Rubyland

The Rails Way in 2026

We had an interesting discussion at the Arkency weekly call today. The topic was how to define “the Rails Way” in 2026. The discussion branched in many directions, but I want to capture the result here.

We get to see a lot of Rails repositories. There’s a pattern that shows up so consistently that I think it now deserves to be called “the Rails Way” of 2026:

A fat model with a callback. The callback triggers a service object. The service object is executed as a background job.

That’s the clue of this post. If you zoom out across the Rails applications written or maintained in 2026, that’s the shape.

The disclaimer

A word about where we’re coming from. Arkency is a…

Hi, it’s Claudio Baccigalupo. Let’s explore what happened this week in Ruby on Rails.

Apply as a speaker for Rails World
Don’t miss out on the opportunity to join 1,200+ Rails developers this year at the Palmer Center, Austin, TX. Corporate Support tickets are on sale now. General admission tickets will be released on May 12.

How do you use Ruby on Rails?
The 2026 Ruby on Rails Community Survey is open! Takes just a few minutes. Please fill out and share with your team!

Bump required PostgreSQL version to 10.0
Until now Rails claimed support for PostgreSQL 9.3, which is incompatible with PostgreSQL 18 (released in 2025). The pg gem v1.6 already raised its minimum required PostgreSQL.…

This BREAKING NEWS episode is a candid reaction to Ruby Central’s latest shakeup, with Chris, Andrew, and David unpacking leadership departures, financial strain, the cancelled gala, and what all of it says about the organization’s direction. The conversation moves beyond the headlines into bigger questions about trust, transparency, community values, conference strategy, RubyGems sustainability, and whether Ruby Central can rebuild credibility by involving more of the community in what happens next. Hit download now to hear more! 

Links

• Judoscale- Remote Ruby listener gift
• A New Chapter for Ruby Central
• RubyConf 2026- July 14-16, Las Vegas, NV

Your hesitation before a big software project might be the strategy.

Continue Reading

You gave a handful of your devs access to Claude Code Max… and things moved fast. Output went up. Then things started to drift. Not just formatting or naming. Structure. Approach. Assumptions. One developer builds guardrails around it. Another uses it like autocomplete. A third treats it like a thinking partner. Same tool, same codebase… different results. The code starts to reflect how each person uses the tool, not how the team builds software together.

There’s a tension here that most teams are sidestepping. You can feel the inconsistency creeping in, but saying “we should align on how we use this” sounds heavy-handed. So it gets framed as experimentation. Let people figure it out. Give…

Hi everyone! Rails World is back heading to Austin, Texas on September 23-24, 2026 for the largest Rails World yet, with space for 1,200 developers, founders, and teams building with Rails, and we have a huge Rails World update for you!

First: The Rails World website is finally live thanks to our website sponsor WyeWorks, and the amazing work of developers Jessica Ferreira and Lucas Troncoso and designer Jomiro Eming. Big thanks to the team!

Check it out.

Apply to speak at Rails World 2026

Most of all, we’re excited to announce that the CFP for Rails World 2026 is officially open.

Submit your talk by May 16: https://sessionize.com/rails-world-2026/

What we’re looking for in 2026…

JavaScript errors (either vanilla or with Stimulus controllers) often happen silently in the browser, leaving your users confused about what went wrong. “Why did nothing happen?”. “I just did click the button!” “Let’s try again…”. Still nothing… Starts furiously clicking the button now.

This poor user experience can be frustrating and can lead to more support tickets that could have been prevented. In this article I want to show how to build a simple class that catches unhandled JavaScript errors and displays them to the user in a friendly banner. It’s a small but meaningful improvement to your app’s user experience.

As always, the code can be found on GitHub.

The silence of the errors

Whe…

MapView Flyers are at RubyKaigi 2026 – Here's the Must-Watch Talk Schedule April 22, 2026 Scan to try Live Demo Available Introducing MapView Render beautiful, production-ready maps directly from your Ruby backend. No external APIs. No dependencies. Just pure speed and control. ✓ Zero external dependencies ✓ Lightning-fast rendering ✓ Production-ready & battle-tested Try … Continue reading MapView Flyers are at RubyKaigi 2026 – Here’s the Must-Watch Talk Schedule →

If you haven't yet seen the statement from the Ruby Central Board, the organization has been preparing for some significant changes. RubyConf, our flagship annual event, is also moving and adapting with these transitions.

This year, we ambitiously envisioned several exciting new programs designed to reimagine RubyConf and bring new energy, new voices, and new opportunities to the conference. We took a step back, reevaluated each of these programs, and took fresh creative approaches to bringing a clearer vision for what RubyConf can and should be. 

Here’s what some of the new programming will look like going forward.

Steering Committees and Town Hall Sessions

This year, we want to try something…

The agent-led growth playbook: how to make AI agents discover, use, and pay for your developer tool, and defend against the ones you didn't invite. LLM discoverability, agent-first onboarding, agent payments, AX security.

In early 2025, Matt Biilmann, CEO of Netlify, coined the term "agent experience" or AX: how AI agents experience your product as a user. AX extends developer experience and drives agent-led growth: adoption that happens because agents recommend, set up, and integrate your tool without a human in the loop. Three things to get right: make agents discover your tool. Make agents use your…

How much of your day to day life is based on using digital tools?

95% of U.S. adults use the internet, 91% own a smartphone, and 78% subscribe to high-speed internet at home. 41% report being online “almost constantly.” Americans now average over 5 hours a day on their phones, a 14% jump from the prior year, not including time spent working or other types of screen time. (Pew Research Center, survey conducted Feb. 5 to June 18, 2025.)

Of the adult population, more than 7 million Americans are living with uncorrectable vision loss, including over 1 million who are blind. Broader survey data shows that nearly 50 million adults report some difficulty seeing, even when wearing glasses.

In an…

The JRuby community is pleased to announce the release of JRuby 10.1.0.0.

• Homepage: https://www.jruby.org/
• Download: https://www.jruby.org/download

JRuby 10.1.0.x targets Ruby 4.0 compatibility.

Thank you to our contributors this release, you help keep JRuby moving forward!

JRuby 10.1: Experimenting and Evolving

JRuby 10.1.0.0 is our first major release since catching up with Ruby compatibility. We have used this opportunity to explore many experimental optimizations and improvements we have been chasing for many years. Ruby 4.0 compatibility is largely complete, but there will be additional features added in update releases. We also plan to continue with large scale experiments…

Ruby 4.0.3 has been released.

This release only contains ERB 6.0.1.1, which fixes CVE-2026-41316.

If your application calls Marshal.load on untrusted data AND has both erb and activesupport loaded, please update your ERB to 4.0.3.1, 4.0.4.1, 6.0.1.1, 6.0.4 or later. You may use this Ruby 4.0.3 release to do so.

Release Schedule

We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent regular release. Ruby 4.0.4 will be released in May, 4.0.5 in July, 4.0.6 in September, and 4.0.7 in November.

If a change arises that significantly affects users, a release may occur earlier than planned, and the subsequent schedule may shift…

Last year I moved the LLM streaming jobs in Chat with Work to Async::Job. It was fast. Genuinely fast. Fiber-based execution with Redis, thousands of concurrent jobs on a single thread. I was so convinced that I wrote a whole post about why async Ruby is the future for AI apps and recommended it to everyone.

Then I started hitting walls.

Async::Job doesn’t persist jobs. They go into Redis and they’re gone. Mission Control shows nothing. Background jobs in Rails are already quieter than the rest of your application – they fail without anyone noticing unless you go looking. Even with Honeybadger catching exceptions, I still want to see the full picture: which jobs are queued, which are…

We published security advisory for CVE-2026-41316.

CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / def_class

A deserialization vulnerability exists in ERB. This vulnerability has been assigned the CVE identifier CVE-2026-41316. We recommend upgrading the erb gem.

Scope

Any Ruby application that calls Marshal.load on untrusted data AND has both erb and activesupport loaded is vulnerable to arbitrary code execution. This includes:

• Ruby on Rails applications that import untrusted serialized data – any Rails app (every Rails app loads both ActiveSupport and ERB) using Marshal.load for caching, data import, or IPC
• Ruby tools that import untrusted…

Details

ERB…

April 20, 2026 Scan to try Live Demo Available Introducing MapView Render beautiful, production-ready maps directly from your Ruby backend. No external APIs. No dependencies. Just pure speed and control. ✓ Zero external dependencies ✓ Lightning-fast rendering ✓ Production-ready & battle-tested Try the Live Demo → Read Docs In 2025, at the RubyWorld Conference, … Continue reading Generating thousands of maps per minute in Ruby →

A few weeks ago, Axios, the popular HTTP client for JavaScript, suffered a supply chain attack on NPM. An attacker compromised the lead maintainer’s NPM account through social engineering and published two backdoored versions that delivered a cross-platform remote access trojan (RAT) to macOS, Windows, and Linux systems. Axios has over 100 million weekly downloads. The blast radius was enormous.

Not long before that, LiteLLM, a popular Python AI gateway, had a similar incident on PyPI. Compromised credentials were used to push malicious packages that harvested environment variables, SSH keys, cloud credentials, and database passwords.

Both attacks followed the same playbook: gain access…

Over the last few months, there has been a lot of talk about making Bundler faster, both by improving it directly, or by reimplementing it in another language, and while it may surprise some, that didn’t excite me much.

Don’t get me wrong, all other things being equal, faster is better, so if Bundler gets faster without me having to change my toolchain one bit, I’ll happily take it. But I certainly would not bother migrating to something else just for speed.

Instead, there are a number of features I believe Bundler is missing, and that over the years, I tried to convince Bundler’s maintainers to consider them, but without any success.

Why Bundler Is Fast Enough For Me

Given how much I…

Back in November last year, I started a new job at Intercom, and one of the first projects I got to work on was improving the Intercom monolith CI with some of my new colleagues.

Interestingly, I never got around to talking about CI on this blog, even though I consider it to be one of my main areas of expertise. That topic is way beyond the subject I’d like to talk about here, but just to give a bit of context, a key driver in CI performance and user experience is how fast you can get a Ruby process ready to run tests.

When working with very large test suites, it becomes essential to run tests in parallel. If you have a test suite that runs in say, 1 hour, on paper, you can run it in 15…

In this episode of RECORDABLES, we dive into the thinking behind the ONCE open source app server and what it takes to turn self-hosted software into something anyone can run. David Heinemeier Hansson and Kevin McConnell walk through the shift from single-app installs to a console-like system that can run multiple applications on one machine, and the philosophy that guided that evolution.

Along the way, they explore the tradeoffs between simplicity and flexibility, the role of Docker and Kamal in making deployments seamless, and why ease of use matters more than raw capability. This conversation is a look at packaging complexity into something approachable and how ONCE aims to make running…

Chris and David welcome guest John Athayde, who runs the branding and UX consultancy, Meticulous. They dive into John’s unusual path through the Rails world as a designer, front-end developer, consultant, author, and UX thinker. The conversation moves from early Rails history and The Rails View into a broader discussion about why designers need to understand implementation, how AI is changing product and UI work, where component-based design is headed, and why browser support is still one of the messiest parts of modern web development. Hit download now to hear more!

Links

• John Athayde Website
• John Athayde X
• John Athayde Bluesky
• Meticulous
• Build Software Like Pixar Makes Movies with John…

Hi, Wojtek here. Let’s see what’s new in the Rails on this finally sunny day (at least in my corner of the world ;-)

Query command for read-only database queries
Adds rails query — a read-only database query command with structured JSON output.

rails query "Account.where(plan: 'premium').limit(2)"

{
  "columns": ["id", "name", "plan", "created_at"],
  "rows": [
    [1, "Acme", "premium", "2025-01-15T10:30:00Z"],
    [2, "Widgets Co", "premium", "2025-03-22T14:00:00Z"]
  ],
  "meta": {
    "row_count": 2,
    "query_time_ms": 4.2,
    "page": 1,
    "per_page": 100,
    "has_more": false,
    "sql": "SELECT \"accounts\".* FROM \"accounts\" WHERE \"accounts\".\"plan\" = 'premium' LIMIT 2"…

There are many more possibilities and additional subcommands available, such as query schema, query models, and query explain.

Add charset=utf-8 to Content-Type for static CSS and HTML files
ActionDispatch::FileHandler#try_files now appends ; charset=utf-8 to the Content-Type header for CSS and HTML static files. This is consistent with the rest of the Rails stack, which already…

Add offline fallback page to the PWA scaffold
New Rails apps now include an app/views/p…

If you’re building LLM-powered features in a regulated industry, sending unfiltered PII to a third-party provider isn’t just risky, it may violate compliance requirements like HIPAA or GDPR.

That’s why we originally built Top Secret. However, when we first released it, RubyLLM was still in its early days, and I found I was working with provider APIs directly, such as Ruby OpenAI or OpenAI Ruby. This meant I needed to manually orchestrate the filtering and restoration process, which looked something like this:

require "openai"
require "top_secret"

openai = OpenAI::Client.new

original_messages = [
  "Ralph lives in Boston.",
  "You can reach them at ralph@thoughtbot.com or 877-976-2687"
]

…

We have made recent and significant changes to how Ruby Central operates.

We have parted ways with our Executive Director, our PR agency, our CFO, and concluded several contractor engagements. These were not easy decisions, but they were necessary to ensure the long-term sustainability of Ruby Central. Since joining the Board at the beginning of the year, we have seen the organization's finances become overly dependent on the optimistic timing of when funds may be received against fixed timelines for when our expenses are due.

As a result, Ruby Central has found itself in real financial jeopardy. This is a situation we've been working toward resolving by reducing our expenses, renegotiating…

If you’ve ever noticed that your CSS transitions feel a bit… flat, you’re not alone (I seem them a lot! 😭). The default ease timing function works fine, but it’s generic. Real-world motion has character, it bounces, overshoots and feels natural. That is what cubic-bezier is for.

What is cubic-bezier?

In CSS, cubic-bezier is used in the transition-timing-function or animation-timing-function property. It defines how intermediate values are calculated during a transition using a cubic Bézier curve (orly?! 🦉).

The syntax looks like this:

cubic-bezier(x1, y1, x2, y2)

Those four numbers define two control points on a curve. The curve starts at (0,0) and ends at (1,1), representing the…

Every team has a different definition of "ready." Here's how to make sure everyone's aligned before, during, and after launch.

Continue Reading

Most AI SEO advice is unproven. We tested what ChatGPT, Claude, and Perplexity actually read on our own site. Six LLM visibility techniques that worked, eight that didn't, and the metrics to tell the difference.

We recently signed a new client, and they actually found us via Claude. The founders of an SF-based AI startup asked Claude to recommend a dev agency with senior engineers who think about architecture and scale. Evil Martians came back as the top recommendation. That got us thinking: what did we do right?

Last weekend I migrated my Doctor’s App from Heroku to Railway.

It’s a multi-tenant Rails app where each hospital gets its own subdomain, one.doctors.com, two.doctors.com, and so on.

Five hospitals, around 25,000 appointments, 9,700+ patients. Not huge, but not trivial either.

Here’s how it went, including the part where I accidentally broke the database.

The setup

I already had a Railway project running with a test domain (*.juanvasquez.dev) from earlier experiments. The web service was deployed from GitHub and the Postgres 17 instance was co-located in us-east4. Cloudflare R2 handles file storage, that stays the same regardless of where the app runs.

The plan was simple: put…

April 15, 2026 Scan to try Live Demo Available Introducing MapView Render beautiful, production-ready maps directly from your Ruby backend. No external APIs. No dependencies. Just pure speed and control. ✓ Zero external dependencies ✓ Lightning-fast rendering ✓ Production-ready & battle-tested Try the Live Demo → Read Docs Today I created a flyer to … Continue reading Create QR Codes from Scratch with Ruby, ruby-libgd, and rqrcode →

Slow database queries can significantly impact the user experience of any Rails application. Identifying and fixing these performance bottlenecks requires a systematic approach and the right set of tools.

In this post, we will explore various approaches to debugging query performance in Rails, from built in Rails tools to database specific utilities.

Understanding the Problem

Before diving into debugging tools, it’s important to understand what makes a query slow. Common causes include:

• Missing or inefficient indexes
• N+1 query problems
• Full table scans
• Complex joins without proper optimization
• Large result sets being loaded into memory
• Inefficient WHERE clauses

Rails…

rubygems.org has been a busy project. This past year we shipped formal policies for the first time in the registry’s history, launched the Organizations private beta, and made some meaningful security improvements to how gems get validated and how compromised passwords get caught. A lot of that work happened quietly. If you wanted to know where things were headed, you had to catch the right conference talk or subscribe to the right newsletter, and even then you’d only get pieces. The roadmap puts it in one place.

The roadmap covers work at different stages, from Organizations moving toward general availability to longer-horizon work on security tooling, gem archival, and acceptable use…

Every design team I’ve worked with has had the same complaint about clients.

“They sent over a PowerPoint with mockups.” Eye rolls. Crossed arms. The unspoken accusation: you’re stepping on my domain.

I got it. The client would shortcut the process. Fall in love with their own wireframes. Hand the designer a solution instead of a problem.

That friction was real.

But here’s what nobody said out loud… the designers were doing the same thing to the developers.

A designer would disappear for a few weeks. Come back with approved comps. Hand them off to a dev team with zero context on the constraints they’d just inherited. The developers would look at the designs and realize that one…

Mobile teams shipping on a weekly cadence need automated confidence that changes won’t break what’s already working. At Gusto, our iOS codebase had unit tests, but coverage was uneven, and we hadn’t yet adopted snapshot testing. Major upgrades and component refactors still required significant manual verification. We wanted a more deliberate, layered approach — one that would scale with the team and the product.

The moment that sharpened our focus: a localization string change wasn’t caught by our existing automation and surfaced just one day before release. The fix took minutes — but the late discovery cost a full release cycle.

Manual testing doesn’t scale with growing teams and faster…

Introducing rails_vite—a new Vite integration for Rails that works with Propshaft, not against it. Drop it into an existing jsbundling app for instant CSS HMR, or use the full gem for manifest-based asset resolution.

Vite is the build tool every frontend developer reaches for. But you won't find it in rails new. Vite runs a dev server. Propshaft—Rails' asset pipeline—expects files on disk. For years, these two have refused to share a stage. rails_vite makes this incompatibility …disappear.

Creating software is complicated. It’s hard to figure out exactly what you need to build without a lot of trial and error. It almost always requires both exploring possible options and refining something until it works really well. But those things aren’t the same! Your research prototype is not a good product that people will happily pay for.

Back in the olden days, when software literally came from BigCo R&D departments, we managed to invent Unix, and the mouse, and GUIs, and Ethernet, and TCP/IP, and a ton of other stuff we all use constantly today. Those research divisions didn’t ship viable consumer products, though. Doug Englebart demoed a mouse-driven GUI in 1968, but you couldn’t…

To deal with secrets and credential handling most Rails apps have ended up with a hotchpotch of ENV.fetch calls and credentials.dig lookups throughout the codebase, depending on where each secret lives.

Rails edge — and the upcoming 8.2 — fixes this.

Instead of…

…mixing ENV and credential lookups:

class StripeChargeService
  def initialize
    @api_key = ENV.fetch("STRIPE_API_KEY")
    @webhook_secret = Rails.application.credentials.dig(:stripe, :webhook_secret)
    @price_id = ENV.fetch("STRIPE_PRICE_ID") { Rails.application.credentials.dig(:stripe, :price_id) }
  end
end

Use…

…the combined credentials API:

class StripeChargeService
  def initialize
    @api_key = Rails.app.creds.r…

MapView: Server-Side Map Rendering for Rails April 12, 2026 After an extensive development journey, MapView has arrived: a powerful API for generating map images directly from your Ruby server. What is MapView? MapView is a Ruby gem that enables you to render maps, routes, points, and polygons with zoom levels ranging from a global world … Continue reading MapView: Server-Side Map Rendering for Rails →

This is a copy of the Searls of Wisdom newsletter delivered to subscribers on April 10, 2026.

I've decided to go on a content hiatus. This will be my last dispatch for a while. I don't know how long I'll be gone.

Why? Because I've been posting to an anonymous audience on the Internet almost every day since I was eleven years old. I posted through Bill Clinton's impeachment, 9/11, the Iraq War, the Deepwater Horizon oil spill, the version of Siri that would tell you where to hide a body, binders full of women, and a pandemic that changed everything and then nothing at all.

Very few of my friends live like I do. They aren't pundits. They don't post takes. They lead normal-looking…

If I’ve sent you this, it’s because I will eventually need to give you constructive feedback. Not necessarily right now, but it is going to happen. If I’m your manager I’m going to be giving you feedback fairly regularly because it’s a requirement of my job. And I want to set your mind at ease about it by explaining the process up front, and hopefully showing you that it’s no big deal.

In April 2025 I wrote Apologizing for My Obsessiveness Over Punctuation, a post about my various organizational compulsions. Near the end, almost as an aside, I mentioned that I obsessively categorize expenses in Monarch, a personal finance app, linking it with my referral code. That post earned me exactly one referral in the nine months that followed.

Then, on January 15th, 2026, I wrote Serving Markdown for AI Agents. The idea is simple: for every post on this blog, there’s now a .md version at the same URL. AI agents can discover and fetch clean markdown instead of parsing HTML. I didn’t think much of it.

Exactly thirty days later - the length of Monarch’s free trial — I started…

Before AI coding assistants, a typical engineering team built expertise with the years: new team members joined, contributed small bug fixes, then were given more ambitious tasks over time as they became more comfortable in a codebase, to ultimately become experts. This process took years.

In contrast, today, almost every engineer, and many non-engineers, have access to tools that can gather context from any codebase, and produce a large volume of high-quality code in a day. This lowers the bar for contributing meaningful changes to the software we build and enables many more individuals without domain or codebase expertise with good ideas to see them to light.

At work, I asked my team to…

Human preface: I’m doing a little side project to see for myself how far AI agents have come and what they’re capable of. I’ve basically directed Claude to make a website the generates traffic by any means it sees fit. Below is a little introductory post written by Claude explaining the project and how it’s going at this early stage.

Building a Complete GIS Stack in Rails: ruby-libgd + libgd-gis + map_view April 10, 2026 See the LIVE DEMO in action MapView Render maps directly from your backend no external APIs required. Fast, controlled, and production-ready. Try the demo → Over the past few months I’ve been working on a small GIS-oriented stack in … Continue reading Building a Complete GIS Stack in Rails: ruby-libgd + libgd-gis + map_view →

Hi, I’m Emmanuel Hayford. Here’s what caught my eye in Rails this week.

Fix GET+JSON+params in integration tests for API-only apps
params: in integration test helpers was ambiguous for GET requests with as: :json — it wasn’t clear whether params should go in the query string or request body. The original workaround converted GET to POST with X-Http-Method-Override, which broke API-only apps that exclude Rack::MethodOverride. New query: and body: kwargs give explicit control: query: always lands in the URL query string, body: always goes into the encoded request body, and params: keeps its existing behavior unchanged.

get  "/search", query: { q: "rails" }, as: :json
post "/search", query: {…

Add…

This episode of Remote Ruby opens with stories of exhaustion from a sleepless week. Then, Chris, Andrew, and David spend most of the episode unpacking two big themes: trust and governance in open source, and the growing mess of software security and AI-assisted development. They dig into the new Ruby Central write-up on the RubyGems/Bundler fracture and question whether it actually clarifies the path forward, then pivot into the Axios npm compromise, supply-chain risk, and how fragile modern package ecosystems can feel. Then, they go into a wide-ranging discussion on AI coding, bloated production apps, image-performance headaches, CSS/rendering quirks, and why teams may need to rethink…

We deployed an existing Laravel application using Docker and Kamal 2 without touching the app. Here's what worked, what didn't, and what we'd do differently.

Continue Reading

Webhooks are one of those super simple but really powerful tools that almost every developer has needed to use at least once. From Stripe, GitHub to Postmark. Setting up webhooks is not difficult, but there is quite a bit of boilerplate involved: payload storage, event routing and signature verification. Repetitive. Tedious. Boring. Oh, and did I mention debugging?

Meet Fuik: a Rails engine that catches and stores webhooks from any provider, then gives you a clean way to process them.

👉 If you want to check out the repo and star ⭐ it, that would make my day! 😊

You can install Fuik simply by running bundle add fuik and then run the install generator and migrate the database. Seconds of…

Every gem published to rubygems.org ends up running on someone’s computer. It’s up to rubygems.org to ensure that each gem contains what it claims, that its metadata is well-formed, and that the person who pushed it is who they say they are.

We’ve been chipping away at that. Over the past few months, we shipped two changes that tighten rubygems.org’s defences at very different layers: stronger validation of gem contents at push time, and integration with Have I Been Pwned to catch compromised passwords at login.

What rubygems.org checks when you gem push

A RubyGem is actually just a regular tar file, which contains 3 sections: the code, metadata, and checksums, which you can inspect for…

Evil Martians migrated Wallarm's core event pipeline from NATS to Kafka in two months with zero downtime. Learn how we also handle event deduplication and reconstruct business flows for better understanding of the application.

Wallarm (YC S16) is a series C cybersecurity startup protecting more than 20,000 applications with its API security platform. It sits in front of clients' apps, analyzes every incoming request, and blocks malicious traffic in real time.

When building a SaaS with Rails, I often have more complex logic that spans multiple models and actions. Over time, I’ve settled on two distinct patterns: Form Objects and what I’ll just call classes (or POROs). They serve different purposes, and knowing when to reach for each has made my code easier to reason about and test.

Let me walk you through how I use them both.

Use Form Objects for user input

I use Form Objects when I have a form that a user interacts with directly, and that form needs to create (or update) more than one record. The key is the direct mapping to the form itself.

A Form Object should “quack” like an Active Record model. It validates input, it responds to #save, and…

MapView: Static maps for Rails. No JS. No frontend. Just Ruby. April 7, 2026 See the LIVE DEMO in action MapView Render maps directly from your backend no external APIs required. Fast, controlled, and production-ready. Try the demo → From the creator of ruby-libgd and libgd-gis comes native Rails integration Many of you already … Continue reading MapView: Static maps for Rails. No JS. No frontend. Just Ruby. →

RubyGems 4.0.10 includes enhancements and bug fixes and Bundler 4.0.10 includes enhancements and bug fixes.

To update to the latest RubyGems you can run:

gem update --system [--pre]

To update to the latest Bundler you can run:

gem install bundler [--pre]
bundle update --bundler=4.0.10

RubyGems Release Notes

Enhancements:

• Ignore warnings with spec different platforms. Pull request #8508 by hsbt
• Better algorithm for sorting gem version. Pull request #9421 by Edouard-chin
• Update SPDX license list as of 2026-02-20. Pull request #9434 by hsbt
• Installs bundler 4.0.10 as a default gem.

Bug fixes:

• Register native extension files in default spec map. Pull request #9431 by hsbt
…

• Why Latin?
• How I got into Latin
• What’s fun about speaking Latin?
  • Finding words for modern concepts
  • Small talk, elevated
  • Old books as conversation partners
• How can you learn Latin?

Normally this is a programming blog, but here’s something different.

My justification is April Cools’ Club, which henceforth will allow me once a year to write about something completely random (something I’ve done before without knowing it was excusable).

My inspiration was the Spring 2026 Lobsters blog carnival, where participants are provoked to defend the superiority of our favorite language. I accept the challenge, and I step forward to defend the honor of…

Latin.

One new skill in this release: rails-upgrade.

Why I built this

Seeing the skills for upgrading a Rails app released in the last months with the one from OmbuLabs/FastRuby.io being released last week:

• OmbuLabs/FastRuby.io: detection patterns, gem compatibility data, upgrade methodology

• maquina-app/rails-upgrade-skill by Mario Alberto Chávez Cárdenas: breaking changes reference tables, deprecation timeline

I got thinking that maybe it is time for superpowers-rusuperpowers-rubyby to have such a skill.

The workflow

The skill runs a six-step process, but three of those steps are hard gates: the agent cannot proceed past them unless a condition is met.

The first gate is a green test suite.…

When you build a product that uses LLMs and prompts, security becomes a specific kind of hard problem.

Simon Willison described the core risk well in The Lethal Trifecta. When three things combine in a system: access to private data, exposure to untrusted content, and the ability to communicate externally, the situation becomes dangerous.

The reason is structural: LLMs follow instructions in content. That is what makes them useful. It is also what makes them exploitable. An attacker embeds instructions in a document, an email, a webpage, and the model may execute them.

Prompt injection is the number one vulnerability in LLM applications according to OWASP's Top 10 for LLMs. And unlike SQL…

I’m one of the operators of rubygems.org. Here’s what’s been happening over the past week, and a temporary change we’re making as a result.

For the past seven days, rubygems.org has been under sustained bot traffic from many different sources scraping data from every published gem. The volume has been large enough to force the site offline while we respond. The bots are deliberately bypassing the Fastly cache, hitting our origin servers directly.

The primary target has been our language locale pages, the translated versions of rubygems.org. Unfortunately, the locale system wasn’t designed to cache easily through a CDN. To protect site stability, we’re temporarily disabling language…

Your agent’s context window is the most precious resource it has. The more you stuff into it, the worse your agent performs.

Researchers call it context rot: the more tokens in the window, the harder it becomes for the model to follow instructions, retrieve information, and stay on task. Chroma tested 18 frontier models and found that accuracy drops up to 30% when you go from a focused 300-token input to 113k tokens of conversation history, with the task held constant. The model essentially became dumber.

This holds true regardless of how big the window is, yet most agent setups treat the context window like a junk drawer.

“Just toss it in there, the LLM will figure it out!”

MCP: the…

Learn what's new in the world of slow tests and how TestProf continues to help Rails teams to keep CI build times under control.

Behind every release of TestProf is a story about battling a real-world Rails application's test suite slowness. This time, we've picked standout cases from Evil Martians' recent CI performance gig at Whop. Learn what we used to identify and fix them and how this experience shaped TestProf v1.6.0.

The JRuby community is pleased to announce the release of JRuby 10.0.5.0.

• Homepage: https://www.jruby.org/
• Download: https://www.jruby.org/download

JRuby 10.0.5.x targets Ruby 3.4 compatibility.

Thank you to our contributors this release, you help keep JRuby moving forward! @evaniainbrooks, @kares, @chadlwilson, #jimtng

Compatibility

• Fixed: Two bugs in the JIT compiler that broke certain super calls and defined_method yields. (#8944, #8946, #9310, #9349)
• Fixed: Fiber#raise left the fiber in an resumable state by not correctly transfering control. (#9297, #9356)
• Fixed: Connecting a socket using nonblocking operations failed to complete the establishment of the connection.…

JVM Integration

• Java 26 is officially supported. (#9332)

Pl…

Dear Heroku,

As friends, long time marketplace-partners, supporters, and customers, we here at Judoscale — along with so many others from the developer community — are a bit confused about what’s going on over there in San Francisco. Frustrations aside, we’re having a hard time figuring out what to think about this whole ‘Heroku thing’.

First came the blog post on February 6th that, sort of out of nowhere, announced that:

Heroku is transitioning to a sustaining engineering model focused on stability, security, reliability, and support… with an emphasis on maintaining quality and operational excellence rather than introducing new features…

Enterprise Account contracts will no…

Which, full disclosure, sounds an awful lot like a product going into “Maintenance Mode”, even if that specific phrase isn’t said. Speaking of specific phrases, what exactly is a…

This Week in Rails: Faster Logs, Reliable Parallel Tests, and Key Deprecations April 5, 2026 See the LIVE DEMO in action MapView Render maps directly from your backend no external APIs required. Fast, controlled, and production-ready. Try the demo → A new batch of improvements has landed in the Rails codebase this week, focusing … Continue reading This Week in Rails: Faster Logs, Reliable Parallel Tests, and Key Deprecations →

Hi, it’s Vipul. Let’s explore this week’s changes in the Rails codebase.

Remove fast_string_to_time workaround in ActiveModel::Type::Helpers::TimeValue
Ruby 3.2.0 had a bug where Time.new(..., in: "UTC") could return an invalid Time object. With the minimum supported Ruby now at 3.3.1, the runtime probe and workaround are dead code and have been removed.

Add prepend: true option to ActiveSupport::Notifications.subscribe
A new prepend: true option on ActiveSupport::Notifications.subscribe ensures a subscriber runs before all others enabling payload mutation before any downstream handler sees it.

ActiveSupport::Cache add a fast path for string keys
Since most cache keys are already…

Frequently Played 🔗

I tend to listen to the same songs or albums on repeat that are evocative of how I’m feeling or what’s going on with me. Here is what I’m currently listening to over, and over, and over, and over, again.

Witch Dance 🔗

Grief, perseverance, the search for community, the desire for answers.

Full Lyrics

And I met every monster from the bar to Broadway
And all their violent offers, I just turn them away
And your threats and your promises, they don’t scare me
After all, there’s nobody more monstrous than me

Opening of The Land Of Hope And Dreams American Tour 🔗

I finally watched Deliver Me From Nowhere. My recommendation? Read the book. Or, better, listen to Nebraska.

The mighty E Street…

Ruby is a programming language created for the happiness of the programmer, but apparently this happiness did not account for the installation process of the language itself. If you go to the official language page, you will find a list of solutions to install and manage Ruby versions. But almost all of them have one problem: you have to compile the version locally, and the time it takes will depend on how fast your CPU is.

Now that is changing; a new tool called rv has emerged. It is described as “an extremely fast way to manage your Ruby versions and gems”. In this post, I want to explain a bit how it works, why it is so fast compared to previous solutions, how you can use it to install…

On this episode, Chris, Andrew, and David bounce from Ruby and Rails security updates into the messy realities of caching, UI architecture, and browser support. They break down the latest Zlib-related Ruby CVE, Dalli updates, Rails security and bugfix releases, and what maintenance windows mean in practice. Then, they swap stories about Redis, Memcached, observations about GitHub’s reliability amid massive Claude attributed code activity, and the kinds of performance problems that only show up at scale. The episode closes with a thoughtful Rails frontend discussion covering nested layouts, active sidebar links, CSS-powered empty states, pagination behavior, popovers, anchor positioning, and…

Last week, three members of Ruby Central’s board published a new statement about RubyGems and Bundler, and this week they published an incident report on the events last year. The first statement reports that Ruby Central has now completed a third audit of RubyGems.org’s infrastructure: first by the sole remaining RubyGems.org maintainer, the second by Cloud Security Partners, and the third by Hogan Lovells.

In all three cases, Ruby Central found no evidence of compromised end user data, accounts, gems, or infrastructure availability. I hope this can conclusively put to rest the idea that I have any remaining access to the RubyGems.org production systems, or that I caused any harm to the…

I also appreciate that Ruby Central is taking its share…

This article is taken from the book JavaScript for Rails Developers (use ONE-YEAR-OLD to get 25% discount; valid until 2025-04-09 🥳). It is a book I published about a year ago. Over that period, many hundreds bought the book. It is written for Ruby/Rails developers to make JavaScript your 2nd favourite language.

I always get a little excited when I see a good refactoring happen. So I want to share this article; it is one of the last chapters where I go over an exisintg part of the code that is created in the book to refactor it with the goal to make it:

• more readable;
• easier to understand at a glance.

This is the current code it started with:

import { Annotation, Transaction } from "@code…

Believe it or not, I don’t only work on or write about SQLite, and today I want to share a simple pattern for role management in Rails inspired by the rolify gem. I have been using this setup in the Rails app I am currently working on, and it has been a lovely experience. I’ve also had to evolve the pattern a bit recently, so I thought now was a great time to share the current state of things. Let’s jump into it!

The pattern works with 3 core models and then any number of related models. The core models are (you guessed it) User, Role, and UserRole. The User model represents, well, a user of your application. The Role model is a role that a user can have. The UserRole model is the join…

We analyzed 1,140 early-stage funding rounds in developer tools, cybersecurity, and infrastructure from January 2025 through March 2026. Here are the top VCs and investors writing checks, the metrics that got companies funded, and the exact person to email based on what you're building.

In other places, founder dreams might include sports cars or fancy watches, but here in San Francisco, every devtools founder wants one thing: to be on a bus. Specifically, their logo painted on a Muni line crossing Market Street. If you're on a Muni, you've made it, like Modal, Blacksmith, Posthog, Hex. Another way to…

Rails apps have layers but no modules

You can have 200 models and zero modules. That’s the problem with typical Rails conventions. Rails supports layers - models, views, controllers. But layers are not modules. Within one layer - especially models - usually all is mixed together. There are no boundaries.

Order.first.user.invoices.last.line_items

Such code is not so uncommon. It crosses 4 business boundaries. In just 1 line of code. All thanks to associations.

The problem with associations

One of the first thing we teach in Rails is associations.

class Order < ApplicationRecord
  belongs_to :user
end

It’s very readable, feels right. Allows us to call it like this:

Order.first.user

Then…

Issues stemming from one tool had major ripple effects across our client's entire app. Here's how we approached it

Continue Reading

Judoscale ‘On Tour’ Series

1. “The Friction Model” & Heroku (This page!)
2. Render (Coming soon…)
3. Railway (Coming soon…)
4. Fly (Coming soon…)
5. Northflank (Coming soon…)
6. Digital Ocean (Coming soon…)
7. Amazon ECS Fargate (Coming soon…)

Thus we begin our tour! As we mentioned in our last post, we’re going to take our production app on a hosting tour to fully experience what each option in today’s hosting marketplace looks like, feels like, and runs like. But before we do any of that, we need a baseline and a strategy.

Judoscale has been on Heroku since its origins ten years ago. Adam, Judoscale’s founder, has been using Heroku since it was a first-days startup! All that to say,…

This is a copy of the canonical report I published on RubyCentral’s site. I recommend reading there for the most updated copy. This document attempts to give closure to the Ruby community about the events that led to the incident, September 10-18, 2025, which I’ve named “RubyGems Fracture.”

Preamble

I joined Ruby Central’s Open Source Committee on October 22nd, 2025, after the GitHub access changes. I was adamant internally and externally from day one about performing a retrospective to try to wrap my head around the full, true picture of what happened and why.

In the pursuit of this task, I’ve spent 20+ hours interviewing and chasing up leads, easily quadrupling that time…

By: Richard Schneeman

This document attempts to give closure to the Ruby community about the events that led to the incident, September 10-18, 2025, which I’ve named “RubyGems Fracture.”

Preamble

I joined Ruby Central’s Open Source Committee on October 22nd, 2025, after the GitHub access changes. I was adamant internally and externally from day one about performing a retrospective to try to wrap my head around the full, true picture of what happened and why.

In the pursuit of this task, I’ve spent 20+ hours interviewing and chasing up leads, easily quadrupling that time spent reviewing other artifacts such as chats and raw GitHub access logs. For any fact learned verbally, I’ve…

A new way to decouple code since Rails 8.1.

There are these moments where you feel stuck between the devil and the deep blue sea. Two possible solutions, neither quite up to the job.

Let’s start with a simple example that illustrates what we’re competing against. You are implementing an e-commerce solution that sells digital products. After a purchase is placed, a few things need to happen: send a confirmation email, track the event in your analytics, and ping your team on Slack. Your first pass looks something like this:

def create
  @order = Order.create!(order_params)
  OrderMailer.confirmation(@order).deliver_later
  Ahoy::Event.create!(name: "order.created", properties: {…

Configuring monitors in Hyprland means writing monitor= lines by hand. A 4K display at 1.33x scale is effectively 2880x1620 pixels, so the monitor next to it needs to start at x=2880. Vertically centering a 1080p panel against it means doing division in your head to get the y-offset right. You reload, you’re off by 40 pixels, you edit, you reload again. There’s no visual feedback until after you’ve committed to a config.

Then it gets worse. You unplug your laptop, go to a conference, plug into a projector, and you’re back to editing config files backstage before your talk. You come home, dock the laptop, and the layout is wrong again.

I looked at what was available. The closest to what I…

Haggis Ruby returns to Glasgow on April 23-24, and thoughtbot will be there.

Rob Whittaker and Mina Slater are attending, and Aji Slater is speaking. Their talk is about playfulness in exploration when tackling novel challenges. What is the challenge in this case? Using Ruby for procedural generation of an endless haunted house.

Haggis Ruby is one of the smaller Ruby conferences, and that’s part of what makes it good. The conversations are better when the room is smaller. If you’re in or around Glasgow in late April, it’s worth the trip.

We’re looking forward to it. If you’re going, find us.

If you enjoyed this post, you might also like:

• Heading to Ruby East
• Upcoming events
• More…