Rubyland

David Heinemeier Hansson is, for better or worse, still in charge of Ruby on Rails. I'd love to stop paying attention to him, but I build applications with Rails, so his actions affect me and my clients. Yesterday, he gave the opening keynote at Rails World 2026, where he laid out his vision for the future of Rails.

Or that's what his talk should have done. His keynote had very little to do with Rails. Here's what he did talk about, and what it means for Rails.

The Gist of It

I have retired from being a professional programmer.

Yes, he said that. No, that doesn't mean he's stepping away from software development. He now styles himself a "maker." He now claims that English is the best…

Have you ever written a type that you appreciated so much you still think about it? Like eating a really good meal, where if you try hard enough, you can still recall the taste in your mouth. I had a mini moment of Rust joy the other day and wanted to share the experience.

TLDR: I turned an enum with N variants into N types. Nothing earth-shattering, but it made my life better.

Specifically, std::path::Component is an enum that you can get from any std::path::Path reference. Where a path can be viewed as an iterator of components. To give you an example /tmp/hello is [Component::RootDir, Component::Normal("tmp"), Component::Normal("hello")]. This enum is very handy for…

Hi everyone,

I am happy to announce that Rails 7.2.4 has been released.

As stated in the maintenance policy, this is the last release of the 7.2.x series.

Security issues and bug fixes will only be provided for the 8.0.x and 8.1.x series.

CHANGES since 7.2.3

To see a summary of changes, please read the release on GitHub:

7.2.4 CHANGELOG To view the changes for each gem, please read the changelogs on GitHub:

• Action Cable CHANGELOG
• Action Mailbox CHANGELOG
• Action Mailer CHANGELOG
• Action Pack CHANGELOG
• Action Text CHANGELOG
• Action View CHANGELOG
• Active Job CHANGELOG
• Active Model CHANGELOG
• Active Record CHANGELOG
• Active Storage CHANGELOG
• Active Support CHANGELOG
• R…

Full listing

To see the full list of changes, check out all the commits on GitHub.

SHA-256

If you’d like to verify that your gem is the same as the one I’ve uploaded, please use these SHA-256 hashes.

Here are the…

On September 15, 2026, TypeSafe announced Jev, the first of what they call System One models. The launch came with a very low price, a lot of speed claims, and the promise that it “can’t hallucinate”. The obvious first question is whether this is just another Large Language Model (LLM) with a smaller bill.

It isn’t, and the reason is more interesting than the price. In this article, we’ll look at what Jev actually is, what it isn’t, and why that difference matters when you decide where AI belongs in your software.

A quick note on where this comes from: Jev launched in early access. This post is based on a careful reading of TypeSafe’s announcement and documentation, and I’ll point out the…

Hi everyone,

I am happy to announce that Rails 8.1.4 has been released.

CHANGES since 8.1.3

To see a summary of changes, please read the release on GitHub:

8.1.4 CHANGELOG To view the changes for each gem, please read the changelogs on GitHub:

• Action Cable CHANGELOG
• Action Mailbox CHANGELOG
• Action Mailer CHANGELOG
• Action Pack CHANGELOG
• Action Text CHANGELOG
• Action View CHANGELOG
• Active Job CHANGELOG
• Active Model CHANGELOG
• Active Record CHANGELOG
• Active Storage CHANGELOG
• Active Support CHANGELOG
• Railties CHANGELOG

Full listing

To see the full list of changes, check out all the commits on GitHub.

SHA-256

If you’d like to verify that your gem is the same as…

In his Rails World 2026 keynote DHH talks about one-shot apps built almost instantly with an agent as part of Omarchy. His canonical example is Omacalc, a dead simple calculator. It’s a good demo and not a hard problem. Let’s take it further and rewrite a more advanced calculator in Rust that we can also run as an MCP server, so an AI coding agent can outsource arithmetic to it instead of hallucinating a square root.

In 1994 I wrote an expression evaluator for a lab assignment. It grew into Expression Calculator, a shareware Windows app I sold through a company I co-founded, Vestris Inc. In 1997 it got pressed onto a CD-ROM and sold 3,000 copies in Germany under the name Global Calculator.…

This is the last article of a series where I introduce Attractive.js 1.0.0 (in pre-release now).

• Attractive.js 1.0.0: interactive HTML without one line of JavaScript
• Custom Actions in Attractive.js: one interface, from small to big

In this last article I want to highlight how Attractive can be a nice addition and in some cases a complete replacement for Hotwire.

I created a simple message board in Rails. No Stimulus anywhere, nor Turbo Streams. Check it out!

Most of the features of the is build one Attractive extension I intentionaly left out last week; Attract. It serves two purposes:

• intercept form request and send fetch instead (we know that technique!), and:
• work with attract JSON…

One partial, three…

I write a lot, and I use AI a lot. But AI does not write my blog posts. Mostly.

AI is useful for making some of my writing less tedious. Recently, I asked GitHub Copilot CLI to read a few dozen posts from this blog and derive a VOICE.md to assist my writing. The result is now checked into this repo and linked from AGENTS.md, so any AI agent working here gets the same reminder: this blog is authored by me, not by AI and the agent’s job is to help me rather than pretend to be me.

The useful and interesting part of VOICE.md was how it captured my weirdly specific patterns.

• Start with a real story, failure, command, bug, or piece of data.
• Say the opinion early.
• Provide examples, pull…

AI has made implementing and enforcing design systems cheaper than ever. At the cost of speed, this falls through the cracks. But agentic development makes good design system practice non-negotiable. Implement a design system and bring consistency to an existing project.

AI has made implementing and enforcing design systems cheaper than ever. Yet, at the cost of speed, this critical element falls through the cracks. But with agentic development, good design system practice is now non-negotiable. In this post, learn what to do in order to implement a…

Once a team stops trusting leaderboards, the next move is usually to build an evaluation of its own. We’ve argued before that benchmark scores are a poor predictor of production agent performance, and the natural follow-up question is what to measure instead.

Two answers come up almost every time, because they are the two cheapest evals to stand up. The first is a panel of LLM judges: ask several models whether an output is factually supported, and take the majority vote. The second is step-level grading: walk the agent’s trajectory one step at a time, score each step, and blame the first one that looks wrong. Neither needs labeled data, and both can be running by the end of the week.

Thr…

David is joined by Javier Cervantes, co-creator of the Ruby User Forum, to discuss the origins of the project and the need for a persistent gathering place for the Ruby community. After returning to Ruby following several years working with other technologies, Javier found an active ecosystem that was nevertheless scattered across newsletters, blogs, Slack communities, Discord servers, social networks, and individual open-source projects. That experience eventually led to the creation of the Ruby User Forum as a place where conversations can happen more slowly, remain searchable, and continue over days or weeks instead of disappearing into a chat history.

Javier shares what the…

Ruby 3.4.11 has been released. This is a regular scheduled update release includes bugfixes.

Please see the GitHub releases for further details.

Download

• https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.11.tar.gz

  SIZE: 22492449
  SHA1: ed687c91e79b20a755666adbc290695accd49d79
  SHA256: 5c22be44524312b3d433d68739bcc530633b1da5ef8ba0afa0a37680da17d3de
  SHA512: cb951af61fb237ddf3213f5efec893a50524216800359514baded26189a5aa1640cc83e344aedd001cc57c4479cfabcf20033be77c28401333f57f2ac13c6640
  

• https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.11.tar.xz

  SIZE: 16712500
  SHA1: c36b1142f3d45441edbe0bb9146ddda39b018065
  SHA256:…

ERB does not know that it is generating HTML. It finds the <% %> tags, evaluates the Ruby inside them, and concatenates everything else as plain text. Whether the result is valid markup has never been its problem.

Herb changes that. On August 25, 2026, the Ruby on Rails core team merged Add Herb as an HTML-aware ERB implementation, which brings in Herb, an ERB implementation that parses HTML and ERB into a single syntax tree and uses Prism for the Ruby inside the tags. Broken markup can now fail while the template compiles, instead of reaching a browser.

In this article, you will learn what Herb is, how to audit your own views with it today, what it can fix for you, what it cannot, and…

When we talk about building with AI, most of the attention goes to what’s new. Models, agent frameworks, protocols, and tools seem to appear every week, making it easy to assume that adopting AI means introducing an entirely new technology stack.

But Rails developers already have many of the building blocks needed to create useful AI-assisted workflows. Generators, Rake tasks, command-line interfaces, schemas, tests, and APIs were designed to make software easier to work with by providing structure and predictable behavior. Those same qualities make them well suited for AI coding tools.

In this context, an AI-assisted workflow doesn’t mean building an agent into a Rails application. It…

I’ve just released of Extralite version 3.1.0. This new release implements automatic caching of parametric queries, and updates the bundled SQLite to version 3.53.4.

Extralite is a fast and innovative SQLite wrapper for Ruby with a rich set of features. It provides multiple ways of retrieving data from SQLite databases, makes it possible to use SQLite databases in multi-threaded and multi-fibered Ruby apps, and includes a comprehensive set of tools for managing SQLite databases.

Automatic Query Caching

Extralite now automatically caches the underyling sqlite3_stmt object for any parametric query. Previously, when you ran the same SQL using Database#query_xxx with different parameters,…

The JRuby community is pleased to announce the release of JRuby 10.0.7.0.

• Homepage: https://www.jruby.org/
• Download: https://www.jruby.org/download

JRuby 10.0.x targets Ruby 3.4 compatibility.

Thank you to our contributors this release, you help keep JRuby moving forward! @aminmansuri, @evaniainbrooks, @gillesbergerp, @jwils, @kares, @lloeki

Notable Changes

Performance

• Fixed a regression in startup time on MacOS by properly loading native JNR subsystem. #9688, #9689
• Improve performance of autoloads overridden by an actual require. [#9677], #9675

Java Integration

• The location of the AppCDS JSA file can now be specified with JRUBY_JSA_HOME. #9667

Standard Library

Def…

The JRuby community is pleased to announce the release of JRuby 10.1.2.0.

• Homepage: https://www.jruby.org/
• Download: https://www.jruby.org/download

JRuby 10.1.x targets Ruby 4.0 compatibility.

Thank you to our contributors this release, you help keep JRuby moving forward! @aminmansuri, @drzaiusx11, @evaniainbrooks, @gillesbergerp, @jcharaoui, @jwils, @kares, @lloeki, @makenowjust, @nobu, @sampokuokkanen, @shugo

Notable Changes

Compatibility

• Multiple fixes for fibers and fiber scheduler support. #9604, #9607, #9622, #9645, #9649, #9656, #9660

Performance

• Fixed a regression in startup time on MacOS by properly loading native JNR subsystem. #9690
• Improve performance of…

In the Stage 2 report we shipped 20 feature tickets on Fizzy and promised to explore benchmarking the agents all on max-effort. Now we have run it: every model on the board, same tickets, reasoning turned all the way up. We also tested a new model: DeepSeek 4.1 Flash.

The short version:

• Effort matters, but only with some agents. GPT-6 Astra (already in first place) went from 35% to 53% success, GPT-5.6 Sol improved from 18% to 28%, and GPT-5.6 Luna performed much better: from 0% to 27% success. Claude, Gemini and Grok barely moved, and Gemini regressed. Muse doubled, from 10% to 20%.
• It costs. The max sweep cost about $4,100 across all models against $2,250 for the defaults, and runs…

Introduction

As products and engineering organizations grow, their API grows with them. New features get shipped, old design patterns coexist with new ones, and decisions that once felt obvious become harder to apply consistently across the entire organization.

At a small scale, maintaining a high-quality API is mostly a matter of shared taste and close collaboration between engineers. At a larger scale, it becomes a systems problem.

How can an organization keep API design consistent and high quality when dozens or hundreds of engineers are making schema changes across many distinct product domains? How do you make sure new APIs follow best practices? And just as importantly, how do you find…

The request fails with SolidQueue::Job::EnqueueError.

That sounds like a clean failure. The controller returned a 500, so the team expects the order transaction to have rolled back. Instead, the order is present in the primary database, the queue database contains no FulfillOrderJob, and retrying the request collides with the order’s uniqueness constraint.

The code responsible for both writes is short:

class FulfillOrderJob < ApplicationJob
  self.enqueue_after_transaction_commit = true

  def perform(order_id)
    # ...
  end
end

Order.transaction do
  order = Order.create!(checkout_token: params[:checkout_token])
  FulfillOrderJob.perform_later(order.id)
end

The exception did not roll back…

Back in January I wrote Serving Markdown for AI Agents: for every page on this blog, there’s also a .md version at the same URL, discoverable via a <link rel="alternate" type="text/markdown"> tag, so AI agents can fetch clean Markdown instead of parsing HTML. It also made me $360, via referral conversions an AI agent apparently generated after reading the clean Markdown version of a post.

That worked, but it lived in this repo as a one-off script, _scripts/render_markdown.rb, wired into the GitHub Actions deploy workflow (needed since GitHub Pages’ native build only allows a small allowlist of plugins, which jekyll-md isn’t on), with the <link> tags added by hand via Liquid and a markdow…

I’ve since extracted all of it into jekyll-md, a proper Jekyll…

EuRuKo happened this week in Brno and even though I was planning to be there, I didn’t go at the end, and I’d like to explain why.

I spent five and a half years at AWS before moving (back) to Microsoft, where I work today. At Amazon, many meetings began with silent reading. Instead of presenting a document, the author gave everyone time to read it before the discussion started.

There was a small facilitation trick that made this work surprisingly well: when reading began, everyone raised a hand. When someone finished, they lowered it. The meeting started with all hands up and counted down to zero.

At Microsoft, I found the inverse practice: everyone began with their hands down and raised one when they finished. At the time of writing this, you’ll find me hard at work changing the culture of raised hands at Microsoft,…

TERAZ - live collective ambient experience made with Rails & Tone.js

The first time TERAZ actually worked, there were around seventy phones in the audience at the wroclove.rb conference.

Before pressing start, I was still not completely sure what would happen. Local tests are one thing. Seventy people with their own phones, batteries, browsers, volume settings, operating systems, and expectations are another.

I was standing at my laptop, looking at a grid of rectangles on the screen, slowly bringing the instruments in. Each rectangle was one person from the audience. Each phone had been randomly assigned a part: bass, piano, crackling noise, angel pads, drone, or bells.

Then the room…

As we gear up for Rails World 2026 next week, we’re so grateful to the companies showing up to make the first Rails World in the US a great one.

Below you’ll find every company sponsoring Rails World, and what they are covering (because sponsorship involves so much more than just booths!)

But first, the best news

This year thanks to our Event Partner Shopify, we will livestream the Rails World Opening Keynote for the very first time.

DHH will lay out his most defining vision yet for what comes next for Rails, and what it means for all of us who build software with it. At this pivotal moment in technology, this is one not to miss.

Tune in early for a pre-opening chat hosted by Shopify’s …

RFC 10008, published in June 2026, defines the QUERY method as safe and idempotent like GET, and it carries its query in the request body like POST. Ruby on Rails merged support for QUERY on August 14, 2026, under the 8.2.0 milestone.

I set up a small application on edge Rails to check it working. The routing and the request object are ready, but the parts of the specification that make QUERY more than a POST with better manners are not quite there yet, since Rails parses only JSON bodies and does not enforce the content type rule RFC 10008 requires. In this article, we will check how the QUERY method works in Rails, how to route and test it, how Puma is handling it, and which pieces of…

A week of things that should just work: schema cache that loads in JSON, PostgreSQL names that resolve to one table, Active Storage that boots even when libvips is missing or too old, and Live responses that finally carry the default headers. Here’s what’s new in Rails:

Watch the Rails World 2026 Opening Keynote live
DHH’s opening keynote is streaming for anyone who can’t get to Austin. He’ll cover what’s new in Rails, what’s coming next, and where the framework is headed. Tune in at 9:30 AM Austin, 7:30 AM Pacific, 10:30 AM Eastern, 3:30 PM UK, 4:30 PM Central Europe, or 11:30 PM Japan. The livestream is made possible by Rails World Event Partner Shopify.

Active Record schema caches can…

Chris, Andrew, and David are back with a conversation that starts with Rails World plans. They break down APIs, webhooks, and persistent connections, using everything from thermostats to Stripe to explain how systems communicate and recover when things go wrong. From there, Chris shares what caught his eye in PlanetScale’s new Postgres sharding work, before the conversation shifts heavily toward AI-assisted programming, where the tools are surprisingly capable one minute and making baffling architectural decisions the next. They also explore how AI is changing Chris’s work on Jumpstart and Hatchbox, improving Rails actionable errors, tackling years-old Android bugs, and potentially…

This post was originally given as a talk at JJ Con 2026. The slides are also available.

Hello! Welcome to “beyond jj”, where we’re going to take a look at the jj ecosystem: commands, configurations, and tools made to work with jj. It’s partly a follow-up to my talk at JJCon last year, where I surveyed jj configurations across the community, but we’ll get there in a minute.

My practical qualifications to give a talk about jj basically come down to “I like trying new things, and I’m very excited about jj”. My impractical qualifications to give a talk about jj come down to “Steve Klabnik was my roommate once, so I can ask him to put my ideas into the official jj docs”. Thanks in advance,…

An open fascist is building one of the bigger sources of funding for open source fully under his individual control and sucks up a lot of money that otherwise might have gone to liberatory projects. Community projects. Antifascist projects.

tante: Power Grab

Collecting a payment sounds like a reasonably well-defined problem. A traveler pays for a booking, the payment succeeds, and the property manager receives the money.

Except that the property manager might only be entitled to part of it. The rest belongs to the owner. A booking channel might have already deducted its commission and collected a tax. The booking might include Travelers’ Fees or Cancellation Protection. And the bank transfer might cover twenty bookings, an adjustment to an older reservation, and a deduction that has nothing to do with any of them.

Suddenly, “the payment succeeded” tells us surprisingly little about what should happen next.

At Smily, we built the system that…

In last week’s announcement, I promised that when the built-in actions aren’t enough, you can write your own. Let me show you how, because this is what was bugging me most: why pull in another library when Attractive.js can do it as well?

Next to that I will also highlight some extra goodies and the bundled extensions that can now be (optionally) added.

Start with a one-liner

The quickest custom action is the js: prefix. It evaluates a JavaScript expression on the element, so you can do things too small for a full action:

<button @click="js:this.textContent=1">0 (I will become 1)</button>

Use it for one-liners only. It goes through the full action pipeline (so all events works as well as …

(Replace this first paragraph with a brief description of your new category. This guidance will appear in the category selection area, so try to keep it below 200 characters.)

Use the following paragraphs for a longer description, or to establish category guidelines or rules:

• Why should people use this category? What is it for?

• How exactly is this different than the other categories we already have?

• What should topics in this category generally contain?

• Do we need this category? Can we merge with another category, or subcategory?

In our last post on Ractors, Edouard demonstrated the potential benefits of using Ractors in a Rails application. He also explained how our team has been working towards making Rails and its dependencies Ractor-friendly. While we’ve been able to get smaller applications running on Ractors, we still have a long way to go to unlock larger applications, which use more features of Rails and many more gems. However, we have reached a good point where we can start to talk about the process itself.

In this post, I want to discuss some of the patterns we’ve used to refactor code to work with Ractors. But first, let’s talk about why any of this is necessary by looking at the constraints that…

Slava (slack-strava) connects a Strava account to a chat and posts a card for every activity, complete with map, pace, and elevation, plus commands like connect, disconnect, stats, and leaderboard. In 2023 I ported Slava to Discord by hand, evening by evening over about three weeks, and it took most of that stretch to get a working bot called Strada (discord-strava). This week I ported the same app to Microsoft Teams as Strata (teams-strava) in 3 days instead of the 3 weeks the Discord port took, using time carved out during the Microsoft Global Hackathon. By “I”, I mean GitHub Copilot CLI and I.

The 2023 Baseline

discord-strava’s git history is a fair record of how long a manual port…

Chris Oliver and Collin Jilbert join David for a candid conversation about the changing economics of building products for the Ruby on Rails community in the age of AI.

Chris traces the history of GoRails from its beginnings as an attempt to fill the void left by RailsCasts, through to the creation of Hatchbox and Jumpstart, and explains how those products evolved together over more than a decade. But the rapid improvement of AI coding assistants has dramatically changed how developers learn and work. Instead of searching for a tutorial, watching a screencast, and adapting an example to their application, developers can increasingly ask an AI tool to work directly inside their…

RubyGems 4.0.21 includes enhancements and Bundler 4.0.21 includes enhancements and bug fixes.

To update to the latest RubyGems you can run:

gem update --system [--pre]

To update to the latest Bundler you can run:

gem install bundler [--pre]
bundle update --bundler=4.0.21

RubyGems Release Notes

Enhancements:

• Stop vendoring resolv for two regexps. Pull request #9877 by Hiroshi SHIBATA
• Normalize absolute symlink targets during gem extraction. Pull request #9860 by Hiroshi SHIBATA
• Installs bundler 4.0.21 as a default gem.

Bundler Release Notes

Enhancements:

• Don’t update bundler to a prerelease unless asked for one. Pull request #9869 by Hiroshi SHIBATA
• Reject Bundler…

Bug fixes:

• Sup…

Introducing Rails Hyperdrive: a development-only Rails engine that gives AI coding agents live answers from your booted app and lets any gem in your bundle ship guidance gated to your Gemfile. Convention over configuration, applied to agent knowledge.

Every session, a coding agent meets your Rails app like a stranger. It reads the Gemfile, greps routes.rb, trusts a db/schema.rb that may lag behind the migrations, and guesses the rest from training data. This burns tokens before the first line of work, and these guesses cause bugs. We've measured…

The Bike Shed is BACK! Aji and Joel kick off this week’s episode with a fantastic combination of component bugs and how much headspace they take up, historic heraldry vs ChatGPT’S anchoring bias, before diving into the latest big development of the Dev world, Github’s release of stacked PR’s.

—

Read more about Joël’s adventure in Europe with ChatGPT, and how to structuring conditionals when working with multi-step forms.

Your hosts for this episode have been thoughtbot’s own Joël Quenneville and Aji Slater.

Don't forget you can now also watch the show over on our YouTube channel!

If you would like to support the show, head over to our GitHub page, or check out our website.

Go…

Ruby 4.0.7 has been released.

This is a routine update that includes bugfixes. Please see the GitHub releases for further details.

Release Schedule

We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent release. Ruby 4.0.8 will be released in November.

If a change arises that significantly affects users, a release may occur earlier than planned.

Download

• https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.7.tar.gz

  SIZE: 23937964
  SHA1: 730d4f8cebb60a1f5b556e7b58d86d0301772558
  SHA256: 911ace20f90d068ca0e4dda6d0e4f0f81e52e52f2dd4f4004c721e253412e82d
  SHA512:…

Founded in 1912, the Irish Chess Union (ICU) is the governing body for chess across the island of Ireland. It has about 2,500 members and run entirely by volunteers.

Its website, icu.ie, has been maintained by webmaster Jonathan O’Connor since 2015. Earlier this year, Jonathan reached out to us. He wanted help taking the ICU’s Rails application from 7.0 to 8.1.

We used Claude Code and our open source Claude Code Rails Upgrade Skill to get it done. We also recorded the sessions as a video series, so other teams could see the methodology in practice.

In this article, we’ll walk through the upgrade, one version at a time, and share what Jonathan thought of the process.

Here was our…

Founded in 1912, the Irish Chess Union (ICU) is the governing body for chess across the island of Ireland. It has about 2,500 members and run entirely by volunteers.

Its website, icu.ie, has been maintained by webmaster Jonathan O’Connor since 2015. Earlier this year, Jonathan reached out to us. He wanted help taking the ICU’s Rails application from 7.0 to 8.1.

We used Claude Code and our open source Claude Code Rails Upgrade Skill to get it done. We also recorded the sessions as a video series, so other teams could see the methodology in practice.

In this article, we’ll walk through the upgrade, one version at a time, and share what Jonathan thought of the process.

Here was our…

RubyLLM 2 is in the final stages of being released and when I learned about this, I went to check the documentation to see if there is anything new that’s interesting to me. While browsing the docs, I came across this example:

Haven't seen this mentioned anywhere, but I was tickled to discover that iOS 27 ships with a keyboard completion that will fill wi-fi details into captive portals you've previously filled out before.

The webhook receiver gets two subscription.past_due events and no subscription.active event.

The application did enqueue both transitions. The first job followed trailing → active; the second followed active → past_due. They have different Active Job IDs, both ran once, and neither raised an exception.

Someone suspects a duplicate enqueue and proposes a uniqueness guard.

The model callback looks not very complicated:

class Subscription < ApplicationRecord
  after_update_commit -> { DeliverSubscriptionWebhookJob.perform_later(self) },
    if: :saved_change_to_status?
end

class DeliverSubscriptionWebhookJob < ApplicationJob
  def perform(subscription)
    Webhooks.deliver(
      event:…

Following reporting by The Wall Street Journal and the publication of research by Nightingale Collective, we want to clarify what we know about the spam-publishing campaign on rubygems.org in May 2026.

We take the security of rubygems.org and the community that depends on it seriously. Our team reviewed the activity and discussed the findings with researchers from Nightingale Collective.

The campaign involved newly registered accounts publishing spam packages. Socket previously documented related activity under the name GemStuffer. As described in our May status updates, we temporarily paused new account registrations, blocked and removed the accounts responsible, and yanked more than 500…

Today Reuters and the Wall Street Journal both reported about rogue AI agents at OpenAI attacking RubyGems.org. https://www.rubyhack.ai/ has an amazing writeup, and you should read it. I just wanted to make a quick post about it because it’s wild.

TL;DR: It seems like OpenAI Bots knew about the RubyGems caching vulnerability, tried to take advantage of it, and at the same time ran some weird web scraping code on RubyDoc.info.

Back in May, socket.dev reported about a “GemStuffer Campaign” where someone (I guess OpenAI) was uploading tons of junk gems to RubyGems.org. For some reason, the gems would scrape UK government websites, then repackage the data as gems, and attempt to upload them…

I honestly didn’t think much about…

Ryan Castillo returns to the show to catch everyone up on what’s changed since his last appearance…and a lot has changed. Ryan explains why he and his co-founder moved on from their web application firewall Wafris and built Knowatoa, a platform focused on helping companies understand how their brands appear in AI-powered search. From there, the conversation expands into GEO and AI search visibility, multi-agent coding workflows, AI skills as the future of content, and when developers should or shouldn’t delegate work to AI. Chris also gets candid about Hatchbox’s recent pricing increase, the financial pressure behind the decision, and why talking directly with customers may be just as…

Hi, Wojtek here. If you’re in Austin for Rails World, be sure to collect our newsletter stickers. See you there!

Rails World Opening Keynote livestream
For those who can’t make it to Austin: Tune in live to watch the Rails World 2026 Opening Keynote where DHH will share what’s new in Rails, what’s coming up, and where Rails is headed in the future.

Join from wherever you are in the world on Wednesday 23.09:

• 9:30 AM - Austin
• 7:30 AM - Pacific
• 10:30 AM - Eastern
• 3:30 PM - UK
• 4:30 PM - Central Europe
• 11:30 PM - Japan

Active Support Core Extensions guide awaiting community review
Read, comment and suggest improvements if you have some free time.

Add alternative text to Action…

Heroku sent us an email about the database behind ips.fastruby.io, a small app we run for sharing benchmark-ips results. That database runs Postgres 15, and the email gave it an end-of-life date on Heroku of January 20, 2027. If we do nothing before December 20, 2026, they will upgrade it to Postgres 18 for us.

Staying in control of when that happens beats finding out on Heroku’s schedule, so I upgraded it that same night. I skipped the method Heroku recommends for a documented one that suited this database better, and still finished the job with commands that are not in their documentation.

In this article, you will learn how we moved a Heroku Postgres database off a deprecated version,…

Welcome to week four of our 2026 sponsorship drive! (Don’t forget to catch up on weeks one, two and three).

This will be our last post before we come back one last time to wrap things up. We do have some treats for you this week, though: a wonderful Q&A with long-time Hanami developer Edouard de Labareyre, a gaggle of individual sponsors to thank, and some news about merch!

Q&A with Edouard de Labareyre

We’re wrapping up our Q&As with a great one, featuring Edouard de Labareyre!

Edouard is a true stalwart of the Hanakai community, shipping Hanami to production since version 1.1. Edouard truly gets what we’re about, and we in the community are lucky to benefit from his generosity, whether…

I wrote a JavaScript library. Again (or rather I rewrote the JavaScript library I wrote some time ago).

I had the idea for Attractive for quite some time, based on the following thought: why do I reach for a framework to toggle a class, add an attribute or copy a bit of text?

So I made Attractive.js: a humble set of declarative HTML actions. You put the behavior on the element itself. No virtual DOM, no state management, no component lifecycle to learn or more of things like that. Reading the markup tells you what the page does. In that regard it is much like Stimulus, but with less ceremony/setup (and Attractive gives you actions out of the gate).

This is an overview of what 1.0.0 looks…

Every hat we take off a small business owner’s head becomes a promise. Payroll has to talk to accounting software, calendars have to talk to HR systems and none of it should be something the owner has to think about. Building connectors like that means understanding, precisely, what the Model Context Protocol (MCP) protects, and what it deliberately does not. So before we built ours, we went looking for an expert. We found a furry one.

Rovry (rhymes with “lovely”) is a cat. Rovry is also, in her own estimation, roughly four steps from running the world. All she needs is for her network of associates (a Tuxedo…

Agentic speed turned all of us into super-ICs and broke our ability to collaborate. Two types of work that both produce code, and three recipes for working together again: a safe perimeter for experiments, shared rules everybody pays for, and an intent log your agents write themselves.

Agentic development has brought new capabilities and unprecedented speed. But this speed has all but disintegrated our ability to collaborate. We pretend it's fine, but look around. We toss 50-100 PRs per day at each other and call this teamwork?…

Ruby on Rails keeps changing between releases. Five This Week in Rails issues rolled in eight Active Record deprecations and behavior changes on Rails main over the last few weeks. Most are small renames. One is a real bug fix that stops a write from leaking outside its association. None of it has shipped in a tagged release yet, main is currently versioned 8.2.0.alpha. Rails has shipped a new minor version roughly every year (8.0 in November 2024, 8.1 in October 2025), so 8.2 landing sometime around the end of 2026 is a reasonable bet, well ahead of binds, which has a committed removal date of 8.3. uniq! is the one to not expect soon: its removal is tied to 9.0, and Rails hasn’t announced…

Today we’re expanding Agents on Rails with Stage 2, a new set of benchmark tasks that exercise a model’s ability to deliver real-world features, more in line with how a developer would actually work.

Before we go deep, here are the results:

First results for Stage 2:

• Most accurate: GPT-6 Astra, with 35% of runs solved (21 of 60).
• Cheapest: GLM 5.3 Flash, 15% for $18.78 across all 60 runs. (Luna’s $1.69 would win, but it finished 0 of 60 tasks.)
• Fastest: GPT-6 Astra again, 9 minutes median per run. (Luna’s 3 minutes don’t count here, either.)
• Best combination of all three: GPT-6 Astra, for the third time. At $150.47 for the campaign it’s on the cheaper end too, which makes it…

What is Stage 2?

How is Stage 2 different from Stage 1? Harder, as you can guess from the results, but it goes a bit deeper than that. Stage 1 asked whether a model knows Rails.…

Jeremy Smith returns to the podcast ahead of Rails World to talk about his upcoming presentation, Practical Hotwire: Turbo and Stimulus on the Ground.

Jeremy shares how years of working with Hotwire in real Rails applications led him to identify a dozen recurring problems and pitfalls involving Stimulus, Turbo Drive, Turbo Frames, and Turbo Streams. He also walks through the surprisingly extensive process of turning those lessons into a 30-minute conference talk, including building a dedicated demo application, creating before-and-after examples, recording screencasts, researching edge cases, and using AI tools to help organize and refine the material.

They also discuss Jeremy’s…

RubyGems and Bundler 4.1.0.beta1 include features, performance, enhancements, breaking changes, bug fixes and deprecations.

To update to the latest RubyGems you can run:

gem update --system [--pre]

To update to the latest Bundler you can run:

gem install bundler [--pre]
bundle update --bundler=4.1.0.beta1

Release Notes

RubyGems

Changes already released in 4.0.x are not repeated here.

Features:

• Add content addressable gems support. Pull request #9773 by Jenny Shen, Harriet Oughton and Gira Chawda
• Let the gem and bundle cooldown settings cover each other. Pull request #9852 by Hiroshi SHIBATA
• Rubygems: Add PQC ML-DSA support for cryptographically signed gems workflow. Pull…

367 posts, four years on Gatsby, and no dedicated team: here's how we moved evilmartians.com to Astro in two weeks with an LLM.

We'd been putting off migrating evilmartians.com off Gatsby for three years. Our website is how new clients find Evil Martians, and our way of serving technical articles to half a million developers. The migration always seemed important, but never enough for a busy consultancy to pull engineers from client work. Then, (and to our own surprise) in August 2026 we moved the…

In July 2022, Ruby Central and Shopify launched Ruby Shield, a four-year partnership built around a single goal: giving the tools at the heart of the Ruby ecosystem the sustained investment they need to stay secure and reliable. Shopify committed $1 million over four years, along with dedicated engineering time from its Ruby and Rails Infrastructure team, and left it to Ruby Central to direct that support wherever it would do the most good for the community.

Software supply chain attacks are climbing sharply across every major package ecosystem, and RubyGems.org, the registry that nearly every Ruby application depends on, was being maintained on a shoestring. Ruby Shield gave us the ability…

Making a Claude plugin named Bill Gates that makes Claude put a dollar in the swear jar every time it says “gate”.

What is Rubydex linter

Rubydex is a static analysis toolkit for Ruby. My teammate Vini introduced it in more detail in One engine, many tools — Introducing Rubydex. Rubydex linter is Rubydex’s built-in linter for writing project-specific structural rules that use Rubydex’s understanding of a codebase.

Why structural linting

Many checks can be decided by reading one file. But in large codebases, we sometimes need to require or prohibit patterns that span several files.

Consider this example: a project has two modules, LegacyFooHelper and FooHelper, that provide different implementations of the same foo method.

module LegacyFooHelper
  def foo
    behaviour_for_legacy_models
  end
end

…

We…

As a way of acknowledging “R U OK?” day on the 10th of September, I’m writing this post as a bit of a reply to that question. I’m also going to check in with some people close to me this week and I hope you do the same. Most everyone’s fighting a battle. See where you can help.

On the day - a Wednesday - I recovered from my worst cold in a year I learned that I was being made redundant. The redundancy contract says that I can’t say more about it, even as much as I want to write about my experience. What I can say is that I found it quite enjoyably ironic that I was wearing my “This is actually my second rodeo” t-shirt (under a jumper) while receiving my second ever redundancy.

By the…

Judoscale now supports Scalingo. If you’ve used Heroku, Scalingo will feel familiar: push your code, run web and worker containers, and let the platform handle the infrastructure underneath. Scalingo is a sovereign European cloud: it hosts apps in Paris datacenters and keeps your infrastructure under European jurisdiction. For public-sector and regulated workloads, its SecNumCloud-backed region goes further by running on French infrastructure that meets France’s strict SecNumCloud security standard.

We built this integration because several customers migrated from Heroku to Scalingo and wanted to bring queue-time autoscaling with them. Yespark was one of those customers:

Judoscale…

While reviewing dozens of PRs from ericproulx optimizing Grape’s internals recently, I noticed that the bare raise ArgumentError, "..." calls scattered across the codebase were inconsistent: some messages were capitalized, some ended in a period, most were not. Longtime readers know where this is going.

Ruby’s own core and standard library exceptions don’t do this - TypeError: no implicit conversion from nil to integer, ArgumentError: wrong number of arguments, and so on all read lowercase and unpunctuated, because the message is meant to be read after the exception class name and a colon, not as a standalone sentence.

Grape’s own Grape::Exceptions::* classes already follow this…

The request log says the job was enqueued. The customer’s CRM record still has not changed.

Enqueued SyncCustomerJob (Job ID: 7f9...) to SolidQueue(crm_sync) 

The queue dashboard shows the job sitting in Solid Queue’s ready state. The error tracker has nothing from SyncCustomerJob, and its retry count remains zero.

Someone adds retry_on Net::ReadTimeout and deploys again. Nothing changes. The team is changing what should happen after a failed attempt without knowing whether an attempt began.

perform_later creates a job

Consider the call that produced that log:

class SyncCustomerJob < ApplicationJob
  queue_as :crm_sync

  def perform(account_id)
    account = Account.find(account_id)
   …

One of the small joys of computer programming is reading some code and thinking aha, that’s nice.

I recently encountered this feeling of aha while reading the docs for the playwright-ruby-client’s set up code for Capybara which described a mismatch between the Playwright and RSpec interface:

The challenge is that Playwright.create and playwright.chromium.launch are block-scoped APIs — the browser shuts down when the block exits. RSpec has before(:suite) and after(:suite) but no around(:suite). A Fiber bridges the gap: start! resumes the fiber until it yields the browser back, and stop! resumes it again so both blocks exit cleanly.

I’ll get to that code in a…

I’ve always been interested in the design of ORMs - I wanted to know how they work, what the different approaches are, and how they can be used. I tried a bunch of different ones, I even created one. But in the last few years I’ve been slowly gravitating toward working more directly with databases - issuing queries using plain SQL, processing raw data coming from the database, or building custom low-level abstractions for working with relational databases. This evolution in the way my code talks to databases is the reason I created Extralite, a Ruby gem for working with SQLite databases.

Why do I prefer direct interaction with the database instead of using an ORM? For any developer…

Hi, it’s Vipul. Let’s explore this week’s changes in the Rails codebase.

Agents on Rails: Claude Fable 5.1 and GLM 5.3 Flash
Claude Fable 5.1 matched Opus 5 at the top of the Agents on Rails leaderboard with 58 of 63 successful runs, while costing less and finishing faster. The formerly unnamed ox-alpha model is GLM 5.3 Flash, which completed 52 of 63 runs for $3.31.

On Rails: Rate Limiting For Your Customers
Robby Russell spoke with Eddie Galindo and Kagen Hearn from Ascend about scaling one Rails monolith as larger customers arrived, finding the limits of its data ingestion pipeline, and shipping software that moves money.

Rails keeps moving toward Ractor support
Rails made controller…

Demo

Ringbinder is a small, simple CLI tool that lets me do this:

> docs "there was a picture with a few dragons of different colors/sizes/shapes, find it"

Found it:

 /Users/max/Documents/Unsorted Photos/2024_11_03_12_07_23.jpg

 It shows “six colorful winged dragons…of different sizes,” including red, orange, yellow, grey-black, brown, and a tiny brown dragon
 in a row.

“Untitled” by ~5yo

Or this:

> docs "when does my car need an oil change next?"

Your Toyota Sienna’s next oil change is due at approximately **46,388 miles**.

- Last documented oil change: **March 26, 2026 at 40,388 miles**
- Recorded interval: **6,000 miles**
- Latest recorded mileage: **44,743 miles**
- Remaining: …

This week, Chris, Andrew, and David dig into a packed mix of Rails news, developer tooling, and the increasingly complicated role AI is playing in everyday coding. They talk about Herb making its way into Rails, the realities of Rails upgrades and stacked PRs, new approaches to Git hosting and object storage, and how Rails is being evaluated in the age of AI agents. They also get into improvements coming to Action Text, Podia’s approach to “flavored” Markdown, the never-ending frustrations of HTML email, and why tools like ArchSpec and Rubydex could become especially useful as more code is generated by LLMs. Hit download now to hear more!

Links

• Chris Oliver X
• Andrew Mason Bluesky
• David Hill…

You get a site audit report and it looks manageable. A few dozen findings, most of them small: a page with barely any text on it, a link whose text is just “here”, a page whose title tag is a copy of its H1, a hero image heavy enough to hurt the largest contentful paint. None of it is that hard. You spend an afternoon on it, close the tickets, and move on.

Then a few months pass, a dozen new pages ship, and the next audit reports the same findings again. Not because anyone ignored the first round, but because the first round fixed pages instead of fixing the process that produces pages.

That happened to us, on this site and on OmbuLabs.ai. So the second time around we spent the effort…

You rolled out an AI tool to your team a year ago. Maybe it was ChatGPT Team for the office, Copilot for the two people who write code, or an AI feature that showed up inside the CRM you already pay for. Whatever it was, it stuck. People use it every day, and if it disappeared tomorrow, someone would notice before lunch.

On August 29, 2026, OpenAI told Cursor, one of the most widely used AI coding tools, that Cursor’s access to OpenAI models ends on November 12. There was no outage, no price change, and no wrongdoing on Cursor’s side. Cursor had just been bought by SpaceX, and OpenAI decided it could not trust the new owner to honor its terms. Cursor’s CEO wrote that they had “trusted…

My position on AI has been extremely boring and is basically, “if something is currently happening, the people who are saying that it’s impossible that it will ever happen are probably wrong”.

danluu.com: How Accurate Have Ed Zitron’s AI Skeptic Predictions Been?

You’ve probably heard the word “agent” in every AI pitch you’ve sat through this year, from vendors, from consultants, maybe from your own team. It gets used to describe everything from a customer service chatbot to a fully autonomous system nobody’s watching, which means the word alone doesn’t tell you much.

We build these systems for a living, and even we don’t reach for an agent by default. In this article, you’ll learn what an AI agent actually does differently from a chatbot, what that looks like on a real project, and how to tell if your business has a task that’s actually a good fit for one.

What an AI Agent Actually Does

Most of what gets called “AI” in a business tool today is…

A while back I wrote about organizing configuration in Rails. The idea was simple: drop YAML files into config/configurations/ and get namespaced constants like Config::Bot.api_key instead of the clunky Rails.application.config.bot.api_key.

It worked well. But every YAML file needed manual wiring: <%= ENV.fetch("BOT_API_KEY", Rails.application.credentials.dig(:bot, :api_key)) %>. For every key. Across every file. Ugh!

So I rebuilt it. Same clean Config::Namespace.key API, but now it chains through all three sources automatically.

Before (old module’s YAML):

# config/bot.yml
shared:
  api_key: <%= ENV.fetch("BOT_API_KEY", Rails.application.credentials.dig(:bot, :api_key)) %>
  user_agent: "M…

After (new module’s YAML):

# config/bot.yml
shared:
  # Config::Bot.api_key is still available and…

Gusto runs payroll for 500,000+ businesses on one of the largest Rails monoliths anywhere. Why a team this strong hired Evil Martians for Sidekiq at scale, what running background jobs at that size actually takes, and when to stop waiting for the perfect hire.

Gusto is the payroll, benefits, and HR platform for more than 500,000 businesses. In May 2026, it crossed $1B in annual revenue, cash flow positive, last valued at $9.3B.

Berlin.rb is a new monthly meetup for people who write Ruby, or are curious about it. A few of us from Berlin’s Ruby community are organizing talks, project show-and-tells, and time to meet other people who work in the same language. It’s free and open to anyone, whether you’ve been writing Ruby for fifteen years or installed it last week.

The first one is Tuesday, September 8, 18:45, at Potsdamer Straße 121. Use the Grover entrance next to Rossmann and head to the third floor. The evening is hosted and sponsored by ablefy, with drinks and snacks provided. After that, the second Tuesday of every month.

Register here. If you can’t make it to Berlin, there’s a livestream and it’ll be on You…

The…

An honest look at what NativePHP's SuperNative makes possible for Laravel teams and what it costs.

Continue Reading

We’ve spent years loading an extraordinary number of responsibilities onto the humble code review: quality gate, security check, architecture review, mentoring mechanism, knowledge-sharing system, ownership model.

Rachel Laycock (rlaycock@thoughtworks.com): Maybe We Shouldn’t Be Reviewing All This Code