Rubyland

Thinking of applying to next year's RubyConf Scholars and Guides program? Read on to hear from this year's Scholars about what it was like and why you should take the leap and apply!

Name:

Shuveksha Tuladhar

Professional Title:

Software Developer Apprentice

How did you get into Ruby? What's your Ruby story?

I started learning Ruby and Ruby on Rails through Code the Dream as part of my journey into software development. I enjoyed learning Ruby so much that it quickly became my natural language.

Are there any Ruby projects you're working on that you're excited about? Tell us all about it!

I am currently working on several Ruby projects, both at work and through personal projects. Ruby has become a…

I released kamal-backup 1.0 today.

Not because the backup command works. That part worked months ago.

I called it 1.0 because I used it to move Chat with Work, the application that pays my bills, to a new Hetzner instance. The old host took the backup. The new host restored it under a temporary hostname. I opened the real application, checked the real data and files, and only then moved DNS.

A backup is only real after you restore it.

The migration that made 1.0

The move found two bugs that a green backup log never could.

First, a fresh backup accessory on the new host could start its schedule before the restore and write a perfectly valid, completely empty snapshot into the same…

RubyLLM 2.0 is almost ready. It isn’t out yet, but it will be soon, and I have been looking forward to showing you what is in it.

There is a lot in this release. Too much for one enormous announcement, and most of it deserves more than a bullet point. So this is the first in a series of posts about what’s coming in RubyLLM 2.0.

Let’s start with providers and protocols.

In 2.0, OpenAI uses the Responses API by default. Providers and protocols are separate things. Four new providers bring the total to seventeen. And if the provider you need is still missing, a new generator gives you a complete provider gem to start from.

RubyLLM.chat(model: 'gpt-5.4')                              #…

A table with 200 rows and 5 action icons per row. That’s 1,000 inline SVGs dropped into your HTML. When does that start to impact your performance?

By default, Rails Icons renders each icon as a full <svg> element. Fine for a handful of icons. But at scale, it adds up.

I built a simple benchmark to measure exactly how much (feel free to fork and improve ❤️). Two pages, identical layout, 1,000 icons each. One uses inline SVGs you use and love. The other uses an SVG sprite you will surely start to love after reading this. 😬

The benchmark is on GitHub.

How SVG sprites work

A SVG sprite is a single file (but can also be embedded) with multiple icon definitions wrapped in <symbol> tags:

<svg…

As of last week, I’ve been working at Fat Zebra for 5 years. (To celebrate, I caught up with my cardiologist.) In about a year and a half, it’ll be double the amount of time that I’ve worked anywhere else. So I think that has to count for something in both Fat Zebra’s favour and my own.

This week I was given some big news:

1. The powers that be want to restructure my team
2. This means the Tech Lead of Customer Experience role is now redundant
3. BUT! I’ve received an offer to go work as an individual contributor in a different, very cool team
4. Bonus: no pay cut.

Ironically, I was wearing my “This is actually my second rodeo” t-shirt while I received my second ever redundancy offer. But…

Two vulnerabilities have been discovered in the resolv gem bundled with Ruby. They have been assigned the CVE identifiers CVE-2026-80212 and CVE-2026-80213. We recommend upgrading the resolv gem.

CVE-2026-80212: Memory exhaustion through malicious DNS responses

An application that resolves a hostname an attacker can influence, such as a webhook target or a user-supplied URL, can be made to consume memory without bound. The attacker points a domain at a name server they control and returns responses that the library retains permanently. Repeated lookups grow the process until it runs out of memory and the service stops.

CVE-2026-80213: Hostname validation bypass

An application that…

A Portland high school student asked our CEO how this all started. Here's the short version, plus what we're up to now.

Continue Reading

I joined Chris on The Hallway Track to talk about running Box Out Sports, Fireside, and Flipper while still maintaining open source projects like HTTParty.

We covered a lot of ground in 50 minutes: why I gave up trying to focus, the production problem that led to Flipper, how feature flags change the way teams build software, and why taste might be the real advantage in the AI era.

Some of the highlights:

Giving Up on Focus. I spent years feeling like I was broken because I couldn’t focus on one thing. Everyone tells you focus is how you do something big and great, but I like having a lot of things going. If I get jammed on one project, I can switch to the next most important thing on…

The SF Ruby Startup Conference is an engineers' conference: meet the people building Ruby open source, scaling Rails in production, and shaping what agentic Rails looks like next.

It's the "SF Ruby Startup Conference", but let's make something clear up front: this is a conference for engineers. The program is built for people who write and read Ruby, and founders are coming here to see those people. The lineup goes from seed-stage founders to the engineers keeping Shopify's monolith up. But the community…

Local Ruby communities don’t simply happen—they need people willing to create the connections that keep them alive.

David sits down with Chicago Ruby co-organizers Anton Tkachov and Michelle Yuen to talk about rebuilding and growing a local Ruby meetup. Anton breaks a meetup down into three essential pieces (attendees, speakers, and venues) and explains why, if you’re starting from scratch, the community itself matters more than anything else. He and Michelle share practical lessons from finding companies willing to host events, recruiting speakers, and creating opportunities for Rubyists to meet one another face-to-face.

That kind of personal connection may be more valuable than…

[Translator's note: buffet dining is often referred to as バイキング ("Viking") in Japan. Here's why.]

Over the past 15 years, Japan had gradually improved the accuracy and quality of English language signs and guidance. This is despite a precipitous drop in domestic English language proficiency. Rather, Engrish began to disappear from all but the most far flung corners of the country thanks to the proliferation of fully remote, easy-to-contract human translation services.

However, thanks to the mainstreaming of LLM chatbots and the weakening of the yen, businesses have opted to save time and money by asking Gemini and ChatGPT ("Chappie") to translate sentences and images out of context. As…

I was trying to describe what working on code with AI while *all this* [waves vaguely] is going on. What came to mind is: imagine spending a couple years in the desert learning to harness petroleum to power tractors and cranes. Then you visit the big city, and everyone is putting crude oil in their hair and on their pizza and using it for sex.

Chris Oliver asked on LinkedIn:

Spotted this in the Rails source today. The trailing comma made me think it was a typo at first glance but it uses the $, global variable for nil instead of nil directly. Anyone know the reason for this?

I left a comment there, but I wanted to preserve it here as well:

There is no “global variable for nil”. $, is the “output field separator”. Known as OFS in AWK, it is known shorthand-mnemonically as $, in both Perl and Ruby – the mnemonic being that “comma” is a very common output field separator (think: comma-separated values). The default value of “nil” simply means “no separator”. But setting it to something else can be quite useful!

Fo…

Our Rails AI assistant had read-only SQL access and could still return peer review scores. Learn how we kept open-ended analytics in an in-app AI assistant while making database access honor application permissions.

Our internal Rails app has an AI assistant with read-only SQL access to the database. But when asked for active peer review assignments, it returned written feedback, scores, and a column of reviewer names the question never mentioned. Read-only protected data from being changed, but it told us nothing about who was allowed to read…

It’s common to see a Rails app using React to handle front-end interactions, with a Redux store that mostly mirrors the database and react-router re-declaring routes Rails already knows about. React does its job well enough, but every user-facing feature now costs twice, once in Ruby and once in JavaScript.

So eventually the question will appear: what would it take to delete all of this and use a Rails-way solution like Hotwire? The honest answer is “it depends.” In this article, we will go through what the code difference actually looks like, what you can expect from bundle size, which pain points to plan for, and how to scope the work before committing to it.

The code difference

Crea…

Another week, another step for Agents on Rails. This one is a big one: lemans, the harness behind every number we’ve published, is now open source. We also ran four new models: Sonnet 5, Terra, an open-weight Qwen you can run on your own machine, and one that won’t tell us its name.

If you’re here for the ride, read on for the tour of lemans. If you’re here for the scores, they’re on the leaderboard, and the raw runs are updated too.

Four new models, and one of them has no name

Qwen 3.8-27B is the one we (and many of you) were most curious about: it’s open weight and small enough to run on hardware you may already own. Should you ditch your cloud LLM subscriptions and go #supportlocal?…

A support team suspends 37 accounts after a credential leak. The operation reports that all 27 rows changed, and a fresh query confirms that each account is now suspended.

The rest of the application tells a less tidy story. The audit screen has no suspension entries. updated_at still points to work performed hours earlier. Code that loaded the same accounts before the operation continues to see them as active.

Those are operational differences, not cosmetic ones. The missing audit row leaves the incident timeline incomplete, while an authorization check that reuses one of those loaded objects can still make a decision from active after the database has suspended the account.

Nothing raised,…

Hi, it’s Claudio Baccigalupo. Let’s explore this week’s changes in the Rails codebase.

Add –no-banner to bin/rails console
I love seeing the Rails logo when I run the console. If you disagree, bin/rails console --no-banner will remove it for you.

Add support for the HTTP QUERY method
ActionDispatch::Request gets the RFC10008 constant appended to HTTP_METHODS, plus a query? predicate.

Keep the relation scope in Relation#update
update and update! now respect the scope of the Active Record Relation. This is a breaking change: relation.update(ids, …) called with an id outside the relation used to update the record and now raises RecordNotFound.

Join an Array accept in file_field_tag
Passing…

Ernesto Tagwerker joins Chris, Andrew, and David, to talk about how AI is changing Rails development, consulting, and the way teams approach upgrades and maintenance. They discuss using Claude Code for Rails upgrades, the risks of relying too heavily on AI-generated tests and code, and why strong development standards are becoming even more important. The conversation also explores code quality, open AI models, team consistency, and how developers can use AI to work more efficiently without giving up the experience and judgment that good software still requires. Start listening now! 

Links

• Chris Oliver X
• Andrew Mason Bluesky
• David Hill LinkedIn
• Judoscale- Remote Ruby listener gift
• Ernesto…

Here at FastRuby.io we work with test suites and test coverage reports every single day, given our specialty. In the Ruby world that means we interact with SimpleCov every day. Not only that, we explicitely rely on SimpleCov reports in two of the open source projects we maintain, RubyCritic and Skunk.

Which is why, after more than a decade at 0.x, we were super excited to see SimpleCov ship its first stable release on July 12, 2026. In this article we’d like to share the details on the breaking changes, the deprecations and how to address them, if you’re impacted by them.

Everything below refers only to the 1.0.0 entry in the changelog.

Also, it’s worth noting that the minimum required…

The Scholars & Guides Program is one of Ruby Central's most direct expressions of what this community is built on. The program pairs aspiring Rubyists from underrepresented communities with experienced mentors, called Guides, to help them navigate RubyConf, grow as developers, and find their footing in a community that genuinely wants to see them thrive.

Rubyists know by heart: Matz is nice and so we are nice, or MINASWAN. It flows directly from the philosophy Yukihiro "Matz" Matsumoto embedded into Ruby itself. Ruby exists to make developers as productive as possible, and that productivity is only possible when the community surrounding it keeps bringing in fresh minds, new perspectives,…

Ever wondered how to build those interactive product tours that spotlight elements and walk users through your app? Ever wondered how you could with just roughly 100 lines of JS and modern CSS? Wonder now more, I will show and it will look like this:

Yes, just around 100 LoC 🤯

I built one using CSS Anchor Positioning and a Stimulus controller. The approach uses two techniques worth talking about: a clip-path spotlight effect (useful in all sorts of contexts) and CSS anchor positioning for the dialog (still very new as of mid-2026).

The full code, as always, is on GitHub.

The clip-path trick

The overlay covers the viewport with a semi-transparent background. But instead of sitting on top…

A Bag of Bolts

So, a few weeks ago, I went to the hardware store to buy some casters and the hardware to mount them to a couple of cabinets. To save a few bucks, I decided to buy the hardware from the bulk bins. But, as I began filling my bag, I quickly noticed that not every bolt in the bin was the same size. Most of the bolts matched the label. But, some had clearly been misplaced.

Having experienced what it is like to make 2 or 3 trips to the hardware store to finish a project, I decided to pad my quantities by 10%, to mitigate the risk that I would need to…

More and more code is written by a model. Tests still tell you it works. RuboCop still tells you it’s tidy. Nothing tells you it still follows your architecture.

I released ArchSpec 1.0 today. It’s an architecture linter for Ruby and Rails. You declare your components and boundaries in one file, and every change gets checked, whether a person or an agent wrote it.

This is part of my push towards making Ruby one of the best languages to build with AI. RubyLLM is one piece. Schematist is another. Making the default Rails job queue fiber-based is another.

People and AIs take shortcuts

An agent or a person that’s in a hurry or doesn’t fully understand your architecture takes shortcuts.

The…

RubyGems 4.0.19 includes enhancements, bug fixes and documentation and Bundler 4.0.19 includes enhancements, bug fixes and documentation.

To update to the latest RubyGems you can run:

gem update --system [--pre]

To update to the latest Bundler you can run:

gem install bundler [--pre]
bundle update --bundler=4.0.19

RubyGems Release Notes

Enhancements:

• Reject SafeMarshal collection lengths longer than the remaining input. Pull request #9756 by hsbt
• Installs bundler 4.0.19 as a default gem.

Bug fixes:

• Fix gem uninstall –user-install crash when GEM_HOME does not exist. Pull request #9749 by hsbt

Documentation:

• Document SPDX license handling for license= and licenses=.…

Some parts of the book went way over my head, but I read it and re-read it. I wrote my first Shoes app, my first camping app¹. This led me to attend my first conference and user group, my first Chaos Communication Congress, join my first open-source project, start my first podcast, and organize my own CoderDojo. I made friends for life through all of that. And _why‘s whimsical book lit that fire². That‘s why I have a quote from him on my about page that I try to follow and sometimes do.

Today is _why day. „On 19 August 2009, _why’s accounts on Twitter and GitHub and his personally maintained websites went offline.“. Someone doxxed the person behind the artistic figure, so the artistic…

Halunke

In 2018, I invented and…

In my previous post, AI Assistant for Our Blog Writing Process, I introduced the assistant we built to help with our blog writing. It has two pieces: an MCP (Model Context Protocol) server that holds the source of truth for our two blogs, and a Claude Code plugin that turns that information into workflows for suggesting topics, planning a post, drafting it and reviewing it.

That post was about deciding what to build. This one is about building it. We’ll go through the ingestion pipeline that gets our posts into a database, the embeddings that make the corpus searchable by meaning, the MCP server that exposes all of it, and the plugin that packages the workflows on top.

The stack

The…

Rails boot time is a DX metric in the AI age: meet require-profiler, learn to actually read sampling profilers, and see the pit stop that cut a 200-component monolith's boot by 40%.

Every Rails app race starts the same: load code, read config, then the green flag. But the bigger the app, the more startup drags on deploys, CI, and developer patience. This is doubly so as AI agents boot your app far more often than humans do. Thus, meet require-profiler, a new one-stop profiler for Ruby's code loading process! Grab it first when optimizing…

Welcome to week two of our 2026 sponsorship drive!

Progress from week one

We’ve had a great response since we kicked things off last week: we’ve had ten new individuals join as sponsors! If everyone sticks around for a year (we’ll make it worthwhile, I promise!), that will amount to a full $2,400 towards our goal.

Thank you to our new supporters for proving there’s power in numbers!

We’d love to see more individuals get behind us, and if we can find 2-3 new businesses to join as supporters, we’ll get very close to being able to offer a first-time honorarium to our active maintainers. Learn more here.

Q&A with Pat

As a little treat this year, we’re bringing you Q&As from leading Hanakai…

Sometimes the best conference conversations start with a weird idea.

Rachael Wright-Munn and Andy Andrea join me to revisit a moment at RubyConf when Andy's experiment with schemas and MCP tools collided with a problem Rachel had been trying to solve for Ruby Events: how to make Rails generators easily accessible to AI.

What started as an excited post-talk conversation quickly became an in-person pair programming session, and eventually working MCP tooling that Rachel now uses to maintain Ruby Events. The result has reduced some event updates from more than an hour of manual work to roughly 10–15 minutes.

They dig into how MCP tools work, why wrapping deterministic Rails…

Earlier this summer, I heard from Ojal Kulkarni, a local high school student who found Planet Argon through the Portland Startup Community Slack. Her summer project was interviewing local business owners and entrepreneurs.

We’d never met before, but a few weeks later we spent an hour on a Saturday morning talking about how Planet Argon got started, what I’ve learned from running a business for 24 years, and how AI is changing the way I think about software and experimentation.

One part I especially enjoyed was revisiting how I learned to build software in the first place. I wasn’t trying to become a programmer. I wanted to sell stickers on the internet, so I kept learning whatever I…

Version 6.2.0 of the Passenger application server has been released. This release addresses several NGINX vulnerabilities for deployments utilizing the bundled NGINX server (CVE-2026-42533, CVE-2026-60005, CVE-2026-56434) and one in Passenger itself with a pending CVE number. Additionally this release improves compatibility with FreeBSD.

Passenger Vulnerability

We have seen exploitation of this vulnerability in the wild at a shared hosting provider. Please upgrade as soon as possible, especially users that run Passenger as root and allow untrusted users to run arbitrary processes (i.e. multi-tenant deployments) are susceptible to attack.

If you do not run Passenger as root and your systems do…

Joanna Wang is a senior software engineer at Sixfold, where the team builds AI underwriting tools that help insurance companies gather data and assess risk. She came to Ruby on Rails after working across Java, Go, Python, and Node.

Robby and Joanna get into why the homegrown orchestration they built on state machines and callbacks turned brittle, what moving to Hatchet changed, and the tradeoffs of leaning on a gem that is no longer maintained. They also talk about what happened when the team went fully agentic, and why Rails magic is easier to understand when an agent can trace it for you.

Links:

• Sixfold
• Hatchet

Listen to this episode (43m) or subscribe to On Rails in your podcast…

When I first started thinking about private gem distribution, I approached the problem the way I always do, backward from bundle install. What does a developer need to make that command succeed for a private library? Three things: a source (URL or repo), credentials that work in CI and locally, and a reliable way to receive updates without breaking deployments.

Not all code belongs on RubyGems.org, and that’s okay. Sometimes the goal is internal reuse- sharing an SDK or auth client across services. Sometimes it’s a business model: you ship a private gem behind a license. Either way, the constraints are the same: authentication, delivery, and trust.

In this blog post, we’ll give an…

Way back in 2008 I started a site to track military reading lists. I needed something for searching, and I was most familiar with Sphinx, so, that's what I used.

Sphinx served me well over the last 18 years. But it runs as a separate process, and it felt like overkill to have an additional architectural component since I only have about 3000 books in the database. And PostgreSQL has a perfectly good full-text-search capability with a nice Ruby integration in pg_search. So, time to make the switch!

This article from Daniela Baron was really helpful on how to make the cutover. She was spot-on with her explaination of how calculating vectors on the fly just is too …

Last week we launched Agents on Rails and published the first benchmark report. The response was immediate: suggestions, questions, model requests, and more than a few “but have you tried…” messages. We love the enthusiasm! We want this benchmark to be useful to you, so for this run we added four new models, updated the insights, and uploaded the full traces of the first two rounds (every command, diff, and verdict).

Read on for the new results, check the updated leaderboard, or go straight to the raw runs.

But first: effort levels

We got asked this a lot and it is written in the methodology, but in case you missed it: All models were run at their provider’s default effort level.

Four…

I’m thrilled to be part of the program for Rocky Mountain Ruby 2026 in Boulder, Colorado.

I’ll be speaking about…LLMs? I hope you can join us!

InstiLLMent of Successful Practices in an Agentic World 🔗

Congrats on joining Hours Unlimited. The Math and Numbers team is excited to have you join us on our journey to redefine the importance of numerals. This introductory session will provide tips and tricks for best interacting with powerfuLLMachine, the next-level platform we use to unlock productivity and effectiveness.

Why some of us are still bothered about the way we write tests and what the “matcher” concept has to do with it.

During most of my Ruby career, I was that unpleasant person who honestly enjoys writing tests and is frequently concerned about the ways we write them.

This means treating unit tests like the rest of the codebase: like something that is supposed to be read by humans and something that should be written efficiently and expressively. Basically, like something that wouldn’t be boring and disgusting to read and write.

This also means that I find it useful, once in a while, to stop and reflect on why we write test code the way we write it. And can this be improved?

Let’s move…

A new account reaches the job queue before it reaches the rest of the database.

That sounds impossible the first time you see it. The account has an ID. The request log contains a successful INSERT. Yet a worker starting at almost the same moment raises ActiveRecord::RecordNotFound, and retrying the job a second later usually works.

Callbacks let an application react to persistence without putting every consequence in a controller or service object:

• before_validation

• after_validation

• before_save

• after_save

• after_commit

Read from top to bottom, this looks like one lifecycle with after_commit at the far end. For a save that opens and closes its own transaction, that picture is close enough. It breaks…

The ruby-enum gem is a small library I maintain that adds enum-like behavior to a class via include Ruby::Enum and define :KEY, value. Four pull requests landed against it recently, each fixing a different symptom, and all four turned out to be the same underlying bug: class-level instance variables set in a module’s included hook are not inherited by subclasses the way you might expect. All of these fixes shipped in ruby-enum 1.2.0.

Ruby::Enum stores its keys and values in instance variables on the class itself, set up when the module is included.

def self.included(base)
  base.extend ClassMethods
  base.instance_variable_set(:@_enum_hash, {})
  base.instance_variable_set(:@_enums_by_val…

This works fine for a single class. It gets interesting the moment subclasses or class reloading show…

My previous post walked through four bugs in ruby-enum, a gem I maintain, all stemming from the fact that class-level instance variables aren’t inherited by subclasses. The third fix, #59, made keys, key?, value?, key, value, to_h, parse and each walk up superclass and merge in a parent’s enums, so a subclass would see everything its ancestors defined. It was correct, fully tested, and shipped. It also made every one of those methods roughly 5x slower on any subclass.

def _enum_hash
  if superclass < Ruby::Enum
    superclass.send(:_enum_hash).merge(_own_enum_hash)
  else
    _own_enum_hash
  end
end

This recomputes the merged hash, walking the entire ancestor chain, on every single…

If your team uses Claude to draft client-facing copy, documents, or images, you have probably seen some version of the news by now: Anthropic announced that Claude’s output will carry an imperceptible watermark in text and signed provenance metadata in files, worldwide, as its implementation of the EU AI Act’s Article 50 transparency rules. A lot of comments and interpretations have followed: detectors can now catch your AI-assisted content, you can strip the watermark out if you find the hidden characters, your clients can trace a document back to you.

Most of that is wrong, and the loudest claim, that every Claude output is already watermarked, happens to be the easiest one to check. So…

In this episode, Chris, Andrew, and David dig into their latest experiences building with Claude, from massive diffs and unnecessary view specs to the challenge of catching subtle mistakes in AI-generated code. Andrew shares what went into launching Podia’s new Shop experience, Chris breaks down a serious Rails Active Storage security vulnerability, and David earns a developer rite of passage by accidentally bringing production to its knees. Along the way, they talk Redis 6, smarter Active Record queries, testing philosophy, and why sometimes the fastest solution is still jumping into the code yourself. Hit download now to hear more! 

Links

• Chris Oliver X
• Andrew Mason Bluesky
• David Hill LinkedIn
…

Hi, Wojtek here. Let’s explore this week’s news in the Rails.

Agents on Rails
Read the announcement and the first benchmark report.

Add support for the HTTP QUERY method
QUERY is a safe and idempotent HTTP method that conveys the query in the request content, making it suitable for queries too large or structured for a URL query string:

# config/routes.rb
query "search", to: "search#index"
match "filter", to: "search#filter", via: :query

# request handling
request.query?                # => true
request.request_method_symbol # => :query

# integration tests
query "/search", params: { filters: { status: "active" } }, as: :json

Show bin/console startup banner based on IRB
Show a…

A mature app's history has to survive the feature being built (and AI can't do that on its own!).

Continue Reading

Thinking of applying to next year's RubyConf Scholars and Guides program? Read on to hear from this year's Scholars about what it was like and why you should take the leap and apply!

Name:

KJ Loving

Professional Title:

Junior Developer

How did you get into Ruby? What's your Ruby story?

I got into Ruby through Code the Dream and learned on The Odin Project curriculum. I had zero background in programming but I wanted to try the backend program because it seemed a bit intimidating to me. I quickly found a loving, kind and supportive community. I couldn't have picked a better place to land.

Are there any Ruby projects you're working on that you're excited about? Tell us all about it!

Too many to list,…

Docker has made it easy to use the same environment everywhere, from development to production. But the most basic Dockerfile, where all your dependencies are lumped together in one image, has hidden costs. In this article, we’ll learn the advantages of multi-stage Dockerfiles both from a security and a performance standpoint, primarily for production images.

What is a Multi-Stage Dockerfile?

You might have a Dockerfile in your application that looks something like this:

FROM ruby:3.2

WORKDIR /app

# Install system dependencies needed to compile native gems
RUN apt-get update && apt-get install -y \
    gcc \
    make \
    libpq-dev

# Install gems
COPY Gemfile Gemfile.lock ./
RUN bu…

This is a typical single-stage setup. There’s one base image, for…

Today we’re sharing the first results of Agents on Rails, a new, ongoing initiative to measure how well today’s leading agentic coding tools (both frontier and open-weight) actually perform on Ruby on Rails codebases.

The Rails Foundation commissioned Evil Martians for this project, which will roll out in several stages over the next few weeks.

Read more about the project below, check out the leaderboard, or jump right over to the first benchmark report.

Why we built this.

The use of coding agents has skyrocketed in the past year with nearly every developer or team using AI to write code. But the options are overwhelming, with new models dropping nearly every week. The cost of running…

TL;DR

We ran 8 models against 21 atomic Rails tasks, 3 runs each. Every task runs against Writebook: a bug report, a security finding, a feature request, each written the way you’d actually file it. Read our announcement post for more information about the project.

So, as of August 2026, which model is best?

• Most accurate: Claude Opus 5, 92% of runs solved (58 of 63)^*.
• Cheapest: GPT-5.6 Luna, 73% at its default medium reasoning effort, and all 63 of its runs cost 91 cents combined. Not a typo.
• Fastest: Luna again, at a median of 3.3 minutes per run task.
• Best combination of all three: GPT-5.6 Sol: 84%, about $0.52 and five minutes per run.

^* Claude Fable 5 might lead with…

Something I must confess is that I absolutely hate writing these blog posts. It’s not quite as bad as having to give a conference talk, but it’s up there on the list of activities that feel like pulling teeth to me. Not that I’m not proud of the result. I absolutely am. But the process of writing them is very painful for me. It’s particularly true of the very first sentence, as the post progresses, it gets a bit easier

Yet, I force myself to do it, because it helps me think about problems, and “compile” knowledge in my head. I’m so terrified of posting something wrong or inaccurate that I tend to double-check some long-held assumptions, dig into more details about how some things are…

The eleven-shade color scale from Tailwind CSS is one of those ideas I keep stealing. You know the one: 50 through 950 gives you enough stops for backgrounds, borders, hover states, text, everything. I use it even when I’m not using Tailwind.

But I almost never use the defaults (your site/app ends up looking like every other site built by LLMs).

The fix is not complicated. You don’t need a color theory degree or a five-color palette generator (you know the ones 🥹). You only need two or three color scales, and you can derive them all from a single value.

How to choose your brand hue

Rule of thumb: pick a color that fits the problem, not your personal taste (I like pink but not use it all…

Beyond travel_to: The Block-Scoped State Pattern Hidden in Rails Testing August 12, 2026 Rails developers often use travel_to without thinking much about how it works. travel_to Time.zone.parse("2026-08-12 10:00") do # Test code runs as if it were 10:00 end The API is simple: change the perceived time, run some code, and automatically return to the … Continue reading Beyond travel_to: The Block-Scoped State Pattern Hidden in Rails Testing →

How to publish agent skills so any AI coding agent can find and install them: the .well-known/agent-skills/index.json discovery index, SHA-256 integrity digests, single-file vs multi-file vs bundle packaging, and every install command. Worked from the catalog we just open-sourced.

Two posts ago, an AI startup found us because Claude, which recommended Evil Martians when they asked for a senior dev agency. One post ago, we measured the traffic behind that. Over two months, coding agents read evilmartians.com more than twice as often as people did: 268,000 agent…

Maintaining an organizational knowledge graph with an LLM and event sourcing

Organizations are surprisingly good at forgetting.
Decisions are made on calls, insights get buried in Slack threads, and a month later no one remembers why things are the way they are.

Arkency is no exception.
Weekly calls, ad-hoc meetings, our book clubs, Slack discussions, GitHub mentions, email inbox - we could use some support in organizing all those signals.

Then Ruby Community Conference 2026 happened in March.
In Kraków, Obie Fernandez showed some parts of his NEXUS system.
He had already described it on his blog back in January, but the conference was where I first came across it.
That was the push I…

When it was…

Yet again instead of tweets, a blog post. The backlog got out of hand - 40 of them this time.

Usual caveat: every number below is whatever the author measured on their own machine with their own workload. Some are microbenchmarks. Don't compare them against each other, and don't assume they'll show up in your app. Click through if you care about methodology.

byroot is still speedrunning Ruby and Rails

Jean Boussier shows up often enough that he gets a section instead of bullets scattered through the post.

• Make Monitor a core class - giving it access to Ruby's internal routines strips out a chunk of overhead. Monitor#synchronize goes from about 19.8M to 23.7M calls a second; a plain Mutex…

Andy Kroll joins the podcast to talk about Brighton Ruby, the impact AI is having on software development, and how the changing technology landscape is affecting everything from conference budgets to engineering teams.

Andy shares how tools like Claude Code have changed his day-to-day work, making previously neglected projects more achievable while putting even more emphasis on code review, judgment, and maintaining a sustainable Rails application. They also dig into one of the harder questions created by AI: how do you interview software engineers when take-home coding exercises and traditional technical tests are increasingly easy to hand off to a model?

Andy explains how…

The slack-ruby-client library, an open source Ruby gem I maintain, runs a scheduled GitHub Actions workflow that regenerates code from Slack’s API definitions and opens a pull request with the diff. The commit message and CHANGELOG entry used to be a generic “Update API (2026-08-11)”, which told a reviewer nothing about what actually changed. Here’s how we taught the workflow to describe its own diffs, using GitHub Copilot CLI, which open source maintainers can get for free.

The Idea

The workflow already computes a diff before opening the pull request. Instead of a boilerplate commit message, we pipe that diff through an LLM and ask it to summarize what changed, then use the response as…

Fall is shaping up to be a busy season for thoughtbot. Over the next two months, thoughtbotters are speaking, attending, and hosting events across six cities on two continents. If you’re nearby, come find us.

XO Ruby Vancouver, August 15, Vancouver, Canada

XO Ruby Vancouver kicks things off. Fernando Perales will be speaking on “The Ruby Guide to Responsible LLM Integration,” a talk about the production challenges of wiring large language models into Ruby applications: malformed input, data leaks, prompt injection, outages, and rate limits, and the patterns that keep things stable once real users start hitting them.

EuRuKo 2026, September 16-18, Brno, Czech Republic …

Are you treating your users fairly? They could be stuck in the queue while a greedy user monopolizes resources. And you might not even know it! In this post, you’ll see if it’s time for you to take background job prioritization seriously, and how to make it fair for all users.

Are you treating your users fairly? They could be stuck in the queue while a greedy user monopolizes resources. And you might not even know it! In this post, you’ll see if it’s time for you to take background job prioritization seriously, and how to make it fair for all users.

This is part of an ongoing series of Ruby Runway Spotlights, celebrating the founders who took part in the inaugural Ruby Runway Showcase at RubyConf 2026. Each spotlight is a chance to hear directly from the builders turning Ruby into real, live businesses, and to cheer them on as they keep going.

Tell us your name, your startup, and what it does in one or two sentences.

Stowzilla is your personal warehouse service. Know what you have, and get value from the things you no longer need.

What problem are you solving, and who feels it most? How does your Ruby-powered solution change things for them?

We're solving the problem of getting valuable stuff to people who can use it, and giving space back…

The following is one of those posts where I share some concrete memories/experiences that I associate with some musings, but otherwise doesn’t really have a strong point other than I want to write it down.

When I worked at Code for America, I helped design and deliver two different technical interviews.

The first interview, which I feel confident I can take credit for wholly, was security related. Me, the interviewer, would first have the candidate read about Cross Domain Referer Leakage, and then we’d talk about it:

• How would you summarize the vulnerability in your own words?
• Describe to me a scenario for how an attacker would exploit this.
• Can you think of…

I want to make Ruby the best language to work with LLMs. Part of that is a great JSON Schema DSL.

Schematist is a general purpose JSON Schema DSL that emits Draft 2020-12 schemas. Describe an API payload, a config file, a contract between two services, or the structured output you want back from a model. Trapping that inside another gem’s namespace was a disservice to anyone looking for a great JSON Schema DSL, so it got its own name.

gem 'schematist'

It Emits Actual JSON Schema

This is the breaking change.

to_json_schema used to return this:

{ name: "PersonSchema", description: nil, schema: { type: "object", ... }, strict: true }

That’s not a JSON Schema. It’s OpenAI’s response_fo…

It’s been a whole year since we ran our first sponsorship drive. We’ve been hard at work since then: we shipped Hanami 2.3, unified our ecosystem and launched Hanakai (plus this beautiful new site!), and shipped Hanami 3.0, our most complete release ever. (If you want to catch up on more behind this, hear me on the Dead Code podcast.)

Thanks to our sponsors’ financial support, I’ve been able to maintain at least one full working day on Hanakai every week over the last year. This has been crucial for achieving all of the above. It’s an honour to spend this time serving our community, and a privilege I don’t take lightly. This is why I also spent the last year writing weeknotes, to make our…

Things move fast. Almost daily, we stop doing some basic routine and automate it instead. Engineers aren’t coding anymore, just prompting. PMs tell the AI what the feature is about, and an agent writes the ticket. On plenty of teams a bot now reviews the pull request an agent opened, which makes everyone else a spectator of a conversation between two AIs.

This isn’t just a personal habit shifting. It has a name. Philosopher Avigail Ferdman calls it deskilling, and in her 2025 paper “AI deskilling is a structural problem”[1], she argues something important: this isn’t a matter of individual willpower. Expecting people to resist convenient automation and cultivate their capacities on their…

This week, Anthropic shipped a new messaging feature to Claude Code. It sounds innocuous enough:

Cross-session messaging lets Claude deliver a message from one of your Claude Code sessions to another. When a change in one session breaks what another is building on, Claude can warn that session before you notice. When one session settles a question another is blocked on, Claude can send the answer across.

And because I sometimes have multiple agents working in the same project simultaneously, it didn't take long for them to start coordinating behind my back so as to avoid interfering with each other's work:

Also, another Claude session (working on performance rugs) pinged mid-turn; I told…

Ractors have been experimental for years, but things are changing fast. Last year, a team of four on the Shopify Ruby Infrastructure team tackled Ractor scalability, performance, and stability. Ractors are now viable in production, and Ruby 4.1 will make them even better.

It’s time for Rails to embrace them.

In this post, we’ll explain why: what Ractors unlock for Rails applications, and the first milestone we’re aiming for in the framework.

First, a refresher

A Ractor, or Ruby Actor, brings true multi-core parallelism to Ruby. If you aren’t familiar with CRuby internals, you might expect Threads to already provide this — but they don’t, because of the Global VM Lock (GVL). Threads…

When we think about Ruby code coverage, our go-to gem for this is SimpleCov, which works great when the test suite uses Minitest, RSpec, Cucumber, Capybara, and all these tools that are integrated with Ruby and Rails. But many applications also use other tools like Playwright or Cypress to run e2e tests, and we can’t use SimpleCov the same way.

Most of the time, what we have seen is that the Ruby code executed when running these tools ends up left behind and not being counted for the total code coverage, even though we know the code is actually being tested.

Sample Application

To make it easier to try this, we created a sample application that uses the cypress-on-rails gem along with…

AI Adoption Is More About Culture Than Tools

A few weeks ago, we sat down with a potential client for a project kickoff conversation. The goal was to find out how we could help them integrate AI into their company. Their whole team joined the call, about 15 people, and within the first ten minutes, it was clear everyone had a different idea of what “using AI” meant to them.

One person wanted an easier way to schedule meetings. Another wanted AI to summarize call notes. A few wanted to search through years of client history. Some of what people described, honestly, was closer to plain automation than a need for artificial intelligence. More than a few people in the room were hesitant to…

The problem with our old setup

PDF generation is a core part of Gusto’s business. To serve our customers, we generate reports, invoices, tax documents, employee handbooks, and more. Many of these features relied on a now-deprecated library: wkhtmltopdf.

That reliance had become a liability. Maintenance on the library had stopped, which meant no more security patches. It rendered HTML using WebKit, an engine that had drifted away from how modern browsers display the same markup, so our PDFs didn’t always come out the way we expected. And because PDF generation is memory-intensive by nature, it put pressure on the other services it shared resources with.

Why build a new service?

We decided to…

I love Ruby and it is my goto scripting language. Even in the age of AI, I like to write short custom scripts for my tool arsenal. One way to find subdomains of a potential hacking target is to initiate a DNS zone transfer. You can use various shell tools for this, but if it is part of a process(my case), it might be easier and more flexible to just script it in Ruby. I decided to use the dnsruby gem to save some work, otherwise I would need to do a TCP connection to the nameservers myself. For the sake of demonstration, I converted my script into a command line one, that will accept 2 parameters, the host and an optional IP address of a nameserver:

The method

This process applies the scientific method to a defect. The six phases are the steps of that method. They carry the names a developer uses.

Scientific method       Phase                      You produce
-----------------       -----                      -----------
Build the apparatus     1. Build a feedback loop   one command that goes red on this bug
Observe under control   2. Reproduce and minimise  a minimal case that repeats
State the hypotheses    3. Write the hypotheses    3 to 5 ranked causes, each with a prediction
Run the experiment      4. Instrument              one probe per prediction, one variable at a time
Confirm the result      5. Fix and add a test      a…

If you need more context on why Rails needs a new leadership, here is David Celis summing it up a year ago, Paul Battley a few weeks ago, and—even though it is hard to believe—it even got worse since then.

How could a fork even work?

Rails is a huge code base and has multiple engineers who can invest significant work time into improving it. How could a few people fork and maintain it in their free time? Because Rails is done. Since I started to update The Rails 5 Way to Rails 6 (and then later 7 and 8), I’ve been monitoring the changes to Rails closely:

If you generate a Rails application with rails new --minimal, you only get the core parts of the framework (railties, actionpack,…

transaction is one of the few Active Record APIs that reads like a promise. Wrap the work in a block, and either all of it happens, or none of it does.

An account upgrade shows where the reading breaks:

Account.transaction do
  account.update!(plan: "growth")
  ProvisioningClient.enable_growth_features(account.external_id)
  AuditEvent.create!(account:, action: "plan_upgraded")
end

A validation added to the AuditEvent a week earlier rejects the new audit record, so create! raises ActiveRecord::RecordInvalid. The SQL log ends the way it should:

BEGIN
UPDATE "accounts" SET "plan" = 'growth' ...
INSERT INTO "audit_events" ...
ROLLBACK

The account row goes back to starter, so the ticket is closed as…

Direct link to podcast audio file

We cut our trip a day short, so I found myself with a totally free day with no plans. Naturally, I wasted it by recording a 3-hour podcast. Dang.

I always enjoy shooting the shit with/at you, and if you'd like to be a more active participant in the shit-shooting, then hit me up at podcast@searls.co. Really, I'll be nicer to you than I am to Sam Altman and Tang Tan. I promise.

Back to manually writing links. The zen of monotonous input tasks is suddenly something to be cherished in the current era.

• Mandibular Advancement Device
• Better With Becky
• Why doesn't the U.S. have small elevators like Europe and China? (News+)
• My 240hz gaming QD-OLED (and…
…

After Rails’ Dear Leader DHH once again espoused far-right views on his blog (which I’m not going to link to here), some of the Ruby community said “enough is enough” and decided to fork Rails into a project called Amiko. I don’t want to mince words here, so I’ll talk straight: I think this is a vain attempt at virtue signalling, and will ultimately end up achieving very little.

The Amiko project has started out this fork by renaming all the Rails things into Amiko flavoured things. They have amiko-pack, amiko-view, and so on. All the rails commands are now amiko commands. The structure of the framework remains the same, so far.

The momentum behind the Rails framework itself is monumental…