scale, what running background jobs at this volume requires, and when to seek external expertise.

Account Takeover Privilege Escalation to Admin via Stored XSS in Alchemy CMS

A security advisory for Alchemy CMS details an improper input sanitization vulnerability. Author-level users can inject stored JavaScript into the Page Properties menu node, executing with Admin privileges to allow full account takeover and privilege escalation.

Account Takeover and Privilege Escalation via Stored XSS in Alchemy CMS

A security advisory for Alchemy CMS details an improper input sanitization vulnerability in the menu node name rendering. Author-level users can inject stored JavaScript that executes in an administrator's browser, potentially leading to full account takeover and privilege escalation.

How to Avoid APM Bill Surprises

APM bills often grow because usage creeps up unmanaged. Learn where the spend actually goes, the warning signs to watch out for, and get a renewal-prep checklist to keep production costs under control.

RubyConf 2026: Q&A with Matz

A video recording of the Q&A session with Ruby creator Yukihiro "Matz" Matsumoto, hosted by Aaron Patterson at RubyConf 2026.

Legacy Rails and the AI That Couldn't

Expand Your Ruby Potential with JRuby

Makeover Monday: How a Weekly Ritual Transformed

Why a 1990s Machine Learning Algorithm Destroys LLMs

Fair by Design: Orchestrating Background Jobs in Ruby

RubyConf 2026: Day 1 Opening Remarks

A video recording of the opening remarks from Day 1 of RubyConf 2026, featuring Ran Craycraft and Jason Swett welcoming attendees and kicking off the conference.

Artisanal Computing: Handcrafted Ruby Execution for the Modern Age

RubyConf 2026 Opening Keynote

How to Accessibility If You’re Mostly Back-End

RubyConf 2026: Future of Ruby Panel

Faster FFI for Ruby

The Little Schema That Could (But Should It?)

Come Discuss Ractors and Concurrency with The Dude

Each All the Way Down: How Ruby Enumerators Power Streaming

Campfire Chats

An exploration of packaging Basecamp's Campfire as a native binary. Learn what it took to get from 'boots' to 'chats,' including transpiling unmodified source, managing a walked socket gate, maintaining a DOM-equivalent oracle for Rails, and implementing a multi-layered testing strategy.

Request for Comments

An overview of Request for Comments (RFCs), the official documents shaping internet protocols like HTTP, TCP, and DNS. This guide explores key RFCs, useful tools, and Ruby gems to help developers navigate and stay updated on these foundational technical standards.

Ruby 4.0: ZJIT, Ruby Box, and Ractors

An overview of the upcoming features in Ruby 4.0, including the experimental ZJIT compiler, the Ruby Box sandboxing mechanism, and the new Ractor::Port API. Learn what these changes and deprecations mean for your next major upgrade.

Eddie Galindo & Kagen Hearn: Rate Limiting for Your Customers

An episode of the On Rails series featuring Eddie Galindo and Kagen Hearn from Ascend. They discuss implementing rate limiting for customers within a Rails application designed for insurance agencies to move and reconcile money.

Adding More Display Names to Active Admin

Active Admin automatically determines model names, but sometimes you need more control. This guide explores how to customize display names in Active Admin, including using the display_name method or adding custom methods to handle edge cases like nil values.

Filtering Select Boxes in Active Admin

Active Admin does not support dynamic dropdown filtering out of the box, but it is straightforward to implement. Learn how to create a custom controller action to handle filtering, return JSON based on form selections, and update select boxes using jQuery.

Testing Rails from Scratch Book Updates

Recent updates to the Testing Rails from Scratch book introduce new content on integration testing alongside revisions to the test data chapters. The latest version is now available for readers on Leanpub.

Inlining the GC Fastpath in ZJIT

A look into how object allocations from the garbage collector are now inlined in ZJIT, optimizing the fast path for object creation and improving VM performance.

Inlining the GC Fastpath in ZJIT

A technical look at how object allocations from the garbage collector are now inlined in ZJIT, Shopify's experimental Ruby JIT compiler, to optimize performance and reduce VM call overhead.

Software Foundation Musings

An update from Ruby Central's leadership on navigating the departure of their executive director, managing the extra workload to support the board and staff, and preparing for RubyConf while reflecting on the foundation's evolving role.

Breaking Change v56: Persistent Mode

A new episode of the Breaking Change podcast where Justin Searls shares updates, introduces a new feedback form for listeners, and discusses various software development topics. Listeners can now submit feedback anonymously via a new web form.

Introducing OuijaRouter

An introduction to OuijaRouter, a new tool designed to provide a reliable, bulletproof system for routing tasks to the most appropriate model for the job.

Campfire Boots

Basecamp's Campfire chat application, transpiled from unmodified source with no annotations, now compiles ahead of time to a 4 MB native binary on two platforms. The compiled application successfully links, boots, and serves its first pages.

Adding a Helper to Silence Logging in Rails Console

Use Rails.application.console to run a block only when the console starts, avoiding web or job processes. Defining disableconsoleloggers! and enableconsoleloggers! there allows you to easily toggle verbose logging without repeatedly pasting configuration commands into every session.

Repay Tech Debt with the Strangler Fig Pattern

An exploration of how the strangler fig pattern allows teams to modernize legacy Rails applications gradually, reducing technical debt and avoiding the risks of a complete rewrite.

Adventures in Daylight Saving, Norfolk Island, and Time Zone Math

An exploration of the complexities of time zone math in Ruby, focusing on bugs found in the dotiw gem. Computing durations between timestamps is surprisingly difficult when dealing with daylight saving transitions, particularly with edge cases like Ireland's inverted scheme.

This Week in Rails: August 28, 2026

This week's official roundup of activity in the Rails codebase. Explore the latest updates, bug fixes, and feature discussions from the community to stay up to date with the framework's development.

RubyLLM 2.0: The Agentic Loop, Exposed

An overview of RubyLLM 2.0, which breaks the ask method into granular verbs you can drive yourself. Learn how to stage a message, call the model, run tools, step, resume mid-round, and cancel execution from anywhere.

Bringing Rails into the Ractor-Age

The latest issue of the Awesome Ruby newsletter, featuring a look at bringing Rails into the Ractor-age, alongside the weekly roundup of community news, tools, and tutorials.

Meet RubyConf Scholar Shuveksha Tuladhar

An interview with Shuveksha Tuladhar, a Software Developer Apprentice and RubyConf Scholar. Learn about her experience in the Scholars and Guides program and why you should consider applying for the next cohort.

SVG Sprites: Improve Performance (and Keep Configurability)

Rendering thousands of inline SVGs in Rails can heavily impact page performance. A look at how using SVG sprites instead of inline SVGs via the rails-icons gem can drastically reduce HTML payload size while keeping icons configurable.

RubyLLM 2.0: Providers, Protocols, and Provider Gems

An overview of RubyLLM 2.0, which introduces a new provider architecture and gem generator to make external providers first-class citizens. Additionally, the OpenAI integration now defaults to the new Responses API.

Ryan Bigg Is (Sorta) Looking for Work

After five years at Fat Zebra, a team restructure has made Ryan Bigg's Tech Lead role redundant. He is currently weighing his options between accepting a redundancy package to seek new remote opportunities or transitioning into an individual contributor role within the company.

Security Advisories: CVE-2026-80212 and CVE-2026-80213

An official security advisory details two vulnerabilities in the resolv gem bundled with Ruby. CVE-2026-80212 allows memory exhaustion via malicious DNS responses, while CVE-2026-80213 enables hostname validation bypass. Upgrading the resolv gem is highly recommended.

Kamal-backup 1.0: A Backup Is Only Real After You Restore It

This major release of kamal-backup introduces exact Rails restores, restore drills, and support for PostgreSQL, MySQL, MariaDB, SQLite, SFTP, and rclone to the Kamal deployment ecosystem, ensuring your backups are fully restorable.

Bringing Rails Into the Ractor Age

This issue of the Ruby Weekly newsletter highlights how Ractors are becoming viable in production. Edouard Chin explores what Ractors can unlock for Rails applications, including up to 7x memory savings compared to Puma, and the steps to get there.

CVE-2026-81097: Sandbox Escape in rails-mcp-server's execute_ruby Tool

A security advisory for rails-mcp-server details a vulnerability where the execute_ruby sandbox can be bypassed using pseudo-terminal library spawn entry points. This allows arbitrary command execution. Users should upgrade to version 1.6.1, or 2.0.0 which removes the tool entirely.

CVE-2026-80213: Hostname Validation Bypass in Resolv

A security vulnerability in Ruby's resolv standard library allows hostname validation bypass. Applications checking hostnames against allowlists or SSRF filters can be tricked into resolving unapproved domains if the hostname exceeds DNS length limits.

CVE-2026-80212: Memory Exhaustion in Resolv via Malicious DNS Responses

A security vulnerability in the Ruby resolv standard library allows attackers to cause memory exhaustion. By influencing a resolved hostname, an attacker can trigger unbounded memory growth via malicious DNS responses, potentially leading to a denial of service.

Planet Argon Turns 24

A look back at how the agency started 24 years ago, sharing their journey from the early days to what they are up to now.

Why AI Rewards People Who Already Have Taste

An interview on The Hallway Track podcast discussing running multiple companies, how feature flags change the way you build software, and why taste matters more in the AI era.

ChicagoRuby with Anton Tkachov and Michelle Yuen

In this podcast episode, ChicagoRuby co-organizers Anton Tkachov and Michelle Yuen discuss rebuilding and growing a local Ruby meetup. They share practical lessons on finding venues, recruiting speakers, and the value of face-to-face connections for developers and companies in today's job market.

Why Engineers Should Come to the SF Ruby Startup Conference in 2026

An overview of what to expect at the SF Ruby Startup Conference, an event focused on meeting the people building Ruby open source, scaling Rails in production, and shaping the future of agentic Rails.

GitLab Patch Release: 19.3.1, 19.2.5, 19.1.7

Why Engineers Should Come to the SF Ruby Conference in 2026

SF Ruby is an engineers' conference designed to bring together the people building Ruby open source, scaling Rails in production, and shaping what agentic Rails looks like next.

Output Record Separator in Ruby

A look at Ruby's output record separator global variable, $,. Known as ORS in AWK and shared with Perl, this variable determines the separator printed between arguments, serving as a handy mnemonic for formatting output.

Six Lesser-Known Heroku CLI Commands You Aren't Using

While most engineers use the Heroku CLI strictly for basic tasks like pushing code, it contains a powerful suite of tools built to optimize your workflow. A look at six lesser-known commands to help minimize context switches and upgrade your daily productivity.

Campfire on Spinel

An exploration of running Basecamp's Campfire on Spinel. As a Rails application that heavily relies on WebSockets, holding thousands of concurrent connections invalidates several common assumptions about Redis, conformance scores, and where performance limits actually lie.

What Replacing React with Hotwire Really Costs

Replacing a legacy React and Redux layer with Hotwire sounds tempting. This guide provides an honest look at the development effort, architectural trade-offs, and potential pain points to weigh before making the transition.

Access Control for AI Agents on Rails: Gating SQL with Action Policy

Learn how to secure an in-app AI assistant with open-ended database access. This guide explores how to make SQL queries honor application-level permissions in Rails using the Action Policy gem, preventing unauthorized data exposure.

The Case of the Missing Line: A Ruby Mystery

An investigation into how a Ruby bytecode optimization erased an executed loop condition from the virtual machine's line trace. This deep dive explores the implications for debugging, coverage tools, and instruction sequences.

Agents on Rails: Lemans Goes Open Source

The benchmarking harness behind the Agents on Rails project, lemans, is now open source. This release also includes performance evaluations for four new LLM models running on Rails tasks, including Sonnet 5, Terra, and an open-weight Qwen model.

A Fresh Look at Hanami

For Ruby developers looking to expand beyond Rails, these notes offer a quick look at Hanami. Discover the framework's structure, design philosophy, and how it compares to the Rails ecosystem.

Fine-Grained Access Control Now Available for All Heroku Customers

Heroku has released Fine-Grained Access Controls to all customers, replacing legacy predefined roles with individual capability controls. Users can now manage specific permissions for deploying, scaling dynos, viewing logs, managing config vars, and provisioning add-ons.

Banner or No Banner, That’s the Question

This week's roundup of activity in the Rails codebase explores the latest updates, features, and bug fixes. Stay informed on recent developments and community contributions to the framework.

Ruby 4.0 Universal RCE Deserialization Gadget Chain

SimpleCov Is Now Version 1.0

SimpleCov has released its first stable 1.0 version. This guide covers the breaking changes and deprecations in this major release, helping you identify if your test suites are affected and how to address the updates.

The Scholars & Guides Program: Community, Mentorship, and the Spirit of Ruby

An overview of Ruby Central's program pairing aspiring Rubyists from underrepresented communities with experienced mentors. These Guides help participants navigate RubyConf, grow as developers, and find their footing in the broader Ruby community.

Minimal JS, Modern CSS Anchored Product Tours

Learn how to build interactive product tours using CSS Anchor Positioning and a Stimulus controller in about 100 lines of code. This approach uses a clip-path spotlight effect to highlight elements and CSS anchor positioning to place the dialog.

GitLab 19.3 Released

ArchSpec 1.0: Executable Architecture Specification for Ruby’s Agent Coding Era

ArchSpec turns your architecture into an executable specification. Declare components and boundaries in a single Ruby file to automatically check every change, whether written by a human developer or an AI agent.

RubyGems and Bundler 4.0.19 Released

The official RubyGems blog announces the release of RubyGems and Bundler 4.0.19. This release includes various enhancements, bug fixes, and documentation updates, such as SafeMarshal collection length validation and SPDX license handling improvements.

Power in Numbers, and Pat Allan

An update on the dry-rb 2026 sponsorship drive, highlighting new supporters and the goal of offering honorariums to active maintainers. This week also features a Q&A with Pat Allan, a prominent Australian Ruby developer and Hanami user.