WhereIsWaldo::ApplicationCable::Connection (the gem's built-in ActionCable
connection) authenticated the connection from `request.params[:subject_id]`
whenever no `authenticate_proc` was configured. Because request params are
client-controlled, a client could connect with `?subject_id=` and be
authenticated as that subject, enabling impersonation and cross-account
presence-roster disclosure (authentication bypass by spoofing, CWE-290).
Only applications that mount the built-in connection without configuring
`authenticate_proc` are affected; applications that supply their own
authenticated ActionCable connection (e.g. deriving current_user from a
verified JWT) or configure…
This is a followup to my recent lightning talk and
writeup about i18n in Rails and how it can be useful
even when we’re not translating our applications.
In the talk and writeup I describe how we can change the Active Record error message
format
from the default of "%{attribute} %{message}" and drop the attribute prefix, giving us more flexibility in how we
phrase our error messages. The downside to this is that it results in the default Rails error
messages being output as
incomplete sentences. It’s since occurred to me that it’s possible to avoid this by replicating the default
validation error messages in our app’s locale file with the attribute prefix as part of the message, rather…
So we end up with a locale file that looks something like this:
# app/config/locales/en.yml
en:
…
This is mostly a transcript of my recent lightning talk on i18n in
Rails, go watch that if you prefer your content in video form.
Otherwise read on to find out why I believe understanding i18n in Rails can be useful to you, a Rails developer, even if
you’re not translating your applications into other languages.
I’m going to share ten things I think are interesting in i18n, and explain how we can take advantage of them in our
single language app code. But first a brief primer on i18n…
What actually is i18n?
i18n is shorthand for Internationalisation When we’re talking about i18n, it’s useful to understand the difference
between Internationalisation and Localisation:
When I joined Cheddar I was pleasantly surprised to find a sharp, mostly minimalist development culture which was a pleasant departure from the ZIRP-era “platform and team sprawl” that was in full bloom at WeTransfer.
The mostly-Shopify-inspired mindset - the Shopify of roughly 2012-2014, when Bouke and Tariq were there, long before the sharded-the-world Shopify of today - was extremely poignant and felt like a breath of fresh air:
- Let’s not have services, at most - we’ll have 2
- Let’s not have Kubernetes and use GCP native VM scaling instead
- Let’s not have frontend bundling of any kind and rely on Rails builtins for any internal web plumbing
Since then I took this approach to…
Happy Friday, this is Greg, bringing you the latest news from the Rails world.
A Rails anniversary!
Today is the 22nd anniversary of the first public release of Ruby on Rails!
Learn from real, open-source Rails apps
On the Rails website, now you can find a small, hand-picked library of
exemplary open-source apps worth reading to see how production-quality Rails is
built today.
Update the JavaScript in Rails guide
The updated JavaScript in Rails guide is ready for community review!
Preserve sub-second precision when subtracting a DateTime from a Time
This pull request makes sure that sub-second precision is preserved when subtracting a DateTime from a Time.
Time - DateTime converted…
Ruby Argentina met on July 23 at La Maquinita Innovation Lab in Buenos Aires. The night brought together two questions that tend to surface once an application (or a development workflow) gets serious: what does a convenient default cost us later, and what should we refuse to delegate?
The cost of being unique
Santiago Merlo from Rootstrap opened with “El costo de ser único” (“The cost of being unique”), a close look at what choosing a UUID as a PostgreSQL primary key actually changes.
UUIDs are useful when an identifier must be generated independently or when sequential IDs should not be exposed. But they are not free. Compared with a bigint, they take more space in tables and…
Today we’re adding a new page to the Ruby on Rails website: Reference Apps. This is a small, hand-picked library of real, open-source Rails applications worth studying.
Documentation can only show you so much. Sometimes it’s better to just crack open the lid and go straight to the source to see how a real, production-quality Rails application is built. That’s harder to do well when there’s no curated starting point, so that’s what this library is meant to be.
Each entry links out to the full source so you can read the real thing: how the models are shaped, how a controller stays thin, how Turbo Streams actually get wired up, the full commit history, and all the small decisions made along…
Creation is now near-free. Verification/understanding is not, yet. It’s time to engineer away the slop.
Geoffrey Huntley: Engineer Away the Slop
A Deep Dive into GitHub Actions
This week, Andrew and Chris swap stories from the front lines of Ruby development, from wrangling GitHub Actions and speeding up CI to keeping old Ruby versions alive on brand-new servers. They also unpack a tricky Sidekiq deployment issue, explore the promise of compiling Ruby apps into standalone executables, and reflect on how AI is making once-impossible infrastructure problems a little easier to solve. Hit download now to hear more!
Links
HoneybadgerHoneybadger is an application health monitoring tool built by…
Rails 8 ships with Kamal 2 pre-configured,
so every new app can deploy to any Linux server with zero downtime
and automatic SSL — no PaaS required.
Many teams pay for expensive Platform-as-a-Service solutions
just to avoid managing deployments themselves.
Rails 8 removes that trade-off.
What is Kamal?
Kamal is a deployment tool developed by
37signals
that uses Docker containers to deploy web applications.
It can turn a fresh Linux box into a production ready application server
with just a single command.
Before
Before Rails 8, setting up Kamal required manual installation
and configuration.
We had to install the gem:
gem install kamal
Or add it to the Gemfile:
# Gemfile
gem 'kamal',…
Th…
Most Rails developers have crossed paths with Rake (usually
to run a migration, seed a database, or clear out test data). If you’re like me, you may have
quietly filed Rake away under “that place where Rails keeps database tasks.” But Rake is far
more powerful than that.
It isn’t just a Rails helper: it’s a full-blown, general-purpose build
system, sitting quietly in your project, ready to automate almost anything. And the best part?
It speaks Ruby. That means, as a Rails developer, you’re already fluent in the language your
build tool understands. In this post, I want to open your eyes to the wider world of Rake, beyond
migrations and seeds, into using it as a central hub for building,…
#810 — July 23, 2026
Read on the Web
Ruby Weekly
🔒 RubyGems Revokes Legacy API Keys After Possible Cache Leak — A CDN caching bug, which has existed for years, could have served accounts' legacy API keys to other users. There's no evidence of malicious use, but it's worth affected owners checking their gems over nonetheless.
Colby Swandale (Ruby Central)
💡 Luke Marshall, from Truffle Security, discovered this bug and did a full technical writeup of how the bug could have been exploited.
All-in-One Ruby & Rails Monitoring — Errors + Performance — Track errors, N+1 queries, slow SQL, Sidekiq jobs, and host metrics —…
This is part 1 of a two-part series. Part 2, coming soon, will cover targets, actions and reactive values.
Yep, that text is programmatically added using a recreated Stimulus framework and a hello_world_controller.js
Stimulus is a modest JavaScript framework to sprinkle bits of interactivity. At its core it watches the DOM for elements with a data-controller attribute and connects them to JavaScript classes. When an element appears, a controller instance is created. When it disappears, the instance is cleaned up. That’s it. That’s the entire foundation.
I want to walk through how you can recreate Stimulus yourself to learn a few modern JavaScript features to have in your magic hat, you can…
Learn how Git worktrees keep multiple branches checked out in separate directories, reducing stashing and branch switching during reviews, hotfixes, rebases, and stacked pull requests.
Direct link to podcast audio file
The summer heat ended up thawing out my podcast, so I had no choice but to go buy a new microphone and grumble into it for a couple hours. Just how that works. Please enjoy.
I am actively soliciting mailbag participation. As always, the address is podcast@searls.co, and I'd be really curious to hear how America is doing because it seems like everything is going great.
For the first time I let Claude write these links for me, because it never occurred to me I didn't have to format the markdown manually:
A CDN caching bug on RubyGems.org could hand one account’s API key to another person for up to an hour. If you signed in to RubyGems.org with a gem client older than v3.2.0, your key could have been exposed (the technical details are below). Currently, 18% of sign-ins through gem signin come from an affected version, and for the first several years of this bug, before we changed the client’s sign-in path in December 2020, it was every gem client.
We’ve reviewed the access logs we keep and found no sign of a legacy key being used maliciously, and no user or support report has suggested otherwise. Those logs only cover a recent window, though, a small slice of the years this bug is estimated…
The JRuby community is pleased to announce the release of JRuby 10.1.1.0.
JRuby 10.1.x targets Ruby 4.0 compatibility.
Thank you to our contributors this release, you help keep JRuby moving forward! @chadlwilson, @kares, @katafrakt, @sampokuokkanen, @segiddins, @shugo
Notable Changes
Performance
- Use FastDoubleParser to improve performance of all string-to-double parsing. #9150
- Only pack fixnum values for 16-bit signed by default, with optional 8-bit and 32-bit configs. #9379
Standard Library
- jruby-openssl updated to 0.16.2 with several CVE fixes from BouncyCastle. #9386, #9504, #9539
- erb…
Native Integration
Since last year, we started using AI heavily for all kinds of tasks. What started as chatting to an agent to complete tasks later evolved into a more professional workflow doing Context Engineering and Spec-Driven Development. There are many SDD frameworks out there, but ultimately, after trying out a bunch of them, we opted for OpenSpec. OpenSpec felt like the simplest framework out there, one that aligned with our pre-AI-era workflow.
Quick intro
Spec-Driven Development is a methodology where a highly detailed, structured specification (a “spec”) is written before any code is generated. It acts as a single source of truth to guide AI coding assistants, ensuring the AI builds exactly…
While at RubyConf, I caught up with several attendees and volunteers to discuss their experiences. These quick interviews have been collected for this episode.
Our Guests
Charles Nutter
Miguel Filho
Cameron Dutro
Nico Roulston
RubyGems 4.0.17 includes enhancements and bug fixes and Bundler 4.0.17 includes enhancements, bug fixes and documentation.
To update to the latest RubyGems you can run:
gem update --system [--pre]
To update to the latest Bundler you can run:
gem install bundler [--pre]
bundle update --bundler=4.0.17
RubyGems Release Notes
Enhancements:
- Validate spec name before writing to the spec cache. Pull request #9690 by hsbt
- Installs bundler 4.0.17 as a default gem.
Bug fixes:
- Unquote Gem.ruby when spawning it as a separate argv element. Pull request #9695 by hsbt
- Escape glob metacharacters in install paths when globbing. Pull request #9687 by hsbt
- Preserve Windows editor paths…
Ruby May Finally Fix the Famous "Norway Problem" July 21, 2026 The Ruby ecosystem may soon take an important step toward modern YAML support. Hiroshi SHIBATA (hsbt), a Ruby core developer, has introduced an experimental backend for the Psych library based on libfyaml, bringing full YAML 1.2 compliance closer to Ruby. While this might sound … Continue reading Ruby May Finally Fix the Famous “Norway Problem” →
Hello! I’m on a funny journey right now where I’m trying to learn how to make
websites in a sort of 2010 style, where I have an SQL database and render some
HTML on the backend.
It’s kind of an interesting journey because it doesn’t necessarily feel “easy”
to me to make websites in this way: I never learned how to do it in the 2000s or
2010s, and there’s a lot I need to learn.
So here are some Django features that make building this kind of site feel
more achievable than when I was trying and failing to use Go’s standard library
or Flask. And I’ll talk about a couple of issues with Django I’ve run into.
why learn to make websites like it’s 2010?
Previously the toolkit I felt confident with…
RubyMine 2026.2 is out!
RubyMine 2026.2 introduces agentic debugging, native GitHub Copilot integration, AI completion with third-party providers, and symbol-based code insight enabled by default. You’ll also find improvements across the Ruby ecosystem and everyday IDE workflows.
You can download RubyMine 2026.2 from our website or update via the Toolbox App.
Let’s look at what’s new.
AI
Agentic debugging
Instead of manually stepping through your application, you can now ask an AI agent to investigate a problem using the RubyMine debugger.
Agentic debugging is powered by bundled skills – predefined workflows that give compatible AI agents access to IDE capabilities.…
This is the first in a series of Ruby Runway Spotlights, celebrating the founders who took part in the inaugural Ruby Runway Showcase at RubyConf 2026. Each spotlight is a chance to hear directly from the builders turning Ruby into real, live businesses, and to cheer them on as they keep going.
Tell us your name, your startup, and what it does in one or two sentences.
I am Paresh Sharma, founder of Viveture. Viveture connects pet owners with local sitters for pet care services.
What problem are you solving, and who feels it most? How does your Ruby-powered solution change things for them?
Both sides feel the pain, just differently.
Pet owners search for a sitter and get results sorted by who…
Today I’m excited to share a new open source project: A Claude Code skill to assess technical debt in a Ruby on Rails application. It leverages some of the libraries that we have open sourced and maintained for a long time.
Over the years, we’ve written about many of the tools we use: Skunk
for combining code quality and code coverage data, bundler-audit for security vulnerabilities in your dependencies,
libyear-bundler for measuring dependency freshness in a Ruby application,
and RubyCritic for churn vs. complexity analysis.
The challenge? Running all these tools manually takes time and interpreting the results across multiple reports
can be tedious.
What if we could automate the entire…
Authors: Rita Klubochkina, Sr. Frontend Engineer, and Travis Turner, Tech Editor
Topics: AI, DX, Agent Experience, LLMs, Jamstack
We told you to measure. So of course we did it ourselves too: two months of server-side LLM traffic to evilmartians.com. Find out which agents read HTML, which read Markdown, what llms.txt actually does, and the one technique that got zero hits.
A few months ago we published a guide to making your site readable by LLMs, a practice people now file under GEO (generative engine optimization), or AI SEO. We ended that guide with an uncomfortable admission: you don't actually know if any of it works unless you measure things. So, Evil Martians instrumented…
Beyond tenant_id: Treating Multi-Tenancy as a Database Invariant July 20, 2026 Most Rails applications that become SaaS products follow the same trajectory. They begin with a single customer, acquire a second, then a third, and eventually someone adds a tenant_id column to every table. From that moment forward, every query is expected to remember to … Continue reading Beyond tenant_id: Treating Multi-Tenancy as a Database Invariant →
Version 6.1.8 of the Passenger application server has been released. This release addresses an ABI break in Enterprise Linux (RHEL/Rocky/Alma) Nginx packages.
Installing 6.1.8
Please see the installation guide for advice on getting started with Passenger. Coming from a language other than Ruby, Python, Meteor or Node? Even if we didn't write a specific tutorial for your language, we made a generic guide that shows you the steps.
Upgrading to 6.1.8
We strongly advise staying up to date with the latest version.
Check out our upgrade guides for the different platforms:
Please be aware that you can enjoy enterprise features and sponsor the open…
Validating The Problem Domain 🔗
Today we’re modeling a system that involves providing validated parking. It’s a benefit provided by different businesses. They offer their customers a discount at a nearby parking lot. The lot has the following rules:
- All parking validation tickets must have an expiration time when they’re issued.
- The parking lot owner has a special ticket that does not expire. Instead, the owner provides a PIN after scanning their ticket for free parking.
- Please avoid hitting parked cars.
The last rule is more of a guideline than anything and won’t factor into our modeling.
We will use the ActiveModel::Validations module to implement these system restrictions.
Parking Expiration 🔗
P…
Frequently Played 🔗
I tend to listen to the same songs or albums on repeat that are evocative of how I’m feeling or what’s going on with me. Here is what I’m currently listening to over, and over, and over, and over, again.
Hello Kitty Kat 🔗
The height of passive-aggressive angst?
Full Lyrics
You know I hate to say it
Oh no, I always stay
I don’t wanna be like the others, please
Kitty’s Back 🔗
This is perhaps the Jazz Odyssey of Springsteen’s catalog, but…good?
Full Lyrics
You better learn to move fast when you’re young, or you’re not long around
Cat somehow lost his Kitty down in the city pound
A practical rundown of tools, settings, and habits that reduce token consumption when using Claude Code as your daily AI coding assistant.
Let’s explore this week’s major changes in the Rails codebase.
Preserve sub-second precision when coercing a DateTime in Time.at
Fix Time.at to always return the correct number of milliseconds for a DateTime.
Accept Date and numeric inputs in relative_time_in_words
Normalize the argument in the same way distance_of_time_in_words does, so every documented input type works.
Respect a limit set on the relation in rails query
An Active Record expression that carries a limit like bin/rails query "Post.limit(5)" had its limit silently replaced by the pagination window returning up to a full page instead of the requested 5 rows.
Introduce ActionView::Helper::NavigationHelper
Methods like butto…
### Impact
Datadog tracing libraries that implement W3C baggage propagation parse
incoming baggage HTTP headers without enforcing item-count or byte-size
limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64)
and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only
to baggage injection, not extraction. A remote, unauthenticated attacker
can send a request whose baggage header contains an arbitrarily large
number of comma-separated key-value pairs (or a single very large value).
The tracer allocates a hash-map entry for each pair on every request,
causing unbounded CPU and memory consumption and enabling a remote
Denial of Service against any HTTP service that…
## Summary
Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript:
or vbscript: URIs when the scheme is split by a numeric character
reference that has no trailing semicolon. A browser decodes such
references and resolves the URL to an executable javascript: scheme,
while allowed_uri? reports it safe.
This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled
numeric character references with a trailing ; ( ,
,
)
but did not cover the forms without semicolons.
## Impact
Callers that validate a user-controlled URL with
Loofah::HTML5::Scrub.allowed_uri? and then render the approved value
into an href or other browser-interpreted URI attribute may be
vulnerable to…
## Summary
Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript:
URIs when the scheme is split or prefixed by the HTML5 named character
references 	 (tab) or 
 (line feed).
This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled
the equivalent numeric character references ( ,
,
) but
did not cover the named forms.
## Summary
Loofah's HTML5 sanitizer restricted only the xlink:href attribute on
certain SVG elements to local, same-document references. Browsers
also accept a plain href attribute as an alternative to the deprecated
xlink:href per the SVG 2 spec, but Loofah did not apply the same
restriction to it, allowing those elements to reference arbitrary
external documents.
## Impact
SVG can load and render external SVG content by reference. If
the referenced external SVG is same-origin and contains scripts or
other dangerous content, it could execute in the context of the
sanitized document. can load external images, which can be
used for tracking. Modern browsers restrict cross-origin
fetche…
## Summary
There is a possible cross-site scripting vulnerability in
rails-html-sanitizer when the sanitizer is configured to allow an
SVG reference element such as .
See related GHSA-9wjq-cp2p-hrgf in Loofah, whose SVG local-reference
logic rails-html-sanitizer mirrors.
Hello! I’ve been working on a Django site recently, and I decided to use SQLite
as the database.
When I was getting started with using SQLite as database for a website I read a bunch
of blog posts about how it is totally fine to use SQLite in production for a
small site and I think it is totally fine, but what I did not fully appreciate
is that SQLite is still a database, databases are complicated, and I do not know
a lot about operating databases.
So here are a couple of small things I’ve been learning about running SQLite. This
is the 4th website I’ve used SQLite for, and I think this one is harder because
with the power of the Django ORM I’ve been making the database do more work than
I…
Dont Steal Our Business Idea
Chris, Andrew, and David dig into the practical realities of modern development, from building faster server images with Packer and untangling database schema problems to deciding when refactoring, code coverage, and quality tools are actually useful. They also share where AI coding assistants are saving real time, where they still create confusion, and why good judgment remains just as important as the tools themselves. The episode wraps with the conversation going completely off the rails with a highly questionable plan to corner the personalized license plate market. Hit download now!
Links
3 example process managers in Rails
I am writing this blogpost from this beautiful place in the Polish mountains. Our RailsEventStore camp takes place this week.
Process managers are meant to map business process into code. The more readable and declarative it is, the better the chance domain experts will understand it.
Over the last years, we have experimented with several approaches on how to implement process managers in Ruby.
The foundation here is RailsEventStore and the architecture where events are published and commands are used to tell what to do next.
Most business processes can be mapped into some sort of a checklist of requirements and when certain conditions are met we…
A user's journey through your app matters just as much as the new feature you're building.
Continue Reading
If you used an LLM to write code you shipped a month ago, how well do you remember it? Would you realize if the code you committed today would break it? If a customer reported a bug, would you quickly think, "Oh, I know what that is" in the same way
Users are creating accounts on your new Saas. Yay (and not just family and friends or bots). Yay! Now comes the next step from every marketing handbook: capturing newsletter subscriptions.
This article builds on Add Sign Up to Rails 8’ Authentication.
Add a simple checkbox to let users opt in to product updates during signup. Store their preference using Rails Vault and manage the subscription with Rails Courrier.
First, add Rails Vault and Rails Courrier to your Gemfile:
gem "rails_vault"
gem "rails_courrier"
Rails Vault adds simple and easy settings, preferences and so on to any ActiveRecord model (I recently pushed 1.0.0). Courrier is API-powered email delivery for Ruby apps with…
Ruby 3.3.12 has been released.
This release includes security fixes.
Please check the topics below for details.
This release updates the default gem erb to 4.0.3.1 and the bundled gem net-imap to 0.4.25. The net-imap update fixes CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258, CVE-2026-47240, CVE-2026-47241 and CVE-2026-47242. Please see the release notes of net-imap v0.4.24 and net-imap v0.4.25 for the details of these fixes.
Please see the GitHub releases for further details.
Download
## Description
A participant can load the demographics questionnaire admin editor
and make changes.
## Impact
- Low-privilege users can access questionnaire-admin interfaces.
- They can read question-management surfaces that should remain
limited to questionnaire managers.
## Credits
This issue was discovered in a security audit organized by the
[Decidim Association](https://decidim.org) and made by
[Radically Open Security](https://www.radicallyopensecurity.com/)
against Decidim financed by [NGI](https://ngi.eu/).
## Description
The verification admin mutation flow allows accessing, verifying,
and rejecting participants records from another tenant.
## Impact
A tenant admin can access, reject or approve another tenant's
`id_documents` requests.
## Credits
This issue was discovered in a security audit organized by the
[Decidim Association](https://decidim.org) and made by
[Radically Open Security](https://www.radicallyopensecurity.com/)
against Decidim financed by [NGI](https://ngi.eu/).
## Description
The admin organization user search uses the untrusted term value inside
raw SQL ORDER BY expressions. Because the value is interpolated before
Rails sanitization is applied, a crafted search string is executed by
PostgreSQL as part of the sort expression.
## Impact
- Exploitation requires an authenticated admin session, which limits
exposure but does not remove the underlying SQL injection risk.
- An authenticated admin can inject arbitrary SQL expressions into
the query's `ORDER BY` clause and use timing differences as a
blind SQL oracle.
- The injection happens inside a database expression, so the effect
is not inherently limited to sorting the current…
## Description
The normal `download_your_data` flow requires the requester to be
logged in as the export owner, but the resulting Active Storage blob
redirect URL can be replayed without authentication by anyone who obtains it.
## Impact
Personal data exports can be retrieved through leakage channels such
as browser history, logs, referrers, screenshots, copied links, support
transcripts, intercepted email content, or other client-side disclosure
of the GET URL.
## Credits
This issue was discovered in a security audit organized by the
[Decidim Association](https://decidim.org) and made by
[Radically Open Security](https://www.radicallyopensecurity.com/)
against Decidim financed by…
## Description
Scanned identity-document images provided by participants and shown
in the verification admin workflow are exposed through signed
`/rails/active_storage/disk/` URLs that can be fetched without any
authenticated session.
Anyone who obtains one of those URLs can retrieve the document until
the signature expires.
## Impact
- This only applies to Organizations using the \"Identity documents\"
verification
- Any party that obtains one of these URLs can download the underlying
scanned identity document for the lifetime of the signed link without needing to
authenticate as the reviewing admin.
- In the reproduced case, that replay window was about seven days,
which is…
## Description
A JWT issued to an Org 1 account is accepted on the Org 2 API and can
read the admin-only GraphQL `participantDetails` field for an Org 2
participant. The same trust-boundary problem also affects API-user
authentication: an Org 1 API user can use a JWT on the Org 1 host
and replay that JWT to the Org 2 API to read Org 2 participant
personal data and reach Org 2's `proposal.answer` mutation path.
## Impact
A JWT issued for one organization can be replayed successfully against
another organization's API and used to retrieve sensitive details from
that organization.
## Credits
This issue was discovered in a security audit organized by the
[Decidim…
## Description
A participant manager can access and modify the CSV census
record admin forms.
## Impact
Any participant admin can create, alter, or remove CSV census rows,
which can corrupt verification data relied on by authorization workflows.
## Credits
This issue was discovered in a security audit organized by the
[Decidim Association](https://decidim.org) and made by
[Radically Open Security](https://www.radicallyopensecurity.com/)
against Decidim financed by [NGI](https://ngi.eu/).
## Description
A privileged admin user who can edit an affected landing page can
store arbitrary HTML/JavaScript in an `HTML block`, and the public
page renders it with `html_safe` and no output escaping.
## Impact
- A user with landing-page editing rights for an affected scope can
persist JavaScript that executes in visitor's browsers on that page.
- Because exploitation already requires privileged administrative
access, the practical risk is lower than a participant-controlled
or unauthenticated stored XSS. It still creates a browser-execution
primitive in a trusted admin-editable surface.
## Credits
This issue was discovered in a security audit organized by the
[Decidim…
## Description
The push-subscription endpoint stores an attacker-controlled delivery
URL, and the notification send path becomes an outbound-request sink when
VAPID delivery is enabled. The practical result is an authenticated,
stored, mostly blind SSRF primitive to arbitrary HTTPS endpoints
reachable from the app server.
## Impact
- In a configured deployment, an authenticated user can register an
attacker-controlled or otherwise unauthorized HTTPS URL.
- The server then sends outbound `POST` requests there whenever a
notification is pushed.
- This is a stored, mostly blind SSRF primitive: useful for outbound
interaction with attacker infrastructure and, where routable, internal
…
We're excited to share some big news from our partners at the Ruby Association: the launch of the RubyGems.org Supporters Program in Japan.
Starting this October, the Ruby Association will serve as a local liaison for Japanese companies who wish to support RubyGems.org. This means their domestic sponsors can now contribute in Japanese Yen through a familiar organization, removing a real barrier that has kept many companies in Japan from supporting the infrastructure their teams rely on every day.
What This Means
RubyGems.org is critical infrastructure for the global Ruby community, and its long term sustainability depends on broad, diverse support. This partnership opens the door for Japanese…
I’m at RubyConf this week, and it’s great!
I recently read that lobste.rs is now running on SQLite.
One part from the post caught my attention:
I wish we could say in a test, “Fail if you encounter any full table scans”. Which would have caught the perf issues we experienced during the first deploy.
SQLite collects information about prepared statements and exposes those statistics though an API.
The upshot of this is that we can tell whether a statement did a full table scan after executing the statement without using an EXPLAIN.
Here’s an example program that demonstrates detecting a query did a full table scan:
db = SQLite3::Database.new(":memory:")
db.execute("CREATE TABLE users (id…
Rails 8.1 includes support for marking associations as deprecated right in your models. In this post, I’ll explain how the feature works, why it matters, and how you can use it to safely remove outdated associations from your application.
Overview of Deprecated Associations in Rails 8.1
Rails 8.1 lets you explicitly mark outdated or obsolete associations as deprecated. If your codebase includes association tables or relationships that are no longer valid, you can flag them by adding the deprecated: true option to the association definition:
has_many :blogs, deprecated: true
Keep in mind that you need to mark both sides of a relationship as deprecated. Marking only one (like has_many…
Every time a new model launches, the conversation follows a familiar pattern.
People pull up benchmark leaderboards. They compare scores across well-known benchmarks like Massive Multitask Language Understanding (MMLU), Graduate-Level Google-Proof Q&A (GPQA), Humanity’s Last Exam, and whatever new benchmark appeared this week, then declare a winner.
The assumption is obvious: if Model A scores higher than Model B, then agents built on Model A should perform better. In practice, that assumption breaks down surprisingly fast.
Part of the problem is that benchmark scores only measure a narrow slice of what makes an AI system successful. As benchmarks become widely adopted, model developers…
The simplest way to make a page collaborative with Hotwire and Rails is to subscribe to changes and broadcast a refresh when relevant models update. But that approach sometimes causes a problem. This post explains the refresh approach, the problem and the fix. The full monty. The problem Let’s assume we’re implementing a game because that is an example I have handy. My little MinesVsHumanit...
World Cup Fever Hits the Ruby Community July 14, 2026 As the FIFA World Cup 2026 reaches its final stages, millions of fans around the globe are glued to every match. The Ruby community is no exception. Over the past few weeks, we've seen several developers build and share open-source Ruby and Rails applications … Continue reading World Cup Fever Hits the Ruby Community →
Authors: Svyatoslav Kryukov, Senior backend engineer, and Travis Turner, Tech Editor
Topics: Rails, Open Source, React, JavaScript
Inertia is Turbolinks with one twist: render JSON instead of HTML on the second visit. We rebuild the whole protocol on a real Rails app with a 50-line client and a 16-line server, then audit what the real gem adds on top.
Hi there, welcome back, so glad you could join us again. You know, we've painted with Inertia.js on this blog many times, but today is gonna be a little different: today we make the brush ourselves. Then, we'll end up with a 50-line React client, a 16-line Rails renderer, wet-on-wet, running on a real Rails app. There won't be any mistakes here…
The following is some notes I’ve collected over my twenty years of career, some in tech, some in nonprofit and academia and government, and some as a strategic planning consultant.
I’ll cover the most common stumbles I’ve seen, and end with a little bit of advice for doing better. This is not intended to be an essay, or some something comprehensive like Good Strategy, Bad Strategy. Just fun stuff I occassionally try to describe to others.
I do recognize that a lot of these things stem from context like “toxic workplaces are bad and warp your sense of normalcy long after you leave them”, so if any of these things I write about seems self-evidently obvious, consider…
It’s time to play the music, it’s time to… get Aji and Sally together again. This week’s episode is a radical one, and a listener suggestion no less; let’s Muppet-cast a software development team!
Who would you hire as the content designer? Which of the Muppets would do their best work as the QA? And the most important question of all - which role would be played by the human?!
—
Your hosts for this episode have been thoughtbot’s own Sally Hall and Aji Slater.
Don't forget you can now also watch episodes of The Bike Shed over on YouTube!
If you would like to support the show, head over to our GitHub page, or check out our website.
Got a question or comment about the show?…
A few months ago, we were tasked with building a platform that aggregates events across an entire city, concerts, gallery openings, museum exhibitions, comedy shows, community gatherings, and makes them searchable in real time.
On the surface it sounds straightforward: scrape some websites, store the data, build a search index. In practice it is anything but. Every event organiser publishes their calendar differently. One venue lists events in a structured JSON-LD block. Another buries them in a hand-coded HTML table. A third loads them dynamically from a proprietary ticketing API. Dates are formatted as “Sat Jun 20”, “June 20th at 7pm”, “Through August 16”, and “Ongoing.” Prices appear as…
This is a self-translation of an article I originally wrote in Japanese.
Hello. I'm Pocke. In this article I'll show you how to define a loop in Ruby that you can never escape from.
A loop you can escape
Ruby has the Kernel.#loop method. It's a method that evaluates its block over and over, forever.
# "hello" is printed forever
loop do
puts "hello"
end
Naturally, you can also break out of loop.
# Prints "hello" once, then leaves the loop
loop do
puts 'hello'
break
end
# Likewise, prints "Ruby" once and then leaves the loop.
# Calling `return` inside a method exits the method itself.
def f
loop do
puts 'Ruby'
return
end
end
f
# Prints "world"…
A loop you can't escape
Now, unlike Kernel.#loop, let's think about a…
Ruby 4.0.6 has been released.
This is a routine update that includes bugfixes.
Please see the GitHub releases for further details.
Release Schedule
We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent release. Ruby 4.0.7 will be released in September, and 4.0.8 in November.
If a change arises that significantly affects users, a release may occur earlier than planned, and the subsequent schedule may shift accordingly.
Download
Photo by
Bozhin Karaivanov on
UnsplashAs AI agents commoditize the execution of code, the leverage moves to the two things a machine can’t do for you: deciding what belongs on the menu, and knowing when a finished plate is wrong.
Introduction: The Shifting Medium of Craftsmanship
Software craftsmanship has always been an evolving discipline. For the last decade, our industry was shaped by what I think of as the “happy coder” mentality. Evangelized heavily by the Ruby on Rails community and figures like David Heinemeier Hansson (DHH), we treated code primarily as a medium for human-to-human communication. We piled into rooms with whiteboards to map out dreams. We obsessed over tight feedback…
A lightning talk exploring i18n in Rails and how it can be helpful to us even when we’re not translating our applications into other languages.
I gave this talk at Brighton Ruby in 2026.
Slides
At OmbuLabs.ai, we’ve explored the importance of identifying meaningful AI opportunities before selecting a solution. Once a worthwhile opportunity has been identified, however, a new question emerges:
Is this problem worth solving in the first place?
Too often, teams focus on the technology before evaluating the value. AI can automate tasks, generate content, and process information at incredible speed, but if the underlying work doesn’t matter, making it faster won’t create meaningful business outcomes.
Once a worthwhile opportunity has been identified, however, a new question emerges:
What should we build first?
This is where many AI projects begin to drift toward unnecessary…
A new jj tutorial, summarizing a many of the reasons jj is so useful, and powerful, in just a few paragraphs.
jj improves upon Git by achieving two opposing goals at the same time: it has a simpler mental model and command set, but simultaneously provides more powerful functionality. jj simplifies Git not by hiding complexity, but by using a better conceptual model.
– Evan’s Jujutsu Tutorial
A few weeks ago I joined Jared to record a new episode of his Dead Code podcast, and now it’s out — go have a listen! Jared’s titles never disappoint, and I feel it’s only appropriate that “Bloom of the Undying” take the place of honour as the title for these weeknotes.
After all the effort to get Hanami 3.0 out the door, this week I’m having a break. I’ve travelled to Adelaide with my wife and kids to spend some time with my parents. It’s a rainy winter week here, but we’ve all been having a good time.
Last week I did poke some more at my custom Hanakai API docs site. While it still needs a bit of design finesse, all the basics are now in place, including cross-gem search! So I think…
This year marks a big milestone in my history working on JRuby: twenty years ago, I joined Sun Microsystems to work on the project full-time. This month also marks another milestone for JRuby: two years being independently funded by my company Headius Enterprises through commercial support contracts. It’s a perfect time for us to return to RubyConf 2026 and show today’s Rubyists what JRuby can do for them!
Update! After a very long time, we have a new batch of JRuby t-shirts! Limited run so only folks at the JRuby talk, hack space, or cabana can get them! Also plenty of stickers for everyone!
Main JRuby Talk
My goal with JRuby has always been to give Rubyists more tools and more…
The Great Falcon Defense and CI Innovations
In this episode, Chris, Andrew, and David kick things off with a very Remote Ruby style detour through Costco, Blue Apron, leftovers, Blackstone grills, and cast iron pans. Then, Andrew explains his Stripe subscription migration scare and major GitHub Actions workflow improvements that sped up Podia’s CI by 20–30%. They dive into Apple’s new on-device AI tooling, container alternatives on macOS, and the state of conferences, GitHub, AI infrastructure costs, solar power, and even crows attacking solar panels. Hit download now to hear more!
Links
Ho…Hi, Wojtek here. Let’s explore this week’s changes in the Rails codebase.
The Rails Foundation is inviting RUG organizers from around the world to apply to be a Rails World MC
Ruby User Group organizers are a huge part of what makes the Ruby ecosystem special. They grow the community, create welcoming spaces, introduce speakers, keep events running smoothly, and make newcomers feel at home - all the things that make a great Rails World MC.
Add this_quarter? to Date/Time
It returns true if the date/time falls within the current quarter.
Date.current #=> Tue, 15 Feb 2000
Date.new(2000, 3, 31).this_quarter? # => true
Date.new(2000, 4, 1).this_quarter? # => false
Add…
RubyGems 4.0.16 includes enhancements and bug fixes and Bundler 4.0.16 includes enhancements, bug fixes and documentation.
To update to the latest RubyGems you can run:
gem update --system [--pre]
To update to the latest Bundler you can run:
gem install bundler [--pre]
bundle update --bundler=4.0.16
RubyGems Release Notes
Enhancements:
- Installs bundler 4.0.16 as a default gem.
Bug fixes:
- Skip the make job server when using BSD make. Pull request #9676 by flavorjones
Bundler Release Notes
Enhancements:
- Bundler: Fix Bundler::Fetcher for PQC support, adding integration connection tests. Pull request #9637 by junaruga
- Reuse RubyGems’ vendored tsort in Bundler. Pull…
Bug fixes:
- Initialize the new gem’s git repo without a subshell. Pull request #9670 by…
…
At FastRuby.io, we always recommend that clients set up an Application Performance Monitor. It’s not just useful for our Tune Report Service, but good practice for visibility into server health, user experience, and more.
One concern that we sometimes hear is that the application may have really sensitive information about the users and it may not be possible to send the information to a third-party provider, or that a managed service can be too expensive. In this article, we are going to explore some open source solutions that can be self-hosted.
The Ingredients (aka Glossary)
APM
An Application Performance Monitor (APM) is a system that provides different insights into the current…
I’ve built many a SaaS. And most have pricing tiers: the higher the plans the more widgets you can create or features are allowd. Typically there are two ways to approach this:
- hide the feature if the customer does not have access;
- show all features, to all customers, but guard them with some, optional, upsell.
I have succesfully implementated the latter approach with a helper that quacks like Rails itself.
The helper lets you wrap content and decide what happens when access is denied. Hide it, redirect to a link, render content or render a partial. It’s small but flexible. This is how it looks (added a toggle allowed/denied states):
As always view on GitHub for a ready-to-copy code.
The…
Why Ruby's Issue Tracker Still Links to a 1991 Paper About Floating-Point Numbers July 8, 2026 If you've ever been surprised by this in Ruby: (2.0 - 1.1) == 0.9 # => false you're not alone. Many developers initially assume this is a Ruby bug. It isn't. In fact, Ruby's own issue tracker includes a … Continue reading Why Ruby’s Issue Tracker Still Links to a 1991 Paper About Floating-Point Numbers →
I was recently a guest on Scaling DevTools, hosted by the gracious Jack Bridger.
We talked about how Oh My Zsh went from a messy little config I shared with a few coworkers into one of the more widely used open source developer tools in the world. Which still feels a little absurd, especially when I look back at the original blog post where I announced it and remember how little grand strategy was involved.
The original goal was not world domination. There was no developer platform strategy. No roadmap. No monetization funnel wearing a fake mustache.
As I said in the conversation:
I literally wanted, like, eight of my coworkers to have this on their computer so that I could be lazy…
One of our all-time clients owns a multi-brand marketplace. Earlier this year, he had an idea to revolutionize his platform by observing how his users behave and turning that information into actionable insights for his customers (the brands). The core idea was to track user events, turn each user’s events into a single, computed profile that identifies them (internally called a fingerprint), and use this information to build a brand brief, including user segments and actionable insights.
For this project, our client wanted to use AI throughout the development process: he built the plan with AI assistance, designed the UI with AI, and planned to use AI for most of the features he wanted to…
You may not be aware that, since Rails 7.1, the standard way to store secrets is by using credentials.yml instead of the old secrets.yml.
DEPRECATION WARNING:
`Rails.application.secrets` is deprecated in favor of `Rails.application.credentials`
and will be removed in Rails 7.2.
If you still see this warning, your app uses secrets.yml and the migration applies to you. If you don’t use Rails.application.secrets or config/secrets.yml at all, you can ignore the deprecation and the rest of this post.
The migration itself isn’t hard, but it can take some coordination: if your app runs in several environments, you’ll probably need to work with whoever manages your servers to move everything…
Authors: Gleb Stroganov, Product Designer, Camila Mirabal, Tech writer, and Travis Turner, Tech Editor
Topics: AI, Design, DX, Design engineering, Agent Experience, Design for devtools, Agentic development
Storybook Workbench is a bundle of Agent Skills that turn Storybook into an audit layer for AI-generated UIs: find dead components, design-system drift, and hidden accessibility bugs.
An AI agent can generate a full web app that looks plausible and runs within one afternoon. However, you still can’t really tell which of the 469 component files in ‘src/’ are structural and which are dead ends the agent abandoned three prompts ago. So, Evil Martians built Storybook Workbench: a set of agent…
This is episode #04 of the Ruby Stained Glass Notes, a pop-up newsletter in which I write about the process of building a stained glass panel celebrating Ruby. Today, I talk about tools!
What happens when your entire app rests on one developer's shoulders?
Continue Reading
Fullscript is sponsoring the Relax Lounge at RubyConf this year; it’s the conference experience that felt like the right fit.
The Ruby community has given us a lot; not just the tools we build on, but the people and community who've shaped how we work. Our folks attended Ruby conferences in five countries last year, and we continue to support meetups across North America. We keep showing up because we've seen what happens when devs actually get in the same room. Things click differently in person. There's something about face-to-face that you can't replicate over Slack.
So when RubyConf came around we asked ourselves what we could contribute that felt like us. We're a healthcare company:…
Judoscale ‘On Tour’ Series
- “The Friction Model” & Heroku
-
Render (This page!)
-
Railway (Coming soon…)
-
Fly (Coming soon…)
-
Northflank (Coming soon…)
-
Digital Ocean (Coming soon…)
-
Amazon ECS Fargate (Coming soon…)
After about a month of migrating, tweaking, and configuring, our opinions are in! We successfully migrated our full production and staging application stacks to Render. We tried as many bells and whistles as we could, let things run for a non-trivial amount of time, and have some interesting thoughts to share with you.
👀 Note
The “Judoscale Tour” is our exploration of today’s PaaS offerings via deliberately migrating our real production app, our…
The Rails Foundation is looking for two people to be MCs at Rails World this year, and we think that some of the best candidates are already doing the job every month in Ruby communities around the world…
Ruby User Groups (RUGs) are where people find their first Ruby friends, give their first talks, discover their next role, and become part of the community, and RUG organizers are a huge part of what makes the Ruby ecosystem special. They create welcoming spaces, introduce speakers, keep events running smoothly, and make newcomers feel at home — all the things that make a great Rails World MC too.
That’s why, this year, we’re inviting RUG organizers from around the world to apply to be a…
Sally and Joël join forces to discuss the different ways to interpret the role of a ‘principle’ or ‘staff’ engineer, and the handwaving around what those titles mean in terms of the gradation.
Whilst Joël dives into career progression within the industry, what a staff engineer does and the different archetypes within it, Sally talks about the importance of having principle engineers in the room during AI discussions, and her previous positive experiences working with principle engineers.
—
Joel used the Staff Archetypes page from staffeng.com during this episode’s discussion.
Your hosts for this episode have been thoughtbot’s own Joël Quenneville and Sally Hall.
Don't forget…
You ship a new background job—let’s call it SendShinyNewThingJob—run the deploy, and go get coffee. By the time you’re back, the error tracker is on fire:
NameError: uninitialized constant SendShinyNewThingJob
But the class is right there in the codebase. It’s deployed. You can call SendShinyNewThingJob.perform_later in a console on production without a hitch. So what happened?
Why a class you just deployed is “missing”
The culprit is the rolling deploy. When you roll out a new version, old and new processes run side by side for a while—that’s the whole point, zero downtime. During that window you have two kinds of processes in play:
- something that enqueues jobs: a freshly started…
## Summary
In its default configuration, MCP::Server::Transports::StreamableHTTPTransport
never expires sessions. Every successful initialize request stores a
new ServerSession and a session record under a fresh UUID, and the
only path that removes them is an explicit client-issued HTTP DELETE.
An unauthenticated attacker can repeatedly initialize new sessions
and immediately disconnect, forcing the server to retain an unbounded
number of ServerSession objects until memory is exhausted.
## Summary
Vulnerability: Missing Session Ownership Validation in the Ruby MCP
SDK's Streamable and SSE HTTP transport implementation. Any attacker
with a stolen session ID can execute tools with the victim's session.
This is a silent attack - the victim's session is compromised and
being used for unauthorized actions, but it is hard to know for the victim.
## Summary
The stdio transports in MCP::Server::Transports::StdioTransport and
MCP::Client::Stdio read newline-delimited JSON-RPC frames using
IO#gets with no limit argument. CRuby's IO#gets with no limit reads
from the current position until the next separator (\n) with no upper
bound on the returned string length. A peer that streams bytes without
ever emitting a newline causes gets to accumulate the entire stream
in a single Ruby String until the process is killed by the
operating-system OOM killer.
## Summary
An unauthenticated remote attacker can force any MCP Ruby SDK server
using MCP::Server::Transports::StreamableHTTPTransport to allocate
gigabytes of memory by sending a single oversized JSON-RPC POST. The
transport reads the entire HTTP body into a Ruby String and parses
it with JSON.parse(body, symbolize_names: true) with no size limit,
no Content-Length pre-check, and no streaming parser, allowing
trivial denial of service against the worker process.
## Summary
MCP::Server::Transports::StreamableHTTPTransport (the Rack-mountable
Streamable HTTP transport in the mcp gem) processes every incoming
JSON-RPC request without ever inspecting the HTTP Host or Origin
request headers. There is no AllowedHosts/AllowedOrigins allowlist
and no DNS-rebinding guard anywhere in the transport. A local MCP
server that binds a loopback or LAN HTTP port is therefore reachable
by any web origin a victim's browser visits, via a DNS-rebinding
attack: a malicious page rebinds its own hostname to 127.0.0.1, then
drives the local MCP server cross-origin to enumerate and invoke
its tools and exfiltrate their output. This is the standard…
Version 6.1.7 of the Passenger application server has been released. This release addresses an ABI break in EL9 (RHEL/Rocky/Alma) Nginx packages.
Installing 6.1.7
Please see the installation guide for advice on getting started with Passenger. Coming from a language other than Ruby, Python, Meteor or Node? Even if we didn't write a specific tutorial for your language, we made a generic guide that shows you the steps.
Upgrading to 6.1.7
We strongly advise staying up to date with the latest version.
Check out our upgrade guides for the different platforms:
Please be aware that you can enjoy enterprise features and sponsor the open source…
Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through
2.19.8 are vulnerable to heap buffer overflow when the JSON generator
is provided with an oversized streamed object.
When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io)
can write past the internal JSON generator buffer when a streamed
object contains an attacker-controlled string near 16 KB. Exploitation
would result in a reliable process crash/denial of service.
This was triaged on HackerOne as report #3785370.
The issue was confirmed there and I was asked to open it here.
This issue has been fixed in version 2.19.9.
ruby webrick through v1.9.2 WEBrick reparses trailer Content-Length
into canonical request state, enabling request smuggling.
Now that I’ve been working on Spinel Cooperative for a full year already, I have finally managed to write the very first post I meant to write about the entire situation: What is Spinel? Who is Spinel? Why is Spinel? Read on to finally receive the answers to all these and questions and more.
Head over to the Spinel Cooperative blog to read Meet Spinel.
Hanami 3.0 is out! In this writer’s opinion, a release worthy of its new major version: new mailers, i18n, and Minitest, your apps becoming way faster, and much more!
I’m proud of this release. Eight months of continuous work. Two brand new gems. 100 pull requests authored by me, another 50 by our team and community. I feel we’re getting better and better with how we bring improvements and polish to Hanami and the Hanakai ecosystem.
I didn’t manage my last couple of weeknotes due to the focus I needed to put on the release. To sum it up: I prepared and pushed a release candidate, wrote substantial new docs (in particular, mailers, internationalisation, logger, container and components),…
Turning a Claude skill audit report into a labelled, severity-tiered GitHub backlog, and what the skill found in a small Rails 8 app.
In this episode, we look at creating Claude slash commands. These can be useful when dealing with a complicated task or trying to extract certain information from the application.
## Summary
The `Pay::Webhooks::PaddleBillingController#valid_signature?`
(`app/controllers/pay/webhooks/paddle_billing_controller.rb`)
verifies the Paddle Billing webhook signature by computing
`OpenSSL::HMAC.hexdigest(...)` and comparing it to the attacker-supplied
header value using Ruby's `String#==`. Ruby's `==` is non-constant-time —
it returns as soon as the first byte mismatches — and exposes a per-byte
timing side channel on the webhook signature verification path. The
canonical mitigation is to use a constant-time primitive
(`OpenSSL.fixed_length_secure_compare` /
`ActiveSupport::SecurityUtils.secure_compare`).
- IMPACT - CWE-208 — Observable Timing Discrepancy on the webhook
…
A quick look at how TypeScript conditional types behave with union types.
