Rubyland

Today we’re sharing the first results of Agents on Rails, a new, ongoing initiative to measure how well today’s leading agentic coding tools (both frontier and open-weight) actually perform on Ruby on Rails codebases.

The Rails Foundation commissioned Evil Martians for this project, which will roll out in several stages over the next few weeks.

Read more about the project below, check out the leaderboard, or jump right over to the first benchmark report.

Why we built this.

The use of coding agents has skyrocketed in the past year with nearly every developer or team using AI to write code. But the options are overwhelming, with new models dropping nearly every week. The cost of running…

TL;DR

We ran 8 models against 21 atomic Rails tasks, 3 runs each. Every task runs against Writebook: a bug report, a security finding, a feature request, each written the way you’d actually file it. Read our announcement post for more information about the project.

So, as of August 2026, which model is best?

• Most accurate: Claude Opus 5, 92% of runs solved (58 of 63)^*.
• Cheapest: GPT-5.6 Luna, 73% at its default medium reasoning effort, and all 63 of its runs cost 91 cents combined. Not a typo.
• Fastest: Luna again, at a median of 3.3 minutes per run task.
• Best combination of all three: GPT-5.6 Sol: 84%, about $1.50 and five minutes per task.

^* Claude Fable 5 would lead at…

Something I must confess is that I absolutely hate writing these blog posts. It’s not quite as bad as having to give a conference talk, but it’s up there on the list of activities that feel like pulling teeth to me. Not that I’m not proud of the result. I absolutely am. But the process of writing them is very painful for me. It’s particularly true of the very first sentence, as the post progresses, it gets a bit easier

Yet, I force myself to do it, because it helps me think about problems, and “compile” knowledge in my head. I’m so terrified of posting something wrong or inaccurate that I tend to double-check some long-held assumptions, dig into more details about how some things are…

The eleven-shade color scale from Tailwind CSS is one of those ideas I keep stealing. You know the one: 50 through 950 gives you enough stops for backgrounds, borders, hover states, text, everything. I use it even when I’m not using Tailwind.

But I almost never use the defaults (your site/app ends up looking like every other site built by LLMs).

The fix is not complicated. You don’t need a color theory degree or a five-color palette generator (you know the ones 🥹). You only need two or three color scales, and you can derive them all from a single value.

How to choose your brand hue

Rule of thumb: pick a color that fits the problem, not your personal taste (I like pink but not use it all…

Beyond travel_to: The Block-Scoped State Pattern Hidden in Rails Testing August 12, 2026 Rails developers often use travel_to without thinking much about how it works. travel_to Time.zone.parse("2026-08-12 10:00") do # Test code runs as if it were 10:00 end The API is simple: change the perceived time, run some code, and automatically return to the … Continue reading Beyond travel_to: The Block-Scoped State Pattern Hidden in Rails Testing →

How to publish agent skills so any AI coding agent can find and install them: the .well-known/agent-skills/index.json discovery index, SHA-256 integrity digests, single-file vs multi-file vs bundle packaging, and every install command. Worked from the catalog we just open-sourced.

Two posts ago, an AI startup found us because Claude, which recommended Evil Martians when they asked for a senior dev agency. One post ago, we measured the traffic behind that. Over two months, coding agents read evilmartians.com more than twice as often as people did: 268,000 agent…

Maintaining an organizational knowledge graph with an LLM and event sourcing

Organizations are surprisingly good at forgetting.
Decisions are made on calls, insights get buried in Slack threads, and a month later no one remembers why things are the way they are.

At Arkency, I had a feeling that some things slip away from us too from time to time.
Weekly calls, ad-hoc meetings, our book clubs, Slack discussions, GitHub mentions, e-mail inbox - we could use some support in organizing all those signals.

Then Ruby Community Conference 2026 happened in March.
In Kraków, Obie Fernandez showed some parts of his NEXUS system.
He had already described it on his blog back in January, but the…

Yet again instead of tweets, a blog post. The backlog got out of hand - 40 of them this time.

Usual caveat: every number below is whatever the author measured on their own machine with their own workload. Some are microbenchmarks. Don't compare them against each other, and don't assume they'll show up in your app. Click through if you care about methodology.

byroot is still speedrunning Ruby and Rails

Jean Boussier shows up often enough that he gets a section instead of bullets scattered through the post.

• Make Monitor a core class - giving it access to Ruby's internal routines strips out a chunk of overhead. Monitor#synchronize goes from about 19.8M to 23.7M calls a second; a plain Mutex…

Andy Kroll joins the podcast to talk about Brighton Ruby, the impact AI is having on software development, and how the changing technology landscape is affecting everything from conference budgets to engineering teams.

Andy shares how tools like Claude Code have changed his day-to-day work, making previously neglected projects more achievable while putting even more emphasis on code review, judgment, and maintaining a sustainable Rails application. They also dig into one of the harder questions created by AI: how do you interview software engineers when take-home coding exercises and traditional technical tests are increasingly easy to hand off to a model?

Andy explains how…

The slack-ruby-client library, an open source Ruby gem I maintain, runs a scheduled GitHub Actions workflow that regenerates code from Slack’s API definitions and opens a pull request with the diff. The commit message and CHANGELOG entry used to be a generic “Update API (2026-08-11)”, which told a reviewer nothing about what actually changed. Here’s how we taught the workflow to describe its own diffs, using GitHub Copilot CLI, which open source maintainers can get for free.

The Idea

The workflow already computes a diff before opening the pull request. Instead of a boilerplate commit message, we pipe that diff through an LLM and ask it to summarize what changed, then use the response as…

Fall is shaping up to be a busy season for thoughtbot. Over the next two months, thoughtbotters are speaking, attending, and hosting events across six cities on two continents. If you’re nearby, come find us.

XO Ruby Vancouver, August 15, Vancouver, Canada

XO Ruby Vancouver kicks things off. Fernando Perales will be speaking on “The Ruby Guide to Responsible LLM Integration,” a talk about the production challenges of wiring large language models into Ruby applications: malformed input, data leaks, prompt injection, outages, and rate limits, and the patterns that keep things stable once real users start hitting them.

EuRuKo 2026, September 16-18, Brno, Czech Republic …

Are you treating your users fairly? They could be stuck in the queue while a greedy user monopolizes resources. And you might not even know it! In this post, you’ll see if it’s time for you to take background job prioritization seriously, and how to make it fair for all users.

Are you treating your users fairly? They could be stuck in the queue while a greedy user monopolizes resources. And you might not even know it! In this post, you’ll see if it’s time for you to take background job prioritization seriously, and how to make it fair for all users.

This is part of an ongoing series of Ruby Runway Spotlights, celebrating the founders who took part in the inaugural Ruby Runway Showcase at RubyConf 2026. Each spotlight is a chance to hear directly from the builders turning Ruby into real, live businesses, and to cheer them on as they keep going.

Tell us your name, your startup, and what it does in one or two sentences.

Stowzilla is your personal warehouse service. Know what you have, and get value from the things you no longer need.

What problem are you solving, and who feels it most? How does your Ruby-powered solution change things for them?

We're solving the problem of getting valuable stuff to people who can use it, and giving space back…

The following is one of those posts where I share some concrete memories/experiences that I associate with some musings, but otherwise doesn’t really have a strong point other than I want to write it down.

When I worked at Code for America, I helped design and deliver two different technical interviews.

The first interview, which I feel confident I can take credit for wholly, was security related. Me, the interviewer, would first have the candidate read about Cross Domain Referer Leakage, and then we’d talk about it:

• How would you summarize the vulnerability in your own words?
• Describe to me a scenario for how an attacker would exploit this.
• Can you think of…

I want to make Ruby the best language to work with LLMs. Part of that is a great JSON Schema DSL.

Schematist is a general purpose JSON Schema DSL that emits Draft 2020-12 schemas. Describe an API payload, a config file, a contract between two services, or the structured output you want back from a model. Trapping that inside another gem’s namespace was a disservice to anyone looking for a great JSON Schema DSL, so it got its own name.

gem 'schematist'

It Emits Actual JSON Schema

This is the breaking change.

to_json_schema used to return this:

{ name: "PersonSchema", description: nil, schema: { type: "object", ... }, strict: true }

That’s not a JSON Schema. It’s OpenAI’s response_fo…

It’s been a whole year since we ran our first sponsorship drive. We’ve been hard at work since then: we shipped Hanami 2.3, unified our ecosystem and launched Hanakai (plus this beautiful new site!), and shipped Hanami 3.0, our most complete release ever. (If you want to catch up on more behind this, hear me on the Dead Code podcast.)

Thanks to our sponsors’ financial support, I’ve been able to maintain at least one full working day on Hanakai every week over the last year. This has been crucial for achieving all of the above. It’s an honour to spend this time serving our community, and a privilege I don’t take lightly. This is why I also spent the last year writing weeknotes, to make our…

This week, Anthropic shipped a new messaging feature to Claude Code. It sounds innocuous enough:

Cross-session messaging lets Claude deliver a message from one of your Claude Code sessions to another. When a change in one session breaks what another is building on, Claude can warn that session before you notice. When one session settles a question another is blocked on, Claude can send the answer across.

And because I sometimes have multiple agents working in the same project simultaneously, it didn't take long for them to start coordinating behind my back so as to avoid interfering with each other's work:

Also, another Claude session (working on performance rugs) pinged mid-turn; I told…

When we think about Ruby code coverage, our go-to gem for this is SimpleCov, which works great when the test suite uses Minitest, RSpec, Cucumber, Capybara, and all these tools that are integrated with Ruby and Rails. But many applications also use other tools like Playwright or Cypress to run e2e tests, and we can’t use SimpleCov the same way.

Most of the time, what we have seen is that the Ruby code executed when running these tools ends up left behind and not being counted for the total code coverage, even though we know the code is actually being tested.

Sample Application

To make it easier to try this, we created a sample application that uses the cypress-on-rails gem along with…

AI Adoption Is More About Culture Than Tools

A few weeks ago, we sat down with a potential client for a project kickoff conversation. The goal was to find out how we could help them integrate AI into their company. Their whole team joined the call, about 15 people, and within the first ten minutes, it was clear everyone had a different idea of what “using AI” meant to them.

One person wanted an easier way to schedule meetings. Another wanted AI to summarize call notes. A few wanted to search through years of client history. Some of what people described, honestly, was closer to plain automation than a need for artificial intelligence. More than a few people in the room were hesitant to…

The problem with our old setup

PDF generation is a core part of Gusto’s business. To serve our customers, we generate reports, invoices, tax documents, employee handbooks, and more. Many of these features relied on a now-deprecated library: wkhtmltopdf.

That reliance had become a liability. Maintenance on the library had stopped, which meant no more security patches. It rendered HTML using WebKit, an engine that had drifted away from how modern browsers display the same markup, so our PDFs didn’t always come out the way we expected. And because PDF generation is memory-intensive by nature, it put pressure on the other services it shared resources with.

Why build a new service?

We decided to…

I love Ruby and it is my goto scripting language. Even in the age of AI, I like to write short custom scripts for my tool arsenal. One way to find subdomains of a potential hacking target is to initiate a DNS zone transfer. You can use various shell tools for this, but if it is part of a process(my case), it might be easier and more flexible to just script it in Ruby. I decided to use the dnsruby gem to save some work, otherwise I would need to do a TCP connection to the nameservers myself. For the sake of demonstration, I converted my script into a command line one, that will accept 2 parameters, the host and an optional IP address of a nameserver:

The method

This process applies the scientific method to a defect. The six phases are the steps of that method. They carry the names a developer uses.

Scientific method       Phase                      You produce
-----------------       -----                      -----------
Build the apparatus     1. Build a feedback loop   one command that goes red on this bug
Observe under control   2. Reproduce and minimise  a minimal case that repeats
State the hypotheses    3. Write the hypotheses    3 to 5 ranked causes, each with a prediction
Run the experiment      4. Instrument              one probe per prediction, one variable at a time
Confirm the result      5. Fix and add a test      a…

If you need more context on why Rails needs a new leadership, here is David Celis summing it up a year ago, Paul Battley a few weeks ago, and—even though it is hard to believe—it even got worse since then.

How could a fork even work?

Rails is a huge code base and has multiple engineers who can invest significant work time into improving it. How could a few people fork and maintain it in their free time? Because Rails is done. Since I started to update The Rails 5 Way to Rails 6 (and then later 7 and 8), I’ve been monitoring the changes to Rails closely:

If you generate a Rails application with rails new --minimal, you only get the core parts of the framework (railties, actionpack,…

transaction is one of the few Active Record APIs that reads like a promise. Wrap the work in a block, and either all of it happens, or none of it does.

An account upgrade shows where the reading breaks:

Account.transaction do
  account.update!(plan: "growth")
  ProvisioningClient.enable_growth_features(account.external_id)
  AuditEvent.create!(account:, action: "plan_upgraded")
end

A validation added to the AuditEvent a week earlier rejects the new audit record, so create! raises ActiveRecord::RecordInvalid. The SQL log ends the way it should:

BEGIN
UPDATE "accounts" SET "plan" = 'growth' ...
INSERT INTO "audit_events" ...
ROLLBACK

The account row goes back to starter, so the ticket is closed as…

Direct link to podcast audio file

We cut our trip a day short, so I found myself with a totally free day with no plans. Naturally, I wasted it by recording a 3-hour podcast. Dang.

I always enjoy shooting the shit with/at you, and if you'd like to be a more active participant in the shit-shooting, then hit me up at podcast@searls.co. Really, I'll be nicer to you than I am to Sam Altman and Tang Tan. I promise.

Back to manually writing links. The zen of monotonous input tasks is suddenly something to be cherished in the current era.

• Mandibular Advancement Device
• Better With Becky
• Why doesn't the U.S. have small elevators like Europe and China? (News+)
• My 240hz gaming QD-OLED (and…
…

After Rails’ Dear Leader DHH once again espoused far-right views on his blog (which I’m not going to link to here), some of the Ruby community said “enough is enough” and decided to fork Rails into a project called Amiko. I don’t want to mince words here, so I’ll talk straight: I think this is a vain attempt at virtue signalling, and will ultimately end up achieving very little.

The Amiko project has started out this fork by renaming all the Rails things into Amiko flavoured things. They have amiko-pack, amiko-view, and so on. All the rails commands are now amiko commands. The structure of the framework remains the same, so far.

The momentum behind the Rails framework itself is monumental…

Some things that should have worked all along finally do… like alias_attribute in associations, pluck on unsaved records, search_field with autosave: true. The rest of the week went into sharper SQL logs, sturdier job continuations, and more Ractor-ready registries. Here’s what’s new in Rails:

Matz is coming to Rails World 2026!
Ruby creator Yukihiro “Matz” Matsumoto is coming to Rails World 2026! He’ll join DHH, Aaron Patterson, Robby Russell, and the rest of the lineup in Austin this September, and the full conference agenda is now live. If you’ve been waiting to see what’s planned before grabbing a ticket or planning your schedule, now’s the time to take a look.

Fix pluck ignoring…

Irina Nazarova and Vladimir Dementyev from Evil Martians return to preview the second annual SF Ruby Startup Conference and share what they learned from bringing the event to life for the first time. They discuss the conference’s new focus on ambitious builders, the importance of creating meaningful connections for attendees, and why Ruby on Rails remains a powerful foundation for startups tackling difficult, real-world problems. The conversation also explores open-source innovation, AI-assisted development, hidden pockets of Ruby adoption, and how the community can help the next generation of companies confidently build and grow with Rails. Hit download now!

Links

• Chris Oliver X
• Andrew Mason…

Hi everyone!

Rails World 2026 is just 47 days away, and we have a few fun updates for you. If you haven’t already, you can grab your ticket here.

Now for the updates:

Matz is coming

Big news first: Matz is coming to Rails World 2026! He’ll sit down with DHH on day 2 for a fireside chat. It’s been two years since the last chat in Toronto, and so much has changed since then. We’re living in a different world, so we wanted to bring these two together on stage again to chat about Ruby, Rails, AI, and what the future holds for programming.

Attendees will be able to submit their questions beforehand. This session was made possible by the generous support of our Event Partner and sponsor, Sho…

August 6, 2026 Most Rails applications that implement multi-tenancy eventually face the same question: Where should the PostgreSQL tenant context be established? Many implementations set the tenant at the controller or middleware level. While that identifies the current tenant, it doesn't necessarily guarantee that every database connection carries the correct PostgreSQL session state. A cleaner … Continue reading Hooking into ActiveRecord’s Connection Pool: A Clean Way to Enable PostgreSQL Row-Level Security →

Where are the benefits of using AI? Last Monday I woke up with this question on my mind, I, from my corner of the world far away from big techs, millions of dollars, datacenters, posts on X and LLM-generated posts on LinkedIn.

Eight years ago I started working as a programmer, two at the company where I am currently and one since they started pushing us to use AI to accelerate the development process. I don’t deny that my speed for spitting out code has increased, solving problems has become faster and reaching solutions is less complicated. But what sense does it make if I drift away from what I like most: using my capacities and knowledge to write code that solves a problem and then,…

If you work on Rails for a living, you clone repositories you didn’t write all week long: a gem you’re debugging, a client’s application you’re about to audit, a bug reproduction attached to an issue. For years, opening one of those in your editor was the safe part. You were reading someone else’s code, not running it, and the only real rule was to not run anything until you had looked.

That rule quietly stopped being enough. AI coding editors like Claude Code and Cursor read project-local configuration the moment you open a repository, and some of that configuration is executable. A repo you cloned five seconds ago can hand your editor a command to run before you have read a line of it,…

You run bundle update, kick off a build, and asset precompilation stops on this:”

cssbundling-rails: Command install failed, ensure bun is installed
Tasks: TOP => assets:precompile => css:build => css:install

Except your application uses Yarn. It has always used Yarn. Nothing in the project references Bun, and nobody on the team added it.

This is not an exotic edge case. It can happen to ordinary Yarn applications, and it lingers because the fix has been merged upstream but never released. In this post, we’ll walk through why cssbundling-rails misidentifies your package manager, and how to unblock your build.

The Short Version

cssbundling-rails 1.4.3 added yarn.lock to the list of……

You’re evaluating AI vendors for a company-wide rollout, and every conversation ends the same way: it’s safe, it’s anonymized, we have guardrails. We’ve watched this play out recently, and the questions don’t stop at that answer. Safe how, and which guardrails are actually in place to prevent a leak? Vendor reps tend to stall on the specifics: how access is managed at the level of an individual AI agent, not just the account, and which models and model providers are actually involved, with what safety assurances at each one, not because they’re hiding something, but because “we have guardrails” is often as far as the pitch was built to go.

That gap is worth taking seriously, because the…

This is part 2 of a two-part series. Part 1 covered controllers and lifecycle.

Controllers connect and disconnect. That is not useful on its own. The value comes from three things: referencing elements inside the controller, handling events without inline JavaScript and reacting to data changes. Stimulus calls these targets, actions and values.

Each maps to a distinct JavaScript feature. And none of them repeat the tricks from part 1.

Here is the code. See the full commit on GitHub.

Targets: dynamic getters

A target is a named element inside a controller’s scope. Declare it in the class and get a getter for free:

class HelloController extends Controller {
  static targets = ["name",…

The getter this.nameTarget returns the first element…

The RubyGems guides at guides.rubygems.org are read by more than humans these days. AI agents fetch them to answer questions about building, publishing, and installing gems. Evil Martians’ Ruby/Rails LLM discoverability scorecard asks how easily an agent can find and read Ruby documentation, and the guides had no good answer. There was no machine readable index, and no way to get a page without its navigation and markup. This week we merged three changes that close both gaps.

The first change adds sitemap.xml and robots.txt (rubygems/guides#523), giving crawlers a complete map of the site. The robots.txt allows everyone, AI crawlers included. Some documentation sites have gone the other…

As you may know, one area of Ruby performance optimization that particularly interests me is memory usage. Given that most Ruby deployments rely on fork, improving Copy-on-Write performance is generally where you get the biggest bang for your buck, but that only helps with the somewhat static part of an application heap.

A significant contributor to memory usage is also the transient memory that is allocated during a request or job cycle and released soon after. As such, it’s also interesting to keep an eye out for opportunities to make various Ruby objects smaller.

And the Ruby object type that’s probably the biggest contributor to memory usage is likely Hash. Hash instances are…

When you have to fix an accessibility issue without interrupting users- here's what that actually looks like in a mature Laravel app.

Continue Reading

We're excited to welcome Rubyroid Labs as a Ruby Alliance Supporter, joining a growing group of organizations investing in the long-term health of Ruby and its open source ecosystem.

Every day, millions of developers rely on RubyGems.org without thinking twice about it. That's exactly how great infrastructure should work—reliable, secure, and always there when you need it.

Keeping it that way takes a community.

Since 2013, Rubyroid Labs has helped startups and enterprises build and scale Ruby on Rails applications while actively giving back to the Ruby community through conferences, education, and technical content. Now they're expanding that commitment by contributing engineering resources to…

Tailwind CSS has become a very popular CSS framework, and it can speed up development. But using it without proper caution can add mayhem to your code. Learn best practices to avoid getting swept away!

Working with Tailwind CSS is pretty fast and easy (that's why it's received such wide recognition). You just paste a list of different classes in your HTML—and your interface immediately becomes attractive! But, as the application grows, the lists of classes grow. Then, one day you realize you can't understand your code, you're confused with the structure of the application and…

I'm happy to announce that Karafka 2.6 and Karafka Web UI 1.0 have just been released.

For those new here: Karafka is a Ruby and Rails multi-threaded, efficient Kafka processing framework, and its Web UI is a monitoring and management dashboard that ships alongside it. As with every release in the 2.x line, this is a continuation rather than a rewrite - you upgrade, apply a couple of small changes, and keep going.

On the surface, 2.6 is a focused set of features - redesigned Declarative Topics, dynamic worker pool scaling, a new low-level offsets API, and lag compensation for paused partitions. Underneath, it is the largest internal reorganization the framework has seen in years. Almost…

Rails Foundation Executive Director Amanda Perino joins David to preview Rails World 2026, the conference’s first year in the United States.

Amanda shares how the team is bringing Austin’s personality into the event through live music, barbecue, sponsor experiences, a mechanical bull, the returning Buzzsprout podcast booth, and Rails World’s biggest lightning-talk stage yet. She also discusses the opening keynote livestream, the lightning-talk CFP, ticket availability, and what attendees should expect as the conference approaches.

The conversation then turns to the Rails Foundation itself. Amanda explains how the rapid growth of AI has forced the organization to reconsider how it…

Finally, Netflix you can chill.

RubyGems 4.0.18 includes enhancements, bug fixes and documentation and Bundler 4.0.18 includes enhancements, bug fixes, security and documentation.

To update to the latest RubyGems you can run:

gem update --system [--pre]

To update to the latest Bundler you can run:

gem install bundler [--pre]
bundle update --bundler=4.0.18

RubyGems Release Notes

Enhancements:

• Check the resolved parent directory before extracting old format gems. Pull request #9755 by hsbt
• Installs bundler 4.0.18 as a default gem.

Bug fixes:

• Call Kernel.format explicitly in Gem::Deprecate wrapper. Pull request #9714 by hsbt

Documentation:

• Point bundler.io URLs at guides.rubygems.org. Pull request #…

You saw the advisory for CVE-2026-66066, the Active Storage vulnerability in the way Rails processes image variants with libvips. You bumped activestorage to the patched version, ran your tests, deployed, and moved on. That is the responsible thing to do, and for most Ruby vulnerabilities it would be the whole job.

This one is different. The patched version of Active Storage will not run on an old copy of libvips. It raises an exception during boot and refuses to start:

/usr/local/bundle/gems/activestorage-8.1.3.1/lib/active_storage/vips.rb:36:in '<compiled>': libvips's unfuzzed operations are not safe to use with untrusted content, and Active Storage cannot disable them. Disabling them r…

libvips is a system library that lives…

This is part of an ongoing series of Ruby Runway Spotlights, celebrating the founders who took part in the inaugural Ruby Runway Showcase at RubyConf 2026. Each spotlight is a chance to hear directly from the builders turning Ruby into real, live businesses, and to cheer them on as they keep going.

Tell us your name, your startup, and what it does in one or two sentences.

I'm Joe Masilotti, and I help Rails developers deploy to the mobile app stores. Ruby Native builds real iOS and Android apps from the HTML and ERB you already have, without writing Swift or Kotlin.

What problem are you solving, and who feels it most? How does your Ruby-powered solution change things for them?

Your customers…

We designed and shipped a fresh AppSignal homepage in code, then validated it in an A/B test with a 14% lift in activated users.

AppSignal is an established APM platform used by thousands of engineering teams that combines error tracking, logs, and uptime in one product. For its 2026 homepage, Evil Martians imagined a bold creative direction, built it with LLMs, and shipped it straight into an A/B test. Early data shows…

In a previous post, AI Assistant for Our Blog Writing Process, I introduced the assistant we built to help with our blog writing. At the core of that assistant is an MCP server, which serves as the source of truth for both of our blogs. It exposes that knowledge through tools the client can call and documentation the client can read.

Getting an MCP server running is the easy part. Every quickstart, in every language, gives you a server that runs as a subprocess on your own machine and disappears when the client exits. That’s enough to experiment locally, but it’s a long way from something a team can rely on. Once you want to deploy it, questions about where it runs, state management,…

If your business runs a support chatbot, or if someone on your team uses an AI tool to draft marketing copy, you already have an AI system in scope of the EU AI Act’s transparency rules. You don’t need to be doing anything exotic or high-risk to be covered. As of August 2, 2026, these rules are binding, and the European Commission’s AI Office, together with national market surveillance authorities, can enforce them.

That catches a lot of businesses off guard, because most of the coverage of the AI Act so far has focused on high-risk systems: hiring tools, credit scoring, biometric surveillance. Those obligations are real, but they’re not due for a while yet, more on that below. The…

RSpec Expectations: You're Probably Using the Wrong Matcher August 3, 2026 If you've been writing Ruby tests for a while, chances are you've reached for eq more times than you can count. While it works for many scenarios, RSpec Expectations offers a much richer vocabulary for expressing intent. Choosing the right matcher isn't just about … Continue reading RSpec Expectations: You’re Probably Using the Wrong Matcher →

It’s possible to programmatically upload images to GitHub Issues, Pull Requests and Comments via automation. Finally, though maybe mistakenly, I dunno.

It’s fairly well known that for the longest time, GitHub has not had a programmatic interface for uploading images and attachments. It’s possible in the browser, by dragging-and-dropping your image, but not via something you can script or curl. That’s been a bummer for lots of GitHub Action-powered systems you might imagine, like: automatically attaching demo screenshots or videos on PRs for new features, or attaching failure screenshots or visual diffs from browser tests.

Until now, I guess. Here’s the unofficial,…

In our previous post, we treated Zod schemas as agent-readable contracts. But a schema is just a hypothesis; without tests, you’re shipping vibes. This post dives into how we operationalized these schemas, set up a testing suite on Braintrust, and started scoring AI output against our design system.

We set up an experiment with 167 hand-written prompts across 25 components, plus a second dataset built from real engineer requests. Each prompt is a plain-English UI request (e.g., “a primary action button that confirms saving”). The model receives the component’s schema and…

Frequently Played 🔗

I tend to listen to the same songs or albums on repeat that are evocative of how I’m feeling or what’s going on with me. Here is what I’m currently listening to over, and over, and over, and over, again.

Atlantic City 🔗

I just got my hands on the Expanded Edition of Nebraska. Easily a top 5 Springsteen album for me. I’m not sure the Expanded Edition added much for me though.

Full Lyrics

Down here, it’s just winners and losers
And don’t get caught on the wrong side of that line

Free 🔗

This is still, I think, the most important song released this decade to me.

Full Lyrics

The feeling comes so fast and I cannot control it
I’m on fire, but I’m trying not to show it

An account upgrade starts with an ordinary assignment:

account = Account.find(42)
account.plan = "growth"

account.changes_to_save
# => {
#   "plan" => ["starter", "growth"]
# }

The object has the right value. Dirty tracking has the right transition, but the save fails:

account.save
# => false

account.errors.full_messages
# => []

The row remains on the starter plan. The SQL log contains no UPDATE.

That missing UPDATE is useful evidence: save stopped before the adapter attempted the row write. It does not yet tell us what stopped it.

The cause lives in a concern included by Account:

module BillingMigrationGuard
  extend ActiveSupport::Concern

  included do
    before_update…

Hi, it’s Vipul. Let’s explore this week’s changes in the Rails codebase.

Nominations are open for the 2026 Rails Luminary Awards
The Rails Foundation announced that nominations are open through August 21. The awards recognize people who have significantly advanced Rails for the benefit of the community.

Rails versions 7.2.3.2, 8.0.5.1, and 8.1.3.1 have been released
These security releases address a possible arbitrary file read and remote code execution vulnerability in Active Storage variant processing. Please upgrade as soon as possible.

Stop filtering i18n paths on initialize
Removes redundant path-globbing work during i18n initialization, cutting the load time from 400 ms to about…

I was recently part of a Mastodon discussion about the best way to run code in a Rails application before Puma boots. The need for this is that sometimes you want some code that only runs within a webserver, not when running rake tasks or rails commands or opening the console.

Here we go…

Via server do blocks

Rails 6.1 added a Railtie#server hook that can be invoked in application.rb or a gem’s engine.rb. It’s invoked when the config.ru file is evaluated.

Warning: the invocation of the hook in config.ru is missing from a lot of Rails projects. I once lackadaisically tried to address this upstream, but doublecheck your config.ru actually contains Rails.application.l…

In your config.ru

The Rackup configuration file…

Chris, Andrew, and David begin with summer heat, home cooling problems, and an IPv6 issue preventing Andrew from playing Battlefield 6. The conversation quickly heads down a Raspberry Pi rabbit hole, with projects ranging from smart-home automation and MagicMirror dashboards to local AI transcription. David then recaps RubyConf in Las Vegas before the group discusses design patterns, the changing conference landscape, and how AI is reshaping programming education, software development, and the economics of building products. Hit download now!

Links

• Chris Oliver X
• Andrew Mason Bluesky
• David Hill LinkedIn
• Judoscale- Remote Ruby listener gift
• Brockovich AI Data Center Reporting
• Raspberry Pi
• Rails…

At conferences and meetups, and in conversations online, many Ruby developers have asked me about Ruby Central and my disagreement with them. This post is my attempt to answer the questions I’ve been getting over and over, covering: 1) what is Ruby Central doing now? 2) has the dispute over Bundler and RubyGems been resolved? 3) what has Ruby Central said about the dispute? and 4) what can Ruby developers do now?

What is Ruby Central doing now?

To talk about what Ruby Central is doing now, we need to start with a bit of historical context. What was Ruby Central doing before this saga began? About 18 months ago, Ruby Central:

• ran 2 conferences every year, RubyConf and RailsConf
• had an Open…

Understanding the Rails Middleware Stack July 31, 2026 Middleware is one of the core building blocks of every Ruby on Rails application, yet many developers never interact with it directly. Every incoming HTTP request passes through a chain of middleware before it reaches your routes and controllers, and every response travels back through the same … Continue reading Understanding the Rails Middleware Stack →

For those who have been coding CSS since the Internet Explorer 6 era, when aligning divs on the web was an art, and there was no way to use partials or variables, the arrival of SCSS was a gift to life. At that moment, creating partials and reusing variables for your primary colors was a delightful experience.

Now in 2026, for the real fans, it’s possible you’re still using sass-rails and you’re full of these files around your project. So if you still want to keep using it like me, I recommend migrating to Dart Sass, which is, in fact, a simple migration, to avoid headaches in the future and, most importantly, to start using the latest features.

Historical context

To give a bit of…

Our blog posts are written by the people who did the work. The process is simple: someone picks a topic, writes a draft, and opens a pull request. From there it goes through two passes, a review that looks for correctness issues, gaps, and overstated claims, followed by a QA pass that checks the final polish: that the whole thing ties together, there are no typos, images render correctly, and links go where they say they go.

Like a lot of teams, we started leaning on AI to help our authors get ideas onto the page. Posts get written faster and people get past their writer’s block quicker. It comes with its downsides though. Asked to fill in a gap, it will make an assumption. Asked to make a…

This is part of an ongoing series of Ruby Runway Spotlights, celebrating the founders who took part in the inaugural Ruby Runway Showcase at RubyConf 2026. Each spotlight is a chance to hear directly from the builders turning Ruby into real, live businesses, and to cheer them on as they keep going.

Tell us your name, your startup, and what it does in one or two sentences.

I'm Michael Carroll, founder of Coolhand Labs. Coolhand Labs is a COO for your AI agents. Whether they run on your computer or in prod, we use log traces and human feedback to keep an eye on them and optimize for efficiency and quality, often cutting costs over 50% in the process.

What problem are you solving, and who feels…

Every transactional email provider ships a Ruby SDK. Each one has its own client class, its own conventions, its own way of doing the same thing. I got tired of learning yet another API for every project. So I built Courrier.

About 14 months and 73 commits later, Courrier 1.0 is here. It covers 13 email providers and 7 newsletter platforms. There’s a companion gem for Rails apps that adds generators, ActiveJob support, browser-based inbox previews and more.

Star it on GitHub ✨

13 providers, one API

Courrier.configure do |config|
  config.email = {
    provider: :postmark,
    api_key: "your_postmark_api_key"
  }

  config.from = "devs@railsdesigner.com"
end

#…

Hi friends!

Rails Versions 7.2.3.2, 8.0.5.1, and 8.1.3.1 have been released!

These are security patches addressing 1 security issues:

• A possible arbitrary file read and remote code execution in Active Storage variant processing

We strongly recommend upgrading as soon as possible.

Older versions of Rails are unsupported, and users are recommended to upgrade to at least the 7.2 series. See our maintenance policy for details.

Here is more information about the security issue that these releases address:

• CVE-2026-66066 Possible arbitrary file read and remote code execution in Active Storage variant processing

SHA-256

If you’d like to verify that your gems are the same as the…

Every year, Rails gets a little better. A little faster, a little safer, a little easier to work with. And none of that happens on its own.

The Rails Luminary Awards exist to celebrate those contributions, acknowledging those in the community who have significantly advanced Rails for the benefit of all, and the nominations for 2026 are now open.

If you know of someone who has consistently gone above and beyond to contribute to the framework, triaging bugs, improving performance, adding helpful features, etc. please nominate them below.

All nominations will be reviewed by Rails Core, and the final pick of Rails Luminaries will receive a trophy for their service, as well as a monetary…

Making new Ruby Friends is one of my favorite parts of attending conferences. Neha Abraham joins me to chat about RubyConf, Mental Health, Data Aggregation, and being my Nemesis

How to protect your npm package from being stolen in a supply chain attack and improve its position in security ratings

Here's why you should care about how you release your npm package:

1. Supply chain attacks that steal npm packages are now a real threat, with new attacks every month. If the TanStack, Axios, or ESLint teams were hacked, you can be hacked. These days, attackers steal packages automatically with LLMs, using previously stolen dependencies to reach the next ones.
2. Taking care of…

We recently enabled a really cool feature in ZJIT that makes it feel like a Real Compiler™: the inliner! We’ll write more about it soon. In this post, we’ll talk about one excellent concrete benefit we are already seeing and how it optimizes blocks in pretty much every Ruby program.

I’ll start off with a refresher on how blocks work in the Ruby interpreter, then show you how ZJIT understands and optimizes that bytecode, and then show you the impact of the inliner.

Ruby: a refresher

In the beginning, there were loops.

arr = [1, 2, 3]
i = 0
sum = 0
while i < arr.length
  sum += arr[i]
  i += 1
end

People used them to navigate and manipulate variable-length structures, like arrays and…

Over the past six months at OmbuLabs.ai, we’ve had the opportunity to work on several projects involving generative AI for designing and enhancing real world products.

With today’s image generation models, it might seem like this should be straightforward. A user describes what they want, an image generation model creates a design, and you’re done.

In practice, building an application that consistently produces useful product designs is much more involved. The image generation model is only one part of the solution. The real challenge is designing the application around the model so that it has the information and context it needs to generate useful results.

There is no single way to…

Wiring an LLM into a Rails app takes a handful of lines. Understanding what it actually costs you (feature by feature, user by user) is harder. Most providers and SDKs already report tokens, latency, and even cost, but that data lives in their dashboard. It’s disconnected from your requests, your users, and the feature that made the call. And it sits apart from the APM and logs where you already watch the rest of your app.

In a previous post, we introduced Rails.event.notify(...), the tool-agnostic Event Reporter shipping in Rails 8.1. In this post, we’ll put it to work on a real problem: instrumenting every LLM call in your app so token usage, latency, and cost become structured events…

July 27, 2026 The Ruby Association has announced the Ruby Association Activity Report 2026, an in-person event that will showcase recent developments across the Ruby ecosystem, including keynote presentations, invited talks, and the results of the Association's 2025 development grant program. The event will take place on August 4, 2026, in Tokyo, Japan. Matz to … Continue reading Ruby Association Activity Report 2026: Matz, Fastly, and Ruby Grant Projects Take the Stage →

<Button size="lg" intent="confirm" icon="check" />

Three things are wrong. One line of code. size=”lg”. intent=”confirm”: that prop doesn’t exist anywhere in our schema. icon=”check”. None of these are obscure edge cases. All of them are documented in the design system we own and maintain.

This is what every AI coding assistant does when it meets a private design system. It writes the average of every button it has ever seen. The average is wrong.

For the past several months, we’ve been building toward something we call eval-driven design systems: making our design system…

Every year, Ruby Central's Scholars & Guides Program pairs aspiring Rubyists with experienced mentors for a week of learning, connection, and growth at RubyConf. Scholars get a Guide to help them navigate the conference, build their coding skills, and meet other Rubyists face to face. Alongside that mentorship, Scholars are also invited to take on a mini-project, an open opportunity (not a requirement of the program) to share their own unicorn, whatever makes them uniquely them, with a community that's wonderfully diverse in thought, interests, skills, and talents. This year's theme was "Ruby for funsies: using Ruby and Rails to enhance a hobby," and Scholars could present however felt…

As developers, we sometimes find ourselves in situations where something feels slower than it should be. The first thing we tell ourselves is “Maybe I need a different tool.”

And sure, at times, it might be due to the tool, I’ll give you that. But most of the time, it comes down to how you’ve implemented certain features. That’s one of the downsides that comes with having too much freedom.

As for Sidekiq specifically, there are various reasons why your project might be getting slow or was slow to begin with. In this tutorial, we will cover a few of them:

• N+1 queries inside jobs
• Missing or misconfigured database indexes
• Synchronous external HTTP calls
• Too much work in a single job (no…

Launched the Theme Builder with coordinated accent and base palettes, live light and dark previews, and copy-ready Tailwind CSS. Updated checkbox, radio, and tooltip components for the new theme contract.

Components in this release:

• Checkbox
• Radio
• Tooltip

View full changelog →

Rails Isn't Getting Bigger It's Getting Sharper July 27, 2026 Every week, This Week in Rails highlights the latest changes merged into the framework. Most weeks, it's easy to focus on the individual features. But the July 10 edition suggests something more interesting: a broader trend in how Rails is evolving. Instead of shipping large, … Continue reading Rails Isn’t Getting Bigger It’s Getting Sharper →

It has now been about 18 months since I concluded my post series on optimising Ruby’s json.

Back then, I covered interesting performance patches that happened between version 2.7.2, the last version published before I took over maintenance, and version 2.9.0, the latest release at that time.

During that span, both the parser and the generator became twice as fast on the infamous twitter.json benchmark.

== Parsing twitter.json (466906 bytes)
ruby 4.0.6 (2026-07-14 revision 03b6d3f889) +YJIT +PRISM [arm64-darwin25]
 2.7.2    575.498  (± 2.1%) i/s    (1.74 ms/i) -      2.880k in   5.004363s
 2.9.0      1.109k (± 0.7%) i/s  (901.86 μs/i) -      5.564k in   5.017923s

Comparison:
2.7.2:     …

Changing an Active Record object can feel like one operation: assign a value, call save, and expect the row to change.

Rails sees two separate moments. Before the save, it needs to know what the next write would change. After the save, callbacks and application code may need to know what that write changed.

Confusing those questions can produce a bug even when the update itself succeeds.

A plan-change audit starts recording the wrong transition.

The account update succeeds, and the callback creates the audit row. Nothing raises, and the result looks close enough to correct:

class Account < ApplicationRecord
  before_update :record_plan_change

  private

  def record_plan_change
   …