Beyond jj: config & tools ecosystem
This post was originally given as a talk at JJ Con 2026. The slides are also available.
Hello! Welcome to ābeyond jjā, where weāre going to take a look at the jj ecosystem: commands, configurations, and tools made to work with jj. Itās partly a follow-up to my talk at JJCon last year, where I surveyed jj configurations across the community, but weāll get there in a minute.
My practical qualifications to give a talk about jj basically come down to āI like trying new things, and Iām very excited about jjā. My impractical qualifications to give a talk about jj come down to āSteve Klabnik was my roommate once, so I can ask him to put my ideas into the official jj docsā. Thanks in advance,ā¦
https://avdi.codes/184910-2/?utm_source=rss&utm_medium=rss&utm_campaign=184910-2
An open fascist is building one of the bigger sources of funding for open source fully under his individual control and sucks up a lot of money that otherwise might have gone to liberatory projects. Community projects. Antifascist projects.
tante: Power Grab
Did AI agents attack RubyGems?
#ā817 ā September 17, 2026
Ruby Weekly
Researchers Tie RubyGems' 'GemStuffer' Campaign to OpenAIĀ Agents ā Researchers say May's RubyGems spam flood came from OpenAI agents that ran code on RubyDoc.info and probed a key-leaking CDN bug. OpenAI has confirmed its agents were involved, but describes their actions as "benign tasks", while Ruby Central finds no evidence of successful key theft.
Kitts, Larsen, and Von Arx
š” Truffle Security, which disclosed the caching bug in July, digs into the code from May that targeted it.
Upgrading Rails Is Dead Simple Now. So Why Are You Behind? ā Wouldn't it beā¦
From collecting payments to distributing revenue: the FinTech system behind Smily
Collecting a payment sounds like a reasonably well-defined problem. A traveler pays for a booking, the payment succeeds, and the property manager receives the money.
Except that the property manager might only be entitled to part of it. The rest belongs to the owner. A booking channel might have already deducted its commission and collected a tax. The booking might include Travelersā Fees or Cancellation Protection. And the bank transfer might cover twenty bookings, an adjustment to an older reservation, and a deduction that has nothing to do with any of them.
Suddenly, āthe payment succeededā tells us surprisingly little about what should happen next.
At Smily, we built the system thatā¦
In last weekās announcement, I promised that when the built-in actions arenāt enough, you can write your own. Let me show you how, because this is what was bugging me most: why pull in another library when Attractive.js can do it as well?
Next to that I will also highlight some extra goodies and the bundled extensions that can now be (optionally) added.
Start with a one-liner
The quickest custom action is the js: prefix. It evaluates a JavaScript expression on the element, so you can do things too small for a full action:
<button @click="js:this.textContent=1">0 (I will become 1)</button>
Use it for one-liners only. It goes through the full action pipeline (so all events works as well as ā¦
(Replace this first paragraph with a brief description of your new category. This guidance will appear in the category selection area, so try to keep it below 200 characters.)
Use the following paragraphs for a longer description, or to establish category guidelines or rules:
-
Why should people use this category? What is it for?
-
How exactly is this different than the other categories we already have?
-
What should topics in this category generally contain?
-
Do we need this category? Can we merge with another category, or subcategory?
Ractor-age Rails: A How-To Guide
In our last post on Ractors, Edouard demonstrated the potential benefits of using Ractors in a Rails application. He also explained how our team has been working towards making Rails and its dependencies Ractor-friendly. While weāve been able to get smaller applications running on Ractors, we still have a long way to go to unlock larger applications, which use more features of Rails and many more gems. However, we have reached a good point where we can start to talk about the process itself.
In this post, I want to discuss some of the patterns weāve used to refactor code to work with Ractors. But first, letās talk about why any of this is necessary by looking at the constraints thatā¦
Slava (slack-strava) connects a Strava account to a chat and posts a card for every activity, complete with map, pace, and elevation, plus commands like connect, disconnect, stats, and leaderboard. In 2023 I ported Slava to Discord by hand, evening by evening over about three weeks, and it took most of that stretch to get a working bot called Strada (discord-strava). This week I ported the same app to Microsoft Teams as Strata (teams-strava) in 3 days instead of the 3 weeks the Discord port took, using time carved out during the Microsoft Global Hackathon. By āIā, I mean GitHub Copilot CLI and I.

The 2023 Baseline
discord-stravaās git history is a fair record of how long a manual portā¦
These weeknotes are pulling into the station a little late, because Iāve been busy starting my new job! Iāve joined the crew at HotDoc, as a manager slash engineer. Itās been a great time so far!
I noticed Dry Monads CI was failing in production due to version 3.0 of the json gem removing the
json/addcustom serialization machinery (and for good reason). I switched this over to the newJSON::CoderAPI and pushed up v1.11.0 of Dry Monads.I forgot to mention it last week, but we landed the styled text support in Dry CLI! Iām really happy with the collaborative process on this one (Aaron and I both contributing different things to the work) as well as the final result: a flexible andā¦
Episode 552: Hatchbox and GoRails in the age of AI with Chris Oliver and Collin Jilbert
Chris Oliver and Collin Jilbert join David for a candid conversation about the changing economics of building products for the Ruby on Rails community in the age of AI.
Chris traces the history of GoRails from its beginnings as an attempt to fill the void left by RailsCasts, through to the creation of Hatchbox and Jumpstart, and explains how those products evolved together over more than a decade. But the rapid improvement of AI coding assistants has dramatically changed how developers learn and work. Instead of searching for a tutorial, watching a screencast, and adapting an example to their application, developers can increasingly ask an AI tool to work directly inside theirā¦
4.0.21 Released
RubyGems 4.0.21 includes enhancements and Bundler 4.0.21 includes enhancements and bug fixes.
To update to the latest RubyGems you can run:
gem update --system [--pre]
To update to the latest Bundler you can run:
gem install bundler [--pre]
bundle update --bundler=4.0.21
RubyGems Release Notes
Enhancements:
- Stop vendoring resolv for two regexps. Pull request #9877 by Hiroshi SHIBATA
- Normalize absolute symlink targets during gem extraction. Pull request #9860 by Hiroshi SHIBATA
- Installs bundler 4.0.21 as a default gem.
Bundler Release Notes
Enhancements:
- Donāt update bundler to a prerelease unless asked for one. Pull request #9869 by Hiroshi SHIBATA
- Reject Bundlerā¦
Bug fixes:
- Supā¦

Introducing Rails Hyperdrive: a development-only Rails engine that gives AI coding agents live answers from your booted app and lets any gem in your bundle ship guidance gated to your Gemfile. Convention over configuration, applied to agent knowledge.
Every session, a coding agent meets your Rails app like a stranger. It reads the Gemfile, greps routes.rb, trusts a db/schema.rb that may lag behind the migrations, and guesses the rest from training data. This burns tokens before the first line of work, and these guesses cause bugs. We've measuredā¦
507: Stacked Vertical Slices
The Bike Shed is BACK! Aji and Joel kick off this weekās episode with a fantastic combination of component bugs and how much headspace they take up, historic heraldry vs ChatGPTāS anchoring bias, before diving into the latest big development of the Dev world, Githubās release of stacked PRās.
ā
Read more about JoĆ«lās adventure in Europe with ChatGPT, and how to structuring conditionals when working with multi-step forms.
Your hosts for this episode have been thoughtbotās own JoĆ«l Quenneville and Aji Slater.
Don't forget you can now also watch the show over on our YouTube channel!
If you would like to support the show, head over to our GitHub page, or check out our website.
Goā¦
Ruby 4.0.7 Released
Ruby 4.0.7 has been released.
This is a routine update that includes bugfixes. Please see the GitHub releases for further details.
Release Schedule
We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent release. Ruby 4.0.8 will be released in November.
If a change arises that significantly affects users, a release may occur earlier than planned.
Download
-
https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.7.tar.gz
SIZE: 23937964 SHA1: 730d4f8cebb60a1f5b556e7b58d86d0301772558 SHA256: 911ace20f90d068ca0e4dda6d0e4f0f81e52e52f2dd4f4004c721e253412e82d SHA512:ā¦
Founded in 1912, the Irish Chess Union (ICU) is the governing body for chess across the island of Ireland. It has about 2,500 members and run entirely by volunteers.
Its website, icu.ie, has been maintained by webmaster Jonathan OāConnor since 2015. Earlier this year, Jonathan reached out to us. He wanted help taking the ICUās Rails application from 7.0 to 8.1.
We used Claude Code and our open source Claude Code Rails Upgrade Skill to get it done. We also recorded the sessions as a video series, so other teams could see the methodology in practice.
In this article, weāll walk through the upgrade, one version at a time, and share what Jonathan thought of the process.

Here was ourā¦
Founded in 1912, the Irish Chess Union (ICU) is the governing body for chess across the island of Ireland. It has about 2,500 members and run entirely by volunteers.
Its website, icu.ie, has been maintained by webmaster Jonathan OāConnor since 2015. Earlier this year, Jonathan reached out to us. He wanted help taking the ICUās Rails application from 7.0 to 8.1.
We used Claude Code and our open source Claude Code Rails Upgrade Skill to get it done. We also recorded the sessions as a video series, so other teams could see the methodology in practice.
In this article, weāll walk through the upgrade, one version at a time, and share what Jonathan thought of the process.

Here was ourā¦
RubyLLM 2 is in the final stages of being released and when I learned about this, I went to check the documentation to see if there is anything new thatās interesting to me. While browsing the docs, I came across this example:
Haven't seen this mentioned anywhere, but I was tickled to discover that iOS 27 ships with a keyboard completion that will fill wi-fi details into captive portals you've previously filled out before.
CVE-2026-88030 (mongo): MongoDB Ruby Driver - Improper neutralization of special elements in data query logic in the GridFS component
The webhook receiver gets two subscription.past_due events and no subscription.active event.
The application did enqueue both transitions. The first job followed trailing ā active; the second followed active ā past_due. They have different Active Job IDs, both ran once, and neither raised an exception.
Someone suspects a duplicate enqueue and proposes a uniqueness guard.
The model callback looks not very complicated:
class Subscription < ApplicationRecord
after_update_commit -> { DeliverSubscriptionWebhookJob.perform_later(self) },
if: :saved_change_to_status?
end
class DeliverSubscriptionWebhookJob < ApplicationJob
def perform(subscription)
Webhooks.deliver(
event:ā¦Following reporting by The Wall Street Journal and the publication of research by Nightingale Collective, we want to clarify what we know about the spam-publishing campaign on rubygems.org in May 2026.
We take the security of rubygems.org and the community that depends on it seriously. Our team reviewed the activity and discussed the findings with researchers from Nightingale Collective.
The campaign involved newly registered accounts publishing spam packages. Socket previously documented related activity under the name GemStuffer. As described in our May status updates, we temporarily paused new account registrations, blocked and removed the accounts responsible, and yanked more than 500ā¦
What a time to be alive
Today Reuters and the Wall Street Journal both reported about rogue AI agents at OpenAI attacking RubyGems.org. https://www.rubyhack.ai/ has an amazing writeup, and you should read it. I just wanted to make a quick post about it because itās wild.
TL;DR: It seems like OpenAI Bots knew about the RubyGems caching vulnerability, tried to take advantage of it, and at the same time ran some weird web scraping code on RubyDoc.info.
Back in May, socket.dev reported about a āGemStuffer Campaignā where someone (I guess OpenAI) was uploading tons of junk gems to RubyGems.org. For some reason, the gems would scrape UK government websites, then repackage the data as gems, and attempt to upload themā¦
I honestly didnāt think much aboutā¦
Episode 367 - Ryan Castillo
Ryan Castillo returns to the show to catch everyone up on whatās changed since his last appearanceā¦and a lot has changed. Ryan explains why he and his co-founder moved on from their web application firewall Wafris and built Knowatoa, a platform focused on helping companies understand how their brands appear in AI-powered search. From there, the conversation expands into GEO and AI search visibility, multi-agent coding workflows, AI skills as the future of content, and when developers should or shouldnāt delegate work to AI. Chris also gets candid about Hatchboxās recent pricing increase, the financial pressure behind the decision, and why talking directly with customers may be just asā¦
Hi, Wojtek here. If youāre in Austin for Rails World, be sure to collect our newsletter stickers. See you there!
Rails World Opening Keynote livestream
For those who canāt make it to Austin: Tune in live to watch the Rails World 2026 Opening Keynote where DHH will share whatās new in Rails, whatās coming up, and where Rails is headed in the future.
Join from wherever you are in the world on Wednesday 23.09:
- 9:30 AM - Austin
- 7:30 AM - Pacific
- 10:30 AM - Eastern
- 3:30 PM - UK
- 4:30 PM - Central Europe
- 11:30 PM - Japan
Active Support Core Extensions guide awaiting community review
Read, comment and suggest improvements if you have some free time.
Heroku sent us an email about the database behind ips.fastruby.io, a small app we run for sharing benchmark-ips results. That database runs Postgres 15, and the email gave it an end-of-life date on Heroku of January 20, 2027. If we do nothing before December 20, 2026, they will upgrade it to Postgres 18 for us.
Staying in control of when that happens beats finding out on Herokuās schedule, so I upgraded it that same night. I skipped the method Heroku recommends for a documented one that suited this database better, and still finished the job with commands that are not in their documentation.
In this article, you will learn how we moved a Heroku Postgres database off a deprecated version,ā¦
#ā816 ā September 10, 2026
Ruby Weekly
RubyKaigi's Talks Are Finally Online
RubyKaigi, the conference where Ruby's core team gathers each year, took place in Japan this April, but the talks have just made it onto YouTube with 68 videos in this playlist. Some highlights:
-
ā¶ļø Matz's "Meet Spinel" keynote ā It's in Japanese, but the English subtitles are good. Matz covers his use of AI, what AI has helped clear from his backlog, and the Spinel project (including a fun live demo).
-
ā¶ļø Twenty Years of JRuby ā Charles Nutter's keynote on two decades of keeping Ruby thriving on the JVM.
-
ā¶ļø Surviving Black Friday:ā¦
I'll link to more as I get through them. There's some great stuffĀ here!
Welcome to week four of our 2026 sponsorship drive! (Donāt forget to catch up on weeks one, two and three).
This will be our last post before we come back one last time to wrap things up. We do have some treats for you this week, though: a wonderful Q&A with long-time Hanami developer Edouard de Labareyre, a gaggle of individual sponsors to thank, and some news about merch!
Q&A with Edouard de Labareyre
Weāre wrapping up our Q&As with a great one, featuring Edouard de Labareyre!
Edouard is a true stalwart of the Hanakai community, shipping Hanami to production since version 1.1. Edouard truly gets what weāre about, and we in the community are lucky to benefit from his generosity, whetherā¦
I wrote a JavaScript library. Again (or rather I rewrote the JavaScript library I wrote some time ago).
I had the idea for Attractive for quite some time, based on the following thought: why do I reach for a framework to toggle a class, add an attribute or copy a bit of text?
So I made Attractive.js: a humble set of declarative HTML actions. You put the behavior on the element itself. No virtual DOM, no state management, no component lifecycle to learn or more of things like that. Reading the markup tells you what the page does. In that regard it is much like Stimulus, but with less ceremony/setup (and Attractive gives you actions out of the gate).
This is an overview of what 1.0.0 looksā¦
An Abyssinian Blue sits at a laptop, paw on the trackpad planning a dire conspiracy.Every hat we take off a small business ownerās head becomes a promise. Payroll has to talk to accounting software, calendars have to talk to HR systems and none of it should be something the owner has to think about. Building connectors like that means understanding, precisely, what the Model Context Protocol (MCP) protects, and what it deliberately does not. So before we built ours, we went looking for an expert. We found a furryĀ one.
Rovry (rhymes with ālovelyā) is a cat. Rovry is also, in her own estimation, roughly four steps from running the world. All she needs is for her network of associates (a Tuxedoā¦

Agentic speed turned all of us into super-ICs and broke our ability to collaborate. Two types of work that both produce code, and three recipes for working together again: a safe perimeter for experiments, shared rules everybody pays for, and an intent log your agents write themselves.
Agentic development has brought new capabilities and unprecedented speed. But this speed has all but disintegrated our ability to collaborate. We pretend it's fine, but look around. We toss 50-100 PRs per day at each other and call this teamwork?ā¦
Ruby on Rails keeps changing between releases. Five This Week in Rails issues rolled in eight Active Record deprecations and behavior changes on Rails main over the last few weeks. Most are small renames. One is a real bug fix that stops a write from leaking outside its association. None of it has shipped in a tagged release yet, main is currently versioned 8.2.0.alpha. Rails has shipped a new minor version roughly every year (8.0 in November 2024, 8.1 in October 2025), so 8.2 landing sometime around the end of 2026 is a reasonable bet, well ahead of binds, which has a committed removal date of 8.3. uniq! is the one to not expect soon: its removal is tied to 9.0, and Rails hasnāt announcedā¦
Today weāre expanding Agents on Rails with Stage 2, a new set of benchmark tasks that exercise a modelās ability to deliver real-world features, more in line with how a developer would actually work.
Before we go deep, here are the results:

First results for Stage 2:
- Most accurate: GPT-6 Astra, with 35% of runs solved (21 of 60).
- Cheapest: GLM 5.3 Flash, 13% for $18.78 across all 60 runs. (Lunaās $1.69 would win, but it finished 0 of 60 tasks.)
- Fastest: GPT-6 Astra again, 9 minutes median per run. (Lunaās 3 minutes donāt count here, either.)
- Best combination of all three: GPT-6 Astra, for the third time. At $150.47 for the campaign itās on the cheaper end too, which makes itā¦
What is Stage 2?
How is Stage 2 different from Stage 1? Harder, as you can guess from the results, but it goes a bit deeper than that. Stage 1 asked whether a model knows Rails.ā¦
Jeremy Smith returns to the podcast ahead of Rails World to talk about his upcoming presentation, Practical Hotwire: Turbo and Stimulus on the Ground.
Jeremy shares how years of working with Hotwire in real Rails applications led him to identify a dozen recurring problems and pitfalls involving Stimulus, Turbo Drive, Turbo Frames, and Turbo Streams. He also walks through the surprisingly extensive process of turning those lessons into a 30-minute conference talk, including building a dedicated demo application, creating before-and-after examples, recording screencasts, researching edge cases, and using AI tools to help organize and refine the material.
They also discuss Jeremyāsā¦
4.1.0.beta1 Released
RubyGems and Bundler 4.1.0.beta1 include features, performance, enhancements, breaking changes, bug fixes and deprecations.
To update to the latest RubyGems you can run:
gem update --system [--pre]
To update to the latest Bundler you can run:
gem install bundler [--pre]
bundle update --bundler=4.1.0.beta1
Release Notes
RubyGems
Changes already released in 4.0.x are not repeated here.
Features:

367 posts, four years on Gatsby, and no dedicated team: here's how we moved evilmartians.com to Astro in two weeks with an LLM.
We'd been putting off migrating evilmartians.com off Gatsby for three years. Our website is how new clients find Evil Martians, and our way of serving technical articles to half a million developers. The migration always seemed important, but never enough for a busy consultancy to pull engineers from client work. Then, (and to our own surprise) in August 2026 we moved theā¦
In July 2022, Ruby Central and Shopify launched Ruby Shield, a four-year partnership built around a single goal: giving the tools at the heart of the Ruby ecosystem the sustained investment they need to stay secure and reliable. Shopify committed $1 million over four years, along with dedicated engineering time from its Ruby and Rails Infrastructure team, and left it to Ruby Central to direct that support wherever it would do the most good for the community.
Software supply chain attacks are climbing sharply across every major package ecosystem, and RubyGems.org, the registry that nearly every Ruby application depends on, was being maintained on a shoestring. Ruby Shield gave us the abilityā¦
https://avdi.codes/183665-2/?utm_source=rss&utm_medium=rss&utm_campaign=183665-2
Making a Claude plugin named Bill Gates that makes Claude put a dollar in the swear jar every time it says āgateā.
What is Rubydex linter
Rubydex is a static analysis toolkit for Ruby. My teammate Vini introduced it in more detail in One engine, many tools ā Introducing Rubydex. Rubydex linter is Rubydexās built-in linter for writing project-specific structural rules that use Rubydexās understanding of a codebase.
Why structural linting
Many checks can be decided by reading one file. But in large codebases, we sometimes need to require or prohibit patterns that span several files.
Consider this example: a project has two modules, LegacyFooHelper and FooHelper, that provide different implementations of the same foo method.
module LegacyFooHelper
def foo
behaviour_for_legacy_models
end
end
ā¦Weā¦
Feeling a lot better than last week, so I was able to do some more Hanakai work.
Shared our next sponsorship drive post, thanking our silver sponsors, and bringing you a Q&A with Hanami-to-Rails porting export Carolyn Cole. Go give it a read! (And while youāre there, go sponsor Hanakai too! Support your local bigotry-free Ruby framework.)Ā
Andrea put together internal code reloading support for Hanami (no more Guard!). I reviewed that in depth and left a bunch of feedback for her. Sheās already on the road to handling it all, so Iāll be looking forward to getting this merged soon.
What I like about this work is that itās our first opportunity to start adding an extensible structure toā¦
R U OK: Yeah nah yeah
As a way of acknowledging āR U OK?ā day on the 10th of September, Iām writing this post as a bit of a reply to that question. Iām also going to check in with some people close to me this week and I hope you do the same. Most everyoneās fighting a battle. See where you can help.
On the day - a Wednesday - I recovered from my worst cold in a year I learned that I was being made redundant. The redundancy contract says that I canāt say more about it, even as much as I want to write about my experience. What I can say is that I found it quite enjoyably ironic that I was wearing my āThis is actually my second rodeoā t-shirt (under a jumper) while receiving my second ever redundancy.
By theā¦
Judoscale now supports Scalingo. If youāve used Heroku, Scalingo will feel familiar: push your code, run web and worker containers, and let the platform handle the infrastructure underneath. Scalingo is a sovereign European cloud: it hosts apps in Paris datacenters and keeps your infrastructure under European jurisdiction. For public-sector and regulated workloads, its SecNumCloud-backed region goes further by running on French infrastructure that meets Franceās strict SecNumCloud security standard.
We built this integration because several customers migrated from Heroku to Scalingo and wanted to bring queue-time autoscaling with them. Yespark was one of those customers:
Judoscaleā¦
While reviewing dozens of PRs from ericproulx optimizing Grapeās internals recently, I noticed that the bare raise ArgumentError, "..." calls scattered across the codebase were inconsistent: some messages were capitalized, some ended in a period, most were not. Longtime readers know where this is going.
Rubyās own core and standard library exceptions donāt do this - TypeError: no implicit conversion from nil to integer, ArgumentError: wrong number of arguments, and so on all read lowercase and unpunctuated, because the message is meant to be read after the exception class name and a colon, not as a standalone sentence.
Grapeās own Grape::Exceptions::* classes already follow thisā¦
Native Dialog
The request log says the job was enqueued. The customerās CRM record still has not changed.
Enqueued SyncCustomerJob (Job ID: 7f9...) to SolidQueue(crm_sync) The queue dashboard shows the job sitting in Solid Queueās ready state. The error tracker has nothing from SyncCustomerJob, and its retry count remains zero.
Someone adds retry_on Net::ReadTimeout and deploys again. Nothing changes. The team is changing what should happen after a failed attempt without knowing whether an attempt began.
perform_later creates a job
Consider the call that produced that log:
class SyncCustomerJob < ApplicationJob
queue_as :crm_sync
def perform(account_id)
account = Account.find(account_id)
ā¦One of the small joys of computer programming is reading some code and thinking aha, thatās nice.
I recently encountered this feeling of aha while reading the docs for the playwright-ruby-clientās set up code for Capybara which described a mismatch between the Playwright and RSpec interface:
The challenge is that
Playwright.createandplaywright.chromium.launchare block-scoped APIs ā the browser shuts down when the block exits. RSpec hasbefore(:suite)andafter(:suite)but noaround(:suite). A Fiber bridges the gap:start!resumes the fiber until it yields the browser back, andstop!resumes it again so both blocks exit cleanly.
Iāll get to that code in aā¦
Beyond ORMs
Iāve always been interested in the design of ORMs - I wanted to know how they work, what the different approaches are, and how they can be used. I tried a bunch of different ones, I even created one. But in the last few years Iāve been slowly gravitating toward working more directly with databases - issuing queries using plain SQL, processing raw data coming from the database, or building custom low-level abstractions for working with relational databases. This evolution in the way my code talks to databases is the reason I created Extralite, a Ruby gem for working with SQLite databases.
Why do I prefer direct interaction with the database instead of using an ORM? For any developerā¦
Hi, itās Vipul. Letās explore this weekās changes in the Rails codebase.
Agents on Rails: Claude Fable 5.1 and GLM 5.3 Flash
Claude Fable 5.1 matched Opus 5 at the top of the Agents on Rails leaderboard with 58 of 63 successful runs, while costing less and finishing faster. The formerly unnamed ox-alpha model is GLM 5.3 Flash, which completed 52 of 63 runs for $3.31.
On Rails: Rate Limiting For Your Customers
Robby Russell spoke with Eddie Galindo and Kagen Hearn from Ascend about scaling one Rails monolith as larger customers arrived, finding the limits of its data ingestion pipeline, and shipping software that moves money.
Rails keeps moving toward Ractor support
Rails made controllerā¦
Demo
Ringbinder is a small, simple CLI tool that lets me do this:
> docs "there was a picture with a few dragons of different colors/sizes/shapes, find it"
Found it:
/Users/max/Documents/Unsorted Photos/2024_11_03_12_07_23.jpg
It shows āsix colorful winged dragonsā¦of different sizes,ā including red, orange, yellow, grey-black, brown, and a tiny brown dragon
in a row.
āUntitledā by ~5yo
Or this:
> docs "when does my car need an oil change next?"
Your Toyota Siennaās next oil change is due at approximately **46,388 miles**.
- Last documented oil change: **March 26, 2026 at 40,388 miles**
- Recorded interval: **6,000 miles**
- Latest recorded mileage: **44,743 miles**
- Remaining: ā¦GHSA-4qhx-6wrv-5hg2 (alchemy_cms): Account Takeover & Privilege-Escalation To Admin via Stored XSS in Menu Node Name Rendered in Admin Configure Dialog Page Content
GHSA-g7vv-4mjj-6fgm (alchemy_cms): Account Takeover & Privilege-Escalation To Admin via Stored XSS in Menu Node Name Rendered in Page Properties Configure Dialog
Rails World Prep, Herb in Rails, Stacked PR Headaches and New Ruby Tooling
This week, Chris, Andrew, and David dig into a packed mix of Rails news, developer tooling, and the increasingly complicated role AI is playing in everyday coding. They talk about Herb making its way into Rails, the realities of Rails upgrades and stacked PRs, new approaches to Git hosting and object storage, and how Rails is being evaluated in the age of AI agents. They also get into improvements coming to Action Text, Podiaās approach to āflavoredā Markdown, the never-ending frustrations of HTML email, and why tools like ArchSpec and Rubydex could become especially useful as more code is generated by LLMs. Hit download now to hear more!
Links
You get a site audit report and it looks manageable. A few dozen findings, most of them small: a page with barely any text on it, a link whose text is just āhereā, a page whose title tag is a copy of its H1, a hero image heavy enough to hurt the largest contentful paint. None of it is that hard. You spend an afternoon on it, close the tickets, and move on.
Then a few months pass, a dozen new pages ship, and the next audit reports the same findings again. Not because anyone ignored the first round, but because the first round fixed pages instead of fixing the process that produces pages.
That happened to us, on this site and on OmbuLabs.ai. So the second time around we spent the effortā¦
ZJIT can now inline GC allocations
#ā815 ā September 3, 2026
Ruby Weekly
ZJIT š¤ GC: Inlining GC Fastpath in ZJIT ā JIT compilation first came to CRuby eight years ago, but the garbage collector has remained opaque to CRuby's JITs, with every allocation requiring a function call. Now, ZJIT can inline allocations, yielding a notable performance boost. Fingers crossed for RubyĀ 4.1!
Peter Zhu
š” On Bluesky, Benoit Daloze noted that TruffleRuby has been doing this for a decade, one of many reasons it's such a fast implementation!
šØ We Give Your Auditors VEX, Not a Scanner Dump ā We map your images, runtimes, and K8s workloads againstā¦
When Your AI Provider Says No
You rolled out an AI tool to your team a year ago. Maybe it was ChatGPT Team for the office, Copilot for the two people who write code, or an AI feature that showed up inside the CRM you already pay for. Whatever it was, it stuck. People use it every day, and if it disappeared tomorrow, someone would notice before lunch.
On August 29, 2026, OpenAI told Cursor, one of the most widely used AI coding tools, that Cursorās access to OpenAI models ends on November 12. There was no outage, no price change, and no wrongdoing on Cursorās side. Cursor had just been bought by SpaceX, and OpenAI decided it could not trust the new owner to honor its terms. Cursorās CEO wrote that they had ātrustedā¦
https://avdi.codes/182978-2/?utm_source=rss&utm_medium=rss&utm_campaign=182978-2
My position on AI has been extremely boring and is basically, āif something is currently happening, the people who are saying that itās impossible that it will ever happen are probably wrongā.
danluu.com: How Accurate Have Ed Zitronās AI Skeptic Predictions Been?
Youāve probably heard the word āagentā in every AI pitch youāve sat through this year, from vendors, from consultants, maybe from your own team. It gets used to describe everything from a customer service chatbot to a fully autonomous system nobodyās watching, which means the word alone doesnāt tell you much.
We build these systems for a living, and even we donāt reach for an agent by default. In this article, youāll learn what an AI agent actually does differently from a chatbot, what that looks like on a real project, and how to tell if your business has a task thatās actually a good fit for one.
What an AI Agent Actually Does
Most of what gets called āAIā in a business tool today isā¦
A while back I wrote about organizing configuration in Rails. The idea was simple: drop YAML files into config/configurations/ and get namespaced constants like Config::Bot.api_key instead of the clunky Rails.application.config.bot.api_key.
It worked well. But every YAML file needed manual wiring: <%= ENV.fetch("BOT_API_KEY", Rails.application.credentials.dig(:bot, :api_key)) %>. For every key. Across every file. Ugh!
So I rebuilt it. Same clean Config::Namespace.key API, but now it chains through all three sources automatically.
Before (old moduleās YAML):
# config/bot.yml
shared:
api_key: <%= ENV.fetch("BOT_API_KEY", Rails.application.credentials.dig(:bot, :api_key)) %>
user_agent: "Mā¦
After (new moduleās YAML):
# config/bot.yml
shared:
# Config::Bot.api_key is still available andā¦
Gusto runs payroll for 500,000+ businesses on one of the largest Rails monoliths anywhere. Why a team this strong hired Evil Martians for Sidekiq at scale, what running background jobs at that size actually takes, and when to stop waiting for the perfect hire.
Gusto is the payroll, benefits, and HR platform for more than 500,000 businesses. In May 2026, it crossed $1B in annual revenue, cash flow positive, last valued at $9.3B.
Berlin.rb is a new monthly meetup for people who write Ruby, or are curious about it. A few of us from Berlinās Ruby community are organizing talks, project show-and-tells, and time to meet other people who work in the same language. Itās free and open to anyone, whether youāve been writing Ruby for fifteen years or installed it last week.
The first one is Tuesday, September 8, 18:45, at Potsdamer StraĆe 121. Use the Grover entrance next to Rossmann and head to the third floor. The evening is hosted and sponsored by ablefy, with drinks and snacks provided. After that, the second Tuesday of every month.
Register here. If you canāt make it to Berlin, thereās a livestream and itāll be on Youā¦
Theā¦
https://avdi.codes/182801-2/?utm_source=rss&utm_medium=rss&utm_campaign=182801-2
Weāve spent years loading an extraordinary number of responsibilities onto the humble code review: quality gate, security check, architecture review, mentoring mechanism, knowledge-sharing system, ownership model.
Rachel Laycock (rlaycock@thoughtworks.com): Maybe We Shouldnāt Be Reviewing All This Code
Claude Fable 5.1 dropped yesterday. See how it handles real Rails tasks, and where it landed on the leaderboard today. We also finally have a name for the stealth model from the last round.
Fable 5.1: We have a new best.
Fable 5.1 scored as well as Claude Opus 5 on accuracy, but surpassed it in all other marks (including price!). And it does security work now.
Fable 5.1 solved 58 of 63 runs (92%), matching Claude Opus 5 at the top of the leaderboard, and passed 20 of the 21 tasks at least once. Here is how it compares:
- Claude Fable 5.1: 58 of 63, $75 for all 63 runs, 5.4 minutes median per run.
- Claude Opus 5, the sole leader until now: 58 of 63, $120, 9.7 minutes.
- Claude Fable 5:ā¦

Efficiency is the clearest difference between 5.1 and the previous generation: the bill is ~50% lower than Fable 5ās and ~40%ā¦
Jim Remsik, founder of Flagrant and organizer of XORuby, joins David to talk about what heās learned from taking a Ruby conference on the road.
XORuby was designed around a simple premise: traditional conferences are valuable, but travel costs, time away from work, and family responsibilities put them out of reach for many developers. Jim explains how XORuby tries to lower those barriers with inexpensive, one-day regional eventsāand why he measures their success as much by first-time attendees, new speakers, friendships, and community connections as by the financial bottom line.
The conversation turns to Flagrant and the rapidly changing role of AI in software development. Jimā¦
4.0.20 Released
RubyGems 4.0.20 includes enhancements, bug fixes and documentation and Bundler 4.0.20 includes enhancements, bug fixes and documentation.
To update to the latest RubyGems you can run:
gem update --system [--pre]
To update to the latest Bundler you can run:
gem install bundler [--pre]
bundle update --bundler=4.0.20
RubyGems Release Notes
Enhancements:
- Print a release notes link instead of the whole changelog on
gem update --system. Pull request #9794 by hsbt - Installs bundler 4.0.20 as a default gem.
Bug fixes:
- Only coerce exact true and false gemrc values to booleans. Pull request #9822 by hsbt
- Make the gem CLI work under RUBY_BOX=1. Pull request #9810 by hsbt
Documenā¦
Welcome to week three of our 2026 sponsorship drive! (Donāt forget to catch up on weeks one and two, or skip ahead to week four).
Progress from week two
We received two one-time individual contributions and one new monthly individual sponsor since our last update, bringing us another $760 closer to our goal for 2026. (Iām basing these estimates on monthly sponsors sticking with us for at least 12 months ā weāll do everything we can along the way to show how your support is helping!)
This puts us at $3.1k out of the additional $15k weāre looking to raise. Please continue to spread the word about our goals and our fundraising, every bit counts!
Q&A with Carolyn Cole
This week weāre luckyā¦
Frequently Played š
I tend to listen to the same songs or albums on repeat that are evocative of how Iām feeling or whatās going on with me. Here is what Iām currently listening to over, and over, and over, and over, again.
Jolene š
Thanks for the name Dolly. And for modeling how to be yourself without compromising yourself.
I had to have this talk with you
My happiness depends on you
Gasoline š
This is a pretty good collection of Halseyās summer tour performances.
I think thereās a flaw in my code
These voices wonāt leave me alone
Well my heart is gold and my hands are cold
Itās been 8 years since the first just-in-time compiler was introduced in Ruby. However, throughout this time, the garbage collector has been a black box to the JIT compilers. This meant that JIT compilers were not able to optimize any object allocations and instead had to perform function calls. This has all changed now that we have integration of the GC fastpath into ZJIT. In this article, weāll be looking at how object allocations work in the GC, what it means to inline the GC fastpath into ZJIT, and the performance implications.
Object Allocation
In Rubyās default GC, object allocations previously used a free list based allocator. The free list allocator keeps a linked list of allā¦
You approved an APM tool at a modest monthly rate. A year later, the renewal invoice bears little resemblance to what you signed, and nobody remembers deciding to spend that much more.
APM is worth having when itās used well: it resolves incidents faster by showing you where in the stack a problem started, it gives you warning before a threshold alert turns into an outage, and it gives you a defensible answer when a client or stakeholder asks whether you hit your SLA (often measured through percentile response times like p95 and p99). None of that is in question here. What tends to go unexamined is whether the bill still matches what youāre getting for it.
In this article, weāll walkā¦
Eddie Galindo is an engineering lead at Ascend and Kagen Hearn is a senior software engineer there, working on a Rails app that helps insurance agencies move and reconcile money.
Robby, Eddie, and Kagen get into why Ascend still runs one Rails monolith five years in, what needed attention when much larger customers started arriving, and how the team went about finding the real limits of their data ingestion pipeline. They also get into feature flags versus database configuration, and where AI tooling fits in when the software you ship moves money.
Links:
Listen to this episode (1h 24m) or subscribe to On Rails in your podcast player.
Tracing helps answer an important question: what happened? But knowing what happened isnāt the same as knowing whether it was any good. Thatās where evaluation comes in. And if you already have traces running in production, youāre closer to a solid evaluation system than you might think.
In this post, weāll walk through the core evaluation loop, how to build an evaluation dataset from production traces, and how to use evaluation signals to debug and improve your application.
Introduction
In the previous post, we explored the foundations of LLM observability and tracing. We discussed how traces give you visibility into your LLM application by capturing the full sequence of events acrossā¦
Ruby 4.0 was released on December 25, 2025, and three features get cited most often when people talk about it: ZJIT, Ruby Box, and a reworked Ractor API.
Two of those three features are experiments you have to turn on deliberately. The third one removes methods.
In this article, we will go through what ZJIT, Ruby Box, and the new Ractor::Port API actually do, and which of them can force you to change code when you move from Ruby 3.4 to 4.0.
ZJIT
ZJIT is a new just-in-time compiler, described in the Ruby 4.0.0 release announcement as the next generation of YJIT and built by the same team. You enable it with the --zjit command line flag, at runtime with RubyVM::ZJIT.enable or evenā¦
10 anti-AI slop moves for frontend projects going faster than humans can review

Ten checks that catch what AI-written frontend code hides: contract codegen, boundary linting, mutation testing, and dead-code detectors.
Ten thousand lines of code in a week used to mean a team. With that team came institutional memory, and every bit of code had a person who knew why it looked as it did. Now one "person" can put out ten thousand lines in a week. But our new "co-authors" don't remember what we agreed yesterday, don't have to answer for production, and won't be around in six months toā¦
A couple of years ago, we rewrote Judoscaleās marketing site from NextJS to Ruby on Rails. I enjoyed the process so much that I made a video sharing how it worked, and Jon wrote a spicy piece arguing that Rails was a perfect fit for mostly-static marketing sites like ours, and that you shouldnāt waste your time with JavaScript frameworks that were all the rage at the time.
A lot has changed since then (duh!), and I wanted to revisit this topic to share my current take. Jonās gonna chime in later with his take as a bit of a rebuttal. Itās healthy to disagree, but rare to see it in a blog post. Let us know what you think of the format!
Adamās take
I recently built a newā¦
Active Admin does a lot of heavy lifting on Rails projects, providing a nice way to quickly build out an admin backend for your application. One thing it does is try to be clever with deciding on the name for a model.
You might have noticed if you just mention a model, and that model has a name method or attribute, that Active Admin will automatically pick that up.
On some projects you want some additional control over this, because maybe name should be a formatted version, but other parts of your app need something else. Active Admin gives us a few ways to address this.
Use display_name
Active Admin will default to looking to see if the model responds to display_name first, which weā¦
On a recent project we needed Active Admin to show a dropdown box that automatically updated depending on other selections happening on a form. This isnāt supported out of the box by Active Admin, but is quick to add yourself.
Bonus points, we get to use jQuery!
Create a new controller action to handle filtering
You have a number of choices for how you go about this, exactly where you place this Controller and/or Action will depend on what makes sense for your project. In our project it made the most sense to have an AdminFiltersController controller. Which would house all of our filters. Other projects will prefer to keep these Actions tied to the model youāre acting on.
The specificsā¦
Request for Comments (RFCs)
Request for Comments (RFCs) are the official guiding documents that shape the internet via technical standards, protocols, and procedures. This encompass the following:
-
HyperText Transfer Protocol (HTTP)
-
Transmission Control Protocol (TCP)
-
Internet Protocol (IP)
-
Domain Name System (DNS)
-
Transport Layer Security (TLS)
RFCs are also the primary output of the Internet Engineering Task Force (IETF) which was founded in 1986.
The following will help you stay on top of the ever changing RFC landscape.
Highlights
There are a lot of RFCs to read through. At the time of thisā¦
Software Foundation Musings
For the last several months, I've been incredibly busy. With our former executive director's departure, I've picked up extra work supporting the board and staff, especially in preparing for RubyConf.
Two years ago, when I stepped into this role, I started by observing where we stood as operators of RubyGems. A few gaps jumped out at me: lack of governance, no formal policies, and thin internal documentation. These weren't just nice to haves; I flagged them as critical from the start. What I didn't see yet was that they were also the backbone of a strong software foundation. That realization led me to a bigger question: what would it take to close the gaps standing between us and becoming one?
ā¦Pulp Opus
Human slop
This is gonna sound bitter, but hey. I take my whisky neat.
Why has it become a thing that people must use social media to give commencement speeches about every Ā· fucking Ā· thing in their life?
To be clear, I have nothing against you soaring through your personal growth in a permanent state of child-like wonder like the absolute Peter Pan you are, learning profound wisdoms from every new shape of eye floater youāve rubbed into your retina. Be you, king. But holy hell, why has it become the rite of passage for every clown promoting something to share daily life lessons on social media?
A daily, unstoppable firehose of something that should by definition⦠take a while.
I pooped today.ā¦
We are all juniors again
We are all juniors again
A long, long time ago, when Akinator was the peak of āadvanced AIā on the internet, before services became micro, and deployments meant sending a file directly from a local computer via FTP to a server, I was introduced to the Dreyfus Skill Model. As a junior dev back then, I liked it because it explained why my senior and architect colleagues could sometimes make impactful decisions intuitively, while I, on the contrary, was expecting step-by-step instructions on how to convert HTML form input into a database row.
In short, the Dreyfus Skill Model describes that when learning a new skill, a learner goes through 5 stages to acquire it:
- Novice. We need/expectā¦
Direct link to podcast audio file
The summer heat has finally broken here in Shizuoka, and I'm enjoying a cool, wet, and cloudy day huddled around my microphone for warmth. I hope you'll join around my verbal campfire for yet another one of these.
As always, you can e-mail the show at podcast@searls.co. Only a small proportion of listeners will ever write an e-mail, so I now offer a second option: the justin.searls.co/feedback form. People love filling out forms! Go try it out! Check the anonymous checkbox! Hell, enter a fake e-mail addressāsee if I care!
Stuff we talked about, in order of me talking about them:
Been sick as a dog ever since I wrote my last weeknotes, so thereās not a lot to report here except general feelings of uselessness. Good news, though: Iām now on antibiotics and hoping to be back to normal within a few days. š¤Ā
In my brief moments of lucidity, I managed to push forward a couple of things: a clearer API for validating operation arguments, and working with Aaron to add native style support to Dry CLI.
Two Puma workers try to assign the same user to the same customer account.
One request comes from an administrator. The other comes from an invitation acceptance that reached another process at nearly the same time. Both use the ordinary Active Record lifecycle, and both records pass validation.
A later query finds two active seat assignments:
SeatAssignment.where(account_id: 42, user_id: 7).count
# => 2The model appears to prohibit that state:
class SeatAssignment < ApplicationRecord
belongs_to :account
belongs_to :user
validates :user_id, uniqueness: { scope: :account_id }
endNothing skipped validation. Neither write used update_all, insert_all, or raw SQL. Each worker asked theā¦
Finally figured out a bulletproof system for landing on the best model for the job.
CVE-2026-80212 (resolv): CVE-2026-80212 - Memory exhaustion through malicious DNS responses
CVE-2026-81097 (rails-mcp-server): The execute_ruby tool is documented as a read-only Ruby sandbox
Adventures in Daylight Saving, Norfolk Island, and Time Zone Math (in Ruby)
distance_of_time_in_words is a small Ruby gem that turns two Time objects into a human-readable string like ā3 days and 4 hoursā. Several separate bug reports against it turned out to be variations on the same theme: computing a duration between two timestamps is not the trivial subtraction it looks like, the moment time zones are involved. The first two fixes shipped in dotiw 5.6.0; four more followed shortly after in dotiw 5.6.1.
Bug 1: dst? Lies When You Least Expect It
#63 reported that a duration of one minute was rendered as āless than 1 secondā for users in Europe/Dublin. The gemās TimeHash had a DST correction that looked reasonable:
d = largest - smallest
d -= 1.hour if smallest.ā¦Moon Crimes
Shopping for an anonymous VPN service is so weird because all the marketing and all the reviews are like DO YOU WANT TO DO CRIMES? DO YOU WANT TO DO DOUBLE SECRET CRIMES? DO YOU WANT YOUR PACKETS TO COME FROM THE MOON? DO YOU WANT TO DO MOON CRIMES WHILE WE PROJECT A PLAUSIBLE HOLOGRAM OF YOU IN TIMES SQUARE? DO YOU WANT NO LOGS OF YOUR CRIMES? DO YOU WANT US TO ERASE THE GOVERNMENT WHEN THEY ASK FOR YOUR LOGS?
And here I am just wanting decently fast secure connections from coffee shop wifi without every website being like āum, your IP is listed in our database as āMOONCRIME6ā, are you sure you arenāt a crimebot?ā
Hi, itās Greg. Letās explore this weekās changes in the Rails codebase.
Agents on Rails: lemans goes open source
Another week, another update from Agents on Rails. This one is a big one: lemans,
the harness behind every number weāve published, is now open source. Also four
new models were added: Sonnet 5, Terra, an open-weight Qwen you can run on your
own machine, and one that wonāt tell us its name.
Actionpack ractorize
This Pull Request changes the following:
- Make
ActionDispatch::ParamBuilder.defaultractor safe by using singleton class attr accessor. - Make
ActionDispatch::Request::LOCALHOSTractor safe by freezing the regex. - Make
ActionDispatch::Response.default_charsetandActiā¦
Additionally, prefixed partial names were made ractor safe and reset_primary_key was also made ractor compatible.
Replacing a business-critical legacy system does not have to mean committing to a risky, all-at-once rewrite. The strangler fig pattern offers a practical alternative: migrate one capability at a time, run the old and new systems side by side, and gradually retire the legacy code as each replacement is validated. This post walks through how it works, where it fits, and a practical Rails-based example of migrating one piece of functionality without stopping the business to do it.
The Problem: A Business-Critical System Youāre Afraid to Touch
Most organizations donāt wake up one day and decide to replace a legacy system. It happens gradually, as the cost and risk of maintaining the systemā¦
MCP Implementations and Rails World Preparations
Andrew and David catch up on everything from wild weather and the upcoming Rails World conference to Andrewās latest deep dive into MCPs (Model Context Protocols). Andrew shares what heās learned while building an MCP for a Rails side project, including choosing the official Ruby MCP SDK, discovering the limitations of resources versus tools, and wrestling with OAuth and Doorkeeper authorization. They also look ahead to Rails World in Austin, highlighting talks on Active Search, Ractors, Herb, Action Text, Solid Cable, custom Rails generators, and appropriately enough MCPs.Ā
Links:

