Rubyland

RubyGems 4.0.21 includes enhancements and Bundler 4.0.21 includes enhancements and bug fixes.

To update to the latest RubyGems you can run:

gem update --system [--pre]

To update to the latest Bundler you can run:

gem install bundler [--pre]
bundle update --bundler=4.0.21

RubyGems Release Notes

Enhancements:

• Stop vendoring resolv for two regexps. Pull request #9877 by Hiroshi SHIBATA
• Normalize absolute symlink targets during gem extraction. Pull request #9860 by Hiroshi SHIBATA
• Installs bundler 4.0.21 as a default gem.

Bundler Release Notes

Enhancements:

• Don’t update bundler to a prerelease unless asked for one. Pull request #9869 by Hiroshi SHIBATA
• Reject Bundler…

Bug fixes:

• Sup…

Introducing Rails Hyperdrive: a development-only Rails engine that gives AI coding agents live answers from your booted app and lets any gem in your bundle ship guidance gated to your Gemfile. Convention over configuration, applied to agent knowledge.

Every session, a coding agent meets your Rails app like a stranger. It reads the Gemfile, greps routes.rb, trusts a db/schema.rb that may lag behind the migrations, and guesses the rest from training data. This burns tokens before the first line of work, and these guesses cause bugs. We've measured…

The Bike Shed is BACK! Aji and Joel kick off this week’s episode with a fantastic combination of component bugs and how much headspace they take up, historic heraldry vs ChatGPT’S anchoring bias, before diving into the latest big development of the Dev world, Github’s release of stacked PR’s.

—

Read more about Joël’s adventure in Europe with ChatGPT, and how to structuring conditionals when working with multi-step forms.

Your hosts for this episode have been thoughtbot’s own Joël Quenneville and Aji Slater.

Don't forget you can now also watch the show over on our YouTube channel!

If you would like to support the show, head over to our GitHub page, or check out our website.

Go…

Ruby 4.0.7 has been released.

This is a routine update that includes bugfixes. Please see the GitHub releases for further details.

Release Schedule

We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent release. Ruby 4.0.8 will be released in November.

If a change arises that significantly affects users, a release may occur earlier than planned.

Download

• https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.7.tar.gz

  SIZE: 23937964
  SHA1: 730d4f8cebb60a1f5b556e7b58d86d0301772558
  SHA256: 911ace20f90d068ca0e4dda6d0e4f0f81e52e52f2dd4f4004c721e253412e82d
  SHA512:…

Founded in 1912, the Irish Chess Union (ICU) is the governing body for chess across the island of Ireland. It has about 2,500 members and run entirely by volunteers.

Its website, icu.ie, has been maintained by webmaster Jonathan O’Connor since 2015. Earlier this year, Jonathan reached out to us. He wanted help taking the ICU’s Rails application from 7.0 to 8.1.

We used Claude Code and our open source Claude Code Rails Upgrade Skill to get it done. We also recorded the sessions as a video series, so other teams could see the methodology in practice.

In this article, we’ll walk through the upgrade, one version at a time, and share what Jonathan thought of the process.

Here was our…

Founded in 1912, the Irish Chess Union (ICU) is the governing body for chess across the island of Ireland. It has about 2,500 members and run entirely by volunteers.

Its website, icu.ie, has been maintained by webmaster Jonathan O’Connor since 2015. Earlier this year, Jonathan reached out to us. He wanted help taking the ICU’s Rails application from 7.0 to 8.1.

We used Claude Code and our open source Claude Code Rails Upgrade Skill to get it done. We also recorded the sessions as a video series, so other teams could see the methodology in practice.

In this article, we’ll walk through the upgrade, one version at a time, and share what Jonathan thought of the process.

Here was our…

RubyLLM 2 is in the final stages of being released and when I learned about this, I went to check the documentation to see if there is anything new that’s interesting to me. While browsing the docs, I came across this example:

Haven't seen this mentioned anywhere, but I was tickled to discover that iOS 27 ships with a keyboard completion that will fill wi-fi details into captive portals you've previously filled out before.

The webhook receiver gets two subscription.past_due events and no subscription.active event.

The application did enqueue both transitions. The first job followed trailing → active; the second followed active → past_due. They have different Active Job IDs, both ran once, and neither raised an exception.

Someone suspects a duplicate enqueue and proposes a uniqueness guard.

The model callback looks not very complicated:

class Subscription < ApplicationRecord
  after_update_commit -> { DeliverSubscriptionWebhookJob.perform_later(self) },
    if: :saved_change_to_status?
end

class DeliverSubscriptionWebhookJob < ApplicationJob
  def perform(subscription)
    Webhooks.deliver(
      event:…

Following reporting by The Wall Street Journal and the publication of research by Nightingale Collective, we want to clarify what we know about the spam-publishing campaign on rubygems.org in May 2026.

We take the security of rubygems.org and the community that depends on it seriously. Our team reviewed the activity and discussed the findings with researchers from Nightingale Collective.

The campaign involved newly registered accounts publishing spam packages. Socket previously documented related activity under the name GemStuffer. As described in our May status updates, we temporarily paused new account registrations, blocked and removed the accounts responsible, and yanked more than 500…

Today Reuters and the Wall Street Journal both reported about rogue AI agents at OpenAI attacking RubyGems.org. https://www.rubyhack.ai/ has an amazing writeup, and you should read it. I just wanted to make a quick post about it because it’s wild.

TL;DR: It seems like OpenAI Bots knew about the RubyGems caching vulnerability, tried to take advantage of it, and at the same time ran some weird web scraping code on RubyDoc.info.

Back in May, socket.dev reported about a “GemStuffer Campaign” where someone (I guess OpenAI) was uploading tons of junk gems to RubyGems.org. For some reason, the gems would scrape UK government websites, then repackage the data as gems, and attempt to upload them…

I honestly didn’t think much about…

Ryan Castillo returns to the show to catch everyone up on what’s changed since his last appearance…and a lot has changed. Ryan explains why he and his co-founder moved on from their web application firewall Wafris and built Knowatoa, a platform focused on helping companies understand how their brands appear in AI-powered search. From there, the conversation expands into GEO and AI search visibility, multi-agent coding workflows, AI skills as the future of content, and when developers should or shouldn’t delegate work to AI. Chris also gets candid about Hatchbox’s recent pricing increase, the financial pressure behind the decision, and why talking directly with customers may be just as…

Hi, Wojtek here. If you’re in Austin for Rails World, be sure to collect our newsletter stickers. See you there!

Rails World Opening Keynote livestream
For those who can’t make it to Austin: Tune in live to watch the Rails World 2026 Opening Keynote where DHH will share what’s new in Rails, what’s coming up, and where Rails is headed in the future.

Join from wherever you are in the world on Wednesday 23.09:

• 9:30 AM - Austin
• 7:30 AM - Pacific
• 10:30 AM - Eastern
• 3:30 PM - UK
• 4:30 PM - Central Europe
• 11:30 PM - Japan

Active Support Core Extensions guide awaiting community review
Read, comment and suggest improvements if you have some free time.

Add alternative text to Action…

Heroku sent us an email about the database behind ips.fastruby.io, a small app we run for sharing benchmark-ips results. That database runs Postgres 15, and the email gave it an end-of-life date on Heroku of January 20, 2027. If we do nothing before December 20, 2026, they will upgrade it to Postgres 18 for us.

Staying in control of when that happens beats finding out on Heroku’s schedule, so I upgraded it that same night. I skipped the method Heroku recommends for a documented one that suited this database better, and still finished the job with commands that are not in their documentation.

In this article, you will learn how we moved a Heroku Postgres database off a deprecated version,…

Welcome to week four of our 2026 sponsorship drive! (Don’t forget to catch up on weeks one, two and three).

This will be our last post before we come back one last time to wrap things up. We do have some treats for you this week, though: a wonderful Q&A with long-time Hanami developer Edouard de Labareyre, a gaggle of individual sponsors to thank, and some news about merch!

Q&A with Edouard de Labareyre

We’re wrapping up our Q&As with a great one, featuring Edouard de Labareyre!

Edouard is a true stalwart of the Hanakai community, shipping Hanami to production since version 1.1. Edouard truly gets what we’re about, and we in the community are lucky to benefit from his generosity, whether…

I wrote a JavaScript library. Again (or rather I rewrote the JavaScript library I wrote some time ago).

I had the idea for Attractive for quite some time, based on the following thought: why do I reach for a framework to toggle a class, add an attribute or copy a bit of text?

So I made Attractive.js: a humble set of declarative HTML actions. You put the behavior on the element itself. No virtual DOM, no state management, no component lifecycle to learn or more of things like that. Reading the markup tells you what the page does. In that regard it is much like Stimulus, but with less ceremony/setup (and Attractive gives you actions out of the gate).

This is an overview of what 1.0.0 looks…

Every hat we take off a small business owner’s head becomes a promise. Payroll has to talk to accounting software, calendars have to talk to HR systems and none of it should be something the owner has to think about. Building connectors like that means understanding, precisely, what the Model Context Protocol (MCP) protects, and what it deliberately does not. So before we built ours, we went looking for an expert. We found a furry one.

Rovry (rhymes with “lovely”) is a cat. Rovry is also, in her own estimation, roughly four steps from running the world. All she needs is for her network of associates (a Tuxedo…

Agentic speed turned all of us into super-ICs and broke our ability to collaborate. Two types of work that both produce code, and three recipes for working together again: a safe perimeter for experiments, shared rules everybody pays for, and an intent log your agents write themselves.

Agentic development has brought new capabilities and unprecedented speed. But this speed has all but disintegrated our ability to collaborate. We pretend it's fine, but look around. We toss 50-100 PRs per day at each other and call this teamwork?…

Ruby on Rails keeps changing between releases. Five This Week in Rails issues rolled in eight Active Record deprecations and behavior changes on Rails main over the last few weeks. Most are small renames. One is a real bug fix that stops a write from leaking outside its association. None of it has shipped in a tagged release yet, main is currently versioned 8.2.0.alpha. Rails has shipped a new minor version roughly every year (8.0 in November 2024, 8.1 in October 2025), so 8.2 landing sometime around the end of 2026 is a reasonable bet, well ahead of binds, which has a committed removal date of 8.3. uniq! is the one to not expect soon: its removal is tied to 9.0, and Rails hasn’t announced…

Today we’re expanding Agents on Rails with Stage 2, a new set of benchmark tasks that exercise a model’s ability to deliver real-world features, more in line with how a developer would actually work.

Before we go deep, here are the results:

First results for Stage 2:

• Most accurate: GPT-6 Astra, with 35% of runs solved (21 of 60).
• Cheapest: GLM 5.3 Flash, 13% for $18.78 across all 60 runs. (Luna’s $1.69 would win, but it finished 0 of 60 tasks.)
• Fastest: GPT-6 Astra again, 9 minutes median per run. (Luna’s 3 minutes don’t count here, either.)
• Best combination of all three: GPT-6 Astra, for the third time. At $150.47 for the campaign it’s on the cheaper end too, which makes it…

What is Stage 2?

How is Stage 2 different from Stage 1? Harder, as you can guess from the results, but it goes a bit deeper than that. Stage 1 asked whether a model knows Rails.…

Jeremy Smith returns to the podcast ahead of Rails World to talk about his upcoming presentation, Practical Hotwire: Turbo and Stimulus on the Ground.

Jeremy shares how years of working with Hotwire in real Rails applications led him to identify a dozen recurring problems and pitfalls involving Stimulus, Turbo Drive, Turbo Frames, and Turbo Streams. He also walks through the surprisingly extensive process of turning those lessons into a 30-minute conference talk, including building a dedicated demo application, creating before-and-after examples, recording screencasts, researching edge cases, and using AI tools to help organize and refine the material.

They also discuss Jeremy’s…

RubyGems and Bundler 4.1.0.beta1 include features, performance, enhancements, breaking changes, bug fixes and deprecations.

To update to the latest RubyGems you can run:

gem update --system [--pre]

To update to the latest Bundler you can run:

gem install bundler [--pre]
bundle update --bundler=4.1.0.beta1

Release Notes

RubyGems

Changes already released in 4.0.x are not repeated here.

Features:

• Add content addressable gems support. Pull request #9773 by Jenny Shen, Harriet Oughton and Gira Chawda
• Let the gem and bundle cooldown settings cover each other. Pull request #9852 by Hiroshi SHIBATA
• Rubygems: Add PQC ML-DSA support for cryptographically signed gems workflow. Pull…

367 posts, four years on Gatsby, and no dedicated team: here's how we moved evilmartians.com to Astro in two weeks with an LLM.

We'd been putting off migrating evilmartians.com off Gatsby for three years. Our website is how new clients find Evil Martians, and our way of serving technical articles to half a million developers. The migration always seemed important, but never enough for a busy consultancy to pull engineers from client work. Then, (and to our own surprise) in August 2026 we moved the…

In July 2022, Ruby Central and Shopify launched Ruby Shield, a four-year partnership built around a single goal: giving the tools at the heart of the Ruby ecosystem the sustained investment they need to stay secure and reliable. Shopify committed $1 million over four years, along with dedicated engineering time from its Ruby and Rails Infrastructure team, and left it to Ruby Central to direct that support wherever it would do the most good for the community.

Software supply chain attacks are climbing sharply across every major package ecosystem, and RubyGems.org, the registry that nearly every Ruby application depends on, was being maintained on a shoestring. Ruby Shield gave us the ability…

Making a Claude plugin named Bill Gates that makes Claude put a dollar in the swear jar every time it says “gate”.

What is Rubydex linter

Rubydex is a static analysis toolkit for Ruby. My teammate Vini introduced it in more detail in One engine, many tools — Introducing Rubydex. Rubydex linter is Rubydex’s built-in linter for writing project-specific structural rules that use Rubydex’s understanding of a codebase.

Why structural linting

Many checks can be decided by reading one file. But in large codebases, we sometimes need to require or prohibit patterns that span several files.

Consider this example: a project has two modules, LegacyFooHelper and FooHelper, that provide different implementations of the same foo method.

module LegacyFooHelper
  def foo
    behaviour_for_legacy_models
  end
end

…

We…

As a way of acknowledging “R U OK?” day on the 10th of September, I’m writing this post as a bit of a reply to that question. I’m also going to check in with some people close to me this week and I hope you do the same. Most everyone’s fighting a battle. See where you can help.

On the day - a Wednesday - I recovered from my worst cold in a year I learned that I was being made redundant. The redundancy contract says that I can’t say more about it, even as much as I want to write about my experience. What I can say is that I found it quite enjoyably ironic that I was wearing my “This is actually my second rodeo” t-shirt (under a jumper) while receiving my second ever redundancy.

By the…

Judoscale now supports Scalingo. If you’ve used Heroku, Scalingo will feel familiar: push your code, run web and worker containers, and let the platform handle the infrastructure underneath. Scalingo is a sovereign European cloud: it hosts apps in Paris datacenters and keeps your infrastructure under European jurisdiction. For public-sector and regulated workloads, its SecNumCloud-backed region goes further by running on French infrastructure that meets France’s strict SecNumCloud security standard.

We built this integration because several customers migrated from Heroku to Scalingo and wanted to bring queue-time autoscaling with them. Yespark was one of those customers:

Judoscale…

While reviewing dozens of PRs from ericproulx optimizing Grape’s internals recently, I noticed that the bare raise ArgumentError, "..." calls scattered across the codebase were inconsistent: some messages were capitalized, some ended in a period, most were not. Longtime readers know where this is going.

Ruby’s own core and standard library exceptions don’t do this - TypeError: no implicit conversion from nil to integer, ArgumentError: wrong number of arguments, and so on all read lowercase and unpunctuated, because the message is meant to be read after the exception class name and a colon, not as a standalone sentence.

Grape’s own Grape::Exceptions::* classes already follow this…

The request log says the job was enqueued. The customer’s CRM record still has not changed.

Enqueued SyncCustomerJob (Job ID: 7f9...) to SolidQueue(crm_sync) 

The queue dashboard shows the job sitting in Solid Queue’s ready state. The error tracker has nothing from SyncCustomerJob, and its retry count remains zero.

Someone adds retry_on Net::ReadTimeout and deploys again. Nothing changes. The team is changing what should happen after a failed attempt without knowing whether an attempt began.

perform_later creates a job

Consider the call that produced that log:

class SyncCustomerJob < ApplicationJob
  queue_as :crm_sync

  def perform(account_id)
    account = Account.find(account_id)
   …

One of the small joys of computer programming is reading some code and thinking aha, that’s nice.

I recently encountered this feeling of aha while reading the docs for the playwright-ruby-client’s set up code for Capybara which described a mismatch between the Playwright and RSpec interface:

The challenge is that Playwright.create and playwright.chromium.launch are block-scoped APIs — the browser shuts down when the block exits. RSpec has before(:suite) and after(:suite) but no around(:suite). A Fiber bridges the gap: start! resumes the fiber until it yields the browser back, and stop! resumes it again so both blocks exit cleanly.

I’ll get to that code in a…

I’ve always been interested in the design of ORMs - I wanted to know how they work, what the different approaches are, and how they can be used. I tried a bunch of different ones, I even created one. But in the last few years I’ve been slowly gravitating toward working more directly with databases - issuing queries using plain SQL, processing raw data coming from the database, or building custom low-level abstractions for working with relational databases. This evolution in the way my code talks to databases is the reason I created Extralite, a Ruby gem for working with SQLite databases.

Why do I prefer direct interaction with the database instead of using an ORM? For any developer…

Hi, it’s Vipul. Let’s explore this week’s changes in the Rails codebase.

Agents on Rails: Claude Fable 5.1 and GLM 5.3 Flash
Claude Fable 5.1 matched Opus 5 at the top of the Agents on Rails leaderboard with 58 of 63 successful runs, while costing less and finishing faster. The formerly unnamed ox-alpha model is GLM 5.3 Flash, which completed 52 of 63 runs for $3.31.

On Rails: Rate Limiting For Your Customers
Robby Russell spoke with Eddie Galindo and Kagen Hearn from Ascend about scaling one Rails monolith as larger customers arrived, finding the limits of its data ingestion pipeline, and shipping software that moves money.

Rails keeps moving toward Ractor support
Rails made controller…

Demo

Ringbinder is a small, simple CLI tool that lets me do this:

> docs "there was a picture with a few dragons of different colors/sizes/shapes, find it"

Found it:

 /Users/max/Documents/Unsorted Photos/2024_11_03_12_07_23.jpg

 It shows “six colorful winged dragons…of different sizes,” including red, orange, yellow, grey-black, brown, and a tiny brown dragon
 in a row.

“Untitled” by ~5yo

Or this:

> docs "when does my car need an oil change next?"

Your Toyota Sienna’s next oil change is due at approximately **46,388 miles**.

- Last documented oil change: **March 26, 2026 at 40,388 miles**
- Recorded interval: **6,000 miles**
- Latest recorded mileage: **44,743 miles**
- Remaining: …

This week, Chris, Andrew, and David dig into a packed mix of Rails news, developer tooling, and the increasingly complicated role AI is playing in everyday coding. They talk about Herb making its way into Rails, the realities of Rails upgrades and stacked PRs, new approaches to Git hosting and object storage, and how Rails is being evaluated in the age of AI agents. They also get into improvements coming to Action Text, Podia’s approach to “flavored” Markdown, the never-ending frustrations of HTML email, and why tools like ArchSpec and Rubydex could become especially useful as more code is generated by LLMs. Hit download now to hear more!

Links

• Chris Oliver X
• Andrew Mason Bluesky
• David Hill…

You get a site audit report and it looks manageable. A few dozen findings, most of them small: a page with barely any text on it, a link whose text is just “here”, a page whose title tag is a copy of its H1, a hero image heavy enough to hurt the largest contentful paint. None of it is that hard. You spend an afternoon on it, close the tickets, and move on.

Then a few months pass, a dozen new pages ship, and the next audit reports the same findings again. Not because anyone ignored the first round, but because the first round fixed pages instead of fixing the process that produces pages.

That happened to us, on this site and on OmbuLabs.ai. So the second time around we spent the effort…

You rolled out an AI tool to your team a year ago. Maybe it was ChatGPT Team for the office, Copilot for the two people who write code, or an AI feature that showed up inside the CRM you already pay for. Whatever it was, it stuck. People use it every day, and if it disappeared tomorrow, someone would notice before lunch.

On August 29, 2026, OpenAI told Cursor, one of the most widely used AI coding tools, that Cursor’s access to OpenAI models ends on November 12. There was no outage, no price change, and no wrongdoing on Cursor’s side. Cursor had just been bought by SpaceX, and OpenAI decided it could not trust the new owner to honor its terms. Cursor’s CEO wrote that they had “trusted…

My position on AI has been extremely boring and is basically, “if something is currently happening, the people who are saying that it’s impossible that it will ever happen are probably wrong”.

danluu.com: How Accurate Have Ed Zitron’s AI Skeptic Predictions Been?

You’ve probably heard the word “agent” in every AI pitch you’ve sat through this year, from vendors, from consultants, maybe from your own team. It gets used to describe everything from a customer service chatbot to a fully autonomous system nobody’s watching, which means the word alone doesn’t tell you much.

We build these systems for a living, and even we don’t reach for an agent by default. In this article, you’ll learn what an AI agent actually does differently from a chatbot, what that looks like on a real project, and how to tell if your business has a task that’s actually a good fit for one.

What an AI Agent Actually Does

Most of what gets called “AI” in a business tool today is…

A while back I wrote about organizing configuration in Rails. The idea was simple: drop YAML files into config/configurations/ and get namespaced constants like Config::Bot.api_key instead of the clunky Rails.application.config.bot.api_key.

It worked well. But every YAML file needed manual wiring: <%= ENV.fetch("BOT_API_KEY", Rails.application.credentials.dig(:bot, :api_key)) %>. For every key. Across every file. Ugh!

So I rebuilt it. Same clean Config::Namespace.key API, but now it chains through all three sources automatically.

Before (old module’s YAML):

# config/bot.yml
shared:
  api_key: <%= ENV.fetch("BOT_API_KEY", Rails.application.credentials.dig(:bot, :api_key)) %>
  user_agent: "M…

After (new module’s YAML):

# config/bot.yml
shared:
  # Config::Bot.api_key is still available and…

Gusto runs payroll for 500,000+ businesses on one of the largest Rails monoliths anywhere. Why a team this strong hired Evil Martians for Sidekiq at scale, what running background jobs at that size actually takes, and when to stop waiting for the perfect hire.

Gusto is the payroll, benefits, and HR platform for more than 500,000 businesses. In May 2026, it crossed $1B in annual revenue, cash flow positive, last valued at $9.3B.

Berlin.rb is a new monthly meetup for people who write Ruby, or are curious about it. A few of us from Berlin’s Ruby community are organizing talks, project show-and-tells, and time to meet other people who work in the same language. It’s free and open to anyone, whether you’ve been writing Ruby for fifteen years or installed it last week.

The first one is Tuesday, September 8, 18:45, at Potsdamer Straße 121. Use the Grover entrance next to Rossmann and head to the third floor. The evening is hosted and sponsored by ablefy, with drinks and snacks provided. After that, the second Tuesday of every month.

Register here. If you can’t make it to Berlin, there’s a livestream and it’ll be on You…

The…

An honest look at what NativePHP's SuperNative makes possible for Laravel teams and what it costs.

Continue Reading

We’ve spent years loading an extraordinary number of responsibilities onto the humble code review: quality gate, security check, architecture review, mentoring mechanism, knowledge-sharing system, ownership model.

Rachel Laycock (rlaycock@thoughtworks.com): Maybe We Shouldn’t Be Reviewing All This Code

Claude Fable 5.1 dropped yesterday. See how it handles real Rails tasks, and where it landed on the leaderboard today. We also finally have a name for the stealth model from the last round.

Fable 5.1: We have a new best.

Fable 5.1 scored as well as Claude Opus 5 on accuracy, but surpassed it in all other marks (including price!). And it does security work now.

Fable 5.1 solved 58 of 63 runs (92%), matching Claude Opus 5 at the top of the leaderboard, and passed 20 of the 21 tasks at least once. Here is how it compares:

• Claude Fable 5.1: 58 of 63, $75 for all 63 runs, 5.4 minutes median per run.
• Claude Opus 5, the sole leader until now: 58 of 63, $120, 9.7 minutes.
• Claude Fable 5:…

Efficiency is the clearest difference between 5.1 and the previous generation: the bill is ~50% lower than Fable 5’s and ~40%…

Jim Remsik, founder of Flagrant and organizer of XORuby, joins David to talk about what he’s learned from taking a Ruby conference on the road.

XORuby was designed around a simple premise: traditional conferences are valuable, but travel costs, time away from work, and family responsibilities put them out of reach for many developers. Jim explains how XORuby tries to lower those barriers with inexpensive, one-day regional events—and why he measures their success as much by first-time attendees, new speakers, friendships, and community connections as by the financial bottom line.

The conversation turns to Flagrant and the rapidly changing role of AI in software development. Jim…

RubyGems 4.0.20 includes enhancements, bug fixes and documentation and Bundler 4.0.20 includes enhancements, bug fixes and documentation.

To update to the latest RubyGems you can run:

gem update --system [--pre]

To update to the latest Bundler you can run:

gem install bundler [--pre]
bundle update --bundler=4.0.20

RubyGems Release Notes

Enhancements:

• Print a release notes link instead of the whole changelog on gem update --system. Pull request #9794 by hsbt
• Installs bundler 4.0.20 as a default gem.

Bug fixes:

• Only coerce exact true and false gemrc values to booleans. Pull request #9822 by hsbt
• Make the gem CLI work under RUBY_BOX=1. Pull request #9810 by hsbt

Documen…

Welcome to week three of our 2026 sponsorship drive! (Don’t forget to catch up on weeks one and two, or skip ahead to week four).

Progress from week two

We received two one-time individual contributions and one new monthly individual sponsor since our last update, bringing us another $760 closer to our goal for 2026. (I’m basing these estimates on monthly sponsors sticking with us for at least 12 months — we’ll do everything we can along the way to show how your support is helping!)

This puts us at $3.1k out of the additional $15k we’re looking to raise. Please continue to spread the word about our goals and our fundraising, every bit counts!

Q&A with Carolyn Cole

This week we’re lucky…

Frequently Played 🔗

I tend to listen to the same songs or albums on repeat that are evocative of how I’m feeling or what’s going on with me. Here is what I’m currently listening to over, and over, and over, and over, again.

Jolene 🔗

Thanks for the name Dolly. And for modeling how to be yourself without compromising yourself.

Full Lyrics

I had to have this talk with you
My happiness depends on you

Gasoline 🔗

This is a pretty good collection of Halsey’s summer tour performances.

Full Lyrics

I think there’s a flaw in my code
These voices won’t leave me alone
Well my heart is gold and my hands are cold

It’s been 8 years since the first just-in-time compiler was introduced in Ruby. However, throughout this time, the garbage collector has been a black box to the JIT compilers. This meant that JIT compilers were not able to optimize any object allocations and instead had to perform function calls. This has all changed now that we have integration of the GC fastpath into ZJIT. In this article, we’ll be looking at how object allocations work in the GC, what it means to inline the GC fastpath into ZJIT, and the performance implications.

Object Allocation

In Ruby’s default GC, object allocations previously used a free list based allocator. The free list allocator keeps a linked list of all…

You approved an APM tool at a modest monthly rate. A year later, the renewal invoice bears little resemblance to what you signed, and nobody remembers deciding to spend that much more.

APM is worth having when it’s used well: it resolves incidents faster by showing you where in the stack a problem started, it gives you warning before a threshold alert turns into an outage, and it gives you a defensible answer when a client or stakeholder asks whether you hit your SLA (often measured through percentile response times like p95 and p99). None of that is in question here. What tends to go unexamined is whether the bill still matches what you’re getting for it.

In this article, we’ll walk…

Eddie Galindo is an engineering lead at Ascend and Kagen Hearn is a senior software engineer there, working on a Rails app that helps insurance agencies move and reconcile money.

Robby, Eddie, and Kagen get into why Ascend still runs one Rails monolith five years in, what needed attention when much larger customers started arriving, and how the team went about finding the real limits of their data ingestion pipeline. They also get into feature flags versus database configuration, and where AI tooling fits in when the software you ship moves money.

Links:

• Ascend

Listen to this episode (1h 24m) or subscribe to On Rails in your podcast player.

Tracing helps answer an important question: what happened? But knowing what happened isn’t the same as knowing whether it was any good. That’s where evaluation comes in. And if you already have traces running in production, you’re closer to a solid evaluation system than you might think.

In this post, we’ll walk through the core evaluation loop, how to build an evaluation dataset from production traces, and how to use evaluation signals to debug and improve your application.

Introduction

In the previous post, we explored the foundations of LLM observability and tracing. We discussed how traces give you visibility into your LLM application by capturing the full sequence of events across…

Ruby 4.0 was released on December 25, 2025, and three features get cited most often when people talk about it: ZJIT, Ruby Box, and a reworked Ractor API.

Two of those three features are experiments you have to turn on deliberately. The third one removes methods.

In this article, we will go through what ZJIT, Ruby Box, and the new Ractor::Port API actually do, and which of them can force you to change code when you move from Ruby 3.4 to 4.0.

ZJIT

ZJIT is a new just-in-time compiler, described in the Ruby 4.0.0 release announcement as the next generation of YJIT and built by the same team. You enable it with the --zjit command line flag, at runtime with RubyVM::ZJIT.enable or even…

Ten checks that catch what AI-written frontend code hides: contract codegen, boundary linting, mutation testing, and dead-code detectors.

Ten thousand lines of code in a week used to mean a team. With that team came institutional memory, and every bit of code had a person who knew why it looked as it did. Now one "person" can put out ten thousand lines in a week. But our new "co-authors" don't remember what we agreed yesterday, don't have to answer for production, and won't be around in six months to explain their…

A couple of years ago, we rewrote Judoscale’s marketing site from NextJS to Ruby on Rails. I enjoyed the process so much that I made a video sharing how it worked, and Jon wrote a spicy piece arguing that Rails was a perfect fit for mostly-static marketing sites like ours, and that you shouldn’t waste your time with JavaScript frameworks that were all the rage at the time.

A lot has changed since then (duh!), and I wanted to revisit this topic to share my current take. Jon’s gonna chime in later with his take as a bit of a rebuttal. It’s healthy to disagree, but rare to see it in a blog post. Let us know what you think of the format!

Adam’s take

I recently built a new…

Active Admin does a lot of heavy lifting on Rails projects, providing a nice way to quickly build out an admin backend for your application. One thing it does is try to be clever with deciding on the name for a model.

You might have noticed if you just mention a model, and that model has a name method or attribute, that Active Admin will automatically pick that up.

On some projects you want some additional control over this, because maybe name should be a formatted version, but other parts of your app need something else. Active Admin gives us a few ways to address this.

Use display_name

Active Admin will default to looking to see if the model responds to display_name first, which we…

On a recent project we needed Active Admin to show a dropdown box that automatically updated depending on other selections happening on a form. This isn’t supported out of the box by Active Admin, but is quick to add yourself.

Bonus points, we get to use jQuery!

Create a new controller action to handle filtering

You have a number of choices for how you go about this, exactly where you place this Controller and/or Action will depend on what makes sense for your project. In our project it made the most sense to have an AdminFiltersController controller. Which would house all of our filters. Other projects will prefer to keep these Actions tied to the model you’re acting on.

The specifics…

For the last several months, I've been incredibly busy. With our former executive director's departure, I've picked up extra work supporting the board and staff, especially in preparing for RubyConf.

Two years ago, when I stepped into this role, I started by observing where we stood as operators of RubyGems. A few gaps jumped out at me: lack of governance, no formal policies, and thin internal documentation. These weren't just nice to haves; I flagged them as critical from the start. What I didn't see yet was that they were also the backbone of a strong software foundation. That realization led me to a bigger question: what would it take to close the gaps standing between us and becoming one?

This is gonna sound bitter, but hey. I take my whisky neat.

Why has it become a thing that people must use social media to give commencement speeches about every · fucking · thing in their life?

To be clear, I have nothing against you soaring through your personal growth in a permanent state of child-like wonder like the absolute Peter Pan you are, learning profound wisdoms from every new shape of eye floater you’ve rubbed into your retina. Be you, king. But holy hell, why has it become the rite of passage for every clown promoting something to share daily life lessons on social media?

A daily, unstoppable firehose of something that should by definition… take a while.

I pooped today.…

We are all juniors again

A long, long time ago, when Akinator was the peak of “advanced AI” on the internet, before services became micro, and deployments meant sending a file directly from a local computer via FTP to a server, I was introduced to the Dreyfus Skill Model. As a junior dev back then, I liked it because it explained why my senior and architect colleagues could sometimes make impactful decisions intuitively, while I, on the contrary, was expecting step-by-step instructions on how to convert HTML form input into a database row.

In short, the Dreyfus Skill Model describes that when learning a new skill, a learner goes through 5 stages to acquire it:

1. Novice. We need/expect…

Direct link to podcast audio file

The summer heat has finally broken here in Shizuoka, and I'm enjoying a cool, wet, and cloudy day huddled around my microphone for warmth. I hope you'll join around my verbal campfire for yet another one of these.

As always, you can e-mail the show at podcast@searls.co. Only a small proportion of listeners will ever write an e-mail, so I now offer a second option: the justin.searls.co/feedback form. People love filling out forms! Go try it out! Check the anonymous checkbox! Hell, enter a fake e-mail address—see if I care!

Stuff we talked about, in order of me talking about them:

• A TV commercial for the Famicom Disk System
  • Also, the animation that…

Two Puma workers try to assign the same user to the same customer account.

One request comes from an administrator. The other comes from an invitation acceptance that reached another process at nearly the same time. Both use the ordinary Active Record lifecycle, and both records pass validation.

A later query finds two active seat assignments:

SeatAssignment.where(account_id: 42, user_id: 7).count
# => 2

The model appears to prohibit that state:

class SeatAssignment < ApplicationRecord
  belongs_to :account
  belongs_to :user

  validates :user_id, uniqueness: { scope: :account_id }
end

Nothing skipped validation. Neither write used update_all, insert_all, or raw SQL. Each worker asked the…

Finally figured out a bulletproof system for landing on the best model for the job.

distance_of_time_in_words is a small Ruby gem that turns two Time objects into a human-readable string like “3 days and 4 hours”. Several separate bug reports against it turned out to be variations on the same theme: computing a duration between two timestamps is not the trivial subtraction it looks like, the moment time zones are involved. The first two fixes shipped in dotiw 5.6.0; four more followed shortly after in dotiw 5.6.1.

Bug 1: dst? Lies When You Least Expect It

#63 reported that a duration of one minute was rendered as “less than 1 second” for users in Europe/Dublin. The gem’s TimeHash had a DST correction that looked reasonable:

d = largest - smallest
d -= 1.hour if smallest.…

Shopping for an anonymous VPN service is so weird because all the marketing and all the reviews are like DO YOU WANT TO DO CRIMES? DO YOU WANT TO DO DOUBLE SECRET CRIMES? DO YOU WANT YOUR PACKETS TO COME FROM THE MOON? DO YOU WANT TO DO MOON CRIMES WHILE WE PROJECT A PLAUSIBLE HOLOGRAM OF YOU IN TIMES SQUARE? DO YOU WANT NO LOGS OF YOUR CRIMES? DO YOU WANT US TO ERASE THE GOVERNMENT WHEN THEY ASK FOR YOUR LOGS?

And here I am just wanting decently fast secure connections from coffee shop wifi without every website being like “um, your IP is listed in our database as ‘MOONCRIME6’, are you sure you aren’t a crimebot?”

Hi, it’s Greg. Let’s explore this week’s changes in the Rails codebase.

Agents on Rails: lemans goes open source
Another week, another update from Agents on Rails. This one is a big one: lemans, the harness behind every number we’ve published, is now open source. Also four new models were added: Sonnet 5, Terra, an open-weight Qwen you can run on your own machine, and one that won’t tell us its name.

Actionpack ractorize
This Pull Request changes the following:

• Make ActionDispatch::ParamBuilder.default ractor safe by using singleton class attr accessor.
• Make ActionDispatch::Request::LOCALHOST ractor safe by freezing the regex.
• Make ActionDispatch::Response.default_charset and Acti…

Additionally, prefixed partial names were made ractor safe and reset_primary_key was also made ractor compatible.

Add…

Replacing a business-critical legacy system does not have to mean committing to a risky, all-at-once rewrite. The strangler fig pattern offers a practical alternative: migrate one capability at a time, run the old and new systems side by side, and gradually retire the legacy code as each replacement is validated. This post walks through how it works, where it fits, and a practical Rails-based example of migrating one piece of functionality without stopping the business to do it.

The Problem: A Business-Critical System You’re Afraid to Touch

Most organizations don’t wake up one day and decide to replace a legacy system. It happens gradually, as the cost and risk of maintaining the system…

Andrew and David catch up on everything from wild weather and the upcoming Rails World conference to Andrew’s latest deep dive into MCPs (Model Context Protocols). Andrew shares what he’s learned while building an MCP for a Rails side project, including choosing the official Ruby MCP SDK, discovering the limitations of resources versus tools, and wrestling with OAuth and Doorkeeper authorization. They also look ahead to Rails World in Austin, highlighting talks on Active Search, Ractors, Herb, Action Text, Solid Cable, custom Rails generators, and appropriately enough MCPs. 

Links:

Chris Oliver X

Andrew Mason Bluesky

David Hill LinkedIn

Judoscale- Remote Ruby listener gift

The Ruby on Rails…

Strip any agent framework down and you find the same loop: call the model, run the tools it asked for, call the model again, stop when it answers without wanting a tool. RubyLLM has run that loop inside ask since 1.0. In 2.0, you can also control each step.

# Run the agentic loop automatically
response = RubyLLM.chat(model: "claude-sonnet-4-6")
  .with_tools(Weather)
  .ask("What's the weather in Paris?")
# => #<RubyLLM::Message role: :assistant, content: "Here's the current...

# Run the agentic loop manually
chat = RubyLLM.chat(model: "claude-sonnet-4-6")
  .with_tools(Weather)
  .ask_later("What's the weather in Paris?")

chat.step until chat.complete? || chat.awaiting_approval?  #…

Thinking of applying to next year's RubyConf Scholars and Guides program? Read on to hear from this year's Scholars about what it was like and why you should take the leap and apply!

Name:

Shuveksha Tuladhar

Professional Title:

Software Developer Apprentice

How did you get into Ruby? What's your Ruby story?

I started learning Ruby and Ruby on Rails through Code the Dream as part of my journey into software development. I enjoyed learning Ruby so much that it quickly became my natural language.

Are there any Ruby projects you're working on that you're excited about? Tell us all about it!

I am currently working on several Ruby projects, both at work and through personal projects. Ruby has become a…

I released kamal-backup 1.0 today.

Not because the backup command works. That part worked months ago.

I called it 1.0 because I used it to move Chat with Work, the application that pays my bills, to a new Hetzner instance. The old host took the backup. The new host restored it under a temporary hostname. I opened the real application, checked the real data and files, and only then moved DNS.

A backup is only real after you restore it.

The migration that made 1.0

The move found two bugs that a green backup log never could.

First, a fresh backup accessory on the new host could start its schedule before the restore and write a perfectly valid, completely empty snapshot into the same…

RubyLLM 2.0 is almost ready. It isn’t out yet, but it will be soon, and I have been looking forward to showing you what is in it.

There is a lot in this release. Too much for one enormous announcement, and most of it deserves more than a bullet point. So this is the first in a series of posts about what’s coming in RubyLLM 2.0.

Let’s start with providers and protocols.

In 2.0, OpenAI uses the Responses API by default. Providers and protocols are separate things. Four new providers bring the total to seventeen. And if the provider you need is still missing, a new generator gives you a complete provider gem to start from.

RubyLLM.chat(model: 'gpt-5.4')                              #…

A table with 200 rows and 5 action icons per row. That’s 1,000 inline SVGs dropped into your HTML. When does that start to impact your performance?

By default, Rails Icons renders each icon as a full <svg> element. Fine for a handful of icons. But at scale, it adds up.

I built a simple benchmark to measure exactly how much (feel free to fork and improve ❤️). Two pages, identical layout, 1,000 icons each. One uses inline SVGs you use and love. The other uses an SVG sprite you will surely start to love after reading this. 😬

The benchmark is on GitHub.

How SVG sprites work

A SVG sprite is a single file (but can also be embedded) with multiple icon definitions wrapped in <symbol> tags:

<svg…

As of last week, I’ve been working at Fat Zebra for 5 years. (To celebrate, I caught up with my cardiologist.) In about a year and a half, it’ll be double the amount of time that I’ve worked anywhere else. So I think that has to count for something in both Fat Zebra’s favour and my own.

This week I was given some big news:

1. The powers that be want to restructure my team
2. This means the Tech Lead of Customer Experience role is now redundant
3. BUT! I’ve received an offer to go work as an individual contributor in a different, very cool team
4. Bonus: no pay cut.

Ironically, I was wearing my “This is actually my second rodeo” t-shirt while I received my second ever redundancy offer. But…

Two vulnerabilities have been discovered in the resolv gem bundled with Ruby. They have been assigned the CVE identifiers CVE-2026-80212 and CVE-2026-80213. We recommend upgrading the resolv gem.

CVE-2026-80212: Memory exhaustion through malicious DNS responses

An application that resolves a hostname an attacker can influence, such as a webhook target or a user-supplied URL, can be made to consume memory without bound. The attacker points a domain at a name server they control and returns responses that the library retains permanently. Repeated lookups grow the process until it runs out of memory and the service stops.

CVE-2026-80213: Hostname validation bypass

An application that…

A Portland high school student asked our CEO how this all started. Here's the short version, plus what we're up to now.

Continue Reading

I joined Chris on The Hallway Track to talk about running Box Out Sports, Fireside, and Flipper while still maintaining open source projects like HTTParty.

We covered a lot of ground in 50 minutes: why I gave up trying to focus, the production problem that led to Flipper, how feature flags change the way teams build software, and why taste might be the real advantage in the AI era.

Some of the highlights:

Giving Up on Focus. I spent years feeling like I was broken because I couldn’t focus on one thing. Everyone tells you focus is how you do something big and great, but I like having a lot of things going. If I get jammed on one project, I can switch to the next most important thing on…