Rubyland

My father is a poetry translator, so perhaps my obsession with prose runs in the family. This started before Markdown: I wrote rubocop-exception_messages after noticing inconsistent exception messages in Grape.

After I replaced this blog’s Python spell checker with a RuboCop plugin I still had a Node installation to check Markdown. Since it’s a Jekyll blog, and the build is Ruby, the spelling checker is Ruby, and my default set of code examples are also Ruby, why was formatting the README Node.js?

I first tried extending rubocop-md, proposing prose checks and parser diagnostics, a reusable Markdown parser, hidden cop-directive fixes, front-matter handling, and preserving prose alongside…

Hi, it’s Greg, bringing you the latest changes in the Rails codebase. It was a busy week, with a lot of changes, so buckle up!

Rails 8.0.5.2 and 8.1.4.1 have been released! These are security releases, addressing 21 security issues, so you should upgrade if you haven’t already.

Allow anonymous subclasses of cache stores with LocalCache
A recent change built the local cache’s registry key from the store’s class name in initialize, and that name is nil for an anonymous class, so Class.new(ActiveSupport::Cache::MemoryStore).new blew up with a NoMethodError. Anonymous stores are handy in tests to record what a request writes to the cache, and they work again.

Fix Active Record includes with …

Garrett and I recorded episode two of The Friday Deploy. We started with personalized interfaces and ended with a basketball app and me casually mentioning that I’d rewritten a chunk of Flare to run on Cloudflare. As one does.

But the thing I keep coming back to is the pull request that makes your stomach hurt.

I’ve made plenty of those lately. Ask AI to build something. Have another model review it. Fix the findings. Review it again. Find more things. Fix those. Pretty soon the little change you wanted is 3,000 lines and you don’t want to merge any of it.

For a while, my response was to keep going. Surely one more review would make me feel better.

Sometimes the better answer is to throw…

So who is going to buy Twitter now that he’s throwing his toys?

Nate Berkopec returns to Remote Ruby joining Chris, Andrew, and David for a deep conversation about the latest wave of Ruby security vulnerabilities, AI-powered cybersecurity, and the rapidly changing role of software engineers. Nate shares his firsthand experience investigating a serious Ruby regex vulnerability, explains why developers need to take a more proactive approach to security, and challenges traditional development practices in an AI-driven world. From autonomous coding agents and dramatically faster development workflows to rethinking unit tests and code reviews, this episode explores why the future of programming may be less about writing code and more about building systems…

Code Got Cheap. The Rest Didn't. November 6, 2026 AI has fundamentally changed how we build software. But implementation is only one part of the job. Architecture, business knowledge, testing, and understanding real user workflows still require experienced developers. By Guido Boyke I've been developing software for more than 30 years, including about 20 years … Continue reading Code Got Cheap. The Rest Didn’t. →

The JRuby community is pleased to announce the release of JRuby 10.0.8.0.

• Homepage: https://www.jruby.org/
• Download: https://www.jruby.org/download

JRuby 10.0.x targets Ruby 3.4 compatibility.

Thank you to our contributors this release, you help keep JRuby moving forward! This cycle we had several new contributors and hundreds of pull requests. Keep it coming, JRubyists! @aminmansuri, @kares, @hiukkanen, @evaniainbrooks, @stefanlew-tractive, @sampokuokkanen, @zev, @matrei, @notsrch, @sferik, @RaphaelFakhri

Notable Changes

Security

• The asm bytecode library was updated to 9.11.1 to fix recent CVEs (none of which affect JRuby). #9858

Standard Library

• The standard library…

The JRuby community is pleased to announce the release of JRuby 10.1.3.0.

• Homepage: https://www.jruby.org/
• Download: https://www.jruby.org/download

JRuby 10.1.x targets Ruby 4.0 compatibility.

Thank you to our contributors this release, you help keep JRuby moving forward! This cycle we had several new contributors and hundreds of pull requests. This list includes contributors to JRuby 10.0.8.0. Keep it coming, JRubyists! @samuel-williams-shopify, @aminmansuri, @kares, @hiukkanen, @evaniainbrooks, @stefanlew-tractive, @sampokuokkanen, @edipofederle, @samyron, @reginaldalfret, @albertalef, @taxor03, @zev, @matrei, @notsrch, @sferik, @RaphaelFakhri

Notable Changes

See also the JRub…

RubyMine 2026.3 is out!

This release brings JetBrains Air for working with your preferred coding agents, native access to WSL and Dev Container projects, and smarter Ruby and Rails support. You’ll also find easier interpreter setup, improved navigation and refactoring, and updates that make everyday development more comfortable.

Download RubyMine 2026.3 from our website or update via the Toolbox App.

Now, let’s explore the highlights.

JetBrains Air

I have always been interested in frontend solutions for building web applications. Even though I’m more of a backend programmer, I really dig all the different techniques people come up with for creating browser-based apps that are both reactive (reflecting remote state in real-time) and interactive (responding to user actions).

Over the last few years, I’ve been looking at different frontend frameworks and libraries, to see how they work, and what I can learn from them. I adore Svelte, which is really smart and efficient. Its sister framework SvelteKit inspired the file-based routing in my own web framework for Ruby, Syntropy. I also really like the approach of the Phoenix framework…

Ask any LLM to style a layout and it uses CSS units like: px, rem, em, % and vh. So do you, out of habit. But CSS has grown its number of units. Ones that fit specific jobs way better than your old defaults. Here are seven your code generator has probably never suggested.

They are all baseline ready (e.g. supported by core browsers for at least 30 months), so there is no fallback excuse left. Let’s get into it.

Logical properties: think in axes (x and y)

A few of these units only make sense when you drop the ideas of “width” and “height” and think in axes instead. CSS now measures along the inline axis (the direction your text flows, left to right in, for example, English) and the block…

RubyGems 4.0.24 includes enhancements, bug fixes and documentation and Bundler 4.0.24 includes enhancements and bug fixes.

To update to the latest RubyGems you can run:

gem update --system [--pre]

To update to the latest Bundler you can run:

gem install bundler [--pre]
bundle update --bundler=4.0.24

RubyGems Release Notes

Enhancements:

• Installs bundler 4.0.24 as a default gem.

Bug fixes:

• Skip executable removal gracefully when the bin directory is missing. Pull request #9963 by Evan Li and Hiroshi SHIBATA
• Fix file locks letting multiple processes in when lock files are removed. Pull request #9930 by Richard Janita and Hiroshi SHIBATA
• Turn off echo before printing the…

Documentation:

• [DOC] Fix link. Pull request #10014 by Burdette Lamar

Bundler Release Notes

Enhancements:

• Read the Ruby version from mise’s inline table form. Pull request #9991 by…

Buildkite runs CI/CD for some of the most demanding engineering teams in the world. Why a team of opinionated developers hired Evil Martians to build a framework-agnostic design system with AI skills that guide coding agents through every component.

Buildkite is a high-scale, hybrid CI/CD platform that lets engineering teams run fast automated build, test, and deployment pipelines.

If you've set up an automated email sequence and haven't reviewed it in a while, here's how to audit it with help from AI agents.

Continue Reading

I recently ported my 1996 Pascal/Delphi calculator to Rust. The result is excalc, a cross-platform command-line application and MCP server.

Rust makes it easy to compile an application on every platform. Distributing it via crates.io, MSI, Homebrew or WinGet needed more work. Paste this cookbook into your favorite AI prompt to get it done.

We trigger a distribution from GitHub Releases: a Git tag identifies the new version, CI publishes the crate from that tag, builds portable archives and an MSI from that tag, and attaches everything to the release. Homebrew downloads the tagged source archive. WinGet points at the released MSI.

Prepare the Rust Package

Start with complete package…

What happens when the tool you rely on disappears? For Eduardo and Camila Souza, the shutdown of Pivotal Tracker became the motivation to build Pivotal Tasker, a Rails-based alternative inspired by the project management workflow they missed. They discuss reconstructing the experience from memory and reference material, adding classic and modern interfaces, and integrating coding agents to help create and work through stories.

The conversation expands into their move from consulting toward building products. Eduardo and Camila describe Chamber Builder, an all-in-one platform for chambers of commerce, and a custom sales CRM that brings calling, recordings, transcripts, and…

Five years ago, I announced that RubyTapas had become Graceful.Dev. But a revenant of that feast was left behind: the rubytapas.com site stuck around to handle billing for legacy customers, and I never got around to fully rolling that aspect into Graceful.Dev.

Until now. As of today, RubyTapas.com is no more. If you have a RubyTapas legacy account, it is now managed at Graceful.Dev. Same plan, same price, same access. Nothing changes except the words on the receipts, and there’s nothing you need to do.

And of course, all RubyTapas episodes are here at graceful.dev (as they have been for years). As well as lots and lots of post-RubyTapas content, organized into courses. The old…

Hello, Rails community!

Rails Versions 8.0.5.2 and 8.1.4.1 have been released. These are security updates addressing 21 security issues falling into a few themes:

• Possible arbitrary file read, file write and remote code execution in Active Storage image and video processing
• Possible Strong Parameters bypass in Parameters#each_key
• Possible IP spoofing in remote_ip through the Forwarded header (8.1 only)
• Multiple possible XSS vulnerabilities in Action View helpers, and one in the Active Support MessagePack serializer (8.1 only)
• Possible DoS vulnerabilities in Active Support safe_constantize, Action Controller Live streaming, and Active Storage proxy mode and filename handling
• U…

We strongly recommend upgrading as soon as possible.

Older versions of Rails are unsupported, and users are…

Every business has a list of jobs nobody wants and nobody can automate. Someone logs into a supplier portal every Monday to download invoices, then types them into the accounting software one line at a time. Someone else fills in the same government form every quarter, copying numbers from a spreadsheet into boxes on a website. Neither system offers a way for other software to connect to it (an API), the vendor isn’t going to build an integration for a customer your size, and so the work stays manual.

At the end of October, OpenAI released GPT-6.1 Terra, a model built for what OpenAI calls computer use: it looks at a screen, reads what’s on it, and clicks and types its way through apps and…

We recently moved a client’s Ruby on Rails app off Heroku: a Rails API with Sidekiq workers and several services around it. Before we changed anything, we spent about a week on discovery. We had a kickoff call with the client’s team on a Monday, and then two of us paired for the rest of the week to map the infrastructure and draft a migration plan.

Nothing about that app followed one pattern. Its services were deployed in different ways, and some of the things that mattered most for the migration, like the tools outside Heroku that read from the database and the service that promoted code to production, didn’t show up in the Heroku dashboard at all.

In this article, you will learn what we…

AI can generate a lot of code quickly. There’s a thought that we can catch its mistakes or other issues by reviewing that code. In theory, this may be true; code review can catch bugs. In practice, it only works if the reviewer knows what to look for, has some context and, well, gives a shit.

This is all in a professional context, i.e. at a job. I don't think the conclusions here are necessarily relevant to hobby or open source…

Why Review…

A tour of lemans, the open source Ruby harness behind Agents on Rails: eval task anatomy, how it runs and grades coding agents for hours, and how cheaters shaped its guardrails.

Benchmarking coding agents in one sentence: give a model a task, let it work, check the result. The hard part is keeping the race fair. Every model must get the same conditions, and no agent should be able to escape its sandbox or fool its grader (and they try). And all of that has to keep running for hours. In the first post of The Agents…

I’ve been building a new project in my spare time while working through ideas for a few other apps.

Naturally, I found something to get distracted with.

Oh My Scrobbles is a Mac app for scrobbling Apple Music (and Radio!) to Last.fm and exploring your old listening history.

Like most projects I actually follow through on… this started with a huge itch I needed to scratch. I have over 300,000 scrobbles. I take this shit very seriously. 😉

It can sync my whole Last.fm history to my Mac and expose a local MCP server, so I can ask ChatGPT and Claude questions about it.

I used that to find the exact tracks I’d scrobbled just before and after creating my GitHub account in 2008. Apparently,…

Somebody at Gusto asked, during one of our internal AI AMAs, whether /login was costing them tokens. The answer came back yes, relayed into our Claude Code channel a few minutes later: /login "is an LLM call, which will take more time and end up with unnecessary token use," so run claude auth login from the CLI instead, because that one's instant and free. It came with receipts, sort of. Secondhand from someone who'd watched /login run up $3.

That felt off, so I went and checked. It’s off. /login never touches the model, in any config. It's a local command: it runs entirely on your machine and never builds a prompt, so there is nothing to send.

So where did the $3 come from? A leading space.…

Rails main lets ActiveSupport::EncryptedFile try comma-separated keys when decrypting, including keys supplied through RAILS_MASTER_KEY. This is unreleased Rails 8.2 development functionality; Rails 8.1.4 still expects a single key. Successful fallback reads do not establish support for multi-key writes or a complete credentials-editing workflow.

Try fallback reads with a disposable file

This standalone example generates its own keys and uses a separate example variable. It does not load application credentials or read RAILS_MASTER_KEY.

require "active_support"
require "active_support/encrypted_file"
require "tmpdir"
require "fileutils"

variable = "SAELOUN_SYNTHETIC_KEYS"
raise "Use an…

Two jobs finish successfully. One account update disappears.

Suppose an account has 100 credits. You enqueue two jobs to add 10 and 20. Both jobs finish without an exception, but the account ends with 120 credits.

Each job runs this code:

class AddCreditsJob < ApplicationJob
  def perform(account_id, amount)
    account = Account.find(account_id)
    account.update!(credits: account.credits + amount)
  end
end

Assume credits is an integer column, with no optimistic locking or custom database rule protecting the update. These are application credits; the example doesn't model a payment system.

Two workers can execute the job in this sequence:

Job A (+10)       Job B (+20)
read 100
                …

The idea for Svet came from a private repository at work, where checking filename case helps catch portability problems like Logo.svg and logo.svg colliding on a case-insensitive Windows filesystem. These checks are implemented in pure JavaScript. That seemed like a useful job for a reusable repository linter.

I went looking for an existing tool.

I had a Raspberry Pi 4B I thought might be dead. It wasn’t. I’m having a bunch of building work done and of course, the thermostats do not work with Apple HomeKit.

So the Pi now runs Homebridge, which puts our underfloor heating thermostats (and also now Samsung TVs) in Apple Home. For good measure it also runs Pi-hole, which blocks ads and trackers for every device in the house.

Gear required

• A Raspberry Pi 4B + USB-C power + micro-HDMI
• A (new) microSD card
• Raspberry Pi Imager on my Mac
• An Argon ONE case and a USB SSD

I thought the Pi was dead

First I checked the cheap parts. SD cards and power supplies fail far more often than the Pis themselves.

1. Removed and replaced…

Batching the Billing Ledger: Small Trade-Offs with High Impact is a great article about “systems assembly”, and microbilling is part and parcel of nearly any web app today, certainly when your users call into LLM models. Gotta keep’em tokens counted!

Since the start of the agentic era, I’ve been curious about “how much software” we need for workloads like this. After all, my doctrine is less stuff and this looked like a use case too perfect to pass on. Thank you, Vicente, for the pitch-perfect nerdsnipe!

So, here’s bab - but I am getting ahead of myself. First, we need the parts.

I am currently available for contract work. Hire meto help make your Rails app better! …

T…

Hi, it’s Claudio Baccigalupo. Don’t be scared 🎃 this week’s changes to the Rails codebase are all treats. Let’s explore them.

New guide to multiple databases in Active Record
As part of the Rails Foundation effort, the refreshed guide is live, tackling the three-tier production configuration that new apps get by default.

Tuning performance for deployment guide open for review
A PR that updates the guide to performance tuning is open. Your feedback is helpful, especially if you have experience tuning Rails apps in production.

Don’t load Capybara and Selenium on boot in new applications
The generated Gemfile now declares capybara and selenium-webdriver with require: false. ActionDispatc…

While working on Svet, a Git and filesystem linter, I had a conversation with GitHub Copilot CLI about a flag.

The tool checks files. We were adding automatic fixes. Naturally, I wanted to preview changes before allowing the tool to write them.

The first suggestion was --fix-dry-run. I preferred a global --dry-run that could apply to both checking and fixing.

Simple enough. Except checking already doesn’t write anything. What should a dry run of a check do?

One answer is that a dry run prohibits writes. Run all the checks, report the findings, and leave the files alone. With --fix, calculate the fixes but don’t apply them. Without --fix, the flag changes nothing.

That’s a consistent…

I’ve put together “Which Rails Layer Owns This?”, a six-page reference for when production Rails does something you didn’t expect.

Use it to find the layer to inspect: request handling, identity, loaded records, database writes or background work. Each page gives you checks to run, evidence to collect and links to the full explanations.

Download the attached PDF and keep it beside your logs the next time you’re tracing a production bug.

Summary

• The private keys of eight eMudhra intermediate certificates were compromised. A network attacker could use them to impersonate websites and services that JetBrains tools connect to.
• JetBrains IDEs, the Toolbox App, Gateway, and ReSharper are affected because they use the trust store of the bundled JetBrains Runtime (JBR). For IDEs, the embedded browser (JCEF) is also affected. Operating system updates don’t protect against this issue. 
• The Toolbox App and JetBrains IDEs use a background service, jetbrainsd. It has its own built-in list of trusted certificates and is fixed separately, in jetbrainsd 0.9.9728.
• At the time of publishing, we are not aware of any…

Available fixed versions

The issue is fixed in the following versions:

• IntelliJ IDEA: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.4.
• PyCharm: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3.
• PhpStorm: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3.
• RubyMine: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3.
• WebStorm: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3.
• Rider: 2026.3 EAP 9, 2026.2.4, 2026.1.5.3, 2025.3.5.3.
• CLion: 2026.3 RC, 2026.2.4.1, 2026.1.5.2, 2025.3.6.3, 2025.2.6.3.
• DataSpel…

The 2025.2.6.* updates for all IDEs now…

This week on Remote Ruby, Chris, Andrew, and David welcome Dan Manges, co-founder of RWX and former CTO of Braintree, to explore a new approach to continuous integration built for the age of AI coding agents. Dan explains how RWX uses intelligent caching, graph-based execution, and isolated agent sandboxes to dramatically improve development workflows. They dive into flaky tests, automated code validation, security concerns, and why traditional CI platforms may be struggling to keep up with AI-driven development. Plus, they discuss how engineering teams can test changes before opening pull requests, reduce infrastructure costs, and rethink the way software gets built and shipped. Hit…

(I’m still looking for my next gig. You can get in touch by emailing job@ryanbigg.com.)

As someone with infinite spare time, I feel qualified to share my opinion on AI by carving a post out of the raw marble of my keyboard with my bare hands.

I wrote this on LinkedIn at the start of this month:

After interviewing now at a few places these things are simultaneously true:

1. EVERYONE is on the hype train
2. Nobody knows how to REALLY use AI and people are trying to figure that out
3. There are a lot of experiments that sound promising on the cover, but nothing past “we’re gonna go THATAWAY”
4. There is an unlimited budget for this exploration, until there won’t be

I’ve now…

Last weekend we were camping. Fall break. Glorious northern Indiana weather. My kids were fishing with grandpa, so I went for a walk around the campground (to check out the other rigs as dads do). Somewhere along the way I opened T3 and told Nunebot to do another run. Merge, merge, merge, run it again, merge, merge. Just getting some exercise and enjoying the fall weather.

Between Saturday and Sunday I merged 113 pull requests. Definitely the most in a two day span in the two decades I’ve been doing this.

I know how that sounds. But I honestly like this more than games, mindless scrolling, or Instagram. It’s relaxing for me. Read a PR, it makes sense, merge. Little dopamine hit. Next.

I’ve…

you can train someone to be better. You can’t make someone care about things they don’t intrinsicly value.

naildrivin5.com – David Bryant Copeland’s Website: You Cannot Trust the AI Code Generator

I’ve built five spell-checking plugins in the last week. This is not an unhealthy interest in spelling. The cost of rolling tools out is the cost of tokens + my time supervising AI. So, before adding another language runtime, package manager, configuration file, and CI job to your project, consider spending an hour vibe coding the missing plugin.

This blog used to run a Python spell checker that took more than three minutes. It’s a Jekyll blog, which is Ruby. Why was I maintaining a Python environment to tell me that I misspelled “hello”? I replaced it with a RuboCop plugin. Spelling became another cop, with the same configuration, exclusions, command, and CI integration as the rest of the…

A Rust project…

Most of what can be read here is around and for Ruby on Rails. My main apps still are powered by it. But monopolies are never good. Hanami is the one I get most excited about.

It is why I extracted the core features (pulling SVGs from remote repository, transforming filenames, etc.) of Rails Icons into a Ruby gem, called Icons, so other frameworks can have all the icons in their apps as well.

Hanami Icons is the next wrapper of the Icons gem for… drumroll… Hanami! It gives you the same interface as Rails Icons too, whether that is Heroicons, Lucide, Tabler or even a folder of your own SVGs.

<%== icon "check", class: "text-gray-500" %>

<%== icon "apple", library: "simple_icons", class:…

if you have seen Rails icons, you…

Originally published on Ruby Central.

Relaunching the changelog

It has been a long time since the last Ruby Central Changelog, and we’re bringing it back. Ruby Central’s open source team operates RubyGems.org, a service many of us rely on every day, and supports the packaging ecosystem around it. The Changelog is where we will share that work. Each issue will cover what is changing, why it matters, and where you can get involved.

This is the first issue edited by our new Community Manager, Kirk Haines, who joined Ruby Central in August. If you missed his introduction in the Ruby Central August README, the short version is that Kirk has been using Ruby since 2001 and is glad to give back…

Relaunching the Changelog

It has been a long time since the last Ruby Central Changelog, and we’re bringing it back. Ruby Central’s open source team operates RubyGems.org, a service many of us rely on every day, and supports the packaging ecosystem around it. The Changelog is where we will share that work. Each issue will cover what is changing, why it matters, and where you can get involved.

This is the first issue edited by our new Community Manager, Kirk Haines, who joined Ruby Central in August. If you missed his introduction in the Ruby Central August README, the short version is that Kirk has been using Ruby since 2001 and is glad to give back to the language and the community that…

Starting a new Solidus store involves only a few tweaks to support my preferred JS bundler, as well as a number of decisions regarding hosting, databases, assets and more. This is the sequence of steps I follow to launch a fresh store.

For the purposes of this demo, I have intentionally left out some of the details regarding configuring pipelines in Heroku, and distinct public/private S3 buckets in AWS.

Please read the documentation I’ve provided in those sections to ensure you are complying with best practices and procedures to keep your app safe and secure.

Prerequisites

Before you get started, make sure to have Node, Docker, and the Heroku CLI installed. You will also need to set up an…