This is a story about a donate button that slowly turned into a switchboard operator, not because the payments were hard, but because two SDKs refused to speak the same language. For the longest time, our donate button had exactly one job. A donor picked an amount, tapped Donate, a payment sheet slid up, money … Continue reading When Razorpay Meets Stripe: An Adapter Pattern Story
A dropdown looks like a problem solved by many already. But it is not too difficult to build your own and allows to make them exactly how you want them to be. It has to open next to its trigger, flip when there’s no room, stay inside the viewport, move focus into the panel, cycle through its items with the arrow keys, close on Escape and disappear when you click somewhere else.
Then there’s the part I find most useful: the same panel should also work as a right-click context menu, opening where the pointer is instead on a button.
That’s a handful of behaviors together. I keep them in one custom element, <ui-dropdown>.
The click version is a trigger plus a panel marked with data-dropdown-pa…
William Mena shares how Rails World changed his daily workflow and what he’s not changing yet.
Felipe Vogel 11 Nov 2026
Hand coding a feature in a Ruby gem
- This year
- The idea
- How often do I quit?
- How early do I quit?
- Adding a test
- Making the CLI output prettier
- Showing the new stats on my website
- Why hand coding?
A full year since my last programming post, recharged by months of being offline LARPing as a normal person, I’m ready to make my grand re-entrance to the Internet.
Ready for it?
Today I’ll walk you through adding a small feature to a little Ruby gem I made a few years ago.
Audience: 【・_・?】
I’m pretty sure I’m the only person who uses my gem.
Audience: (￣(エ)￣)ゞ
Oh, and we’ll do it entirely by hand. No AI!
Audience: (ง ˃ ᗜ ˂)و ̑̑ ヾ(｡★ω★｡)ｼ ٩(ˊᗜˋ*)و ♡ ₍₍⚞(˶˃ ᵕ ˂˶)⚟⁾⁾
(At least, that’s how I feel these days…
Authors: Aibek Izhanov, Backend Engineer, and Travis Turner, Tech EditorTopics: AI, Rails, Case Study, Ruby, LLMs
How Evil Martians moved Uscreen’s MCP server into its Rails app as a remote, multi-tenant service: Doorkeeper OAuth, tenant-scoped tools, and dry-run previews for destructive operations.
Uscreen, the leading all-in-one membership platform for video creators and entrepreneurs, came to Evil Martians with a working Model Context Protocol (MCP) server already tested by early adopters. To use it, a creator installed an NPM package that ran the server on their computer, entered an API key, and plugged it into the AI client of their choice. It worked, but it took a lot of setup. So, to…
How we train and serve a shared generative model for personalized search and recommendation at Shopify scale.
How Can You Be Responsible for Code You Don't Understand, Especially When You Can No Longer Program?
If AI is writing all the code and no one is reviewing it, how the heck can anyone be responsible or accountable for code they not only don’t understand and eventually can never understand?
AI's primary purpose is to deskill its operators.The short answer is that programmers become responsible for outcomes, not code. The longer answer is there are no programmers - AI is a replacement, not an assistant, since it’s primary purpose is to deskill its operators.
If AI is writing all the code and no one is reviewing it, how the heck can anyone be responsible or accountable for code they not only don't understand and eventually *can never understand*? The short answer is that programmers…justin․searls․co - Digest 11 Nov 2026
📄 I'm just a meat proxy
I feel like AI-related blog posts should all begin with a disclosure as to how cooked the author is. On a scale of 1 to 10, I'm apparently now at "built a custom software factory and has fooled himself into thinking it actually works." So I guess that makes me an 8 or a 9? Not full-blown psychosis, I hope, but consider yourself duly warned.
My agents are currently shipping 20 to 40 issues a day across the dozen or so iOS apps I'm building. Today, I'm going to show you a bit of my app, MeatProxy, and how it governs my software development process. I'm not going to let you download it (you don't want it, trust me), but at the end of this post, your agent will find instructions for building…
An engineering manager I worked with before asked me how I can deliver good software for lower cost. Am I slow? Is it truly good? Am I losing money?
One should always keep such friends close. And it’s a fair question. The old rule in software is good, fast, cheap: pick two. But I provide all three. The short answer is that I changed how I work. The long answer follows.
I jumped in advance
For most of my career I had it all: a reliable full-time salary as a staff engineer, solving tricky engineering or team problems with people I like. Then AI agents appeared, and got better at writing code faster than anyone expected. And I wanted to build software differently. How long would jobs…
If you run a small business, there’s a good chance your website, your proposals, and the handouts you give clients were made at different times, by different people, in different tools. Each one looks fine on its own. Put them side by side, though, and they don’t quite look like they came from the same company.
I ran into this recently on a side project: setting up the brand and website for a new business that had little more than a few rough documents to its name. I used Claude Design, Anthropic’s design tool, and instead of starting with the website, I started with a design guide (also called a style guide or design book). That’s one document that records the business’s colors, fonts,…
What does it take to make an open source project welcoming to contributors—and manageable for its maintainers—in the age of AI? Rachael Wright-Munn joins David Hill to share what she’s learning through her work on Ruby Events, where supporting new contributors and reviewing AI-assisted pull requests raise many of the same questions about context, documentation, and code quality.
Rachael explains how Ruby Events uses YAML validation to catch problems and provide actionable feedback, along with an evolving Active Record–style interface built around Yerb. The conversation explores how clear rules, useful abstractions, and better development environments can help contributors produce…
Many of the Ruby on Rails apps we work on now have an AI layer of some kind. Sometimes it’s a single RubyLLM chat in a background job, sometimes it’s an MCP client wired into a support tool, and on most teams there’s a coding agent running in somebody’s editor. That layer gets the same security process as the rest of the app, which usually means bundler-audit in CI and a Ruby upgrade when somebody gets to it.
The last few weeks produced four separate problems in that layer. None of them has an advisory against a Ruby gem, so a dependency scanner stays green for all four. Two come from reading the source of ruby_llm-mcp, a community MCP client gem, one is a version constraint, and one is a…
RubyLLM 2.2 is out! I released it on stage at SF Ruby, and it’s the release I’m proudest of.
The code a model writes now runs in a sandbox on your own servers, and skills and file stores build on it. Tools can ask a person and wait for the answer. A chat survives a deploy. And there are context budgets, tests without a provider, and four new providers.
It’s also the first release I built for a new kind of user: the coding agent. More and more of the code that uses RubyLLM is written by Claude Code, Codex and Cursor, so I spent as much time making RubyLLM easy for them to use as I did on features. The talk was about that, and about the idea that you don’t need frameworks anymore.
Here’s…
ruby – Bibliographic Wilderness 10 Nov 2026
Limit to 20 minutes of audio for (hosted?) whisper-1 for transcription
We are using the proprietary hosted version of OpenAI whisper-1 to transcribe audio, with timestamps, into timestamped VTT.
The newer gpt-transcribe may reportedly do a better job of transcribing — but it doesn’t provide timestamps. One could probably try to use other tools to then sync the transcript, but we haven’t looked into that, not sure if it would get you anything useful, we’re trying to keep it simple.
The platform-hosted whisper-1 has a limit of 25 MB per audio file input, but no duration limit.
So when we started, when I was new to such things, I figured, great, we can downsample our oral history interview content to 16kbps mono Opus/ogg audio, and fit a lot in 25MB.…
code.dblock.org | tech blog 10 Nov 2026
How I Learned to Use Copilot Sessions 400 Million Tokens Later
I recently built a Markdown linter with GitHub Copilot CLI. In between, I reviewed other projects, edited this blog, and generally treated one conversation as a terminal into which I could dump whatever I was doing next. I really loved the fact that Copilot would context switch, do some work, then go back to what it was doing. It’s so smart!
Well, that may have burnt some extra tokens.
Counting Tokens
The local usage logs for the roughly three-and-a-half-day development window showed approximately 4,322 model calls, including delegated agents:
Token Type Millions Non-cached input 11.4 Output 2.4 Cache…Back in August, we tested Anthropic’s promise to watermark Claude’s output and found nothing there yet. Since then, Anthropic has published which models it marks and how, and it’s no longer alone: OpenAI has announced a text watermark of its own, Google has opened its detector to the public, and xAI has taken a different route entirely.
Since August, though, the questions we’ve heard most are about what comes after the watermark: who owns a logo that a model drew, whether code written with AI can be treated as proprietary, and whether a prompt counts as authorship. And behind those sits a newer one: if your AI-assisted marketing turns out to infringe someone’s work, does your insurance…
What changed when agents started writing our mobile code, and how we redesigned our architecture, tooling, and workflow around validation.
Tim Riley 10 Nov 2026
Continuations 2026/45: Non-stop
It’s been a week of non-stop work.
First, big thing: I merged diagnostics into Hanami Webconsole! With that done, I was able to do a review of the rest of the gem and push up a range of improvements, along with a related change in Hanami Reloader.
I also got to sight some of the design revisions that Max has been putting together for this. It’s going to feel truly us when it ships. Can’t wait.I shipped the new, styled output for Hanami CLI! It feels so much more polished now, and this is just the beginning. Also discovered that fast terminals are fast and pushed up a fix for a flickering spinner.
Katafrakt Korner: Paweł found and fixed a gap in our error handling around actions…
Passenger - Phusion Blog 10 Nov 2026
Passenger 6.2.2
Version 6.2.2 of the Passenger application server has been released. This release is mostly focused on bug-fixes and security hardening.
Other Improvements
- Harden against symlink attacks on improperly secured instance directories. This is a mitigation, and not intended to replace the use of proper filesystem permissions.
- Harden against secure headers containing header delimiters.
- [Enterprise] Fix the hard memory limit not being enforced on a process that already exceeded the soft memory limit and is still finishing its requests.
- [Standalone] Fix Passengerfile.json strings that contain \uXXXX escapes for non-ASCII characters being garbled or making Passenger crash.
Upgraded libraries
- Upgrade llhttp…
Rails at Scale 10 Nov 2026
Metaprogramming on a Budget
If you generate an empty model class in a Rails application, the attribute methods are automatically available:
class Post < ActiveRecord::Base
end
p = Post.new
p.title = "Metaprogramming on a Budget"
p.title # => "Metaprogramming on a Budget"
It’s one of Rails’ oldest features, as seen in the old Build a Blog in 15 Minutes demo from 2005. But how does it work?
✨ Metaprogramming ✨
If you’ve never used it before, metaprogramming may sound really scary, but its not too bad in practice. All it really means is that we’re writing code that writes more code.
To get a better understanding, let’s try implementing a simple version of this Rails feature ourselves. The entrypoint will be a…
In the previous post, we saw how a large language model like Claude works. Your application can use Claude by sending HTTP requests to the Claude API, which Anthropic runs. The model can't query your database, call your APIs, or run any of your code. All it can do is read the text you send it and write text back. Yet you've used AI features that look up records, search the web, or edit your code in a local repo. They're all built on a feature of the Claude API called tool use. With tool use, Claude doesn't run your code. It asks your app to run it, and your app decides whether to run it or not.
In this post, we'll build that tool exchange to learn what goes back and forth between…
I’ve been using git worktrees a lot lately. Having a couple of branches checked out next to each other (often with an agent working away in one of them) is awesome. Until two of them start running migrations against the same development database and everything gets mixed up.
The obvious fix is to give every worktree its own database. But I like to develop against an anonymized copy of production, and copying gigabytes of data for every new worktree is slow and fills up my disk in no time.
Postgres 18 quietly shipped a new setting that fixes both: file_copy_method = clone. It’s been there since 18.0 (changelog), so if you’re still on an older version, that’s a good reason to upgrade.
What…
Giant Robots Smashing Into Other Giant Robots 09 Nov 2026
NWRUG's (Manchester, UK) November 2026 meeting — (Un)learning programming
The next North West Ruby User Group in Manchester, UK is in a fortnight on 19 November at Colony, One Silk Street. Sam Péchèr will reflect on starting out as a junior last year, just as the industry started to shift to not writing code.
We’ll be at the venue for pizza from 6:30pm with the talk starting at 7pm. Afterwards we’ll retire to The Crown & Kettle for a drink. The venue, pizza, and drinks are kindly provided by NWRUG’s sponsors Fatsoma and thoughtbot.
Register here if you would like to attend. Full details on this (and all NWRUG events) over on NWRUG’s website.
If you enjoyed this post, you might also like:
On the 4th of November the Rails security team shipped 8.0.5.2 and 8.1.4.1, and it is a big one: 21 security issues in a single release. One of them is rated critical, GHSA-f3w6-w445-fwh9, “Possible arbitrary file write and read in Active Storage image analysis”, with a CVSS score of 9.8.
Noteflakes 08 Nov 2026
Introducing Project Steadfast
Recently I wrote about an idea that’s been
floating around in my mind for a long time - the ability to do metaprogramming
in Ruby by manipulating Ruby ASTs, similar to the macro capabilities of
languages such as Lisp or Elixir. The use of eval (in its different
variations) is a common metaprogramming technique in Ruby that consists of
generating code at runtime from dynamically constructed strings. This is often
done for performance reasons: ERB compiles templates into optimized code by
generating pieces of Ruby source code then putting them together and calling
eval; In Rails, the same technique is used for implementing features such as
associations, or scaffolding. With eval, we can avoid…
Releasing Ruby gems manually typically involves incrementing a version in a file, creating a tag, pushing a gem to Rubygems and making a GitHub release. These tasks can be automated in many ways, including release-gem or GHA with rubygems/configure-rubygems-credentials and trusted publishing. Moreover, you can build upon these approaches when you need something beyond the plain rake release, such as updating a CHANGELOG.md, by rolling miles of brittle GitHub Actions YAML and shell script AI slop.
As an alternative to both the manual process and scripts, I’ve been asking AI to follow a hand-crafted RELEASING.md. AI can run tests, date CHANGELOG.md, ask me for a RubyGems OTP, make the…
Why Kamal 2 fails docker login with an empty registry password when .kamal/secrets tries to source .env, and three fixes that work.
My father is a poetry translator, so perhaps my obsession with prose runs in the family. This started before Markdown: I wrote rubocop-exception_messages after noticing inconsistent exception messages in Grape.
After I replaced this blog’s Python spell checker with a RuboCop plugin I still had a Node installation to check Markdown. Since it’s a Jekyll blog, and the build is Ruby, the spelling checker is Ruby, and my default set of code examples are also Ruby, why was formatting the README Node.js?
I first tried extending rubocop-md, proposing prose checks and parser diagnostics, a reusable Markdown parser, hidden cop-directive fixes, front-matter handling, and preserving prose alongside…
Hi, it’s Greg, bringing you the latest changes in the Rails codebase. It was a busy week, with a lot of changes, so buckle up!
Rails 8.0.5.2 and 8.1.4.1 have been released! These are security releases, addressing 21 security issues, so you should upgrade if you haven’t already.
Allow anonymous subclasses of cache stores with LocalCache
A recent change built the local cache’s registry key from the store’s class name in initialize, and that name is nil for an anonymous class, so Class.new(ActiveSupport::Cache::MemoryStore).new blew up with a NoMethodError. Anonymous stores are handy in tests to record what a request writes to the cache, and they work again.
Garrett and I recorded episode two of The Friday Deploy. We started with personalized interfaces and ended with a basketball app and me casually mentioning that I’d rewritten a chunk of Flare to run on Cloudflare. As one does.
But the thing I keep coming back to is the pull request that makes your stomach hurt.
I’ve made plenty of those lately. Ask AI to build something. Have another model review it. Fix the findings. Review it again. Find more things. Fix those. Pretty soon the little change you wanted is 3,000 lines and you don’t want to merge any of it.
For a while, my response was to keep going. Surely one more review would make me feel better.
Sometimes the better answer is to throw…
avdi.codes 06 Nov 2026
https://avdi.codes/192568-2/?utm_source=rss&utm_medium=rss&utm_campaign=192568-2
So who is going to buy Twitter now that he’s throwing his toys?
Remote Ruby 06 Nov 2026
Vulnerabilites & AI with Nate Berkopec
Nate Berkopec returns to Remote Ruby joining Chris, Andrew, and David for a deep conversation about the latest wave of Ruby security vulnerabilities, AI-powered cybersecurity, and the rapidly changing role of software engineers. Nate shares his firsthand experience investigating a serious Ruby regex vulnerability, explains why developers need to take a more proactive approach to security, and challenges traditional development practices in an AI-driven world. From autonomous coding agents and dramatically faster development workflows to rethinking unit tests and code reviews, this episode explores why the future of programming may be less about writing code and more about building systems…
Code Got Cheap. The Rest Didn't. November 6, 2026 AI has fundamentally changed how we build software. But implementation is only one part of the job. Architecture, business knowledge, testing, and understanding real user workflows still require experienced developers. By Guido Boyke I've been developing software for more than 30 years, including about 20 years … Continue reading Code Got Cheap. The Rest Didn’t.
Lately, I've been trying to learn more about AI, particularly large language models (LLMs). My usual approach to learning a new subject is to read the classic books on the topic. However, since this version of generative and agentic AI is so new and evolving so rapidly, it's been difficult to find good, established books that covers it and explains it so a web developer like me could understand it.
So I decided to try something different by learning AI with AI. That is, I asked Claude to explain how LLMs work over a series of back-and-forth conversations over a few days to build my understanding of the topic. This post is my attempt to explain what I've learned about how LLMs…
I'm a web…
#825 — November 5, 2026
Ruby Weekly
🔒 Rails 8.0.5.2 and 8.1.4.1 Released to Fix 21 Security Issues — A rare 21-advisory release, led by a critical Active Storage bug (when using ImageMagick/mini_magick) where attaching a specially crafted image can let an uploader write (and sometimes read) arbitrary files. A Strong Parameters bypass, remote_ip spoofing in 8.1, and more make this a key update.
Mike Dalessio (Rails Core)
💡 Christine Seeman's walkthrough covers the advisories you may want to give a closer look, what can break on upgrade, and workarounds if you can't upgrade.
Our architecture lets agents test mobile app behavior without an emulator and use one test suite to keep iOS and Android in sync.
JRuby.org News 05 Nov 2026
JRuby 10.0.8.0 Released
The JRuby community is pleased to announce the release of JRuby 10.0.8.0.
- Homepage: https://www.jruby.org/
- Download: https://www.jruby.org/download
JRuby 10.0.x targets Ruby 3.4 compatibility.
Thank you to our contributors this release, you help keep JRuby moving forward! This cycle we had several new contributors and hundreds of pull requests. Keep it coming, JRubyists! @aminmansuri, @kares, @hiukkanen, @evaniainbrooks, @stefanlew-tractive, @sampokuokkanen, @zev, @matrei, @notsrch, @sferik, @RaphaelFakhri
Notable Changes
Security
- The asm bytecode library was updated to 9.11.1 to fix recent CVEs (none of which affect JRuby). #9858
Standard Library
- The standard library…
JRuby.org News 05 Nov 2026
JRuby 10.1.3.0 Released
The JRuby community is pleased to announce the release of JRuby 10.1.3.0.
- Homepage: https://www.jruby.org/
- Download: https://www.jruby.org/download
JRuby 10.1.x targets Ruby 4.0 compatibility.
Thank you to our contributors this release, you help keep JRuby moving forward! This cycle we had several new contributors and hundreds of pull requests. This list includes contributors to JRuby 10.0.8.0. Keep it coming, JRubyists! @samuel-williams-shopify, @aminmansuri, @kares, @hiukkanen, @evaniainbrooks, @stefanlew-tractive, @sampokuokkanen, @edipofederle, @samyron, @reginaldalfret, @albertalef, @taxor03, @zev, @matrei, @notsrch, @sferik, @RaphaelFakhri
Notable Changes
See also the JRub…
RubyMine 2026.3 is out!
This release brings JetBrains Air for working with your preferred coding agents, native access to WSL and Dev Container projects, and smarter Ruby and Rails support. You’ll also find easier interpreter setup, improved navigation and refactoring, and updates that make everyday development more comfortable.
Download RubyMine 2026.3 from our website or update via the Toolbox App.
Now, let’s explore the highlights.
JetBrains Air
Noteflakes 05 Nov 2026
A Look at Datastar
I have always been interested in frontend solutions for building web applications. Even though I’m more of a backend programmer, I really dig all the different techniques people come up with for creating browser-based apps that are both reactive (reflecting remote state in real-time) and interactive (responding to user actions).
Over the last few years, I’ve been looking at different frontend frameworks and libraries, to see how they work, and what I can learn from them. I adore Svelte, which is really smart and efficient. Its sister framework SvelteKit inspired the file-based routing in my own web framework for Ruby, Syntropy. I also really like the approach of the Phoenix framework…
Josh Software 05 Nov 2026
From One to Five: How We Solved a Real-Time Trading System’s Scaling Crisis
A story of race conditions, Docker containers, RabbitMQ queues, and the architecture decisions that kept our risk management platform alive under pressure. The Problem Nobody Wants on a Trading Floor Picture this: it’s 9:15 AM. The market just opened. Orders are flooding in — portfolio checks, risk calculations, compliance validations. And your Risk Management system? … Continue reading From One to Five: How We Solved a Real-Time Trading System’s Scaling Crisis
Ask any LLM to style a layout and it uses CSS units like: px, rem, em, % and vh. So do you, out of habit. But CSS has grown its number of units. Ones that fit specific jobs way better than your old defaults. Here are seven your code generator has probably never suggested.
They are all baseline ready (e.g. supported by core browsers for at least 30 months), so there is no fallback excuse left. Let’s get into it.
Logical properties: think in axes (x and y)
A few of these units only make sense when you drop the ideas of “width” and “height” and think in axes instead. CSS now measures along the inline axis (the direction your text flows, left to right in, for example, English) and the block…
RubyGems Blog 05 Nov 2026
4.0.24 Released
RubyGems 4.0.24 includes enhancements, bug fixes and documentation and Bundler 4.0.24 includes enhancements and bug fixes.
To update to the latest RubyGems you can run:
gem update --system [--pre]
To update to the latest Bundler you can run:
gem install bundler [--pre]
bundle update --bundler=4.0.24
RubyGems Release Notes
Enhancements:
- Installs bundler 4.0.24 as a default gem.
Bug fixes:
- Skip executable removal gracefully when the bin directory is missing. Pull request #9963 by Evan Li and Hiroshi SHIBATA
- Fix file locks letting multiple processes in when lock files are removed. Pull request #9930 by Richard Janita and Hiroshi SHIBATA
- Turn off echo before printing the…
Documentation:
- [DOC] Fix link. Pull request #10014 by Burdette Lamar
Bundler Release Notes
Enhancements:
- Read the Ruby version from mise’s inline table form. Pull request #9991 by…
Author: Varya Nekhina, Account ManagerTopics: Case Study, AI, DX, Design for devtools, UI coding harness, Agentic development, Figma, React, Ruby on Rails, CSS, Accessibility
Buildkite runs CI/CD for some of the most demanding engineering teams in the world. Why a team of opinionated developers hired Evil Martians to build a framework-agnostic design system with AI skills that guide coding agents through every component.
Buildkite is a high-scale, hybrid CI/CD platform that lets engineering teams run fast automated build, test, and deployment pipelines.
.jpg)
If you've set up an automated email sequence and haven't reviewed it in a while, here's how to audit it with help from AI agents.
RoboRuby 04 Nov 2026
Ruby AI News - November 4th, 2026
.bh__table, .bh__table_header, .bh__table_cell { border: 1px solid #C0C0C0; }
.bh__table_cell { padding: 5px; background-color: #FFFFFF; }
.bh__table_cell p { color: #2D2D2D; font-family: 'Helvetica',Arial,sans-serif !important; overflow-wrap: break-word; }
.bh__table_header { padding: 5px; background-color:#F1F1F1; }
.bh__table_header p { color: #2A2A2A; font-family:'Trebuchet MS','Lucida Grande',Tahoma,sans-serif !important; overflow-wrap: break-word; }
Welcome to the 40th edition of Ruby AI News! This edition features an avalanche of security issues, Ruby’s MCP SDK reaching Tier 1 status, a closer look at building AI evals for Rails, and much more.
Personal…
RoboRuby 04 Nov 2026
Newsletter Sponsorship Packages
.bh__table, .bh__table_header, .bh__table_cell { border: 1px solid #C0C0C0; }
.bh__table_cell { padding: 5px; background-color: #FFFFFF; }
.bh__table_cell p { color: #2D2D2D; font-family: 'Helvetica',Arial,sans-serif !important; overflow-wrap: break-word; }
.bh__table_header { padding: 5px; background-color:#F1F1F1; }
.bh__table_header p { color: #2A2A2A; font-family:'Trebuchet MS','Lucida Grande',Tahoma,sans-serif !important; overflow-wrap: break-word; }
New Sponsorship Opportunities
Ruby AI News has reached its 40th edition, and to mark it I am opening sponsorship packages that cover everything in the RoboRuby network. It is built for organizations that want in depth…
RubySec 04 Nov 2026
GHSA-2gff-2mmg-m73p (actionpack): Possible IP spoofing in Action Dispatch RemoteIp
### Impact
Since Rails 8.1.0, `ActionDispatch::RemoteIp` derives `request.remote_ip` from
`Rack::Request#forwarded_for`, which under Rack 3 reads the RFC 7239
`Forwarded` header in preference to `X-Forwarded-For`. When a reverse proxy
appends the client address to `X-Forwarded-For` but passes a client-supplied
`Forwarded` header through unchanged, `request.remote_ip` returns an address
chosen by the client, and the IP spoofing check does not raise, because it
compares only `Client-Ip` with the forwarded addresses. An unauthenticated
attacker could therefore spoof `request.remote_ip`, possibly bypassing
IP-based access controls and rate limits keyed on the client address
(including the…
RubySec 04 Nov 2026
GHSA-2p2f-4rq4-gjwc (actionview): Possible XSS vulnerability in Action View text helpers
### Impact
With the HTML5 sanitizer (`Rails::HTML5::Sanitizer`, the default vendor on
CRuby for applications using `load_defaults 7.1` or later), Nokogiri before
1.19.5 serializes `<` and `>` unescaped inside attribute values. The Action
View text helpers `highlight` and `simple_format` sanitize their input and
then process the resulting HTML as a string: `highlight` splits it on tag
boundaries to insert matches, and `simple_format` splits it into paragraphs on
blank lines. An unescaped `>` or a blank line inside an attribute value could
cause markup in that value, which the sanitizer left inert, to be emitted as
live elements in the helper's `html_safe` output, possibly leading to…
RubySec 04 Nov 2026
GHSA-2w9f-fxwj-w2qf (activesupport): Possible XSS vulnerability in Active Support MessagePack serializer
### Impact
`ActiveSupport::MessagePack` serializes an `ActiveSupport::SafeBuffer` as its
bytes alone and deserializes it as a new `SafeBuffer`, so a buffer that is no
longer `html_safe?` (for example, one mutated in place with `gsub!`) is
restored as `html_safe`. If such a buffer holds untrusted input and is stored
through a MessagePack serializer, rendering it after it is loaded bypasses ERB
auto-escaping, possibly leading to XSS.
Applications on Rails 8.1 are affected if they use a MessagePack serializer,
such as `config.action_dispatch.cookies_serializer = :message_pack` or
`:message_pack_allow_marshal`, or `serializer: :message_pack` for
`Rails.cache`, `ActiveSupport::MessageVerifier`…
RubySec 04 Nov 2026
GHSA-3f4q-8x5m-76v8 (activestorage): Possible local file disclosure in Active Storage video previews and analysis
### Impact
Active Storage's `VideoPreviewer`, `VideoAnalyzer` and `AudioAnalyzer` run
`ffmpeg` and `ffprobe` on a blob's contents without restricting the input
format, so FFmpeg selects a demuxer by probing the file. A blob created
through a direct upload keeps the content type the client declared, so a
client can store an HLS playlist under a `video/*` or `audio/*` type. When
that blob is previewed or analyzed, the `hls` demuxer opens the `file://`
segments that the playlist names, and the preview image or the stored metadata
could disclose a local media file that the application process can read and
whose path the attacker knows.
Applications that accept uploads from untrusted users and…
RubySec 04 Nov 2026
GHSA-3w93-6hmw-whh4 (activestorage): Unsigned Content-Type in Active Storage GCS direct uploads with cache_control
### Impact
When a GCS service is configured with the `cache_control` option,
`ActiveStorage::Service::GCSService#url_for_direct_upload` signs direct-upload
URLs with V4, and the V4 signature covers only the `Cache-Control` and `Host`
headers. A direct-upload client can therefore send a `Content-Type` of its
choosing, and can omit the declared `Content-MD5`, without invalidating the
URL. GCS stores the supplied content type as object metadata, which takes
precedence over the `response-content-type` that Active Storage sets on
download URLs, so an uploaded object could be served as inline HTML under the
application's bucket path on `storage.googleapis.com`. Script in such an
object runs on…
RubySec 04 Nov 2026
GHSA-4v2w-w6g6-f8f8 (activestorage): Possible DoS vulnerability in Active Storage proxy mode via storage errors during streaming
### Impact
When Active Storage serves a file through its proxy controllers,
`ActiveStorage::Streaming#send_blob_stream` handles an error from the storage
service by calling `head` to send a 404 or 500 response. If the error occurs
after the first chunk has been written, the response is already committed, and
`head` replaces the response body while the server is still reading the
original `ActionController::Live` buffer. That buffer is never closed, so the
server thread handling the request blocks until the process restarts. Repeated
failed downloads could exhaust the server's threads, possibly resulting in a
DoS vulnerability.
Applications are affected when they store files on a service…
RubySec 04 Nov 2026
GHSA-5957-c7qm-m469 (actionmailbox): Possible signature replay in Action Mailbox Mailgun ingress
### Impact
The Action Mailbox Mailgun ingress authenticates a request with an HMAC of the
`timestamp` and `token` parameters concatenated without a separator, and
`ActionMailbox::Ingresses::Mailgun::InboundEmailsController::Authenticator#recent?`
rejects only timestamps more than 2 minutes in the past. Because the signature
does not fix the boundary between the two values, a captured signed request
can be presented with a timestamp far in the future, which the ingress then
accepts indefinitely. An attacker who obtains one signed Mailgun webhook
request, but not the signing key, could submit arbitrary inbound email that
Action Mailbox processes as genuine, possibly leading to forged…
RubySec 04 Nov 2026
GHSA-68p9-83h6-5wpj (actionview): Possible XSS vulnerability in Action View tag helpers
### Impact
The fix for
[CVE-2026-33168](https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq)
skips blank HTML attribute names in Action View tag helpers, but it tests the
name before converting it to a string. A Symbol name made only of whitespace,
such as `:" "`, is not blank, because `Symbol#blank?` is `Symbol#empty?`, so
it reaches the attribute escaping, which emits an attribute with no name and
produces malformed HTML. The asset tag helpers, such as `image_tag`,
`video_tag` and `audio_tag`, symbolize their options, so a whitespace String
name passed to them takes the same path. A carefully crafted attribute value
could then be misinterpreted by the browser as a…
RubySec 04 Nov 2026
GHSA-8474-xrp6-wh69 (activesupport): Possible DoS vulnerability in Active Support safe_constantize
### Impact
When constant lookup raises `LoadError`,
`ActiveSupport::Inflector#safe_constantize` (and `String#safe_constantize`)
builds a regular expression from the requested constant name without escaping
it, so a caller that passes untrusted input lets the attacker choose the
source of a pattern that the application compiles. Crafted patterns can
trigger defects in Ruby's regular expression compiler, possibly leading to a
crash of the server process, and repeated requests could keep the application
unavailable.
Action Cable passes the `channel` value of each `subscribe` command to
`safe_constantize` before any channel lookup, so in the default configuration
an unauthenticated client of…
RubySec 04 Nov 2026
GHSA-f3w6-w445-fwh9 (activestorage): Possible arbitrary file write and read in Active Storage image analysis
### Impact
A Rails application that processes attachments with ImageMagick may allow an
unauthenticated attacker to write arbitrary files on the server and, when
attachments are stored with the Disk service, to read arbitrary files readable
by the application process. Those files typically include `secret_key_base`
and credentials for external systems, which may in turn allow escalation to
remote code execution or lateral movement to those systems.
### Details
ImageMagick selects a coder from the content of the file it is given, and some
coders act on files named inside the image rather than on the image itself.
Active Storage constrained none of ImageMagick's coders, and the…
RubySec 04 Nov 2026
GHSA-gmj8-hvj3-49mw (actionpack): Missing SameSite attribute on session cookies from Action Pack session stores
### Impact
Action Pack session stores other than `ActionDispatch::Session::CookieStore`
(`CacheStore`, `MemCacheStore`, and third-party stores built on
`AbstractStore`, `AbstractSecureStore` or the session mixins) write the
session cookie without a `SameSite` attribute, regardless of
`config.action_dispatch.cookies_same_site_protection`, which defaults to
`:lax`. Only `CookieStore` applies the configured policy. In browsers that do
not treat a cookie without the attribute as `SameSite=Lax`, a cross-site
request could carry the session cookie, possibly leading to cross-site request
forgery against actions that do not verify an authenticity token, such as
those of API-only…
RubySec 04 Nov 2026
GHSA-hfr4-8rjc-97m2 (activestorage): Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage
### Impact
`ActiveStorage::Service::GCSService#url_for_direct_upload` does not bind the
declared content length into the signed direct-upload URL, and
`#headers_for_direct_upload` returns no length constraint, so the URL
authorizes an upload body of any size. A direct-upload client could store a
file larger than the `byte_size` it declared, and the resulting blob keeps the
declared size, possibly bypassing application file size validations and
quotas. This is the weakness that CVE-2020-8162 fixed in the S3 service.
Applications that store files in Google Cloud Storage and accept direct
uploads are affected.
### Details
The fixed releases sign an `x-goog-content-length-range` header that…
RubySec 04 Nov 2026
GHSA-p2pm-g2h6-7j5j (activestorage): Possible DoS vulnerability in Active Storage filename handling
### Impact
`ActiveStorage::Filename#base` and `#extension_with_delimiter`, and therefore
`#extension`, pass the stored filename unmodified to `File.basename` and
`File.extname`, which raise `ArgumentError` when the name contains a NUL byte.
Active Storage stores the client-supplied filename verbatim, so a user who is
permitted to upload an attachment could persist such a filename on databases
that accept NUL bytes in string columns, such as SQLite and MySQL/MariaDB.
Each subsequent request that builds a variant or preview of the blob, opens
it, or renders it as an Action Text attachment then raises, possibly resulting
in a persistent DoS vulnerability for the pages that display the blob…
RubySec 04 Nov 2026
GHSA-r9jg-fmfx-2gv6 (actionpack): Possible cache poisoning in Action Pack content negotiation
### Impact
Action Pack negotiates the format of a rendered response from the `Accept`,
`X-Requested-With` and, for XHR requests without `Accept`, `Content-Type`
request headers, but `ActionController::Rendering#_set_vary_header` adds
`Vary: Accept` only when the request carries a usable `Accept` header and the
response has no `Vary` header yet. A response to a request without `Accept`,
or to an XHR request, therefore omits the headers that selected its
representation, and a response whose `Vary` the application set before
rendering (for example `Vary: Accept-Language`) never gains `Accept`. A shared
cache that honours `Vary` could store such a response and serve it to later
clients that…
RubySec 04 Nov 2026
GHSA-rq8q-p985-fjq7 (actionview): Possible XSS vulnerability in Action View strip_tags
### Impact
`strip_tags` in Action View returns its sanitized output marked `html_safe`,
but the underlying sanitizer encodes only `&`, `<` and `>`, leaving `"` and
`'` unencoded. Because ERB does not escape a string marked `html_safe`,
untrusted input passed through `strip_tags` and rendered inside a quoted HTML
attribute value could close the attribute and add new attributes, possibly
leading to XSS. Applications that render `strip_tags` output from untrusted
input inside an HTML attribute, for example in a `title` attribute or a
`` tag, are affected. Output rendered as element content is not
affected.
### Details
`strip_tags` now encodes `"` and `'` in its output, as well as `&`, `<`…
RubySec 04 Nov 2026
GHSA-rwvh-fw6r-pwvp (actionpack): Possible DoS vulnerability in Action Controller Live streaming
### Impact
`ActionController::Live::Buffer#close` pushes its end-of-stream marker onto
the response's bounded queue while it holds the buffer's monitor. When the
client has stopped reading and the queue is full, the push blocks, and
`Buffer#abort`, which runs when the client disconnects or a write times out,
waits indefinitely for the same monitor. Each such response could permanently
hold a web server thread and its `ActionController::Live` thread, possibly
resulting in a DoS vulnerability through thread exhaustion.
Applications that stream responses with `ActionController::Live`, including
`send_stream`, are affected. Applications that serve large files through
Active Storage proxy mode…
RubySec 04 Nov 2026
GHSA-v6rj-xm57-3p59 (actionview): Possible XSS vulnerability in Action View highlight helper
### Impact
`ActionView::Helpers::TextHelper#highlight` substitutes each matched phrase
into the `:highlighter` string without escaping it and returns the result
marked HTML-safe. Because sanitizing leaves quote characters in text
unescaped, a match substituted into a quoted attribute value of the
highlighter, such as the `` form shown in the method's
documentation, could end the attribute value and add attributes to the
element, possibly leading to XSS. Applications are affected when they pass a
`:highlighter` that places a placeholder inside an attribute value and
highlight text or phrases that a user controls. The default `\1`
highlighter and the block form are not affected.
###…
RubySec 04 Nov 2026
GHSA-v924-7rp8-4mxh (activestorage): Possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing
### Impact
`ActiveStorage::Blob#open` writes a blob to a tempfile whose name carries the
extension of the uploaded filename, and hands that path to `ffprobe`
(`VideoAnalyzer`, `AudioAnalyzer`), `ffmpeg` (`VideoPreviewer`) and
ImageMagick (`ImageAnalyzer`, the `:mini_magick` variant processor). These
tools select a decoder from the file extension when the content does not
identify its own format, so an attacker who chooses the filename and declares
the content type of an upload chooses which decoder processes it. An FFmpeg
built with AviSynth support treats a file with the `.avs` extension as an
AviSynth script and evaluates it, which could disclose files readable by the
application process…
RubySec 04 Nov 2026
GHSA-wm3x-v3qw-4jh3 (actionpack): Possible Strong Parameters bypass in Parameters#each_key in Action Pack
### Impact
`ActionController::Parameters#each_key` delegates to the internal
`ActiveSupport::HashWithIndifferentAccess` that holds the request parameters,
so when called with a block it returns that hash instead of the `Parameters`
instance. The hash does not respond to `permitted?`, so Active Model mass
assignment (`new`, `assign_attributes`, `update`) accepts it without raising
`ActiveModel::ForbiddenAttributesError`. An application that passes the return
value of `each_key` to mass assignment could allow a remote, unauthenticated
attacker to set attributes that the application does not permit, such as an
authorization flag.
This is an incomplete fix…
RubySec 04 Nov 2026
GHSA-x6mj-8jx9-qhqv (actionpack): Possible sensitive session information leak in Active Storage proxy mode
### Impact
When `ActionDispatch::Cookies` reads a signed or encrypted cookie that was
written under a rotated secret (`config.action_dispatch.cookies_rotations`) or
in the format that a `:hybrid` cookie serializer migrates from, it writes the
cookie back to the response in the current format, and that write ignores
`request.session_options[:skip]`. `ActiveStorage::DisableSession` relies on
that option to keep the session cookie off the public, immutable responses of
the Active Storage proxy controllers, but those controllers still load the
session, so a request carrying an old-format session cookie could receive the
rewritten session cookie in `Set-Cookie` on a cacheable response. A…
code.dblock.org | tech blog 04 Nov 2026
How to Distribute a Rust App with Cargo, Homebrew, MSI, and WinGet
I recently ported my 1996 Pascal/Delphi calculator to Rust. The result is excalc, a cross-platform command-line application and MCP server.
Rust makes it easy to compile an application on every platform. Distributing it via crates.io, MSI, Homebrew or WinGet needed more work. Paste this cookbook into your favorite AI prompt to get it done.
We trigger a distribution from GitHub Releases: a Git tag identifies the new version, CI publishes the crate from that tag, builds portable archives and an MSI from that tag, and attaches everything to the release. Homebrew downloads the tagged source archive. WinGet points at the released MSI.
Prepare the Rust Package
Start with complete package…
The Ruby on Rails Podcast 04 Nov 2026
Episode 559: From Consulting to Rails Products with Eduardo and Camila Souza
What happens when the tool you rely on disappears? For Eduardo and Camila Souza, the shutdown of Pivotal Tracker became the motivation to build Pivotal Tasker, a Rails-based alternative inspired by the project management workflow they missed. They discuss reconstructing the experience from memory and reference material, adding classic and modern interfaces, and integrating coding agents to help create and work through stories.
The conversation expands into their move from consulting toward building products. Eduardo and Camila describe Chamber Builder, an all-in-one platform for chambers of commerce, and a custom sales CRM that brings calling, recordings, transcripts, and…
Graceful.Dev 04 Nov 2026
So long, RubyTapas.com
Five years ago, I announced that RubyTapas had become Graceful.Dev. But a revenant of that feast was left behind: the rubytapas.com site stuck around to handle billing for legacy customers, and I never got around to fully rolling that aspect into Graceful.Dev.
Until now. As of today, RubyTapas.com is no more. If you have a RubyTapas legacy account, it is now managed at Graceful.Dev. Same plan, same price, same access. Nothing changes except the words on the receipts, and there’s nothing you need to do.
And of course, all RubyTapas episodes are here at graceful.dev (as they have been for years). As well as lots and lots of post-RubyTapas content, organized into courses. The old…
Hello, Rails community!
Rails Versions 8.0.5.2 and 8.1.4.1 have been released. These are security updates addressing 21 security issues falling into a few themes:
- Possible arbitrary file read, file write and remote code execution in Active Storage image and video processing
- Possible Strong Parameters bypass in
Parameters#each_key - Possible IP spoofing in
remote_ipthrough theForwardedheader (8.1 only) - Multiple possible XSS vulnerabilities in Action View helpers, and one in the Active Support MessagePack serializer (8.1 only)
- Possible DoS vulnerabilities in Active Support
safe_constantize, Action Controller Live streaming, and Active Storage proxy mode and filename handling - U…
We strongly recommend upgrading as soon as possible.
Older versions of Rails are unsupported, and users are…
OmbuLabs.ai 03 Nov 2026
ChatGPT Can Now Use Your Apps
Every business has a list of jobs nobody wants and nobody can automate. Someone logs into a supplier portal every Monday to download invoices, then types them into the accounting software one line at a time. Someone else fills in the same government form every quarter, copying numbers from a spreadsheet into boxes on a website. Neither system offers a way for other software to connect to it (an API), the vendor isn’t going to build an integration for a customer your size, and so the work stays manual.
At the end of October, OpenAI released GPT-6.1 Terra, a model built for what OpenAI calls computer use: it looks at a screen, reads what’s on it, and clicks and types its way through apps and…
We recently moved a client’s Ruby on Rails app off Heroku: a Rails API with Sidekiq workers and several services around it. Before we changed anything, we spent about a week on discovery. We had a kickoff call with the client’s team on a Monday, and then two of us paired for the rest of the week to map the infrastructure and draft a migration plan.
Nothing about that app followed one pattern. Its services were deployed in different ways, and some of the things that mattered most for the migration, like the tools outside Heroku that read from the database and the service that promoted code to production, didn’t show up in the Heroku dashboard at all.
In this article, you will learn what we…
AI can generate a lot of code quickly. There’s a thought that we can catch its mistakes or other issues by reviewing that code. In theory, this may be true; code review can catch bugs. In practice, it only works if the reviewer knows what to look for, has some context and, well, gives a shit.
There's a thought that we can catch mistakes in AI-generated code by reviewing it (or having an AI do that). This is short-sighted thinking, especially as developers lose the skill of code review entirely. Better to use AI to create better tooling.This is all in a professional context, i.e. at a job. I don't think the conclusions here are necessarily relevant to hobby or open source…
Why Review…
Evil Martians 03 Nov 2026
The Agents on Rails Files: enter lemans, a Ruby harness for fair agent races
Authors: Vladimir Dementyev, Principal Backend Engineer, Artur Petrov, Backend Engineer, and Travis Turner, Tech EditorTopics: Rails, AI, Open Source, LLM benchmarking, Ruby, LLMs
A tour of lemans, the open source Ruby harness behind Agents on Rails: eval task anatomy, how it runs and grades coding agents for hours, and how cheaters shaped its guardrails.
Benchmarking coding agents in one sentence: give a model a task, let it work, check the result. The hard part is keeping the race fair. Every model must get the same conditions, and no agent should be able to escape its sandbox or fool its grader (and they try). And all of that has to keep running for hours. In the first post of The Agents…
Tim Riley 03 Nov 2026
Continuations 2026/44: More filtery
Milestone: this week I called a freeze on new Hanami work. From here we’re focused on cutting down our outstanding items and then switching to release prep.
I cut down a few items myself: three little
pigsthings to finish our Hanami CLI changes for compatibility with Dry CLI. This CLI is just right.After some great feedback from Michael, I made a few adjustments to Dry Logger’s expanded log filtering (like making Regexp filters case insensitive by default, for consistency with string filters), and merged it. Thanks Michael! I also updated Hanami’s default list of filters. Combined with Dry Loggers substring filtering, this will make for a much more filtery out of the box experience.
I’ve been building a new project in my spare time while working through ideas for a few other apps.
Naturally, I found something to get distracted with.
Oh My Scrobbles is a Mac app for scrobbling Apple Music (and Radio!) to Last.fm and exploring your old listening history.
Like most projects I actually follow through on… this started with a huge itch I needed to scratch. I have over 300,000 scrobbles. I take this shit very seriously. 😉
It can sync my whole Last.fm history to my Mac and expose a local MCP server, so I can ask ChatGPT and Claude questions about it.
I used that to find the exact tracks I’d scrobbled just before and after creating my GitHub account in 2008. Apparently,…
Last week I learned a technique in Ruby so small and useful, I couldn't believe I hadn't come across it before. Suppose a method doubles as a getter and setter. Pass a value to update a setting, or pass nothing to read it: module Cloakable
def clo
Somebody at Gusto asked, during one of our internal AI AMAs, whether /login was costing them tokens. The answer came back yes, relayed into our Claude Code channel a few minutes later: /login "is an LLM call, which will take more time and end up with unnecessary token use," so run claude auth login from the CLI instead, because that one's instant and free. It came with receipts, sort of. Secondhand from someone who'd watched /login run up $3.
That felt off, so I went and checked. It’s off. /login never touches the model, in any config. It's a local command: it runs entirely on your machine and never builds a prompt, so there is nothing to send.
So where did the $3 come from? A leading space.…
RubySec 02 Nov 2026
GHSA-345x-3rq2-jfrm (loofah): SVG `` and `` bypass local-reference restriction in Loofah
## Summary
Loofah restricts `href` and `xlink:href` on certain SVG elements to
same-document references. Two elements escaped the restriction:
- ``: `SVG_ALLOW_LOCAL_HREF` listed it in lowercase as `textpath`,
but the HTML5 parser names the element `textPath` inside ``, so the
check never matched on the HTML5 path.
- ``: absent from `SVG_ALLOW_LOCAL_HREF`, so its references were never
restricted on either path.
`rails-html-sanitizer` reuses this safelist in its `PermitScrubber`, so it is
affected too.
## Impact
An external `href` or `xlink:href` on `` or `` survives
sanitization. Firefox fetches the URL when rendering the content, which leaks
the viewer's IP address, user agent,…
RubySec 02 Nov 2026
GHSA-3w22-6jfg-527w (nokogiri): Use-After-Free in Nokogiri when replacing an attribute value
### Summary
Nokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed
memory when replacing the value of an existing XML attribute via
`Nokogiri::XML::Node#[]=` or `Nokogiri::XML::Node#lang=`. If Ruby code had
already accessed the attribute's child nodes, replacing the value could free
those native child nodes while their wrappers remained reachable. Using one of
those child nodes afterwards could cause an invalid read and a possible
segfault.
This is the same class of issue as
[GHSA-phwj-rprq-35pp](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-phwj-rprq-35pp),
which was fixed for `Attr#value=` in Nokogiri 1.19.4.
Nokogiri 1.19.5 preserves all…
RubySec 02 Nov 2026
GHSA-4p39-36wj-23h4 (nokogiri): Possible Mutation XSS when serializing `noscript` content in `Nokogiri::HTML5` documents
### Summary
Nokogiri's HTML5 serializer did not escape text inside `noscript` elements, or
`<` and `>` inside attribute values. When a document parsed with the default
options is serialized, a browser with scripting enabled can parse the output
into markup that Nokogiri's parser never produced. This is a mutation XSS for
applications that sanitize untrusted HTML with `Nokogiri::HTML5`, allow
`noscript` elements, and send the serialized output to browsers.
Nokogiri 1.19.5 escapes both, as the HTML standard's serialization algorithm
requires. Text inside `noscript` is still emitted unescaped for documents
parsed with `parse_noscript_content_as_text: true`.
Only the C extension (CRuby and…
RubySec 02 Nov 2026
GHSA-cpgf-5mjf-73p7 (rails-html-sanitizer): Possible regular expression denial of service with certain configurations of rails-html-sanitizer
## Summary
`Rails::HTML::PermitScrubber` restricts the `href` and `xlink:href` attributes
of SVG reference elements to local references. That check matched the
attribute value against `/^\s*[^#\s].*/m`. In Ruby `^` anchors to every line
start and `\s` matches newlines, so an all-whitespace value made the engine
rescan the value from each of its line starts, taking time quadratic in its
length.
- Versions affected: `>= 1.0.3, < 1.7.2`
- Not affected: `< 1.0.3`
- Fixed versions: `1.7.2`
CRuby 3.1 and earlier, and JRuby, are affected. CRuby 3.2 added linear-time
regexp matching, which makes the pattern linear. JRuby's regexp engine does
not.
## Impact
An attacker who supplies HTML to be…
RubySec 02 Nov 2026
GHSA-h6v6-rg66-fqj4 (loofah): Mutation XSS in Loofah HTML5 scrubbers through unescaped attribute values
## Summary
Loofah's HTML5 scrubbers could emit output that a browser parses into
different markup, allowing mutation XSS. Nokogiri < 1.19.5 did not escape `<`
and `>` in attribute values. When the output contained certain MathML, a
browser treated markup inside an allowed attribute as live HTML. The `:strip`
scrubber is affected in every browser. The `:prune` and `:escape` scrubbers
are affected in WebKit browsers such as Safari.
Nokogiri 1.19.5 escapes `<` and `>` in attribute values, as the HTML standard
requires. Loofah 2.25.3 requires Nokogiri >= 1.19.5.
## Impact
Applications that sanitize untrusted HTML with Loofah's HTML5 API
(`Loofah.html5_fragment`, `Loofah.html5_document` and…
RubySec 02 Nov 2026
GHSA-h7wh-q2qr-458c (rails-html-sanitizer): Possible XSS via shared scrubber state in concurrent rails-html-sanitizer calls
## Summary
`Rails::HTML::SafeListSanitizer` (both the HTML4 and HTML5 variants) shares
one `Rails::HTML::PermitScrubber` across every `sanitize` call on the same
instance, assigning its `tags` and `attributes` on each call without
synchronization. Two concurrent `sanitize` calls with different `tags:` or
`attributes:` options can interleave, so one call is scrubbed with the other
call's allowlist.
- Versions affected: `< 1.7.2`
- Not affected: none
- Fixed versions: `1.7.2`
## Impact
Action View memoizes a single `SafeListSanitizer` per helper module and uses
it for every `sanitize` call in the process, so in a multi-threaded server
(for example Puma) all requests share the same…
RubySec 02 Nov 2026
GHSA-jcff-cj73-4w4f (loofah): Loofah allowed_uri? treats data:text/html as safe text/plain
## Summary
`Loofah::HTML5::Scrub.allowed_uri?` returns `true` for a `data:` URI whose
mediatype is written with the HTML5 named character reference `/` in place
of the solidus. Loofah reads that mediatype as malformed and falls back to the
allowed `text/plain`, while a browser decodes the reference and reads the same
URI as `text/html`.
## Details
`allowed_uri?` decodes HTML entities with `CGI.unescapeHTML`, which handles
numeric character references but not HTML5 named character references. `/`
therefore survives normalization, so the mediatype carries no `/`, fails the
MIME grammar, and falls back to the allowed `text/plain` under the WHATWG rule
for a malformed…
RubySec 02 Nov 2026
GHSA-m3x9-938q-5767 (loofah): CSS url() sanitization bypass via escaped parentheses in Loofah
## Summary
`Loofah::HTML5::Scrub.scrub_css` rejected any property whose top-level Crass
tokens included a `:url` or `:bad_url`, and left `url` out of the allowed CSS
functions. Both checks ran only against the first parse of the `style`
attribute. When `scrub_css` rebuilt each property it emitted identifiers with
their CSS escapes decoded, so parentheses written as escapes — `url\28 …\29` —
hid the `url` token from the checks, and the rebuilt value was re-parsed into
a live `url()` that nothing checked again. An escaped property name, six-digit
escapes, escaped comments and escaped quotes all reached the same place.
## Impact
A sanitized `style` attribute could make a viewer's browser…
RubySec 02 Nov 2026
GHSA-mf2j-8f84-cc9q (loofah): Regular expression denial of service in Loofah's SVG local-reference check
## Summary
Loofah's HTML5 sanitizer restricts the `href` and `xlink:href` attributes of
SVG reference elements to local references. That check matched the attribute
value against `/^\s*[^#\s].*/m`. In Ruby `^` anchors to every line start and
`\s` matches newlines, so an all-whitespace value made the engine rescan the
value from each of its line starts, taking time quadratic in its length.
CRuby 3.1 and earlier, and JRuby, are affected. CRuby 3.2 added linear-time
regexp matching, which makes the pattern linear. JRuby's regexp engine does
not.
## Impact
An attacker who supplies HTML to be sanitized can consume CPU out of
proportion to the input size, by sending an SVG reference element…
RubySec 02 Nov 2026
GHSA-p9wj-w8xq-vjx6 (loofah): Loofah allowed_uri? treats javascript: alert(1) as safe
## Summary
`Loofah::HTML5::Scrub.allowed_uri?` returns `true` for a `javascript:` or
`vbscript:` URI whose scheme is split by a numeric character reference without
a trailing semicolon, followed by a character that `allowed_uri?` strips, such
as a space or tab. A browser ends the reference at that character and reads
`javascript: alert(1)` as `javascript: alert(1)`.
## Details
`allowed_uri?` strips control characters and whitespace before it decodes
numeric character references. Removing the character that ends a
semicolon-less reference lets the reference run on into the following text, so
`: alert` decodes as `Ϊ` (U+03AA) instead of a colon, and no scheme
is detected. The same applies…
RubySec 02 Nov 2026
GHSA-v995-44v6-5fqm (nokogiri): Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` set
### Summary
On JRuby, the `NONET` parse option did not block an external DTD or entity
whose system identifier used a short-form IPv4 host, such as `http://127.1/`
or `http://169.254.43518/`, or was an absolute path such as `/x.dtd` in a
document parsed from a network URL. An application that parses untrusted XML
with `DTDLOAD`, `DTDVALID` or `NOENT` could be made to send network requests,
potentially enabling SSRF.
Nokogiri 1.19.5 applies the `XML::Schema` check from
[GHSA-8678-w3jw-xfc2](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2):
with `NONET` set, only local resources are loaded.
Only JRuby is affected. Default parse options are not…
Rails main lets ActiveSupport::EncryptedFile try comma-separated keys when decrypting, including keys supplied through RAILS_MASTER_KEY.
This is unreleased Rails 8.2 development functionality; Rails 8.1.4 still expects a single key.
Successful fallback reads do not establish support for multi-key writes or a complete credentials-editing workflow.
Try fallback reads with a disposable file
This standalone example generates its own keys and uses a separate example variable.
It does not load application credentials or read RAILS_MASTER_KEY.
require "active_support"
require "active_support/encrypted_file"
require "tmpdir"
require "fileutils"
variable = "SAELOUN_SYNTHETIC_KEYS"
raise "Use an…Drifting Ruby Screencasts 01 Nov 2026
Idempotency
In this episode, we look at several different examples of background jobs and how we can refactor them to handle situations where they get called twice from either a user action or a retry. We'll look at scenarios where we can prevent duplicate actions.
Learn how to restrict admin routes to VPN IP addresses on Heroku using Rails Advanced Route Constraints.
RubySec 01 Nov 2026
GHSA-4rw8-495r-pf6j (graphql): Execution::Next renders objects whose authorized? check failed
In some cases, GraphQL::Execution::Next rendered results for objects
whose .authorized? hooks indicated that the object was unauthorized.
RubySec 01 Nov 2026
GHSA-q3cc-p5hm-55wj (graphql): Interpreter runtime renders results from objects whose `.authorized?` checks had failed
The legacy interpreter (Execution::Interpreter) renders the original,
unauthorized object when authorized? raises GraphQL::UnauthorizedError
and Schema.unauthorized_object returns a replacement.
Returning false correctly renders the replacement.
RubySec 01 Nov 2026
GHSA-4fqr-96q8-xrfx (sqlite3): Possible SQL query truncation when a string is 4 GiB or larger
sqlite3-ruby cast Ruby string lengths (long) to int before passing
them to SQLite. On 64-bit platforms, a string of 4 GiB (2^32 bytes)
or larger had its length wrap, so SQLite saw only the first length
mod 2^32 bytes. An attacker who controls the length of a SQL string
could truncate the query, for example dropping a trailing WHERE
clause. The affected paths are:
* the SQL passed to Database#prepare, #execute, and related methods
* String and Blob values passed to Statement#bind_param and related methods
* String and Blob values returned from SQL functions and aggregates
defined in Ruby (Database#create_function, #create_aggregate, and
related methods)
## AFTER PATCH
sqlite3 v2.10.2…
RubySec 01 Nov 2026
GHSA-76hq-g43j-f2rr (wasmtime): Data race in WASI when calling functions with `gvl: false`
### Impact
`Extern#to_func(gvl: false)` releases Ruby's Global VM Lock (GVL) for
the whole duration of a WebAssembly call. Two WASI host paths that run
during such a call access Ruby objects without re-acquiring the GVL:
- Writes to stdout/stderr captured with `WasiConfig#set_stdout_buffer`
or `WasiConfig#set_stderr_buffer`, which append to the Ruby `String`
buffer;
- The block given to `WasiConfig#socket_addr_check`, which is called to
allow or deny socket operations.
A guest can trigger these paths, for example by writing to stdout. If
another Ruby thread runs while the call is in progress, the
unsynchronized access to the Ruby heap is undefined behavior. In
practice it has been…
Ruby values returned from Wasmtime through externrefs from function
results or hostcall arguments may be invalid references. This is due
to not making the Ruby garbage collector aware that the Ruby value
referenced by the externref is still in use.
## Impact
Using an externref returned from a Wasm function or an externref
provided as an argument to a hostcall could trigger a segmentation
fault crashing the host process.
RubySec 01 Nov 2026
GHSA-4w5q-wg7v-w6gp (addressable): Regular Expression Denial of Service in Addressable templates with several exploded variables
Within the URI template implementation in Addressable, expressions
with several exploded variables (e.g., {+a*,b*}, {+a*,b*,c*},
{/a*,b*}, {?a*,b*}) generate regular expressions vulnerable to
excessive backtracking. A run of members can be divided among the
exploded variables in O(n^k) ways for k variables. When Template#match
or Template#extract is called with a maliciously crafted URI, this
can result in uncontrolled resource consumption, leading to denial
of service. With 2.9.0, {+a*,b*,c*} takes over 12 seconds to reject
1 KB of input on MRI Ruby 3.2.
Users of the URI parsing capabilities in Addressable but not the
URI template matching capabilities are unaffected. Users who only
call…
RubySec 01 Nov 2026
GHSA-539f-xcgw-2gjg (addressable): Addressable display_uri can show misleading hosts containing bidi and invisible characters
Addressable::IDNA.to_unicode decodes Punycode labels (labels beginning
with xn--) that contain characters which change how text is displayed
without being visible themselves. These include bidirectional controls
such as U+202E RIGHT-TO-LEFT OVERRIDE and U+2066–U+2069, zero-width
characters, and other invisible format characters.
Addressable::URI#display_uri uses to_unicode, so it can display a
host whose characters appear reordered or which looks identical to
a different host. For example, the host of http://xn--abcmoc-dm0c.com/
is displayed as abc, U+202E, moc.com, and the override makes
everything after abc render right to left.
Parsing, host, normalized_host and any connection made from…
RubySec 01 Nov 2026
GHSA-8gmh-2hhj-2hv9 (addressable): Addressable URI normalization resolves some dotted path segments to the wrong path
Addressable::URI.normalize_path resolves some paths containing ..
segments to a different path than RFC 3986 does. When a path climbs
above the root before any other .. is resolved, the segments that
later .. segments should remove are instead kept:
/../../public/x/../../secret normalizes to /public/x/secret instead
of /secret. URI#normalize, URI#join, URI#== and URI#=== all use
this normalization. An application that checks a normalized Addressable
path against an allowlist, but sends the original URI to something
that resolves it according to RFC 3986, can be made to allow a
request for a path outside the allowlist.
RubySec 01 Nov 2026
GHSA-9crm-g4mf-wc5j (addressable): Addressable display_uri can show misleading hosts with invalid Punycode A-labels
Addressable::IDNA.to_unicode, in the pure-Ruby IDNA implementation,
decodes Punycode labels (labels beginning with xn--) that are not
valid A-labels. Those labels are returned in decoded form, when
they should be returned unchanged. That includes:
* labels that decode to only ASCII characters, e.g. xn--google-
decodes to google;
* labels that decode to text that doesn't convert back to the same
label (RFC 3490 §4.2), e.g. text that isn't in normalized form.
Addressable::URI#display_uri uses to_unicode, so for
https://xn--google-.example.org/ it displays the host google.example.org,
while #host, #normalized_host and any connection made from the URI
use xn--google-.example.org. An…
RubySec 01 Nov 2026
GHSA-9f42-57jx-vpp3 (addressable): Regular Expression Denial of Service in Addressable templates with multiple variables
Within the URI template implementation in Addressable, templates
that put several variables in one expression generate regular
expressions vulnerable to excessive backtracking:
1. Expressions with any operator other than + and # (e.g., {/owner,repo,ref},
{.a,b}, {a,b,c}, {;a,b,c}). The values are joined by an optional
separator, so a run of characters can be divided among the variables
in O(n^k) ways for k variables.
2. Expressions with the + or # operators and many variables (e.g.,
{+v1,v2,v3,v4,v5,v6,v7,v8,v9,v10}). A failing match is exponential
in the number of variables.
3. Several single-variable expressions next to each other (e.g.,
{+a}{+b}{+c} or {a}{b}{c}),…
RubySec 01 Nov 2026
GHSA-j82w-28jv-3pmj (addressable): Regular Expression Denial of Service in Addressable templates with certain exploded expressions
Within the URI template implementation in Addressable, templates
using the * (explode) modifier with the /, ., ;, ? or & operators
(e.g., {/segments*}, {.ext*}, {;params*}, {?query*}) generate
regular expressions vulnerable to catastrophic backtracking. When
Template#match or Template#extract is called with a maliciously
crafted URI that starts with the operator's leading character,
matching takes exponential time, leading to uncontrolled resource
consumption and denial of service. An input under 60 bytes is
enough to occupy a thread for minutes.
GHSA-h27x-rffw-24p4 (CVE-2026-35611) reported this pattern as
fully remediated in 2.9.0. The 2.9.0 fix only made the joiner
between exploded…
RubySec 01 Nov 2026
GHSA-qq38-m9mg-xjj5 (addressable): Denial of service in Addressable URI path normalization
Addressable::URI.normalize_path takes time quadratic in the number
of nested dot segments in a path (e.g., "/" + "a/" * n + "../" * n,
which for n = 3 is /a/a/a/../../../), because it removes one dot
segment per pass over the whole path. URI#normalize, URI#normalized_path,
URI#==, URI#=== and URI#join all call it. Normalizing, comparing or
joining a URI taken from user input can result in uncontrolled
resource consumption, leading to denial of service. On 2.9.0,
normalizing a 34 KB path takes about 3.5 seconds on MRI Ruby 4.0,
and the cost grows with the square of the path length.
This affects every Ruby implementation, including MRI Ruby 3.2 and
later. URI.parse by itself is unaffected,…
Alchemists: Articles 01 Nov 2026
Avoid Proton
Avoid Proton
We are, disturbingly, in a Gilded Age 2.0.0 era and, like the corrupt industrial tycoons of years past, we have tech tycoons forcing LLMs and data centers upon us. Software should be used to enhance and enrich the lives of staff and customers instead of extracting all their worth.
Worse, we have to be much more diligent about what we pay for and be quick to cancel when they disregard their engineers and customers. As was — and still is the case — where you must Avoid Zoom, you need to cancel any/all services with Proton as well. To quote from 404 Media:
Proton, the company behind ProtonMail and other privacy-focused products, told staff on Monday it would be…
Two jobs finish successfully. One account update disappears.
Suppose an account has 100 credits. You enqueue two jobs to add 10 and 20. Both jobs finish without an exception, but the account ends with 120 credits.
Each job runs this code:
class AddCreditsJob < ApplicationJob
def perform(account_id, amount)
account = Account.find(account_id)
account.update!(credits: account.credits + amount)
end
endAssume credits is an integer column, with no optimistic locking or custom database rule protecting the update. These are application credits; the example doesn't model a payment system.
Two workers can execute the job in this sequence:
Job A (+10) Job B (+20)
read 100
…The idea for Svet came from a private repository at work, where checking filename case helps catch portability problems like Logo.svg and logo.svg colliding on a case-insensitive Windows filesystem. These checks are implemented in pure JavaScript. That seemed like a useful job for a reusable repository linter.
I went looking for an existing tool.
Tool Why it isn’t enough here ESLint Can check filenames with a processor; byte-level checks and Git snapshots need custom plumbing. Oxlint Arbitrary non-JS/TS files don’t reach its lint rules. Biome Checks supported languages, not arbitrary repository…I had a Raspberry Pi 4B I thought might be dead. It wasn’t. I’m having a bunch of building work done and of course, the thermostats do not work with Apple HomeKit.
So the Pi now runs Homebridge, which puts our underfloor heating thermostats (and also now Samsung TVs) in Apple Home. For good measure it also runs Pi-hole, which blocks ads and trackers for every device in the house.
Gear required
- A Raspberry Pi 4B + USB-C power + micro-HDMI
- A (new) microSD card
- Raspberry Pi Imager on my Mac
- An Argon ONE case and a USB SSD
I thought the Pi was dead
First I checked the cheap parts. SD cards and power supplies fail far more often than the Pis themselves.
- Removed and replaced…