Rubyland

You get a site audit report and it looks manageable. A few dozen findings, most of them small: a page with barely any text on it, a link whose text is just “here”, a page whose title tag is a copy of its H1, a hero image heavy enough to hurt the largest contentful paint. None of it is that hard. You spend an afternoon on it, close the tickets, and move on.

Then a few months pass, a dozen new pages ship, and the next audit reports the same findings again. Not because anyone ignored the first round, but because the first round fixed pages instead of fixing the process that produces pages.

That happened to us, on this site and on OmbuLabs.ai. So the second time around we spent the effort…

You rolled out an AI tool to your team a year ago. Maybe it was ChatGPT Team for the office, Copilot for the two people who write code, or an AI feature that showed up inside the CRM you already pay for. Whatever it was, it stuck. People use it every day, and if it disappeared tomorrow, someone would notice before lunch.

On August 29, 2026, OpenAI told Cursor, one of the most widely used AI coding tools, that Cursor’s access to OpenAI models ends on November 12. There was no outage, no price change, and no wrongdoing on Cursor’s side. Cursor had just been bought by SpaceX, and OpenAI decided it could not trust the new owner to honor its terms. Cursor’s CEO wrote that they had “trusted…

My position on AI has been extremely boring and is basically, “if something is currently happening, the people who are saying that it’s impossible that it will ever happen are probably wrong”.

danluu.com: How Accurate Have Ed Zitron’s AI Skeptic Predictions Been?

You’ve probably heard the word “agent” in every AI pitch you’ve sat through this year, from vendors, from consultants, maybe from your own team. It gets used to describe everything from a customer service chatbot to a fully autonomous system nobody’s watching, which means the word alone doesn’t tell you much.

We build these systems for a living, and even we don’t reach for an agent by default. In this article, you’ll learn what an AI agent actually does differently from a chatbot, what that looks like on a real project, and how to tell if your business has a task that’s actually a good fit for one.

What an AI Agent Actually Does

Most of what gets called “AI” in a business tool today is…

A while back I wrote about organizing configuration in Rails. The idea was simple: drop YAML files into config/configurations/ and get namespaced constants like Config::Bot.api_key instead of the clunky Rails.application.config.bot.api_key.

It worked well. But every YAML file needed manual wiring: <%= ENV.fetch("BOT_API_KEY", Rails.application.credentials.dig(:bot, :api_key)) %>. For every key. Across every file. Ugh!

So I rebuilt it. Same clean Config::Namespace.key API, but now it chains through all three sources automatically.

Before (old module’s YAML):

# config/bot.yml
shared:
  api_key: <%= ENV.fetch("BOT_API_KEY", Rails.application.credentials.dig(:bot, :api_key)) %>
  user_agent: "M…

After (new module’s YAML):

# config/bot.yml
shared:
  # Config::Bot.api_key is still available and…

Gusto runs payroll for 500,000+ businesses on one of the largest Rails monoliths anywhere. Why a team this strong hired Evil Martians for Sidekiq at scale, what running background jobs at that size actually takes, and when to stop waiting for the perfect hire.

Gusto is the payroll, benefits, and HR platform for more than 500,000 businesses. In May 2026, it crossed $1B in annual revenue, cash flow positive, last valued at $9.3B.

Berlin.rb is a new monthly meetup for people who write Ruby, or are curious about it. A few of us from Berlin’s Ruby community are organizing talks, project show-and-tells, and time to meet other people who work in the same language. It’s free and open to anyone, whether you’ve been writing Ruby for fifteen years or installed it last week.

The first one is Tuesday, September 8, 18:45, at Potsdamer Straße 121. Use the Grover entrance next to Rossmann and head to the third floor. The evening is hosted and sponsored by ablefy, with drinks and snacks provided. After that, the second Tuesday of every month.

Register here. If you can’t make it to Berlin, there’s a livestream and it’ll be on You…

The…

An honest look at what NativePHP's SuperNative makes possible for Laravel teams and what it costs.

Continue Reading

We’ve spent years loading an extraordinary number of responsibilities onto the humble code review: quality gate, security check, architecture review, mentoring mechanism, knowledge-sharing system, ownership model.

Rachel Laycock (rlaycock@thoughtworks.com): Maybe We Shouldn’t Be Reviewing All This Code

Claude Fable 5.1 dropped yesterday. See how it handles real Rails tasks, and where it landed on the leaderboard today. We also finally have a name for the stealth model from the last round.

Fable 5.1: We have a new best.

Fable 5.1 scored as well as Claude Opus 5 on accuracy, but surpassed it in all other marks (including price!). And it does security work now.

Fable 5.1 solved 58 of 63 runs (92%), matching Claude Opus 5 at the top of the leaderboard, and passed 20 of the 21 tasks at least once. Here is how it compares:

• Claude Fable 5.1: 58 of 63, $75 for all 63 runs, 5.4 minutes median per run.
• Claude Opus 5, the sole leader until now: 58 of 63, $120, 9.7 minutes.
• Claude Fable 5:…

Efficiency is the clearest difference between 5.1 and the previous generation: the bill is ~50% lower than Fable 5’s and ~40%…

Jim Remsik, founder of Flagrant and organizer of XORuby, joins David to talk about what he’s learned from taking a Ruby conference on the road.

XORuby was designed around a simple premise: traditional conferences are valuable, but travel costs, time away from work, and family responsibilities put them out of reach for many developers. Jim explains how XORuby tries to lower those barriers with inexpensive, one-day regional events—and why he measures their success as much by first-time attendees, new speakers, friendships, and community connections as by the financial bottom line.

The conversation turns to Flagrant and the rapidly changing role of AI in software development. Jim…

RubyGems 4.0.20 includes enhancements, bug fixes and documentation and Bundler 4.0.20 includes enhancements, bug fixes and documentation.

To update to the latest RubyGems you can run:

gem update --system [--pre]

To update to the latest Bundler you can run:

gem install bundler [--pre]
bundle update --bundler=4.0.20

RubyGems Release Notes

Enhancements:

• Print a release notes link instead of the whole changelog on gem update --system. Pull request #9794 by hsbt
• Installs bundler 4.0.20 as a default gem.

Bug fixes:

• Only coerce exact true and false gemrc values to booleans. Pull request #9822 by hsbt
• Make the gem CLI work under RUBY_BOX=1. Pull request #9810 by hsbt

Documen…

Welcome to week three of our 2026 sponsorship drive!

Progress from week two

We received two one-time individual contributions and one new monthly individual sponsor since our last update, bringing us another $760 closer to our goal for 2026. (I’m basing these estimates on monthly sponsors sticking with us for at least 12 months — we’ll do everything we can along the way to show how your support is helping!)

This puts us at $3.1k out of the additional $15k we’re looking to raise. Please continue to spread the word about our goals and our fundraising, every bit counts!

Q&A with Carolyn Cole

This week we’re lucky to have Carolyn Cole join us for a Q&A!

Carolyn works at Princeton…

Frequently Played 🔗

I tend to listen to the same songs or albums on repeat that are evocative of how I’m feeling or what’s going on with me. Here is what I’m currently listening to over, and over, and over, and over, again.

Jolene 🔗

Thanks for the name Dolly. And for modeling how to be yourself without compromising yourself.

Full Lyrics

I had to have this talk with you
My happiness depends on you

Gasoline 🔗

This is a pretty good collection of Halsey’s summer tour performances.

Full Lyrics

I think there’s a flaw in my code
These voices won’t leave me alone
Well my heart is gold and my hands are cold

It’s been 8 years since the first just-in-time compiler was introduced in Ruby. However, throughout this time, the garbage collector has been a black box to the JIT compilers. This meant that JIT compilers were not able to optimize any object allocations and instead had to perform function calls. This has all changed now that we have integration of the GC fastpath into ZJIT. In this article, we’ll be looking at how object allocations work in the GC, what it means to inline the GC fastpath into ZJIT, and the performance implications.

Object Allocation

In Ruby’s default GC, object allocations previously used a free list based allocator. The free list allocator keeps a linked list of all…

You approved an APM tool at a modest monthly rate. A year later, the renewal invoice bears little resemblance to what you signed, and nobody remembers deciding to spend that much more.

APM is worth having when it’s used well: it resolves incidents faster by showing you where in the stack a problem started, it gives you warning before a threshold alert turns into an outage, and it gives you a defensible answer when a client or stakeholder asks whether you hit your SLA (often measured through percentile response times like p95 and p99). None of that is in question here. What tends to go unexamined is whether the bill still matches what you’re getting for it.

In this article, we’ll walk…

Eddie Galindo is an engineering lead at Ascend and Kagen Hearn is a senior software engineer there, working on a Rails app that helps insurance agencies move and reconcile money.

Robby, Eddie, and Kagen get into why Ascend still runs one Rails monolith five years in, what needed attention when much larger customers started arriving, and how the team went about finding the real limits of their data ingestion pipeline. They also get into feature flags versus database configuration, and where AI tooling fits in when the software you ship moves money.

Links:

• Ascend

Listen to this episode (1h 24m) or subscribe to On Rails in your podcast player.

Tracing helps answer an important question: what happened? But knowing what happened isn’t the same as knowing whether it was any good. That’s where evaluation comes in. And if you already have traces running in production, you’re closer to a solid evaluation system than you might think.

In this post, we’ll walk through the core evaluation loop, how to build an evaluation dataset from production traces, and how to use evaluation signals to debug and improve your application.

Introduction

In the previous post, we explored the foundations of LLM observability and tracing. We discussed how traces give you visibility into your LLM application by capturing the full sequence of events across…

Ruby 4.0 was released on December 25, 2025, and three features get cited most often when people talk about it: ZJIT, Ruby Box, and a reworked Ractor API.

Two of those three features are experiments you have to turn on deliberately. The third one removes methods.

In this article, we will go through what ZJIT, Ruby Box, and the new Ractor::Port API actually do, and which of them can force you to change code when you move from Ruby 3.4 to 4.0.

ZJIT

ZJIT is a new just-in-time compiler, described in the Ruby 4.0.0 release announcement as the next generation of YJIT and built by the same team. You enable it with the --zjit command line flag, at runtime with RubyVM::ZJIT.enable or even…

Ten checks that catch what AI-written frontend code hides: contract codegen, boundary linting, mutation testing, and dead-code detectors.

Ten thousand lines of code in a week used to mean a team. With that team came institutional memory, and every bit of code had a person who knew why it looked as it did. Now one "person" can put out ten thousand lines in a week. But our new "co-authors" don't remember what we agreed yesterday, don't have to answer for production, and won't be around in six months to explain their…

A couple of years ago, we rewrote Judoscale’s marketing site from NextJS to Ruby on Rails. I enjoyed the process so much that I made a video sharing how it worked, and Jon wrote a spicy piece arguing that Rails was a perfect fit for mostly-static marketing sites like ours, and that you shouldn’t waste your time with JavaScript frameworks that were all the rage at the time.

A lot has changed since then (duh!), and I wanted to revisit this topic to share my current take. Jon’s gonna chime in later with his take as a bit of a rebuttal. It’s healthy to disagree, but rare to see it in a blog post. Let us know what you think of the format!

Adam’s take

I recently built a new…

Active Admin does a lot of heavy lifting on Rails projects, providing a nice way to quickly build out an admin backend for your application. One thing it does is try to be clever with deciding on the name for a model.

You might have noticed if you just mention a model, and that model has a name method or attribute, that Active Admin will automatically pick that up.

On some projects you want some additional control over this, because maybe name should be a formatted version, but other parts of your app need something else. Active Admin gives us a few ways to address this.

Use display_name

Active Admin will default to looking to see if the model responds to display_name first, which we…

On a recent project we needed Active Admin to show a dropdown box that automatically updated depending on other selections happening on a form. This isn’t supported out of the box by Active Admin, but is quick to add yourself.

Bonus points, we get to use jQuery!

Create a new controller action to handle filtering

You have a number of choices for how you go about this, exactly where you place this Controller and/or Action will depend on what makes sense for your project. In our project it made the most sense to have an AdminFiltersController controller. Which would house all of our filters. Other projects will prefer to keep these Actions tied to the model you’re acting on.

The specifics…

For the last several months, I've been incredibly busy. With our former executive director's departure, I've picked up extra work supporting the board and staff, especially in preparing for RubyConf.

Two years ago, when I stepped into this role, I started by observing where we stood as operators of RubyGems. A few gaps jumped out at me: lack of governance, no formal policies, and thin internal documentation. These weren't just nice to haves; I flagged them as critical from the start. What I didn't see yet was that they were also the backbone of a strong software foundation. That realization led me to a bigger question: what would it take to close the gaps standing between us and becoming one?

This is gonna sound bitter, but hey. I take my whisky neat.

Why has it become a thing that people must use social media to give commencement speeches about every · fucking · thing in their life?

To be clear, I have nothing against you soaring through your personal growth in a permanent state of child-like wonder like the absolute Peter Pan you are, learning profound wisdoms from every new shape of eye floater you’ve rubbed into your retina. Be you, king. But holy hell, why has it become the rite of passage for every clown promoting something to share daily life lessons on social media?

A daily, unstoppable firehose of something that should by definition… take a while.

I pooped today.…

We are all juniors again

A long, long time ago, when Akinator was the peak of “advanced AI” on the internet, before services became micro, and deployments meant sending a file directly from a local computer via FTP to a server, I was introduced to the Dreyfus Skill Model. As a junior dev back then, I liked it because it explained why my senior and architect colleagues could sometimes make impactful decisions intuitively, while I, on the contrary, was expecting step-by-step instructions on how to convert HTML form input into a database row.

In short, the Dreyfus Skill Model describes that when learning a new skill, a learner goes through 5 stages to acquire it:

1. Novice. We need/expect…

Direct link to podcast audio file

The summer heat has finally broken here in Shizuoka, and I'm enjoying a cool, wet, and cloudy day huddled around my microphone for warmth. I hope you'll join around my verbal campfire for yet another one of these.

As always, you can e-mail the show at podcast@searls.co. Only a small proportion of listeners will ever write an e-mail, so I now offer a second option: the justin.searls.co/feedback form. People love filling out forms! Go try it out! Check the anonymous checkbox! Hell, enter a fake e-mail address—see if I care!

Stuff we talked about, in order of me talking about them:

• A TV commercial for the Famicom Disk System
  • Also, the animation that…

Two Puma workers try to assign the same user to the same customer account.

One request comes from an administrator. The other comes from an invitation acceptance that reached another process at nearly the same time. Both use the ordinary Active Record lifecycle, and both records pass validation.

A later query finds two active seat assignments:

SeatAssignment.where(account_id: 42, user_id: 7).count
# => 2

The model appears to prohibit that state:

class SeatAssignment < ApplicationRecord
  belongs_to :account
  belongs_to :user

  validates :user_id, uniqueness: { scope: :account_id }
end

Nothing skipped validation. Neither write used update_all, insert_all, or raw SQL. Each worker asked the…

Finally figured out a bulletproof system for landing on the best model for the job.

distance_of_time_in_words is a small Ruby gem that turns two Time objects into a human-readable string like “3 days and 4 hours”. Two separate bug reports against it this year turned out to be variations on the same theme: computing a duration between two timestamps is not the trivial subtraction it looks like, the moment time zones are involved. Both fixes shipped in dotiw 5.6.0.

Bug 1: dst? Lies When You Least Expect It

#63 reported that a duration of one minute was rendered as “less than 1 second” for users in Europe/Dublin. The gem’s TimeHash had a DST correction that looked reasonable:

d = largest - smallest
d -= 1.hour if smallest.dst? && !largest.dst?
d += 1.hour if !smallest.dst? …

The idea: if a DST transition happened between the two times, T…

Shopping for an anonymous VPN service is so weird because all the marketing and all the reviews are like DO YOU WANT TO DO CRIMES? DO YOU WANT TO DO DOUBLE SECRET CRIMES? DO YOU WANT YOUR PACKETS TO COME FROM THE MOON? DO YOU WANT TO DO MOON CRIMES WHILE WE PROJECT A PLAUSIBLE HOLOGRAM OF YOU IN TIMES SQUARE? DO YOU WANT NO LOGS OF YOUR CRIMES? DO YOU WANT US TO ERASE THE GOVERNMENT WHEN THEY ASK FOR YOUR LOGS?

And here I am just wanting decently fast secure connections from coffee shop wifi without every website being like “um, your IP is listed in our database as ‘MOONCRIME6’, are you sure you aren’t a crimebot?”

Hi, it’s Greg. Let’s explore this week’s changes in the Rails codebase.

Agents on Rails: lemans goes open source
Another week, another update from Agents on Rails. This one is a big one: lemans, the harness behind every number we’ve published, is now open source. Also four new models were added: Sonnet 5, Terra, an open-weight Qwen you can run on your own machine, and one that won’t tell us its name.

Actionpack ractorize
This Pull Request changes the following:

• Make ActionDispatch::ParamBuilder.default ractor safe by using singleton class attr accessor.
• Make ActionDispatch::Request::LOCALHOST ractor safe by freezing the regex.
• Make ActionDispatch::Response.default_charset and Acti…

Additionally, prefixed partial names were made ractor safe and reset_primary_key was also made ractor compatible.

Add…

Replacing a business-critical legacy system does not have to mean committing to a risky, all-at-once rewrite. The strangler fig pattern offers a practical alternative: migrate one capability at a time, run the old and new systems side by side, and gradually retire the legacy code as each replacement is validated. This post walks through how it works, where it fits, and a practical Rails-based example of migrating one piece of functionality without stopping the business to do it.

The Problem: A Business-Critical System You’re Afraid to Touch

Most organizations don’t wake up one day and decide to replace a legacy system. It happens gradually, as the cost and risk of maintaining the system…

Andrew and David catch up on everything from wild weather and the upcoming Rails World conference to Andrew’s latest deep dive into MCPs (Model Context Protocols). Andrew shares what he’s learned while building an MCP for a Rails side project, including choosing the official Ruby MCP SDK, discovering the limitations of resources versus tools, and wrestling with OAuth and Doorkeeper authorization. They also look ahead to Rails World in Austin, highlighting talks on Active Search, Ractors, Herb, Action Text, Solid Cable, custom Rails generators, and appropriately enough MCPs. 

Links:

Chris Oliver X

Andrew Mason Bluesky

David Hill LinkedIn

Judoscale- Remote Ruby listener gift

The Ruby on Rails…

Strip any agent framework down and you find the same loop: call the model, run the tools it asked for, call the model again, stop when it answers without wanting a tool. In RubyLLM 1.x that loop lived inside ask, sealed. In RubyLLM 2.0, you can also make it yours.

# Run the agentic loop automatically
chat = RubyLLM.chat(model: "claude-sonnet-4-6")
  .with_tools(Weather)
  .ask("What's the weather in Paris?")
# => #<RubyLLM::Message role: :assistant, content: "Here's the current...

# Run the agentic loop manually
chat = RubyLLM.chat(model: "claude-sonnet-4-6")
  .with_tools(Weather)
  .ask_later("What's the weather in Paris?")

chat.step until chat.complete?  # generate, run_tools,…

Thinking of applying to next year's RubyConf Scholars and Guides program? Read on to hear from this year's Scholars about what it was like and why you should take the leap and apply!

Name:

Shuveksha Tuladhar

Professional Title:

Software Developer Apprentice

How did you get into Ruby? What's your Ruby story?

I started learning Ruby and Ruby on Rails through Code the Dream as part of my journey into software development. I enjoyed learning Ruby so much that it quickly became my natural language.

Are there any Ruby projects you're working on that you're excited about? Tell us all about it!

I am currently working on several Ruby projects, both at work and through personal projects. Ruby has become a…

I released kamal-backup 1.0 today.

Not because the backup command works. That part worked months ago.

I called it 1.0 because I used it to move Chat with Work, the application that pays my bills, to a new Hetzner instance. The old host took the backup. The new host restored it under a temporary hostname. I opened the real application, checked the real data and files, and only then moved DNS.

A backup is only real after you restore it.

The migration that made 1.0

The move found two bugs that a green backup log never could.

First, a fresh backup accessory on the new host could start its schedule before the restore and write a perfectly valid, completely empty snapshot into the same…

RubyLLM 2.0 is almost ready. It isn’t out yet, but it will be soon, and I have been looking forward to showing you what is in it.

There is a lot in this release. Too much for one enormous announcement, and most of it deserves more than a bullet point. So this is the first in a series of posts about what’s coming in RubyLLM 2.0.

Let’s start with providers and protocols.

In 2.0, OpenAI uses the Responses API by default. Providers and protocols are separate things. Four new providers bring the total to seventeen. And if the provider you need is still missing, a new generator gives you a complete provider gem to start from.

RubyLLM.chat(model: 'gpt-5.4')                              #…

A table with 200 rows and 5 action icons per row. That’s 1,000 inline SVGs dropped into your HTML. When does that start to impact your performance?

By default, Rails Icons renders each icon as a full <svg> element. Fine for a handful of icons. But at scale, it adds up.

I built a simple benchmark to measure exactly how much (feel free to fork and improve ❤️). Two pages, identical layout, 1,000 icons each. One uses inline SVGs you use and love. The other uses an SVG sprite you will surely start to love after reading this. 😬

The benchmark is on GitHub.

How SVG sprites work

A SVG sprite is a single file (but can also be embedded) with multiple icon definitions wrapped in <symbol> tags:

<svg…

As of last week, I’ve been working at Fat Zebra for 5 years. (To celebrate, I caught up with my cardiologist.) In about a year and a half, it’ll be double the amount of time that I’ve worked anywhere else. So I think that has to count for something in both Fat Zebra’s favour and my own.

This week I was given some big news:

1. The powers that be want to restructure my team
2. This means the Tech Lead of Customer Experience role is now redundant
3. BUT! I’ve received an offer to go work as an individual contributor in a different, very cool team
4. Bonus: no pay cut.

Ironically, I was wearing my “This is actually my second rodeo” t-shirt while I received my second ever redundancy offer. But…

Two vulnerabilities have been discovered in the resolv gem bundled with Ruby. They have been assigned the CVE identifiers CVE-2026-80212 and CVE-2026-80213. We recommend upgrading the resolv gem.

CVE-2026-80212: Memory exhaustion through malicious DNS responses

An application that resolves a hostname an attacker can influence, such as a webhook target or a user-supplied URL, can be made to consume memory without bound. The attacker points a domain at a name server they control and returns responses that the library retains permanently. Repeated lookups grow the process until it runs out of memory and the service stops.

CVE-2026-80213: Hostname validation bypass

An application that…

A Portland high school student asked our CEO how this all started. Here's the short version, plus what we're up to now.

Continue Reading

I joined Chris on The Hallway Track to talk about running Box Out Sports, Fireside, and Flipper while still maintaining open source projects like HTTParty.

We covered a lot of ground in 50 minutes: why I gave up trying to focus, the production problem that led to Flipper, how feature flags change the way teams build software, and why taste might be the real advantage in the AI era.

Some of the highlights:

Giving Up on Focus. I spent years feeling like I was broken because I couldn’t focus on one thing. Everyone tells you focus is how you do something big and great, but I like having a lot of things going. If I get jammed on one project, I can switch to the next most important thing on…

The SF Ruby Startup Conference is an engineers' conference: meet the people building Ruby open source, scaling Rails in production, and shaping what agentic Rails looks like next.

It's the "SF Ruby Startup Conference", but let's make something clear up front: this is a conference for engineers. The program is built for people who write and read Ruby, and founders are coming here to see those people. The lineup goes from seed-stage founders to the engineers keeping Shopify's monolith up. But the community…

Local Ruby communities don’t simply happen—they need people willing to create the connections that keep them alive.

David sits down with Chicago Ruby co-organizers Anton Tkachov and Michelle Yuen to talk about rebuilding and growing a local Ruby meetup. Anton breaks a meetup down into three essential pieces (attendees, speakers, and venues) and explains why, if you’re starting from scratch, the community itself matters more than anything else. He and Michelle share practical lessons from finding companies willing to host events, recruiting speakers, and creating opportunities for Rubyists to meet one another face-to-face.

That kind of personal connection may be more valuable than…

[Translator's note: buffet dining is often referred to as バイキング ("Viking") in Japan. Here's why.]

Over the past 15 years, Japan had gradually improved the accuracy and quality of English language signs and guidance. This is despite a precipitous drop in domestic English language proficiency. Rather, Engrish began to disappear from all but the most far flung corners of the country thanks to the proliferation of fully remote, easy-to-contract human translation services.

However, thanks to the mainstreaming of LLM chatbots and the weakening of the yen, businesses have opted to save time and money by asking Gemini and ChatGPT ("Chappie") to translate sentences and images out of context. As…

I was trying to describe what working on code with AI while *all this* [waves vaguely] is going on. What came to mind is: imagine spending a couple years in the desert learning to harness petroleum to power tractors and cranes. Then you visit the big city, and everyone is putting crude oil in their hair and on their pizza and using it for sex.

Chris Oliver asked on LinkedIn:

Spotted this in the Rails source today. The trailing comma made me think it was a typo at first glance but it uses the $, global variable for nil instead of nil directly. Anyone know the reason for this?

I left a comment there, but I wanted to preserve it here as well:

There is no “global variable for nil”. $, is the “output field separator”. Known as OFS in AWK, it is known shorthand-mnemonically as $, in both Perl and Ruby – the mnemonic being that “comma” is a very common output field separator (think: comma-separated values). The default value of “nil” simply means “no separator”. But setting it to something else can be quite useful!

Fo…

Our Rails AI assistant had read-only SQL access and could still return peer review scores. Learn how we kept open-ended analytics in an in-app AI assistant while making database access honor application permissions.

Our internal Rails app has an AI assistant with read-only SQL access to the database. But when asked for active peer review assignments, it returned written feedback, scores, and a column of reviewer names the question never mentioned. Read-only protected data from being changed, but it told us nothing about who was allowed to read…

It’s common to see a Rails app using React to handle front-end interactions, with a Redux store that mostly mirrors the database and react-router re-declaring routes Rails already knows about. React does its job well enough, but every user-facing feature now costs twice, once in Ruby and once in JavaScript.

So eventually the question will appear: what would it take to delete all of this and use a Rails-way solution like Hotwire? The honest answer is “it depends.” In this article, we will go through what the code difference actually looks like, what you can expect from bundle size, which pain points to plan for, and how to scope the work before committing to it.

The code difference

Crea…

Another week, another step for Agents on Rails. This one is a big one: lemans, the harness behind every number we’ve published, is now open source. We also ran four new models: Sonnet 5, Terra, an open-weight Qwen you can run on your own machine, and one that won’t tell us its name.

If you’re here for the ride, read on for the tour of lemans. If you’re here for the scores, they’re on the leaderboard, and the raw runs are updated too.

Four new models, and one of them has no name

Qwen 3.8-27B is the one we (and many of you) were most curious about: it’s open weight and small enough to run on hardware you may already own. Should you ditch your cloud LLM subscriptions and go #supportlocal?…

A support team suspends 37 accounts after a credential leak. The operation reports that all 27 rows changed, and a fresh query confirms that each account is now suspended.

The rest of the application tells a less tidy story. The audit screen has no suspension entries. updated_at still points to work performed hours earlier. Code that loaded the same accounts before the operation continues to see them as active.

Those are operational differences, not cosmetic ones. The missing audit row leaves the incident timeline incomplete, while an authorization check that reuses one of those loaded objects can still make a decision from active after the database has suspended the account.

Nothing raised,…

Hi, it’s Claudio Baccigalupo. Let’s explore this week’s changes in the Rails codebase.

Add –no-banner to bin/rails console
I love seeing the Rails logo when I run the console. If you disagree, bin/rails console --no-banner will remove it for you.

Add support for the HTTP QUERY method
ActionDispatch::Request gets the RFC10008 constant appended to HTTP_METHODS, plus a query? predicate.

Keep the relation scope in Relation#update
update and update! now respect the scope of the Active Record Relation. This is a breaking change: relation.update(ids, …) called with an id outside the relation used to update the record and now raises RecordNotFound.

Join an Array accept in file_field_tag
Passing…

Ernesto Tagwerker joins Chris, Andrew, and David, to talk about how AI is changing Rails development, consulting, and the way teams approach upgrades and maintenance. They discuss using Claude Code for Rails upgrades, the risks of relying too heavily on AI-generated tests and code, and why strong development standards are becoming even more important. The conversation also explores code quality, open AI models, team consistency, and how developers can use AI to work more efficiently without giving up the experience and judgment that good software still requires. Start listening now! 

Links

• Chris Oliver X
• Andrew Mason Bluesky
• David Hill LinkedIn
• Judoscale- Remote Ruby listener gift
• Ernesto…

Here at FastRuby.io we work with test suites and test coverage reports every single day, given our specialty. In the Ruby world that means we interact with SimpleCov every day. Not only that, we explicitely rely on SimpleCov reports in two of the open source projects we maintain, RubyCritic and Skunk.

Which is why, after more than a decade at 0.x, we were super excited to see SimpleCov ship its first stable release on July 12, 2026. In this article we’d like to share the details on the breaking changes, the deprecations and how to address them, if you’re impacted by them.

Everything below refers only to the 1.0.0 entry in the changelog.

Also, it’s worth noting that the minimum required…

The Scholars & Guides Program is one of Ruby Central's most direct expressions of what this community is built on. The program pairs aspiring Rubyists from underrepresented communities with experienced mentors, called Guides, to help them navigate RubyConf, grow as developers, and find their footing in a community that genuinely wants to see them thrive.

Rubyists know by heart: Matz is nice and so we are nice, or MINASWAN. It flows directly from the philosophy Yukihiro "Matz" Matsumoto embedded into Ruby itself. Ruby exists to make developers as productive as possible, and that productivity is only possible when the community surrounding it keeps bringing in fresh minds, new perspectives,…

Ever wondered how to build those interactive product tours that spotlight elements and walk users through your app? Ever wondered how you could with just roughly 100 lines of JS and modern CSS? Wonder now more, I will show and it will look like this:

Yes, just around 100 LoC 🤯

I built one using CSS Anchor Positioning and a Stimulus controller. The approach uses two techniques worth talking about: a clip-path spotlight effect (useful in all sorts of contexts) and CSS anchor positioning for the dialog (still very new as of mid-2026).

The full code, as always, is on GitHub.

The clip-path trick

The overlay covers the viewport with a semi-transparent background. But instead of sitting on top…

A Bag of Bolts

So, a few weeks ago, I went to the hardware store to buy some casters and the hardware to mount them to a couple of cabinets. To save a few bucks, I decided to buy the hardware from the bulk bins. But, as I began filling my bag, I quickly noticed that not every bolt in the bin was the same size. Most of the bolts matched the label. But, some had clearly been misplaced.

Having experienced what it is like to make 2 or 3 trips to the hardware store to finish a project, I decided to pad my quantities by 10%, to mitigate the risk that I would need to…

More and more code is written by a model. Tests still tell you it works. RuboCop still tells you it’s tidy. Nothing tells you it still follows your architecture.

I released ArchSpec 1.0 today. It’s an architecture linter for Ruby and Rails. You declare your components and boundaries in one file, and every change gets checked, whether a person or an agent wrote it.

This is part of my push towards making Ruby one of the best languages to build with AI. RubyLLM is one piece. Schematist is another. Making the default Rails job queue fiber-based is another.

People and AIs take shortcuts

An agent or a person that’s in a hurry or doesn’t fully understand your architecture takes shortcuts.

The…

RubyGems 4.0.19 includes enhancements, bug fixes and documentation and Bundler 4.0.19 includes enhancements, bug fixes and documentation.

To update to the latest RubyGems you can run:

gem update --system [--pre]

To update to the latest Bundler you can run:

gem install bundler [--pre]
bundle update --bundler=4.0.19

RubyGems Release Notes

Enhancements:

• Reject SafeMarshal collection lengths longer than the remaining input. Pull request #9756 by hsbt
• Installs bundler 4.0.19 as a default gem.

Bug fixes:

• Fix gem uninstall –user-install crash when GEM_HOME does not exist. Pull request #9749 by hsbt

Documentation:

• Document SPDX license handling for license= and licenses=.…

Some parts of the book went way over my head, but I read it and re-read it. I wrote my first Shoes app, my first camping app¹. This led me to attend my first conference and user group, my first Chaos Communication Congress, join my first open-source project, start my first podcast, and organize my own CoderDojo. I made friends for life through all of that. And _why‘s whimsical book lit that fire². That‘s why I have a quote from him on my about page that I try to follow and sometimes do.

Today is _why day. „On 19 August 2009, _why’s accounts on Twitter and GitHub and his personally maintained websites went offline.“. Someone doxxed the person behind the artistic figure, so the artistic…

Halunke

In 2018, I invented and…

In my previous post, AI Assistant for Our Blog Writing Process, I introduced the assistant we built to help with our blog writing. It has two pieces: an MCP (Model Context Protocol) server that holds the source of truth for our two blogs, and a Claude Code plugin that turns that information into workflows for suggesting topics, planning a post, drafting it and reviewing it.

That post was about deciding what to build. This one is about building it. We’ll go through the ingestion pipeline that gets our posts into a database, the embeddings that make the corpus searchable by meaning, the MCP server that exposes all of it, and the plugin that packages the workflows on top.

The stack

The…

Rails boot time is a DX metric in the AI age: meet require-profiler, learn to actually read sampling profilers, and see the pit stop that cut a 200-component monolith's boot by 40%.

Every Rails app race starts the same: load code, read config, then the green flag. But the bigger the app, the more startup drags on deploys, CI, and developer patience. This is doubly so as AI agents boot your app far more often than humans do. Thus, meet require-profiler, a new one-stop profiler for Ruby's code loading process! Grab it first when optimizing…

Welcome to week two of our 2026 sponsorship drive!

Progress from week one

We’ve had a great response since we kicked things off last week: we’ve had ten new individuals join as sponsors! If everyone sticks around for a year (we’ll make it worthwhile, I promise!), that will amount to a full $2,400 towards our goal.

Thank you to our new supporters for proving there’s power in numbers!

We’d love to see more individuals get behind us, and if we can find 2-3 new businesses to join as supporters, we’ll get very close to being able to offer a first-time honorarium to our active maintainers. Learn more here.

Q&A with Pat

As a little treat this year, we’re bringing you Q&As from leading Hanakai…

Sometimes the best conference conversations start with a weird idea.

Rachael Wright-Munn and Andy Andrea join me to revisit a moment at RubyConf when Andy's experiment with schemas and MCP tools collided with a problem Rachel had been trying to solve for Ruby Events: how to make Rails generators easily accessible to AI.

What started as an excited post-talk conversation quickly became an in-person pair programming session, and eventually working MCP tooling that Rachel now uses to maintain Ruby Events. The result has reduced some event updates from more than an hour of manual work to roughly 10–15 minutes.

They dig into how MCP tools work, why wrapping deterministic Rails…

Earlier this summer, I heard from Ojal Kulkarni, a local high school student who found Planet Argon through the Portland Startup Community Slack. Her summer project was interviewing local business owners and entrepreneurs.

We’d never met before, but a few weeks later we spent an hour on a Saturday morning talking about how Planet Argon got started, what I’ve learned from running a business for 24 years, and how AI is changing the way I think about software and experimentation.

One part I especially enjoyed was revisiting how I learned to build software in the first place. I wasn’t trying to become a programmer. I wanted to sell stickers on the internet, so I kept learning whatever I…

Version 6.2.0 of the Passenger application server has been released. This release addresses several NGINX vulnerabilities for deployments utilizing the bundled NGINX server (CVE-2026-42533, CVE-2026-60005, CVE-2026-56434) and one in Passenger itself with a pending CVE number. Additionally this release improves compatibility with FreeBSD.

Passenger Vulnerability

We have seen exploitation of this vulnerability in the wild at a shared hosting provider. Please upgrade as soon as possible, especially users that run Passenger as root and allow untrusted users to run arbitrary processes (i.e. multi-tenant deployments) are susceptible to attack.

If you do not run Passenger as root and your systems do…

Joanna Wang is a senior software engineer at Sixfold, where the team builds AI underwriting tools that help insurance companies gather data and assess risk. She came to Ruby on Rails after working across Java, Go, Python, and Node.

Robby and Joanna get into why the homegrown orchestration they built on state machines and callbacks turned brittle, what moving to Hatchet changed, and the tradeoffs of leaning on a gem that is no longer maintained. They also talk about what happened when the team went fully agentic, and why Rails magic is easier to understand when an agent can trace it for you.

Links:

• Sixfold
• Hatchet

Listen to this episode (43m) or subscribe to On Rails in your podcast…

When I first started thinking about private gem distribution, I approached the problem the way I always do, backward from bundle install. What does a developer need to make that command succeed for a private library? Three things: a source (URL or repo), credentials that work in CI and locally, and a reliable way to receive updates without breaking deployments.

Not all code belongs on RubyGems.org, and that’s okay. Sometimes the goal is internal reuse- sharing an SDK or auth client across services. Sometimes it’s a business model: you ship a private gem behind a license. Either way, the constraints are the same: authentication, delivery, and trust.

In this blog post, we’ll give an…

Way back in 2008 I started a site to track military reading lists. I needed something for searching, and I was most familiar with Sphinx, so, that's what I used.

Sphinx served me well over the last 18 years. But it runs as a separate process, and it felt like overkill to have an additional architectural component since I only have about 3000 books in the database. And PostgreSQL has a perfectly good full-text-search capability with a nice Ruby integration in pg_search. So, time to make the switch!

This article from Daniela Baron was really helpful on how to make the cutover. She was spot-on with her explaination of how calculating vectors on the fly just is too …

Last week we launched Agents on Rails and published the first benchmark report. The response was immediate: suggestions, questions, model requests, and more than a few “but have you tried…” messages. We love the enthusiasm! We want this benchmark to be useful to you, so for this run we added four new models, updated the insights, and uploaded the full traces of the first two rounds (every command, diff, and verdict).

Read on for the new results, check the updated leaderboard, or go straight to the raw runs.

But first: effort levels

We got asked this a lot and it is written in the methodology, but in case you missed it: All models were run at their provider’s default effort level.

Four…

I’m thrilled to be part of the program for Rocky Mountain Ruby 2026 in Boulder, Colorado.

I’ll be speaking about…LLMs? I hope you can join us!

InstiLLMent of Successful Practices in an Agentic World 🔗

Congrats on joining Hours Unlimited. The Math and Numbers team is excited to have you join us on our journey to redefine the importance of numerals. This introductory session will provide tips and tricks for best interacting with powerfuLLMachine, the next-level platform we use to unlock productivity and effectiveness.

Why some of us are still bothered about the way we write tests and what the “matcher” concept has to do with it.

During most of my Ruby career, I was that unpleasant person who honestly enjoys writing tests and is frequently concerned about the ways we write them.

This means treating unit tests like the rest of the codebase: like something that is supposed to be read by humans and something that should be written efficiently and expressively. Basically, like something that wouldn’t be boring and disgusting to read and write.

This also means that I find it useful, once in a while, to stop and reflect on why we write test code the way we write it. And can this be improved?

Let’s move…

A new account reaches the job queue before it reaches the rest of the database.

That sounds impossible the first time you see it. The account has an ID. The request log contains a successful INSERT. Yet a worker starting at almost the same moment raises ActiveRecord::RecordNotFound, and retrying the job a second later usually works.

Callbacks let an application react to persistence without putting every consequence in a controller or service object:

• before_validation

• after_validation

• before_save

• after_save

• after_commit

Read from top to bottom, this looks like one lifecycle with after_commit at the far end. For a save that opens and closes its own transaction, that picture is close enough. It breaks…