Rubyland

This week, Anthropic shipped a new messaging feature to Claude Code. It sounds innocuous enough:

Cross-session messaging lets Claude deliver a message from one of your Claude Code sessions to another. When a change in one session breaks what another is building on, Claude can warn that session before you notice. When one session settles a question another is blocked on, Claude can send the answer across.

And because I sometimes have multiple agents working in the same project simultaneously, it didn't take long for them to start coordinating behind my back so as to avoid interfering with each other's work:

Also, another Claude session (working on performance rugs) pinged mid-turn; I told…

When we think about Ruby code coverage, our go-to gem for this is SimpleCov, which works great when the test suite uses Minitest, RSpec, Cucumber, Capybara, and all these tools that are integrated with Ruby and Rails. But many applications also use other tools like Playwright or Cypress to run e2e tests, and we can’t use SimpleCov the same way.

Most of the time, what we have seen is that the Ruby code executed when running these tools ends up left behind and not being counted for the total code coverage, even though we know the code is actually being tested.

Sample Application

To make it easier to try this, we created a sample application that uses the cypress-on-rails gem along with…

AI Adoption Is More About Culture Than Tools

A few weeks ago, we sat down with a potential client for a project kickoff conversation. The goal was to find out how we could help them integrate AI into their company. Their whole team joined the call, about 15 people, and within the first ten minutes, it was clear everyone had a different idea of what “using AI” meant to them.

One person wanted an easier way to schedule meetings. Another wanted AI to summarize call notes. A few wanted to search through years of client history. Some of what people described, honestly, was closer to plain automation than a need for artificial intelligence. More than a few people in the room were hesitant to…

The problem with our old setup

PDF generation is a core part of Gusto’s business. To serve our customers, we generate reports, invoices, tax documents, employee handbooks, and more. Many of these features relied on a now-deprecated library: wkhtmltopdf.

That reliance had become a liability. Maintenance on the library had stopped, which meant no more security patches. It rendered HTML using WebKit, an engine that had drifted away from how modern browsers display the same markup, so our PDFs didn’t always come out the way we expected. And because PDF generation is memory-intensive by nature, it put pressure on the other services it shared resources with.

Why build a new service?

We decided to…

I love Ruby and it is my goto scripting language. Even in the age of AI, I like to write short custom scripts for my tool arsenal. One way to find subdomains of a potential hacking target is to initiate a DNS zone transfer. You can use various shell tools for this, but if it is part of a process(my case), it might be easier and more flexible to just script it in Ruby. I decided to use the dnsruby gem to save some work, otherwise I would need to do a TCP connection to the nameservers myself. For the sake of demonstration, I converted my script into a command line one, that will accept 2 parameters, the host and an optional IP address of a nameserver:

The method

This process applies the scientific method to a defect. The six phases are the steps of that method. They carry the names a developer uses.

Scientific method       Phase                      You produce
-----------------       -----                      -----------
Build the apparatus     1. Build a feedback loop   one command that goes red on this bug
Observe under control   2. Reproduce and minimise  a minimal case that repeats
State the hypotheses    3. Write the hypotheses    3 to 5 ranked causes, each with a prediction
Run the experiment      4. Instrument              one probe per prediction, one variable at a time
Confirm the result      5. Fix and add a test      a…

If you need more context on why Rails needs a new leadership, here is David Celis summing it up a year ago, Paul Battley a few weeks ago, and—even though it is hard to believe—it even got worse since then.

How could a fork even work?

Rails is a huge code base and has multiple engineers who can invest significant work time into improving it. How could a few people fork and maintain it in their free time? Because Rails is done. Since I started to update The Rails 5 Way to Rails 6 (and then later 7 and 8), I’ve been monitoring the changes to Rails closely:

If you generate a Rails application with rails new --minimal, you only get the core parts of the framework (railties, actionpack,…

transaction is one of the few Active Record APIs that reads like a promise. Wrap the work in a block, and either all of it happens, or none of it does.

An account upgrade shows where the reading breaks:

Account.transaction do
  account.update!(plan: "growth")
  ProvisioningClient.enable_growth_features(account.external_id)
  AuditEvent.create!(account:, action: "plan_upgraded")
end

A validation added to the AuditEvent a week earlier rejects the new audit record, so create! raises ActiveRecord::RecordInvalid. The SQL log ends the way it should:

BEGIN
UPDATE "accounts" SET "plan" = 'growth' ...
INSERT INTO "audit_events" ...
ROLLBACK

The account row goes back to starter, so the ticket is closed as…

Direct link to podcast audio file

We cut our trip a day short, so I found myself with a totally free day with no plans. Naturally, I wasted it by recording a 3-hour podcast. Dang.

I always enjoy shooting the shit with/at you, and if you'd like to be a more active participant in the shit-shooting, then hit me up at podcast@searls.co. Really, I'll be nicer to you than I am to Sam Altman and Tang Tan. I promise.

Back to manually writing links. The zen of monotonous input tasks is suddenly something to be cherished in the current era.

• Mandibular Advancement Device
• Better With Becky
• Why doesn't the U.S. have small elevators like Europe and China? (News+)
• My 240hz gaming QD-OLED (and…
…

After Rails’ Dear Leader DHH once again espoused far-right views on his blog (which I’m not going to link to here), some of the Ruby community said “enough is enough” and decided to fork Rails into a project called Amiko. I don’t want to mince words here, so I’ll talk straight: I think this is a vain attempt at virtue signalling, and will ultimately end up achieving very little.

The Amiko project has started out this fork by renaming all the Rails things into Amiko flavoured things. They have amiko-pack, amiko-view, and so on. All the rails commands are now amiko commands. The structure of the framework remains the same, so far.

The momentum behind the Rails framework itself is monumental…

Some things that should have worked all along finally do… like alias_attribute in associations, pluck on unsaved records, search_field with autosave: true. The rest of the week went into sharper SQL logs, sturdier job continuations, and more Ractor-ready registries. Here’s what’s new in Rails:

Matz is coming to Rails World 2026!
Ruby creator Yukihiro “Matz” Matsumoto is coming to Rails World 2026! He’ll join DHH, Aaron Patterson, Robby Russell, and the rest of the lineup in Austin this September, and the full conference agenda is now live. If you’ve been waiting to see what’s planned before grabbing a ticket or planning your schedule, now’s the time to take a look.

Fix pluck ignoring…

Irina Nazarova and Vladimir Dementyev from Evil Martians return to preview the second annual SF Ruby Startup Conference and share what they learned from bringing the event to life for the first time. They discuss the conference’s new focus on ambitious builders, the importance of creating meaningful connections for attendees, and why Ruby on Rails remains a powerful foundation for startups tackling difficult, real-world problems. The conversation also explores open-source innovation, AI-assisted development, hidden pockets of Ruby adoption, and how the community can help the next generation of companies confidently build and grow with Rails. Hit download now!

Links

• Chris Oliver X
• Andrew Mason…

Hi everyone!

Rails World 2026 is just 47 days away, and we have a few fun updates for you. If you haven’t already, you can grab your ticket here.

Now for the updates:

Matz is coming

Big news first: Matz is coming to Rails World 2026! He’ll sit down with DHH on day 2 for a fireside chat. It’s been two years since the last chat in Toronto, and so much has changed since then. We’re living in a different world, so we wanted to bring these two together on stage again to chat about Ruby, Rails, AI, and what the future holds for programming.

Attendees will be able to submit their questions beforehand. This session was made possible by the generous support of our Event Partner and sponsor, Sho…

August 6, 2026 Most Rails applications that implement multi-tenancy eventually face the same question: Where should the PostgreSQL tenant context be established? Many implementations set the tenant at the controller or middleware level. While that identifies the current tenant, it doesn't necessarily guarantee that every database connection carries the correct PostgreSQL session state. A cleaner … Continue reading Hooking into ActiveRecord’s Connection Pool: A Clean Way to Enable PostgreSQL Row-Level Security →

Where are the benefits of using AI? Last Monday I woke up with this question on my mind, I, from my corner of the world far away from big techs, millions of dollars, datacenters, posts on X and LLM-generated posts on LinkedIn.

Eight years ago I started working as a programmer, two at the company where I am currently and one since they started pushing us to use AI to accelerate the development process. I don’t deny that my speed for spitting out code has increased, solving problems has become faster and reaching solutions is less complicated. But what sense does it make if I drift away from what I like most: using my capacities and knowledge to write code that solves a problem and then,…

If you work on Rails for a living, you clone repositories you didn’t write all week long: a gem you’re debugging, a client’s application you’re about to audit, a bug reproduction attached to an issue. For years, opening one of those in your editor was the safe part. You were reading someone else’s code, not running it, and the only real rule was to not run anything until you had looked.

That rule quietly stopped being enough. AI coding editors like Claude Code and Cursor read project-local configuration the moment you open a repository, and some of that configuration is executable. A repo you cloned five seconds ago can hand your editor a command to run before you have read a line of it,…

You run bundle update, kick off a build, and asset precompilation stops on this:”

cssbundling-rails: Command install failed, ensure bun is installed
Tasks: TOP => assets:precompile => css:build => css:install

Except your application uses Yarn. It has always used Yarn. Nothing in the project references Bun, and nobody on the team added it.

This is not an exotic edge case. It can happen to ordinary Yarn applications, and it lingers because the fix has been merged upstream but never released. In this post, we’ll walk through why cssbundling-rails misidentifies your package manager, and how to unblock your build.

The Short Version

cssbundling-rails 1.4.3 added yarn.lock to the list of……

You’re evaluating AI vendors for a company-wide rollout, and every conversation ends the same way: it’s safe, it’s anonymized, we have guardrails. We’ve watched this play out recently, and the questions don’t stop at that answer. Safe how, and which guardrails are actually in place to prevent a leak? Vendor reps tend to stall on the specifics: how access is managed at the level of an individual AI agent, not just the account, and which models and model providers are actually involved, with what safety assurances at each one, not because they’re hiding something, but because “we have guardrails” is often as far as the pitch was built to go.

That gap is worth taking seriously, because the…

This is part 2 of a two-part series. Part 1 covered controllers and lifecycle.

Controllers connect and disconnect. That is not useful on its own. The value comes from three things: referencing elements inside the controller, handling events without inline JavaScript and reacting to data changes. Stimulus calls these targets, actions and values.

Each maps to a distinct JavaScript feature. And none of them repeat the tricks from part 1.

Here is the code. See the full commit on GitHub.

Targets: dynamic getters

A target is a named element inside a controller’s scope. Declare it in the class and get a getter for free:

class HelloController extends Controller {
  static targets = ["name",…

The getter this.nameTarget returns the first element…

The RubyGems guides at guides.rubygems.org are read by more than humans these days. AI agents fetch them to answer questions about building, publishing, and installing gems. Evil Martians’ Ruby/Rails LLM discoverability scorecard asks how easily an agent can find and read Ruby documentation, and the guides had no good answer. There was no machine readable index, and no way to get a page without its navigation and markup. This week we merged three changes that close both gaps.

The first change adds sitemap.xml and robots.txt (rubygems/guides#523), giving crawlers a complete map of the site. The robots.txt allows everyone, AI crawlers included. Some documentation sites have gone the other…

As you may know, one area of Ruby performance optimization that particularly interests me is memory usage. Given that most Ruby deployments rely on fork, improving Copy-on-Write performance is generally where you get the biggest bang for your buck, but that only helps with the somewhat static part of an application heap.

A significant contributor to memory usage is also the transient memory that is allocated during a request or job cycle and released soon after. As such, it’s also interesting to keep an eye out for opportunities to make various Ruby objects smaller.

And the Ruby object type that’s probably the biggest contributor to memory usage is likely Hash. Hash instances are…

When you have to fix an accessibility issue without interrupting users- here's what that actually looks like in a mature Laravel app.

Continue Reading

We're excited to welcome Rubyroid Labs as a Ruby Alliance Supporter, joining a growing group of organizations investing in the long-term health of Ruby and its open source ecosystem.

Every day, millions of developers rely on RubyGems.org without thinking twice about it. That's exactly how great infrastructure should work—reliable, secure, and always there when you need it.

Keeping it that way takes a community.

Since 2013, Rubyroid Labs has helped startups and enterprises build and scale Ruby on Rails applications while actively giving back to the Ruby community through conferences, education, and technical content. Now they're expanding that commitment by contributing engineering resources to…

Tailwind CSS has become a very popular CSS framework, and it can speed up development. But using it without proper caution can add mayhem to your code. Learn best practices to avoid getting swept away!

Working with Tailwind CSS is pretty fast and easy (that's why it's received such wide recognition). You just paste a list of different classes in your HTML—and your interface immediately becomes attractive! But, as the application grows, the lists of classes grow. Then, one day you realize you can't understand your code, you're confused with the structure of the application and…

I'm happy to announce that Karafka 2.6 and Karafka Web UI 1.0 have just been released.

For those new here: Karafka is a Ruby and Rails multi-threaded, efficient Kafka processing framework, and its Web UI is a monitoring and management dashboard that ships alongside it. As with every release in the 2.x line, this is a continuation rather than a rewrite - you upgrade, apply a couple of small changes, and keep going.

On the surface, 2.6 is a focused set of features - redesigned Declarative Topics, dynamic worker pool scaling, a new low-level offsets API, and lag compensation for paused partitions. Underneath, it is the largest internal reorganization the framework has seen in years. Almost…

Rails Foundation Executive Director Amanda Perino joins David to preview Rails World 2026, the conference’s first year in the United States.

Amanda shares how the team is bringing Austin’s personality into the event through live music, barbecue, sponsor experiences, a mechanical bull, the returning Buzzsprout podcast booth, and Rails World’s biggest lightning-talk stage yet. She also discusses the opening keynote livestream, the lightning-talk CFP, ticket availability, and what attendees should expect as the conference approaches.

The conversation then turns to the Rails Foundation itself. Amanda explains how the rapid growth of AI has forced the organization to reconsider how it…

Finally, Netflix you can chill.

RubyGems 4.0.18 includes enhancements, bug fixes and documentation and Bundler 4.0.18 includes enhancements, bug fixes, security and documentation.

To update to the latest RubyGems you can run:

gem update --system [--pre]

To update to the latest Bundler you can run:

gem install bundler [--pre]
bundle update --bundler=4.0.18

RubyGems Release Notes

Enhancements:

• Check the resolved parent directory before extracting old format gems. Pull request #9755 by hsbt
• Installs bundler 4.0.18 as a default gem.

Bug fixes:

• Call Kernel.format explicitly in Gem::Deprecate wrapper. Pull request #9714 by hsbt

Documentation:

• Point bundler.io URLs at guides.rubygems.org. Pull request #…

You saw the advisory for CVE-2026-66066, the Active Storage vulnerability in the way Rails processes image variants with libvips. You bumped activestorage to the patched version, ran your tests, deployed, and moved on. That is the responsible thing to do, and for most Ruby vulnerabilities it would be the whole job.

This one is different. The patched version of Active Storage will not run on an old copy of libvips. It raises an exception during boot and refuses to start:

/usr/local/bundle/gems/activestorage-8.1.3.1/lib/active_storage/vips.rb:36:in '<compiled>': libvips's unfuzzed operations are not safe to use with untrusted content, and Active Storage cannot disable them. Disabling them r…

libvips is a system library that lives…

This is part of an ongoing series of Ruby Runway Spotlights, celebrating the founders who took part in the inaugural Ruby Runway Showcase at RubyConf 2026. Each spotlight is a chance to hear directly from the builders turning Ruby into real, live businesses, and to cheer them on as they keep going.

Tell us your name, your startup, and what it does in one or two sentences.

I'm Joe Masilotti, and I help Rails developers deploy to the mobile app stores. Ruby Native builds real iOS and Android apps from the HTML and ERB you already have, without writing Swift or Kotlin.

What problem are you solving, and who feels it most? How does your Ruby-powered solution change things for them?

Your customers…

We designed and shipped a fresh AppSignal homepage in code, then validated it in an A/B test with a 14% lift in activated users.

AppSignal is an established APM platform used by thousands of engineering teams that combines error tracking, logs, and uptime in one product. For its 2026 homepage, Evil Martians imagined a bold creative direction, built it with LLMs, and shipped it straight into an A/B test. Early data shows…

In a previous post, AI Assistant for Our Blog Writing Process, I introduced the assistant we built to help with our blog writing. At the core of that assistant is an MCP server, which serves as the source of truth for both of our blogs. It exposes that knowledge through tools the client can call and documentation the client can read.

Getting an MCP server running is the easy part. Every quickstart, in every language, gives you a server that runs as a subprocess on your own machine and disappears when the client exits. That’s enough to experiment locally, but it’s a long way from something a team can rely on. Once you want to deploy it, questions about where it runs, state management,…

If your business runs a support chatbot, or if someone on your team uses an AI tool to draft marketing copy, you already have an AI system in scope of the EU AI Act’s transparency rules. You don’t need to be doing anything exotic or high-risk to be covered. As of August 2, 2026, these rules are binding, and the European Commission’s AI Office, together with national market surveillance authorities, can enforce them.

That catches a lot of businesses off guard, because most of the coverage of the AI Act so far has focused on high-risk systems: hiring tools, credit scoring, biometric surveillance. Those obligations are real, but they’re not due for a while yet, more on that below. The…

RSpec Expectations: You're Probably Using the Wrong Matcher August 3, 2026 If you've been writing Ruby tests for a while, chances are you've reached for eq more times than you can count. While it works for many scenarios, RSpec Expectations offers a much richer vocabulary for expressing intent. Choosing the right matcher isn't just about … Continue reading RSpec Expectations: You’re Probably Using the Wrong Matcher →

It’s possible to programmatically upload images to GitHub Issues, Pull Requests and Comments via automation. Finally, though maybe mistakenly, I dunno.

It’s fairly well known that for the longest time, GitHub has not had a programmatic interface for uploading images and attachments. It’s possible in the browser, by dragging-and-dropping your image, but not via something you can script or curl. That’s been a bummer for lots of GitHub Action-powered systems you might imagine, like: automatically attaching demo screenshots or videos on PRs for new features, or attaching failure screenshots or visual diffs from browser tests.

Until now, I guess. Here’s the unofficial,…

In our previous post, we treated Zod schemas as agent-readable contracts. But a schema is just a hypothesis; without tests, you’re shipping vibes. This post dives into how we operationalized these schemas, set up a testing suite on Braintrust, and started scoring AI output against our design system.

We set up an experiment with 167 hand-written prompts across 25 components, plus a second dataset built from real engineer requests. Each prompt is a plain-English UI request (e.g., “a primary action button that confirms saving”). The model receives the component’s schema and…

Frequently Played 🔗

I tend to listen to the same songs or albums on repeat that are evocative of how I’m feeling or what’s going on with me. Here is what I’m currently listening to over, and over, and over, and over, again.

Atlantic City 🔗

I just got my hands on the Expanded Edition of Nebraska. Easily a top 5 Springsteen album for me. I’m not sure the Expanded Edition added much for me though.

Full Lyrics

Down here, it’s just winners and losers
And don’t get caught on the wrong side of that line

Free 🔗

This is still, I think, the most important song released this decade to me.

Full Lyrics

The feeling comes so fast and I cannot control it
I’m on fire, but I’m trying not to show it

An account upgrade starts with an ordinary assignment:

account = Account.find(42)
account.plan = "growth"

account.changes_to_save
# => {
#   "plan" => ["starter", "growth"]
# }

The object has the right value. Dirty tracking has the right transition, but the save fails:

account.save
# => false

account.errors.full_messages
# => []

The row remains on the starter plan. The SQL log contains no UPDATE.

That missing UPDATE is useful evidence: save stopped before the adapter attempted the row write. It does not yet tell us what stopped it.

The cause lives in a concern included by Account:

module BillingMigrationGuard
  extend ActiveSupport::Concern

  included do
    before_update…

Hi, it’s Vipul. Let’s explore this week’s changes in the Rails codebase.

Nominations are open for the 2026 Rails Luminary Awards
The Rails Foundation announced that nominations are open through August 21. The awards recognize people who have significantly advanced Rails for the benefit of the community.

Rails versions 7.2.3.2, 8.0.5.1, and 8.1.3.1 have been released
These security releases address a possible arbitrary file read and remote code execution vulnerability in Active Storage variant processing. Please upgrade as soon as possible.

Stop filtering i18n paths on initialize
Removes redundant path-globbing work during i18n initialization, cutting the load time from 400 ms to about…

I was recently part of a Mastodon discussion about the best way to run code in a Rails application before Puma boots. The need for this is that sometimes you want some code that only runs within a webserver, not when running rake tasks or rails commands or opening the console.

Here we go…

Via server do blocks

Rails 6.1 added a Railtie#server hook that can be invoked in application.rb or a gem’s engine.rb. It’s invoked when the config.ru file is evaluated.

Warning: the invocation of the hook in config.ru is missing from a lot of Rails projects. I once lackadaisically tried to address this upstream, but doublecheck your config.ru actually contains Rails.application.l…

In your config.ru

The Rackup configuration file…

Chris, Andrew, and David begin with summer heat, home cooling problems, and an IPv6 issue preventing Andrew from playing Battlefield 6. The conversation quickly heads down a Raspberry Pi rabbit hole, with projects ranging from smart-home automation and MagicMirror dashboards to local AI transcription. David then recaps RubyConf in Las Vegas before the group discusses design patterns, the changing conference landscape, and how AI is reshaping programming education, software development, and the economics of building products. Hit download now!

Links

• Chris Oliver X
• Andrew Mason Bluesky
• David Hill LinkedIn
• Judoscale- Remote Ruby listener gift
• Brockovich AI Data Center Reporting
• Raspberry Pi
• Rails…

At conferences and meetups, and in conversations online, many Ruby developers have asked me about Ruby Central and my disagreement with them. This post is my attempt to answer the questions I’ve been getting over and over, covering: 1) what is Ruby Central doing now? 2) has the dispute over Bundler and RubyGems been resolved? 3) what has Ruby Central said about the dispute? and 4) what can Ruby developers do now?

What is Ruby Central doing now?

To talk about what Ruby Central is doing now, we need to start with a bit of historical context. What was Ruby Central doing before this saga began? About 18 months ago, Ruby Central:

• ran 2 conferences every year, RubyConf and RailsConf
• had an Open…

Understanding the Rails Middleware Stack July 31, 2026 Middleware is one of the core building blocks of every Ruby on Rails application, yet many developers never interact with it directly. Every incoming HTTP request passes through a chain of middleware before it reaches your routes and controllers, and every response travels back through the same … Continue reading Understanding the Rails Middleware Stack →

For those who have been coding CSS since the Internet Explorer 6 era, when aligning divs on the web was an art, and there was no way to use partials or variables, the arrival of SCSS was a gift to life. At that moment, creating partials and reusing variables for your primary colors was a delightful experience.

Now in 2026, for the real fans, it’s possible you’re still using sass-rails and you’re full of these files around your project. So if you still want to keep using it like me, I recommend migrating to Dart Sass, which is, in fact, a simple migration, to avoid headaches in the future and, most importantly, to start using the latest features.

Historical context

To give a bit of…

Our blog posts are written by the people who did the work. The process is simple: someone picks a topic, writes a draft, and opens a pull request. From there it goes through two passes, a review that looks for correctness issues, gaps, and overstated claims, followed by a QA pass that checks the final polish: that the whole thing ties together, there are no typos, images render correctly, and links go where they say they go.

Like a lot of teams, we started leaning on AI to help our authors get ideas onto the page. Posts get written faster and people get past their writer’s block quicker. It comes with its downsides though. Asked to fill in a gap, it will make an assumption. Asked to make a…

This is part of an ongoing series of Ruby Runway Spotlights, celebrating the founders who took part in the inaugural Ruby Runway Showcase at RubyConf 2026. Each spotlight is a chance to hear directly from the builders turning Ruby into real, live businesses, and to cheer them on as they keep going.

Tell us your name, your startup, and what it does in one or two sentences.

I'm Michael Carroll, founder of Coolhand Labs. Coolhand Labs is a COO for your AI agents. Whether they run on your computer or in prod, we use log traces and human feedback to keep an eye on them and optimize for efficiency and quality, often cutting costs over 50% in the process.

What problem are you solving, and who feels…

Every transactional email provider ships a Ruby SDK. Each one has its own client class, its own conventions, its own way of doing the same thing. I got tired of learning yet another API for every project. So I built Courrier.

About 14 months and 73 commits later, Courrier 1.0 is here. It covers 13 email providers and 7 newsletter platforms. There’s a companion gem for Rails apps that adds generators, ActiveJob support, browser-based inbox previews and more.

Star it on GitHub ✨

13 providers, one API

Courrier.configure do |config|
  config.email = {
    provider: :postmark,
    api_key: "your_postmark_api_key"
  }

  config.from = "devs@railsdesigner.com"
end

#…

Hi friends!

Rails Versions 7.2.3.2, 8.0.5.1, and 8.1.3.1 have been released!

These are security patches addressing 1 security issues:

• A possible arbitrary file read and remote code execution in Active Storage variant processing

We strongly recommend upgrading as soon as possible.

Older versions of Rails are unsupported, and users are recommended to upgrade to at least the 7.2 series. See our maintenance policy for details.

Here is more information about the security issue that these releases address:

• CVE-2026-66066 Possible arbitrary file read and remote code execution in Active Storage variant processing

SHA-256

If you’d like to verify that your gems are the same as the…

Every year, Rails gets a little better. A little faster, a little safer, a little easier to work with. And none of that happens on its own.

The Rails Luminary Awards exist to celebrate those contributions, acknowledging those in the community who have significantly advanced Rails for the benefit of all, and the nominations for 2026 are now open.

If you know of someone who has consistently gone above and beyond to contribute to the framework, triaging bugs, improving performance, adding helpful features, etc. please nominate them below.

All nominations will be reviewed by Rails Core, and the final pick of Rails Luminaries will receive a trophy for their service, as well as a monetary…

Making new Ruby Friends is one of my favorite parts of attending conferences. Neha Abraham joins me to chat about RubyConf, Mental Health, Data Aggregation, and being my Nemesis

How to protect your npm package from being stolen in a supply chain attack and improve its position in security ratings

Here's why you should care about how you release your npm package:

1. Supply chain attacks that steal npm packages are now a real threat, with new attacks every month. If the TanStack, Axios, or ESLint teams were hacked, you can be hacked. These days, attackers steal packages automatically with LLMs, using previously stolen dependencies to reach the next ones.
2. Taking care of…

We recently enabled a really cool feature in ZJIT that makes it feel like a Real Compiler™: the inliner! We’ll write more about it soon. In this post, we’ll talk about one excellent concrete benefit we are already seeing and how it optimizes blocks in pretty much every Ruby program.

I’ll start off with a refresher on how blocks work in the Ruby interpreter, then show you how ZJIT understands and optimizes that bytecode, and then show you the impact of the inliner.

Ruby: a refresher

In the beginning, there were loops.

arr = [1, 2, 3]
i = 0
sum = 0
while i < arr.length
  sum += arr[i]
  i += 1
end

People used them to navigate and manipulate variable-length structures, like arrays and…

Over the past six months at OmbuLabs.ai, we’ve had the opportunity to work on several projects involving generative AI for designing and enhancing real world products.

With today’s image generation models, it might seem like this should be straightforward. A user describes what they want, an image generation model creates a design, and you’re done.

In practice, building an application that consistently produces useful product designs is much more involved. The image generation model is only one part of the solution. The real challenge is designing the application around the model so that it has the information and context it needs to generate useful results.

There is no single way to…

Wiring an LLM into a Rails app takes a handful of lines. Understanding what it actually costs you (feature by feature, user by user) is harder. Most providers and SDKs already report tokens, latency, and even cost, but that data lives in their dashboard. It’s disconnected from your requests, your users, and the feature that made the call. And it sits apart from the APM and logs where you already watch the rest of your app.

In a previous post, we introduced Rails.event.notify(...), the tool-agnostic Event Reporter shipping in Rails 8.1. In this post, we’ll put it to work on a real problem: instrumenting every LLM call in your app so token usage, latency, and cost become structured events…

July 27, 2026 The Ruby Association has announced the Ruby Association Activity Report 2026, an in-person event that will showcase recent developments across the Ruby ecosystem, including keynote presentations, invited talks, and the results of the Association's 2025 development grant program. The event will take place on August 4, 2026, in Tokyo, Japan. Matz to … Continue reading Ruby Association Activity Report 2026: Matz, Fastly, and Ruby Grant Projects Take the Stage →

<Button size="lg" intent="confirm" icon="check" />

Three things are wrong. One line of code. size=”lg”. intent=”confirm”: that prop doesn’t exist anywhere in our schema. icon=”check”. None of these are obscure edge cases. All of them are documented in the design system we own and maintain.

This is what every AI coding assistant does when it meets a private design system. It writes the average of every button it has ever seen. The average is wrong.

For the past several months, we’ve been building toward something we call eval-driven design systems: making our design system…

Every year, Ruby Central's Scholars & Guides Program pairs aspiring Rubyists with experienced mentors for a week of learning, connection, and growth at RubyConf. Scholars get a Guide to help them navigate the conference, build their coding skills, and meet other Rubyists face to face. Alongside that mentorship, Scholars are also invited to take on a mini-project, an open opportunity (not a requirement of the program) to share their own unicorn, whatever makes them uniquely them, with a community that's wonderfully diverse in thought, interests, skills, and talents. This year's theme was "Ruby for funsies: using Ruby and Rails to enhance a hobby," and Scholars could present however felt…

As developers, we sometimes find ourselves in situations where something feels slower than it should be. The first thing we tell ourselves is “Maybe I need a different tool.”

And sure, at times, it might be due to the tool, I’ll give you that. But most of the time, it comes down to how you’ve implemented certain features. That’s one of the downsides that comes with having too much freedom.

As for Sidekiq specifically, there are various reasons why your project might be getting slow or was slow to begin with. In this tutorial, we will cover a few of them:

• N+1 queries inside jobs
• Missing or misconfigured database indexes
• Synchronous external HTTP calls
• Too much work in a single job (no…

Launched the Theme Builder with coordinated accent and base palettes, live light and dark previews, and copy-ready Tailwind CSS. Updated checkbox, radio, and tooltip components for the new theme contract.

Components in this release:

• Checkbox
• Radio
• Tooltip

View full changelog →

Rails Isn't Getting Bigger It's Getting Sharper July 27, 2026 Every week, This Week in Rails highlights the latest changes merged into the framework. Most weeks, it's easy to focus on the individual features. But the July 10 edition suggests something more interesting: a broader trend in how Rails is evolving. Instead of shipping large, … Continue reading Rails Isn’t Getting Bigger It’s Getting Sharper →

It has now been about 18 months since I concluded my post series on optimising Ruby’s json.

Back then, I covered interesting performance patches that happened between version 2.7.2, the last version published before I took over maintenance, and version 2.9.0, the latest release at that time.

During that span, both the parser and the generator became twice as fast on the infamous twitter.json benchmark.

== Parsing twitter.json (466906 bytes)
ruby 4.0.6 (2026-07-14 revision 03b6d3f889) +YJIT +PRISM [arm64-darwin25]
 2.7.2    575.498  (± 2.1%) i/s    (1.74 ms/i) -      2.880k in   5.004363s
 2.9.0      1.109k (± 0.7%) i/s  (901.86 μs/i) -      5.564k in   5.017923s

Comparison:
2.7.2:     …

Changing an Active Record object can feel like one operation: assign a value, call save, and expect the row to change.

Rails sees two separate moments. Before the save, it needs to know what the next write would change. After the save, callbacks and application code may need to know what that write changed.

Confusing those questions can produce a bug even when the update itself succeeds.

A plan-change audit starts recording the wrong transition.

The account update succeeds, and the callback creates the audit row. Nothing raises, and the result looks close enough to correct:

class Account < ApplicationRecord
  before_update :record_plan_change

  private

  def record_plan_change
   …

This is a followup to my recent lightning talk and writeup about i18n in Rails and how it can be useful even when we’re not translating our applications.

In the talk and writeup I describe how we can change the Active Record error message format from the default of "%{attribute} %{message}" and drop the attribute prefix, giving us more flexibility in how we phrase our error messages. The downside to this is that it results in the default Rails error messages being output as incomplete sentences. It’s since occurred to me that it’s possible to avoid this by replicating the default validation error messages in our app’s locale file with the attribute prefix as part of the message, rather…

So we end up with a locale file that looks something like this:

# app/config/locales/en.yml
en:
 …

This is mostly a transcript of my recent lightning talk on i18n in Rails, go watch that if you prefer your content in video form. Otherwise read on to find out why I believe understanding i18n in Rails can be useful to you, a Rails developer, even if you’re not translating your applications into other languages.

I’m going to share ten things I think are interesting in i18n, and explain how we can take advantage of them in our single language app code. But first a brief primer on i18n…

What actually is i18n?

i18n is shorthand for Internationalisation When we’re talking about i18n, it’s useful to understand the difference between Internationalisation and Localisation:

• Internationalisat…

When I joined Cheddar I was pleasantly surprised to find a sharp, mostly minimalist development culture which was a pleasant departure from the ZIRP-era “platform and team sprawl” that was in full bloom at WeTransfer.

The mostly-Shopify-inspired mindset - the Shopify of roughly 2012-2014, when Bouke and Tariq were there, long before the sharded-the-world Shopify of today - was extremely poignant and felt like a breath of fresh air:

• Let’s not have services, at most - we’ll have 2
• Let’s not have Kubernetes and use GCP native VM scaling instead
• Let’s not have frontend bundling of any kind and rely on Rails builtins for any internal web plumbing

Since then I took this approach to…

Happy Friday, this is Greg, bringing you the latest news from the Rails world.

A Rails anniversary!
Today is the 22nd anniversary of the first public release of Ruby on Rails!

Learn from real, open-source Rails apps
On the Rails website, now you can find a small, hand-picked library of exemplary open-source apps worth reading to see how production-quality Rails is built today.

Update the JavaScript in Rails guide
The updated JavaScript in Rails guide is ready for community review!

Preserve sub-second precision when subtracting a DateTime from a Time
This pull request makes sure that sub-second precision is preserved when subtracting a DateTime from a Time. Time - DateTime converted…

Ruby Argentina met on July 23 at La Maquinita Innovation Lab in Buenos Aires. The night brought together two questions that tend to surface once an application (or a development workflow) gets serious: what does a convenient default cost us later, and what should we refuse to delegate?

The cost of being unique

Santiago Merlo from Rootstrap opened with “El costo de ser único” (“The cost of being unique”), a close look at what choosing a UUID as a PostgreSQL primary key actually changes.

UUIDs are useful when an identifier must be generated independently or when sequential IDs should not be exposed. But they are not free. Compared with a bigint, they take more space in tables and…

Today we’re adding a new page to the Ruby on Rails website: Reference Apps. This is a small, hand-picked library of real, open-source Rails applications worth studying.

Documentation can only show you so much. Sometimes it’s better to just crack open the lid and go straight to the source to see how a real, production-quality Rails application is built. That’s harder to do well when there’s no curated starting point, so that’s what this library is meant to be.

Each entry links out to the full source so you can read the real thing: how the models are shaped, how a controller stays thin, how Turbo Streams actually get wired up, the full commit history, and all the small decisions made along…

Creation is now near-free. Verification/understanding is not, yet. It’s time to engineer away the slop.

Geoffrey Huntley: Engineer Away the Slop

This week, Andrew and Chris swap stories from the front lines of Ruby development, from wrangling GitHub Actions and speeding up CI to keeping old Ruby versions alive on brand-new servers. They also unpack a tricky Sidekiq deployment issue, explore the promise of compiling Ruby apps into standalone executables, and reflect on how AI is making once-impossible infrastructure problems a little easier to solve. Hit download now to hear more!

Links

• Chris Oliver X
• Andrew Mason Bluesky
• David Hill LinkedIn
• Judoscale- Remote Ruby listener gift
• Setting up code for your repository (GitHub Docs)
• Surviving rolling deploys when Sidekiq meets a class it doesn’t know yet (Dmitry Tsepelev blog post)
• Why a Sidekiq…

Rails 8 ships with Kamal 2 pre-configured, so every new app can deploy to any Linux server with zero downtime and automatic SSL — no PaaS required.

Many teams pay for expensive Platform-as-a-Service solutions just to avoid managing deployments themselves. Rails 8 removes that trade-off.

What is Kamal?

Kamal is a deployment tool developed by 37signals that uses Docker containers to deploy web applications. It can turn a fresh Linux box into a production ready application server with just a single command.

Before

Before Rails 8, setting up Kamal required manual installation and configuration.

We had to install the gem:

gem install kamal

Or add it to the Gemfile:

# Gemfile
gem 'kamal',…

Th…

Most Rails developers have crossed paths with Rake (usually to run a migration, seed a database, or clear out test data). If you’re like me, you may have quietly filed Rake away under “that place where Rails keeps database tasks.” But Rake is far more powerful than that.

It isn’t just a Rails helper: it’s a full-blown, general-purpose build system, sitting quietly in your project, ready to automate almost anything. And the best part? It speaks Ruby. That means, as a Rails developer, you’re already fluent in the language your build tool understands. In this post, I want to open your eyes to the wider world of Rake, beyond migrations and seeds, into using it as a central hub for building,…

This is part 1 of a two-part series. Part 2, coming soon, will cover targets, actions and reactive values.

Yep, that text is programmatically added using a recreated Stimulus framework and a hello_world_controller.js

Stimulus is a modest JavaScript framework to sprinkle bits of interactivity. At its core it watches the DOM for elements with a data-controller attribute and connects them to JavaScript classes. When an element appears, a controller instance is created. When it disappears, the instance is cleaned up. That’s it. That’s the entire foundation.

I want to walk through how you can recreate Stimulus yourself to learn a few modern JavaScript features to have in your magic hat, you can…

Direct link to podcast audio file

The summer heat ended up thawing out my podcast, so I had no choice but to go buy a new microphone and grumble into it for a couple hours. Just how that works. Please enjoy.

I am actively soliciting mailbag participation. As always, the address is podcast@searls.co, and I'd be really curious to hear how America is doing because it seems like everything is going great.

For the first time I let Claude write these links for me, because it never occurred to me I didn't have to format the markdown manually:

• PicoRuby Kaigi 2025
• FleaFlicker, my first iOS game!
• Aaron's puns, ranked
• Claude Fable 5 gets another bump: 1, 2, 3, 4, 5
• Who's Afraid of Chinese…

A CDN caching bug on RubyGems.org could hand one account’s API key to another person for up to an hour. If you signed in to RubyGems.org with a gem client older than v3.2.0, your key could have been exposed (the technical details are below). Currently, 18% of sign-ins through gem signin come from an affected version, and for the first several years of this bug, before we changed the client’s sign-in path in December 2020, it was every gem client.

We’ve reviewed the access logs we keep and found no sign of a legacy key being used maliciously, and no user or support report has suggested otherwise. Those logs only cover a recent window, though, a small slice of the years this bug is estimated…

The JRuby community is pleased to announce the release of JRuby 10.1.1.0.

• Homepage: https://www.jruby.org/
• Download: https://www.jruby.org/download

JRuby 10.1.x targets Ruby 4.0 compatibility.

Thank you to our contributors this release, you help keep JRuby moving forward! @chadlwilson, @kares, @katafrakt, @sampokuokkanen, @segiddins, @shugo

Notable Changes

Performance

• Use FastDoubleParser to improve performance of all string-to-double parsing. #9150
• Only pack fixnum values for 16-bit signed by default, with optional 8-bit and 32-bit configs. #9379

Standard Library

• jruby-openssl updated to 0.16.2 with several CVE fixes from BouncyCastle. #9386, #9504, #9539
• erb…

Native Integration

• Updated JRuby’s…

Since last year, we started using AI heavily for all kinds of tasks. What started as chatting to an agent to complete tasks later evolved into a more professional workflow doing Context Engineering and Spec-Driven Development. There are many SDD frameworks out there, but ultimately, after trying out a bunch of them, we opted for OpenSpec. OpenSpec felt like the simplest framework out there, one that aligned with our pre-AI-era workflow.

Quick intro

Spec-Driven Development is a methodology where a highly detailed, structured specification (a “spec”) is written before any code is generated. It acts as a single source of truth to guide AI coding assistants, ensuring the AI builds exactly…

While at RubyConf, I caught up with several attendees and volunteers to discuss their experiences. These quick interviews have been collected for this episode.

Our Guests
Charles Nutter
Miguel Filho
Cameron Dutro
Nico Roulston

RubyGems 4.0.17 includes enhancements and bug fixes and Bundler 4.0.17 includes enhancements, bug fixes and documentation.

To update to the latest RubyGems you can run:

gem update --system [--pre]

To update to the latest Bundler you can run:

gem install bundler [--pre]
bundle update --bundler=4.0.17

RubyGems Release Notes

Enhancements:

• Validate spec name before writing to the spec cache. Pull request #9690 by hsbt
• Installs bundler 4.0.17 as a default gem.

Bug fixes:

• Unquote Gem.ruby when spawning it as a separate argv element. Pull request #9695 by hsbt
• Escape glob metacharacters in install paths when globbing. Pull request #9687 by hsbt
• Preserve Windows editor paths…

Ruby May Finally Fix the Famous "Norway Problem" July 21, 2026 The Ruby ecosystem may soon take an important step toward modern YAML support. Hiroshi SHIBATA (hsbt), a Ruby core developer, has introduced an experimental backend for the Psych library based on libfyaml, bringing full YAML 1.2 compliance closer to Ruby. While this might sound … Continue reading Ruby May Finally Fix the Famous “Norway Problem” →