The last month of the top Ruby blogs
We re excited to share some big news from our partners at the Ruby Association: the launch of the RubyGems.org Supporters Program in Japan. Starting this October, the Ruby Association will serve as a local liaison for Japanese companies who wish to support RubyGems.org. This means their
Inspired by a Lobsters post, this guide demonstrates how to detect full table scans in SQLite. By leveraging SQLite's API for prepared statement statistics, you can programmatically identify inefficient queries in your test suite without relying on EXPLAIN.
Rails 8.1 introduces the ability to mark old associations as deprecated. Learn what changed, why this feature matters, and how to clean up your codebase without breaking your application.
In this podcast episode, Mike Dalton joins the show to discuss the complexities of authentication in Rails, sharing insights on navigating security challenges, managing user sessions, and avoiding common pitfalls in modern web development.
As the FIFA World Cup reaches its final stages, developers in the Ruby community are building and sharing open-source Ruby and Rails applications to track matches, analyze stats, and celebrate the tournament.
The simplest way to make a page collaborative with Hotwire and Rails is to subscribe to changes and broadcast a refresh when models update. However, this approach can introduce latency. Explore the refresh approach, the problems it causes, and how to fix them.
In this episode of the podcast, hosts Sally Hall and Aji Slater take a listener suggestion to Muppet-cast a software development team. They discuss which Muppets would fit best as content designers, QA engineers, and who gets to play the human.
An exploration of how to define a loop in Ruby that cannot be escaped, even when using break, return, or raise. The post demonstrates how Ruby's flexible syntax and exception handling can be pushed to its absolute limits.
An official announcement for the release of Ruby 4.0.6, a routine update containing bugfixes. The official release schedule aims for stable updates every two months, with Ruby 4.0.7 planned for September and 4.0.8 for November.
Inertia is like Turbolinks with one twist: it renders JSON instead of HTML on the second visit. Rebuild the entire protocol on a real Rails app with a 50-line client and a 16-line server, then audit what the official gem adds on top.
As AI agents commoditize the execution of code, software craftsmanship is shifting. Reflecting on the "happy coder" mentality heavily evangelized by the Rails community, this article explores how the value of development moves from writing syntax to directing autonomous machines and exercising taste.
After identifying a valuable AI opportunity, learn which AI features Rails teams should build first and why simpler solutions often deliver more value at scale.
Tim Riley joins Jared on the Dead Code podcast to discuss the evolution of the Ruby ecosystem, Hanami, Dry-rb, and the long-term sustainability of open-source software development.
A Brighton Ruby conference talk exploring internationalization in Rails, demonstrating how the i18n framework remains incredibly useful even when you are not translating your application into other languages.
Nothing to report. Even Matz takes a day off.
An exploration of how Rails applications use send for dynamic dispatch. By analyzing real-world code, we can recover dispatch tables and rewrite dynamic calls into static case statements, allowing ahead-of-time compilers to optimize what normally defeats whole-program resolution.
An analysis of running the lobste.rs benchmark against transpiled Ruby, comparing its performance to Rails. While the transpiled code achieves 3.03× the throughput of Rails on identical hardware, a deep dive into the profiler reveals why this multiple differs from smaller applications.
The official RubyGems team has released version 4.0.16 of both RubyGems and Bundler. This release includes bug fixes for BSD make and Windows paths, alongside enhancements like installing Bundler 4.0.16 as a default gem and adding PQC support to the fetcher.
A weekly roundup of recent changes in the Rails codebase, featuring the addition of the Date.this_quarter? helper and other updates from the development team.
Marking twenty years of full-time work on JRuby and two years of independent funding through Headius Enterprises, this is a perfect time to return to RubyConf 2026 and showcase what JRuby can do for modern Rubyists.
The latest issue of the Awesome Ruby newsletter features a deep dive into reverse-engineering the BIGF archive format using Ruby, alongside a curated collection of the week's best Ruby and Rails articles, tools, and library updates.
A guide on using drop-in configuration files in Linux to manage services and applications cleanly. This approach helps Ruby developers maintain modular, version-controlled server configurations without modifying default upstream files.
A look at implementing a flexible helper to manage feature access and upsell UI in Rails. The helper wraps content to hide it, redirect, or render a partial when access is denied, offering an elegant API that integrates seamlessly with your views.
Learn how to self-host traces, metrics, and logs using OpenTelemetry to set up an open-source APM for Rails without relying on third-party vendors, allowing you to maintain full control over your data.
An exploration of floating-point arithmetic in Ruby, explaining why (2.0 - 1.1) == 0.9 evaluates to false. Discover why this behavior is not a bug and why the official Ruby issue tracker still references a classic 1991 computer science paper to explain it.
This week's newsletter highlights a major new design for RubyGems.org featuring light and dark modes, an official ParadeDB gem for full-text search in ActiveRecord, and progress on getting Mastodon running on Spinel, Matz's ahead-of-time Ruby compiler.
The latest release of Hotwire Native brings lazy loading tabs, UISearchTab support, Large Titles, custom error views, and a variety of bug fixes to the mobile framework.
In this podcast episode, Kyle D'Oliveira joins the show to discuss his journey with Rails, building creative side projects, and the unique challenges of managing complex logic in web applications.
Robby Russell joins the Scaling DevTools podcast to discuss how Oh My Zsh evolved from a simple configuration shared among coworkers into a widely used open-source developer tool. The conversation covers its origins, the introduction of themes and plugins, and early developer tool design.
In this fourth episode of the Ruby Stained Glass Notes newsletter, the focus shifts to the physical tools used in the process of building a custom stained glass panel celebrating the Ruby programming language.
A small team at GitLab shares how they used AI agents to migrate part of their legacy rate-limiting system to a unified implementation in labkit-ruby. Discover how they structured the work, what worked, and how the loop and observability mattered more than the agents.
GitLab has released security patches and bug fixes for versions 19.1.2, 19.0.4, and 18.11.7. These updates resolve several critical vulnerabilities and regressions in the Ruby-based DevOps platform. Immediate upgrade is highly recommended for self-hosted instances.
An exploration of the risks associated with relying on a single developer to maintain your Rails application, and why providing them with external support or backup is crucial for long-term project health.
A detailed roadmap to compile and run Mastodon using Spinel by the end of 2026. The plan focuses on decomposing the application into subsystems, starting with a highly memory-efficient replacement for the Node.js streaming server, alongside upstream Rails fixes and compiler improvements.
Fullscript is sponsoring the Relax Lounge at RubyConf this year. The Ruby community has given us a lot, not just the tools we build on, but the people and community who have shaped how we work.
In this podcast episode, Joël Quenneville and Sally Hall discuss the different ways to interpret the role of a principal or staff engineer. They explore career progression, staff archetypes, and the importance of having principal engineers involved in AI discussions.
Rails 7.1 deprecated secrets.yml in favor of encrypted credentials. Learn why this change happened and follow a step-by-step guide to migrate your application safely.
A tiny Sidekiq middleware that requeues jobs whose class is not loaded yet, preventing NameError exceptions during rolling deploys. Includes a detailed look at how the middleware works under the hood.
A look at how tracking flow in Rails applications enables static N+1 query detection and request tracerouting. By analyzing which actions assign instance variables and feed templates, this static analysis tool finds bugs without booting the application or running tests.
The Rails Foundation is looking for two Ruby User Group organizers to MC Rails World this year. If you are already hosting monthly community events, this is an opportunity to bring that energy to the big stage.
Passenger 6.1.7 has been released. This update addresses an ABI break in EL9 (RHEL, Rocky, and Alma) Nginx packages to ensure compatibility for Ruby deployments.
An introduction to Spinel Cooperative, a new developer-owned consultancy founded by long-time Ruby and Bundler contributor André Arko. Learn about the mission, the team, and the philosophy behind this new cooperative venture.
Hanami 3.0 has been released. This major version brings new mailers, built-in internationalization, Minitest support, and significant performance improvements to make your web applications much faster.
An exploration into Roundhouse's capabilities by analyzing the entire Mastodon codebase directly in the browser. This web-based IDE provides type inference, auto-completion, and static analysis, revealing performance insights and paving the way for future features like static N+1 query detection.
A look at turning a Claude skill audit report into a labeled, severity-tiered GitHub backlog, including what the skill discovered when run against a small Rails 8 application.
A video episode exploring how to create Claude slash commands. These can be useful when dealing with complicated tasks or trying to extract specific information from a Rails application.
All quiet on the Ruby front.
An exploration of observability in LLM applications. While traditional error logs fall short, tracing allows you to monitor, reason about, and understand the internal state of your system purely by examining its outputs.
An exploration of the continuous role of being a custodian for AI agents. The process involves extending coverage, overruling verdicts, and deciding how truth is computed by referencing a live Rails application rather than authored test cases.
Modern applications rarely consume external data exactly as it arrives. Whether integrating with payment gateways, CRMs, or third-party APIs, incoming payloads must be normalized, enriched, or reshaped. Explore how to safely and efficiently handle these transformation layers within Ruby and Rails workflows.
An anonymous community member has generously donated their RubyConf 2026 ticket to help another developer attend. Ruby Central is using this opportunity to match the donation, offering additional tickets to those who need financial assistance to join the conference.
A weekly roundup of recent changes in the Rails codebase, featuring the introduction of ProxyLogger, new MIME deprecations, and various bug fixes.
The Rails Foundation, in partnership with Chris Oliver, has released the final installment of its comprehensive tutorial series. This guide completes the step-by-step journey of building a modern e-commerce application, focusing on implementing product reviews.
The latest issue of the Awesome Ruby newsletter features a deep dive into why polymorphic types are not foreign keys in Rails, alongside a curated collection of the week's best Ruby tutorials, tools, and community discussions.
A guide to building a custom changelog widget using Perron, a Rails-based static site generator. Learn how to use its production-ready custom elements to fetch JSON data, render lists, and track read states without relying on third-party services.
Teams adopting Bundler 4 can breathe a little easier. After several weeks of community reports and investigation, the remaining compatibility issues between Dependabot and Bundler 4 have now been addressed through merged fixes in dependabot-core.
This issue of the Ruby Weekly newsletter highlights what active Rubyists at RubyKaigi are using, including strong Ruby 4.0 adoption and VS Code dominance. It also features updates on the Rails Community Survey and the release of Hanami 3.0.
Extralite 3.0.0, a fast SQLite wrapper for Ruby, has been released. This major update introduces object graph transforms, transitions to modern defaults for opening SQLite databases, and includes a minor security enhancement. It offers a lightweight, high-performance alternative to traditional ORMs.
A security vulnerability in the WEBrick library (up to version 1.9.2) allows request smuggling. The server incorrectly reparses trailer Content-Length headers into the canonical request state.
Starting in version 11.8.0, the Heroku CLI improves security by storing authentication credentials in the system keychain by default. The new credential manager utilizes OS-native secure storage tools designed for sensitive data while maintaining compatibility with existing developer workflows.
Server-Sent Events (SSE) allow a server to push real-time data to a client over a long-lived HTTP connection. This guide explores implementing SSE in Ruby using Rack 3 middleware and htmx on the frontend, complete with a quick-start demo.
A podcast episode featuring Markus Schirp discussing the mutant gem and mutation testing. As AI-generated code becomes more common, mutation testing offers a powerful way to verify code integrity and ensure test suites are truly effective.
A neglected test suite costs more than you think, leading to incidents and delayed releases that pull focus from growth. Learn how to approach test suite optimization as an organizational strategy to improve development velocity.
An exploration of how objects collaborate in Ruby applications using behavioral design patterns. While creational and structural patterns focus on object creation and organization, behavioral patterns define how responsibilities are distributed and managed between collaborating objects.
GitLab has released patch version 18.8.11 to resolve several regressions and bugs. This release contains important bug fixes for the DevSecOps platform, which is built on Rails. Upgrading is highly recommended for self-managed instances.
A security advisory for the pay gem. The Paddle Billing webhook signature verifier uses a non-constant-time string comparison, exposing a timing side-channel vulnerability. The recommended mitigation is upgrading to use a secure comparison primitive like ActiveSupport::SecurityUtils.secure_compare.
Hanami 3.0 has been released, introducing integrated mailers, internationalization, and Minitest support. This milestone version also brings performance improvements, faster defaults, and a sharper developer experience spanning logs to assets.
A podcast episode discussing the establishment of thoughtbot's AI Ethics Taskforce. Guests Tess Griffin and Jimmy Thigpen join host Aji Slater to explore the company's stance on AI ethics, workflows, and how these developments impact their clients.
An official stable release of Ruby 3.4.10 is now available. This package update includes a version bump for the bundled net-imap gem to v0.5.15, which addresses several security vulnerabilities.
A comprehensive reference table mapping the compatibility between Sidekiq and Rails versions. Useful for planning upgrades and identifying the latest supported versions for your application stack.
A practical guide to AI-driven scraping at scale, exploring how to use LLMs to generate CSS selectors across hundreds of partner sites. It covers why first-attempt selectors often fail and the validation loops required to make the system reliable.
A security vulnerability in the Ruby json gem (versions 2.9.0 through 2.19.8) can cause a heap buffer overflow when streaming to an IO object. This issue, which can lead to a reliable process crash or denial of service, is fixed in version 2.19.9.
Bibliographic Wilderness
An introduction to setting up Claude Code, Anthropic's command-line AI assistant, within a Ruby development environment on macOS. Learn how to configure the tool to work seamlessly with chruby and run RSpec tests.
An exploration of how Ruby changes the way developers think about design patterns. This second part covers modern creational and structural patterns, leveraging features like duck typing, modules, blocks, and delegation to replace the ceremony required in more rigid languages.
A comparison of Plain, an open-source specification language where code is regenerated from prose, with the philosophy of using Rails as a running reference. While Plain relies on probabilistic tests, a Rails app can run immediately, serving as its own oracle.
An exploration of the rising ladder of software abstraction, where frameworks evolve into whole-app compilers and full-stack engines. It examines how building these tools has shifted from requiring funded institutions to a single developer in an afternoon, while navigating the boundaries of essential complexity.
The latest release of the Passenger application server updates the Nginx version used in Passenger Standalone and addresses an ABI compatibility break in RHEL, Rocky, and Alma Linux Nginx packages.
A migration of content to a new homepage powered by the Bridgetown static site generator. The redesign lays the groundwork for future interactive Ruby storybooks and inline REPLs to host major programming talks.
The third issue of the Ruby Stained Glass Notes pop-up newsletter, which documents the process of building a stained glass panel celebrating the Ruby programming language. This edition shares design drawings and seeks community feedback on square versus freeform versions.
This week's Rails roundup covers a variety of fixes, including RFC 9110 Accept headers, dotenv configuration parsing, association edge cases, caller-owned state, and ongoing improvements to Ractor safety.
A security advisory for Fluentd reveals a Server-Side Request Forgery (SSRF) vulnerability in the out_http plugin. If placeholder values like ${tag} are derived from untrusted input, attackers can force the node to send HTTP requests to arbitrary internal services.
A security advisory for Fluentd reveals a vulnerability where the inhttp and inforward plugins fail to limit decompressed data size. Attackers can exploit this with a gzip decompression bomb, causing memory exhaustion and a Denial of Service (DoS) crash.
A security advisory for Fluentd reveals that the Monitor Agent plugin (inmonitoragent) unintentionally exposes internal instance variables of loaded plugins via its REST API. This vulnerability could allow unauthorized access to sensitive credentials like database passwords or API keys.
A critical vulnerability in Fluentd allows remote code execution via arbitrary file write. Insufficient validation of the ${tag} placeholder enables path traversal attacks, allowing attackers to overwrite critical system files when receiving logs from untrusted sources.
Roundhouse infers types across a Rails application to compile it to nine languages. The same engine that resolves Rails metaprogramming to emit Rust can answer editor or agent questions with no annotations, app boot, or running server. It is static, deep, annotation-free, and fast enough to run on every keystroke.
The latest issue of the Awesome Ruby newsletter features RubyLLM, a single Ruby framework designed for integrating with all major AI providers, alongside the week's best Ruby and Rails links, tools, and tutorials.
beam_up is a command-line tool and Ruby gem designed to simplify deploying static sites to various providers like AWS S3, Netlify, and Hetzner. It can be run directly from the terminal or integrated directly into Ruby scripts.
Issue 806 of the Ruby Weekly newsletter features an experiment compiling a Rails app to a tiny binary using Spinel, Matz's AOT Ruby compiler, and the Roundhouse compiler. Other highlights include JRuby performance experiments and a proposal for parallel sweeping in Ruby's garbage collector.
A security vulnerability in the Crass CSS parser library. When the :preserve_comments option is disabled, an attacker can provide a stylesheet with a large number of adjacent comments to cause excessive recursion, triggering a SystemStackError and potential denial of service.
A security advisory for the Crass CSS parser gem. Inefficiencies in tracking multi-byte character positions when parsing non-ASCII characters can result in superlinear parsing time, allowing attacker-controlled inputs to cause excessive CPU consumption and potential denial of service.
A security vulnerability in the crass gem allows remote attackers to cause a denial of service via CPU and memory exhaustion. Applications parsing attacker-controlled CSS strings with scientific notation can crash due to unbounded exponentiation before clamping to Float::MAX.
A security advisory for the Crass gem. The parser recursively processes CSS simple blocks and functions without a depth guard, allowing attacker-controlled values with deeply nested blocks to trigger a SystemStackError or cause excessive memory usage.
A vulnerability in the fluent-plugin-opentelemetry gem allows for a Denial of Service attack via memory exhaustion. The in_opentelemetry HTTP input lacks strict size limits, enabling attackers to send large or highly compressed payloads that can crash the Fluentd process.
A security advisory for fluent-plugin-s3 where the in_s3 input plugin is vulnerable to a Denial of Service attack via memory exhaustion. An attacker with upload permissions to the monitored S3 bucket can upload a decompression bomb, causing Fluentd to crash.
Attendees who purchase a ticket for RubyConf 2026 before July 1st will be entered into a raffle to win an exclusive VIP experience. Five randomly selected winners will receive a ticket for themselves and a guest to the conference.
Heading to RubyConf this July? Meet the team from SmartFinancial, a technology-driven insurance marketplace helping people compare insurance options. They are actively hiring and looking to connect with the community at the conference.
Meet the team from SmartFinancial at RubyConf. As a technology-driven insurance marketplace helping users compare insurance options, they are actively hiring and looking to connect with the Ruby community during the conference.
In this podcast episode, Jeremy Smith joins the show to discuss the return of the Blue Ridge Ruby conference in 2026, sharing insights on how the event went and the experience of bringing the community together.
Writing effective test cases is as important as writing business logic. A look at simple yet effective practices developers can use to avoid common testing mistakes and improve the quality of their test suites.
While Dependabot is typically associated with Rails applications, Ruby itself relies on it to automate dependency updates. A look into how the MRI interpreter configures Dependabot offers an interesting glimpse into the core team's workflow.
An official release announcement for RubyGems 4.0.15 and Bundler 4.0.15. This update includes memory usage optimizations for full index loading, PQC support for Gem::Request, and Git LFS resolution fixes.
GitLab has released patch versions 19.1.1, 19.0.3, and 18.11.6 for both GitLab Community Edition and Enterprise Edition. These updates resolve several regressions and bugs identified in recent releases.
Getting acquired is exciting, but the technical story of your acquisition unfolds after the deal closes. A guide to navigating the technical transitions, code audits, and handovers that follow the acquisition of a Rails application.
An exploration of the parallels between the historical skepticism surrounding extreme programming practices like TDD and today's doubts about the viability of AI-driven agentic coding.
In this podcast episode, Joël Quenneville and Aji Slater discuss graph and tree structures, their connection to connected data, and the challenges of serializing them to a database. The discussion also highlights related presentations from Blue Ridge Ruby and Ruby Internals.
A look at refactoring Rails applications to remove unnecessary ActiveJob wrappers from recurring.yml in Solid Queue. By calling class methods directly via the command option, you can reduce boilerplate code while maintaining the same scheduled behavior.
A comprehensive compatibility table mapping JRuby and Rails versions, including the supported Ruby language levels and required Java versions for each release.
An introduction to Procman, a process manager written in Rust. It features a terminal user interface to view and manage services defined in a Procfile, offering a lightweight alternative to tools like Foreman for Rails developers.
A look at Procman, an alternative to Foreman for running Procfile-based applications. It addresses common local development pain points in Rails, such as mixed process outputs and the inability to use interactive debuggers within subprocesses.
A security vulnerability in YARD's static cache lookup allows reading raw traversal paths before router sanitization. When configured with a document root, a path like /../yard-cache-secret.html can return sibling .html files outside the intended static tree, presenting a confidentiality risk.
A security vulnerability in the websocket-driver library can cause a WebSocket server to crash when receiving a malformed Host header. A URI::InvalidURIError exception is raised and uncaught, leading to a denial of service if the application does not handle the error.
Upgrading a Ruby application is rarely as simple as changing the version number. Dependencies, deployment pipelines, CI environments, and legacy code often turn runtime upgrades into major projects. Explore how Ruby Next can help teams adopt newer Ruby features gradually.
The official Rails blog has announced the speaker lineup for the fourth edition of Rails World, taking place in Austin, Texas. Discover the speakers and sessions scheduled for this year's conference.
An exploration of how legacy modernization assessments are shifting from narrative reports to scored diagnoses. Discover how to structure the first 30 days of a modernization project, leverage AI for discovery, and provide leadership with actionable, rated findings.
A look at streamlining engineering support rotations by using Claude to analyze production logs. Instead of manually piecing together log data, leveraging LLMs can significantly speed up debugging and ticket resolution.
An exploration of test-driven development in Rails using mostly the default testing stack. This new book, now available as an early release on Leanpub, offers a practical approach to building reliable Rails applications from the ground up.
Roundhouse features three browser demos resembling previous Ruby2JS showcases. However, underneath lies a typed cross-compiler instead of a heuristic Ruby-to-JS transpiler. In the playground, hovering over any expression reveals its type, inferred by tracing back through the view, controller, model, and schema.
A look at how Roundhouse and Spinel, two independent Ruby compilers, now work together end-to-end. This integration allows an arbitrary Rails application to be lowered to a Ruby subset and compiled directly into a standalone native binary.
A regular status update and newsletter from Hanami core team member Tim Riley, focusing on his recent open-source work, clearing out pending tasks, and progress within the Hanami and dry-rb ecosystems.
For years, Rails developers have enjoyed a simple and productive way to build web applications by writing HTML with ERB and letting Action View render templates. This piece explores how Herb and ReActionView might shape the future of rendering in Rails.
A security advisory for Nokogiri details a low-severity invalid memory read vulnerability in CRuby when calling Nokogiri::XML::Node#initializecopywith_args with an invalid argument type. The issue is resolved in Nokogiri 1.19.4 by raising a TypeError.
AtomicReference#update Livelocks on Float::NAN
A security vulnerability in the concurrent-ruby gem causes AtomicReference#update to enter a permanent busy retry loop when the stored value is Float::NAN. This occurs because Float::NAN == Float::NAN is always false, potentially leading to CPU exhaustion and denial of service.
A security vulnerability in concurrent-ruby allows Concurrent::ReentrantReadWriteLock to incorrectly grant a write lock after a thread acquires a read lock 32,768 times. This overflow breaks the core mutual-exclusion guarantee, allowing concurrent read and write access and potential data races.
A security vulnerability in concurrent-ruby affects Concurrent::ReadWriteLock. The #releasewritelock method fails to verify the calling thread, allowing any thread to release an active write lock. Additionally, #releasereadlock can corrupt the shared counter, potentially breaking mutual exclusion or rendering locks unusable.
A security advisory for the Oj gem. Oj.load in :object mode reads uninitialized stack memory when parsing a JSON object with a key of 254 bytes or longer, potentially disclosing process stack memory. This vulnerability is fixed in version 3.17.3.
A security advisory for the Oj gem details a stack-based buffer overflow vulnerability in Oj.dump. When a large :indent value is provided, memset can write up to 2 GB into a stack-allocated buffer, corrupting the stack and crashing the process.
A security advisory for the Oj JSON parsing gem. A stack buffer overflow vulnerability in Oj::Doc#each_child allows a denial of service attack via deeply nested input. This issue is resolved in version 3.17.3, which adds proper bounds-checking.
A security vulnerability in Faraday's default nested query parameter encoder, NestedParamsEncoder, allows uncontrolled recursion. A crafted query string can cause a SystemStackError and crash the calling Ruby thread, leading to a denial of service.
A security advisory for Alchemy CMS reveals that the unauthenticated GET /api/pages/nested endpoint leaks the full page tree to anonymous callers. This includes restricted and unpublished pages, bypassing access controls and potentially exposing sensitive element and ingredient content.
A security vulnerability in Nokogiri's Nokogiri::XML::NodeSet#[] (and #slice) allows a potential out-of-bounds read via a large negative index, potentially crashing the process on CRuby. Users are advised to upgrade to Nokogiri 1.19.4 or later.
Document#encoding= Raises an Exception
A security advisory for Nokogiri details a low-severity use-after-free vulnerability in the CRuby implementation. Passing an invalid encoding to Document#encoding= can leave the document referencing freed memory, potentially causing a segfault. Users should upgrade to Nokogiri 1.19.4 or later.
A security advisory for Nokogiri on JRuby, where the NONET parse option was not correctly enforced. This allowed external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. The issue is resolved in Nokogiri 1.19.4.
A security advisory for Nokogiri details a low-severity null pointer dereference bug when calling methods on allocated-but-uninitialized native wrapper classes. The issue, which can crash the process, is fixed in Nokogiri 1.19.4. JRuby is unaffected.
A security advisory for Nokogiri details a possible use-after-free vulnerability when directly using Nokogiri::XML::XPathContext beyond its document lifetime. This low-severity issue affects CRuby implementations and is resolved in Nokogiri 1.19.4.
Nokogiri::XML::Attr#value= or #content=
A security advisory for Nokogiri details a possible use-after-free vulnerability in its CRuby native extension. Replacing an XML attribute value could leave a Ruby wrapper pointing to freed memory, potentially causing a segfault. This low-severity issue is fixed in Nokogiri 1.19.4.
A security advisory for Nokogiri details a possible use-after-free vulnerability in XInclude processing. Affecting only CRuby, the issue occurs when Nokogiri::XML::Node#do_xinclude frees nodes still referenced by Ruby objects. The vulnerability is resolved in Nokogiri 1.19.4.
Document#root= to an Invalid Node Type
A security advisory for Nokogiri details a possible heap use-after-free vulnerability when setting Document#root= to an invalid node type. This memory-safety issue affects the CRuby implementation and is resolved in Nokogiri 1.19.4 by raising a TypeError for non-element nodes.
A weekly roundup of the latest updates, bug fixes, and community contributions in the Rails ecosystem.
The latest issue of the Awesome Ruby newsletter explores the influence of Lisp on Ruby's design, alongside a curated collection of the week's best Ruby and Rails links, tools, and tutorials.
Learn how to use Bun's standalone binary to compile Rails assets, eliminating the need to install Node.js and manage multiple version managers for a faster, simpler setup.
Learn how to build a simple, reusable Stimulus controller to create an interactive before-and-after image slider. This lightweight solution uses a wrapper, two images, and a draggable slider handle with dynamic clipping.
Learn how to build a simple, reusable Stimulus controller to create an interactive before-and-after image slider. Using just a wrapper, two images, and a slider handle, this lightweight solution dynamically clips the images as you drag.
Artificial intelligence has become an indispensable tool for Ruby developers, assisting with writing methods, refactoring services, and generating RSpec tests. However, despite the release of Ruby 4.0, AI assistants often remain stuck writing older Ruby 3.0 code.
Brighton Ruby 2026 is just two weeks away. Members of the Thoughtbot team will be attending and speaking at the event, offering a great opportunity to connect and discuss Ruby development.
This issue of the Ruby Weekly newsletter highlights a progress update on rv, a fast Ruby installer and project manager inspired by Python's uv. It also features a retrospective on scaling Rails to handle a peak load of 41 million requests per hour.
An exploration of code organization and modularity in Ruby, focusing on Syntropy, a new web framework utilizing file-based routing. It compares this file-based approach to the global autoloading mechanism used by Rails and Zeitwerk.
After necessary discussions regarding governance, sustainability, and accountability, this year's RubyConf shifts the focus toward the future. Discover how the community is coming together to shape the next chapter of Ruby and Ruby Central.
Ruby Central shifts its focus from past discussions on governance and sustainability toward the future of the community. This upcoming RubyConf aims to kick off a new chapter, centering conversations on what lies ahead for the Ruby ecosystem.
A collaboration between JetBrains and LinkedIn allows developers to easily showcase their IDE expertise. This integration helps highlight the workflows, debugging skills, and hands-on experience built up using RubyMine and other JetBrains tools directly on professional profiles.
In this podcast episode, Travis Dockter discusses the ups and downs of organizing Blastoff Rails, a brand-new Rails conference, and the journey of creating a community event closer to home.
Ruby Central is launching a brand new site. Sign up to stay up to date and receive email updates as soon as new content and announcements are published.
Ruby Central is launching a brand new site. Sign up to stay up to date and receive email updates as soon as new content and announcements are published.
A security vulnerability in Katello's ContentUploadsController allows authenticated users with edit_products permissions to query content information for unauthorized repositories. This flaw exposes cross-product content existence but does not allow unauthorized modification, import, or publication of content.
A critical missing authorization vulnerability in the Avo admin panel framework allows low-privileged users to bypass attach controls. By sending a crafted POST request, users can manipulate associations, potentially leading to privilege escalation and cross-tenant data exposure.
In this podcast episode, hosts Sally Hall and Aji Slater discuss the productivity apps they use to streamline their workflows and manage task lists. The conversation covers Notion calendar integration, using Jira for personal organization, and the benefits of Alfred for developers with ADHD.
A response to Brandon Weaver's 'Callbacks Are Not Invariants' article, focusing on ActiveRecord and Rails callbacks. The discussion explores where business invariants should live, arguing that ingress points are not the correct place, using pure ActiveRecord reasoning to make the case.
The release candidate for Hanami 3.0 is feature-complete and ready for testing. Key updates in this major release include built-in i18n support, integrated mailers with SMTP delivery, and a new hanami-minitest gem for first-class Minitest support.
A guide on setting up local parallel testing in Rails using the turbo_tests gem. Learn how to configure worker-specific databases and automate database preparation to significantly speed up your RSpec test suites.
An exploration of techniques to speed up test verification and shorten feedback loops. Key improvements include optimizing Docker build caching to reduce startup times and immediately addressing flaky specs rather than deferring them.
All quiet on the Ruby front.