Rubyland

Ruby 4.0.4 has been released.

This is a routine update that includes bugfixes. Please see the GitHub Releases for further details.

Release Schedule

We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent regular release. Ruby 4.0.5 will be released in July, 4.0.6 in September, and 4.0.7 in November.

If a change arises that significantly affects users, a release may occur earlier than planned, and the subsequent schedule may shift accordingly.

Download

• https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.4.tar.gz

  SIZE: 23816838
  SHA1: 3633db75e6b4848b509ecccc64704d8f4467f068
  SHA256:…

We’re excited to share that Gusto has become the first company to join the Ruby Alliance.

The Ruby Alliance is a small coalition of companies that are choosing to make a significant investment in the long-term health, resilience, and sustainability of the Ruby ecosystem and the infrastructure it depends on.

We are honored and humbled by how quickly and decisively Gusto moved to join us. They didn’t wait to see what other companies would step forward. They recognized the importance of this moment and chose to lead the way.

Ruby has always thrived because individuals and companies invested back into the ecosystem that supports their teams and businesses every day. Gusto’s leadership is a…

When you’re building views in Rails, you often need to apply CSS classes conditionally. Maybe a nav link should look different when it’s the current page, or a form field needs error styling. Since Rails 6.1, the class_names helper does this cleanly.

Instead of…

…interpolating conditional classes with ternaries or post-statement conditionals:

<div class="p-4 rounded <%= @error ? 'bg-red-50 border-red-500' : '' %> <%= 'opacity-50 cursor-not-allowed' if @disabled %>">
  <%= @message %>
</div>

Use…

…the class_names helper:

<%= tag.div class: class_names(
  "p-4 rounded",
  "bg-red-50 border-red-500": @error,
  "opacity-50 cursor-not-allowed": @disabled
) do %>
  <%= @message %>
<% end %>…

String arguments (like "p-4 rounded") are always applied. The trailing Hash (the keyword-style arguments) includes any key whose value is…

Introducing ruby-charts: Native Charts for Ruby May 10, 2026 Last Friday I released ruby-charts, a gem for generating charts directly in Ruby—no JavaScript, no external APIs. Built for Ruby on Rails Build Maps WithoutGoogle APIs Generate beautiful production-ready maps directly from your Rails backend. Fast rendering, zero external dependencies, full control. View Live Demo → … Continue reading Introducing ruby-charts: Native Charts for Ruby →

Rails 8 ships Thruster in the default Docker flow. Use it for simple, single-container apps. Keep Nginx when we need edge features.

Puma stays as the app server. Thruster runs in front of Puma and handles the common reverse-proxy duties.

What is Thruster?

Thruster is a lightweight, Go-based HTTP/2 proxy from 37signals. It runs alongside Puma and provides:

• HTTP/2 support
• Optional automatic TLS certificates with Let’s Encrypt
• Basic HTTP caching for public assets
• X-Sendfile support for efficient file serving
• Gzip compression

Before

Before Rails 8, a simple production setup often looked like this:

1. Puma as the application server
2. Nginx or Apache as a reverse proxy
3. Certbo…

At FastRuby.io, we spend a lot of time upgrading Ruby and Rails applications. However, we do more than just that, we also pay attention to other areas of the application that can be improved. For example, we recently migrated a customer’s application from Sprockets to JS bundling with esbuild.

In this article, I share my experience migrating from Sprockets to JS Bundling (JavaScript Bundling for Rails).

This is not a step-by-step guide, as each application has its own unique needs. Instead, I discuss the problems I encountered and the approach I took during the migration to JavaScript bundling.

Why We Needed to Migrate

Before we discuss why we needed to migrate, let me give you some…

On this episode of Remote Ruby, Chris, Andrew, and David kick things off with dentist trauma, gold star stickers, and fiber internet. The conversation centers on Rails direct routes, why they can be more powerful than helpers, the upcoming Rails World CFP and ticket rush, how AI is becoming more practical inside real engineering teams, a reminder to fill out the Rails survey, and Chris’s continued work expanding the Rails Getting Started Guide into a more realistic e-commerce tutorial with wishlists, reviews, ratings, and product images. Hit download now to hear more!

Links

• Judoscale- Remote Ruby listener gift
• How to use Direct Routes in Rails (GoRails)
• On Rails Podcast- Brian Scanlan: Building…

Hi, it’s zzak. This week was full of changes, so grab a seat, there’s a lot to cover.

New Accessibility Guide open for review
The Rails Foundation is working on a new Rails-flavored Accessibility Guide, covering semantic HTML, ARIA, page structure, forms, Turbo interactions, CSS, and testing. Please take a look and share feedback on the pull request.

Add ActiveJob::Attributes to persist data between steps
Active Job can now declare typed attributes that are serialized with the job and restored on resume, removing the need to override serialize and deserialize.

class SubmitEnrollmentJob < ApplicationJob
  include ActiveJob::Continuable
  attribute :payment_token, :string
end

Add…

May 7, 2026 Modern chart rendering usually assumes a browser, a JavaScript runtime, or a frontend stack. But many Ruby applications do not actually need interactive dashboards. They need deterministic image generation. Things like: scheduled reports PDF exports transactional emails admin dashboards analytics snapshots CI metrics server-side rendering pipelines That was the motivation behind building … Continue reading Generating Charts in Pure Ruby Without JavaScript →

Uma história real de upgrade para Rails 8: como evoluir uma aplicação existente, preservar seu valor e seguir em frente sem começar do zero.

Continue Reading

Over the last decade, a great deal of data privacy regulations have been passed in the European Union. Like it or not, measures like GDPR, the Digital Services Act, and the upcoming Artificial Intelligence Act are exerting increasing influence across industries over how and especially where the data of European customers is stored.

In this article, we will explore the ways to keep the simplicity of a Platform as a Service (PaaS) while utilizing only European providers.

Why Data Sovereignty Matters More Than Ever

The General Data Protection Regulation (GDPR), which was ratified in 2016, granted fundamental rights to the "data subject". These include the right of access, the right of…

In a previous article, I explored building nested forms with Stimulus. But what about when you need to edit existing questions, remove ones you no longer need or reorganize them? Let’s extend that foundation by adding: editing, deleting and repositioning questions using drag-and-drop.

This article builds directly on the previous setup, so make sure you have that in place before continuing (check out the repo for the full code base). The reposition logic is inspired by this article to create a Kanban board.

First, update the migration to include a unique index:

class AddPositionToQuestions < ActiveRecord::Migration[8.1]
  def change
    add_column :questions, :position, :integer, null: false
…

I like the positioning gem for this, make sure to set it…

I released RubyLLM 1.15 today.

It ships image editing, cost tracking, cleaner token accounting, inferred tool parameters, additive callbacks, and Rails fixes.

The theme is simple: stop making me write glue code. If the computer can infer it, RubyLLM should infer it. If a provider reports usage, RubyLLM should turn it into cost. If Rails already has a blob, RubyLLM should not download it and upload it again.

Image Editing

RubyLLM.paint could already generate images:

image = RubyLLM.paint("A watercolor robot holding a Ruby gem")

Now with: turns it into an image edit:

image = RubyLLM.paint(
  "Turn the logo green and keep the background transparent",
  model: "gpt-image-1",
  with:…

My good mate Yaroslav wrote about his new solution for bundling a complete Bun runtime inside a gem - by all means, give it a read.

A lot of points he makes are very sensible, but for a few months now I have decided that - for myself - I will not be using any frontend bundling nor JS runtime at all. Here’s how you can do the same.

How useful is an asset pipeline?

There is, in fact, just one sensible use case for needing an asset pipeline, and it goes as follows.

• You are running revision abc0 on two machines, box1 and box2
• You make some glorious changes to your frontend code, and a new version gets prepared which requires those changes to be applied to the frontend assets your users…

For quite a few years the Rails project has been working with the Internet Bug Bounty (IBB). The IBB is an organization that awarded cash to security researchers that reported issues to OSS projects participating in the IBB. For quite a while I wasn’t certain about my feelings toward the program because I felt like cash rewards could incentivize low quality reports as well as encourage reporters to “haggle” about the severity of a particular bug (the IBB paid more when the bug was more severe). In the beginning that certainly was the case. We were fielding many low quality reports, and people were haggling over severity. But the program evolved, and despite the never-ending haggling, I felt…

Most marketing sites ship a SPA framework just to toggle a sidebar. Here's how we migrated an Astro site from React and Ark UI to native Web Components: 100 KB less JavaScript, no functionality lost, and a tiny library called nanotags that makes Custom Elements enjoyable to write.

A while ago, I shipped a marketing site built with Astro, React, and Ark UI. It worked fine, the deadline was tight, and React was the right call at the time. But I always knew I'd come back to it. Months later, I did. The result: 100 KB less JavaScript and no…

Introduction

I just returned from RubyKaigi 2026, held from April 22nd to 24th in Hakodate, Hokkaido. For those unfamiliar with it, RubyKaigi is the biggest Ruby conference in the world, drawing speakers, committers, and Rubyists from across the globe. As always, it managed to combine deep technical talks with a uniquely Japanese atmosphere that no other conference comes close to.

This year's edition had a distinctly Hokkaido feel: the cold winds of the northernmost island, the smell of the sea, kaiseki dinners, sashimi at conference parties, and onsens - a lot of onsens. The conference itself was in the south of Hokkaido (Hakodate). Still, for me, the trip extended significantly further…

Do you need to build a State Machine at least once in your career? May 5, 2026 Probably not. Built for Ruby on Rails Build Maps WithoutGoogle APIs Generate beautiful production-ready maps directly from your Rails backend. Fast rendering, zero external dependencies, full control. View Live Demo → Read Docs ✓ No API fees ✓ … Continue reading Do you need to build a State Machine at least once in your career? →

Frequently Played 🔗

I tend to listen to the same songs or albums on repeat that are evocative of how I’m feeling or what’s going on with me. Here is what I’m currently listening to over, and over, and over, and over, again.

As Alive As You Need Me To Be 🔗

Dive into the album. The NIN x Boys Noize collaboration builds on their work together on the B stage during the Peel It Back tour.

Full Lyrics

I never had a choice, connection
I never had a chance to catch my breath

One Of The Greats 🔗

The dirty riff, pointed lyrics, and stilted delivery are a fantastic combination.

Full Lyrics

Did I get it right? Do I win the prize?
Do you regret bringing me back to life?
…
I will let the light in, I will let some…

Blue Ridge Ruby 2026 🔗

I returned to Asheville for the first time since 2023. Both times for the Blue Ridge Ruby conference. Both times convinced for the same reason: organizer Jeremy Smith. Both times because I was selected as a speaker.

This post is not intended as a review of any of the talks, but to highlight the variety of great work from all involved. I hope you’ll seek out the full videos of all the sessions that interest you once they are available.

Preparing 🔗

Jeremy Smith conducted interviews with many of the speakers prior to the conference. Jeremy and I chatted about various topics related to conferences and writing. Beyond that, I mostly followed my own advice.

Day 1 🔗

Learning from…

AI-first Engineering is now the operating default in many organizations, including mine. Developers have kept up. Vibe coding became agentic engineering, and the race towards truly autonomous engineering isn’t slowing.

But what are we, managers, to do?

A manager job continues to include recruiting and retaining people, setting clear goals and expectations, fostering communication, owning team workflows, and coaching daily behaviors. To this list we must now add driving AI transformation.

Being a passive advocate is not enough. Unlike other subjects, no amount of AI training will help you keep up with the pace of evolution of this technology. Therefore, one cannot drive AI transformation…

A story of validating product demand on a $2K budget with 128 cold-traffic signups, an A/B winner at 95% confidence, and a sequenced playbook founders can run themselves.

Building a product is one thing; knowing someone is willing to pay for it is another. After shipping Thicket's marketplace in 2 weeks, Evil Martians built a full demand validation infrastructure around it. The results were 36K impressions, 128 cold-traffic waitlist joins, a landing page variant confirmed at 95% statistical…

I released kamal-backup today.

I run Chat with Work on Kamal, and I needed backups. There are already Kamal accessories for database backups. None of them also back up Active Storage. None use restic, so encryption, deduplication, and repository checks are on you. None ship a CLI with restores and drills. None produce evidence you can hand a security reviewer.

So I built one.

A gem and a Docker image

kamal-backup is two pieces: a Ruby gem you add to your Rails app, and a Docker image you boot as a Kamal accessory. They point at a restic repository you bring yourself.

The gem is your CLI. Local commands run directly on your machine using restic. Production-side commands shell out…

Introduction

Ship small nonroot images, scan for CVEs, and let Kamal gate traffic. Rails 8.1 gives us that path by default.

• Pin Ruby and keep it synced with .ruby-version
• Use multistage builds
• Precompile gems, app code, and assets during build
• Run production containers as a nonroot user
• Fail CI on high and critical CVEs

While our previous guide covered Rails 8 adds Kamal by default, this post focuses on containerization best practices, security hardening, and production optimization techniques.

The examples below use Rails 8.1, Ruby 3.4.9, and Kamal 2.11.0.

Understanding Rails Docker Setup

When we create a new Rails 8.1 application, it generates several Docker related…

A while back I decided to stop using Tailwind for new projects and to just write vanilla CSS instead.

But one thing I missed about Tailwind was the colour palette (here as CSS). If I wanted a light blue I could just use blue-100 and if I didn’t like it maybe try blue-200 or blue-50. I’m not very good with colours so it makes a big difference to me to have a reasonable colour palette that somebody who is better at colour than me has thought about.

But I’m also a little tired of those Tailwind colours, so I asked on Mastodon today what other colour palettes were out there. And then a friend said they wanted links to those colour palettes, so here’s a blog post so my friend can see them, and…

When you need to build HTML outside of a template, it’s tempting to concatenate strings and call html_safe on the result. This bypasses Rails’s built-in XSS protection entirely: any user input in that string goes straight to the browser unescaped.

The good news is you almost never need html_safe. Rails provides three underappreciated tools that handle escaping for you.

Instead of…

…calling html_safe on strings you’ve built by hand:

def status_badge(label, color)
  "<span class=\"badge badge-#{color}\">#{label}</span>".html_safe
end

def formatted_address(user)
  [user.street, user.city, user.postcode].compact.join("<br>").html_safe
end

def render_comment(comment)
  comment.body_html.…

Use…

…the right tool for…

Oh Asheville! How wonderful, weird, and full of art you are! Aside from returning with sore shins (central Ohio isn’t known for its hills…), Adam and I head home from North Carolina with two primary reflections we feel worth sharing here.

Ye old Blue Ridge Mountains

1. “Humans are the X-factor”. There’s something irreplaceable about a gathering of humans in-person; something unmistakably creative and promising. Something you feel more than you can describe; a moment where the whole is indeed greater than its constituent components. Small Ruby conferences ooze this feeling! My point here is simply that there is no replacement for…

Hello! One of my long term projects on here is figuring out how to write frontend Javascript without using Node or any other server JS runtime.

One issue I run into a lot in my frontend JS projects is that I don’t know how to write tests for them. I’ve tried to use Playwright in the past, but it felt slow and unwieldy to be starting these new browser processes all the time, and it involved some Node code to orchestrate the tests.

The result is that I just don’t test my frontend code which doesn’t feel great. Usually I don’t update my projects much either so it doesn’t come up that much, but it would be nice to be able to make changes with more confidence! So a way to do frontend testing…

Chris, Andrew, and David open with some classic confusion over what day it is then dive into Podia’s gradual rollout of a major new app version, including how the team is handling migration, feature flags, dogfooding, and eventual cleanup. From there, the discussion turns to underrated Rails routing features like direct routes and resolve routes, a newly merged Rails query command, observability improvements through Hatchbox’s AppSignal integration, and the ongoing pain of CSS build tooling in Rails apps. They also touch on conference season and their upcoming talks. Press download now to hear more! 

Links

• Judoscale- Remote Ruby listener gift
• Direct Routes
• Instance Public methods-direct (name,…

Hi, it’s Greg, bringing you the latest updates about Rails.

Updated guides await community input
The Asset Pipeline, Layouts & Rendering, Caching, and Active Job Basics Guides have all recently been updated and are open for community input. If you have time and would like to help review, please check the list of pull requests.

Apply for the Rails at Scale Summit
Reminder to apply by May 8 for the Rails at Scale Summit (Sept 22, Austin), a one day, invite-only gathering for engineers working on large-scale Rails applications.

Enable frozen string literal by default
New Rails apps now include a config/bootsnap.rb file that enables frozen string literals. This only impacts the application…

It is also possible to enable…

If you’ve followed Hanami for a while, you’ll know we’re rather fond of flowers. Today our garden has grown: Hanami, Dry, and Rom — three projects that have lived alongside each other across a decade and billions of downloads — are finally coming together as one. Welcome to Hanakai!

With Hanakai, we’re building a single shared community around the gems you know and love. The gems will carry on, now cared for by a bigger, unified team. And with our beautiful new website, now you can discover our vision for Ruby more easily than ever.

Loosely translated from the Japanese 花会, Hanakai means “flower fellowship”, sharing its first character 花 with Hanami, “flower viewing”. With…

Two weeks ago, the NPM endpoint that yarn audit from Yarn v1 uses, decided to stop working:

I imagine this won't be fixed (unfortunately), but it looks like npm has silently deprecated the security audit API that Yarn 1 uses:

yarn audit v1.22.22
error Error: https://registry.yarnpkg.com/-/npm/v1/security/audits: Request "https://registry.yarnpkg.com/-/npm/v1/security/audits" returned a 410
    at params.callback [as _callback] (/usr/share/yarn/lib/cli.js:66689:18)
    at self.callback (/usr/share/yarn/lib/cli.js:141410:22)
    at Request.emit (node:events:517:28)
    at Request.<anonymous> (/usr/share/yarn/lib/cli.js:142382:10)
    at Request.emit (node:events:517:28)
    at…

For years, our way of taking over legacy systems was simple: start small.

A client would come to us with an existing application and a list of things they needed done. Sometimes that list was mostly bugs. Sometimes it was features. Sometimes it was a mix of vague product wishes, or urgent production issues.

So we would begin with the safest tickets.

Fix a small bug. Change a minor behavior. Add a low-risk feature. Read the code around it. Ask questions. Ship. Repeat.

Starting with low-risk work lets us deliver value to the client while we build confidence and learn the codebase we’re working on.

As the weeks went by, we would move toward more complex parts of the system. By then, we…

Software consultancy and Rails Foundation member Planet Argon is once again collecting real-world insights from Rails developers and turning them into something the whole community can learn from.

The survey takes a deep look at how Rails is actually used today, including the tools people rely on, how teams and workflows are set up, how apps are built and deployed, and the challenges developers face. It also explores how AI is finding its place in everyday Rails work.

All results are shared openly, giving the community a clear, data-driven view of where things stand.

At RubyMine, we’re genuinely glad to see work like this continue. It takes real effort to run a survey at this…

The meetup took place last Friday, April 24th, at the FaHCE (Facultad de Humanidades y Ciencias de la Educación) in La Plata. The talks came from different places: empirical software engineering, custom coding agents, and multi-agent systems. The conversations continued afterward over beers and food provided by the organization.

Empirical software engineering: the scientific compass in the age of LLMs

The first talk was “Ingeniería de software empírica: La brújula científica en la era de los LLMs” (“Empirical software engineering: the scientific compass in the age of LLMs”) by Florencia Riva, a sociologist working at LIFIA.

Florencia’s talk pushed against a common temptation: asking LLMs…

Nine months ago, I introduced Perron, an OSS Rails-based static site generator. 190 commits and 18 releases later, lots of bugfixes and many new features—by yours truly and a few others—have been added. Today I am thrilled to announce Perron 1.0. 🥳

Want to check it out right away? Check out the docs, star it on GitHub or explore the showcase to see what others have built. 😻

Programmatic SEO

One of the most exciting features has been the ability to generate content programmatically. Whether you are building a SaaS directory, product comparison pages or anything else that mixes data with thousands of pages, with Perron this is now super easy.

Learn more about programmatic content creation.

…

RubyGems 4.0.11 includes enhancements and Bundler 4.0.11 includes enhancements, bug fixes and documentation.

To update to the latest RubyGems you can run:

gem update --system [--pre]

To update to the latest Bundler you can run:

gem install bundler [--pre]
bundle update --bundler=4.0.11

RubyGems Release Notes

Enhancements:

• Add commented-out rubygems_mfa_required to bundle gem template. Pull request #9487 by MatheusRich
• Clarify the name and meaning of the first argument to gem spec. Pull request #9476 by eregon
• Installs bundler 4.0.11 as a default gem.

Bundler Release Notes

Enhancements:

• Update gem creation guide URL to rubygems.org. Pull request #9500 by nissyi-gh
• Lo…

On April 23rd, we submitted a vulnerability report to the Nokogiri maintainers. It was the first one our team has filed using AI-assisted scanning. The maintainers accepted the report and published it as GHSA-c4rq-3m3g-8wgx.

The same week, news broke that Mythos, Anthropic’s most capable security model, had been accessed by unauthorized users through a third-party vendor. According to Anthropic, Mythos has identified thousands of zero-day vulnerabilities across every major operating system and web browser, including a 17-year-old remote code execution flaw in FreeBSD and a 27-year-old bug in OpenBSD. Two stories on the same shift, one from each side of it. The capability gap between…

Like a lot of developers right now, I’m figuring out how to support a “supervising several parallel development efforts at once” workflow. If you look for information on the web about how to implement a workflow like this, you’ll see a lot about git worktrees—where a single .git directory serves multiple working checkouts on different branches in different base directories.

But worktrees have some significant limitations. Not least of which is that their dependence on hardcoded fully-qualified paths written into configuration files not only makes worktrees non-portable, but also makes them DOA for any kind of containerized development environment. The worktree.useRelativePaths option…

Owning your server stack shouldn't be a source of anxiety. Unfortunately, it often is, especially if you only pay attention to the problems you can feel in your gut: Is the app running? Is it throwing exceptions? Does it seem fast enough? These are great intuitive measurements, but just as a doctor uses diagnostics to catch high blood pressure before it becomes a crisis, you need deeper visibility to detect memory leaks, CPU spikes, and disk consumption before they bring your project to a halt.

Hatchbox and AppSignal give you that "deeper visibility." They simplify infrastructure management by replacing manual monitoring with automated, real-time feedback. Together, they transform complex…

Mission: remove friction, not gates.

Use AI to speed research, produce better first drafts, and surface facts.

Never skip CI or reviewer sign-off.

• safer Rails changes
• repeatable reviews
• fewer context losses
• private memory that keeps improving

If it does not reduce mistakes, turn it off.

The Old Way

The old workflow was simple:

ask a model a question
copy the answer
paste into editor
manually fix context gaps
repeat

That works for small tasks.

It breaks down for real Rails work.

The missing context is predictable:

• repo conventions
• ownership mapping
• migration review expectations
• mandatory checks before merge

The result is familiar:

• good first draft
• wrong…

People focus so much on <h1> and alt attributes that they forget about usability.

Introduction

When discussing accessibility (a11y), we all focus on the structure of our <h1>/<h2>, the alt image texts, the contrast, and all the necessary rules to be covered. The problem is that during the process, we forget to think about usability: Is the page saying what it is supposed to be saying? Does the image description reflect what you can see there? Or take link text as an example: Does “Read More” explain what content the user is about to access?

Most of the time, usability is overshadowed by a focus on compliance with accessibility standards. As a result, we end up with a site that passes…

Take a trip through Joël and Aji’s YouTube recommended list as they go over the media that has inspired their work the most over the course of their careers.

Our hosts highlight different creators that feature regularly in their YouTube rotation, the long standing channels that have had the most impact on them, the video essays that inspire their work, as well as a small detour Into the world of history videos.

—

Here’s a handful of Joël and Ali’s personal recommendations:
VSauce - Veritasium - Jet Lag the Game - The Coding Train - Tom Scott - Kings and Generals - Daniel Steiner - Assassin’s Creed: Echoes of History - Jay Foreman / Map Men - Practical Engineering - Hannah…

Your hosts for this episode have been thoughtbot’s own Joël Quenneville and Aji Slater.

If you would like to support the show, head over to our Gi…

Abstract 🔗

Congrats on joining Hours Unlimited. The Math and Numbers team is excited to have you join us on our journey to redefine the importance of numerals. This introductory session will provide tips and tricks for best interacting with powerfuLLMachine, the next-level platform we use to unlock productivity and effectiveness.

Presentation Resources 🔗

• Slides
• Proposal

Reviews 🔗

• Rachael Wright-Munn

@kevin_j_m’s talk is a must-watch! I laughed so hard it hurt, and then almost cried. A satirical review of the industry today, with a poignant plea for the future.

• Christine Seeman

Kevin Murphy’s talk, InstiLLMent of Successful Practices in an Agentic World, started out funny. A hilarious bit about being…

When my Sidekiq job starts failing or slowing down, I often feel frustrated, especially if I don’t know how to fix it.

If you’re using Sidekiq to run your background jobs, you know what I’m talking about. It’s a vital element of your stack, handling everything from data exports to password reset requests. It runs silently in the background, and most of the time, you’re not even giving it a second thought.

However, when things go wrong, like pages loading slowly, emails never being sent, or exports failing, the impact can be huge. Getting to the bottom of the issue can be like finding a needle in a haystack.

That’s where AppSignal comes in. It can monitor your Sidekiq jobs, alert you when…

Authentication proves identity. Authorization enforces rules.

Most production authorization bugs in Rails are not syntax mistakes. They are missing tenant scopes, global find calls, or new controller actions that shipped without a policy check.

Rails 8.1.3 is current as of April 28, 2026, and Rails 8 ships with a good authentication generator. That solves only the first half. After sign in, we still need a clear rule for every sensitive read and write.

TL;DR

• Authentication is not authorization.
• Scope collections before loading records.
• Treat Model.find(params[:id]) as suspicious in multi-tenant code.
• Use view checks only for display. Controllers and APIs still need policy…

The…

I built a private local AI brain so assistants start with my defaults, not a blank prompt.

Generic assistants help, but they do not know how I review Rails, what I call risky, or why I choose boring over clever.

It has three parts:

• a Karpathy-style LLM Wiki for durable knowledge
• gbrain for my trained and distilled work signals
• gstack for using that memory inside day-to-day coding workflows

The important part: the private corpus stays private. I distill repeated patterns from my own data signals. I am not retraining a public model on private work. The raw work history, private comments, internal repo names, client names, server paths, credentials, and customer details are not…

Rails gives us a strong security baseline. It does not make an application secure by itself.

That distinction matters. Most real Rails security issues are not caused by Rails forgetting to escape HTML. They come from stale versions, missing authorization checks, exposed secrets, unsafe admin workflows, weak session handling, and business logic that trusts the wrong user.

This guide covers what Rails protects by default, what newer Rails versions add, and what every production Rails app still needs to own.

TL;DR

• As of April 2026, Rails 8.1.3 is the latest Rails release.
• Rails 8.1 adds local CI and credential fetching that make security checks easier to standardize.
• Rails protects…

Spinel in Practice: What Works and What Breaks April 27, 2026 Built for Ruby on Rails Build Maps WithoutGoogle APIs Generate beautiful production-ready maps directly from your Rails backend. Fast rendering, zero external dependencies, full control. View Live Demo → Read Docs ✓ No API fees ✓ Self-hosted ✓ Rails Native ✓ Fast Rendering Why … Continue reading Spinel in Practice: What Works and What Breaks →

Since I wrote about async Ruby and patched Solid Queue to support fibers, people keep asking the same questions. What happens when a fiber blocks? Don’t you still need threads? What about database transactions? What about Ractors?

This post answers all of it. From the ground up.

The four primitives

Ruby gives you four concurrency primitives: processes, threads, fibers, and Ractors. They nest. Every process has an implicit “main Ractor” where your code runs by default, so you never have to think about Ractors unless you explicitly create one. Without Ractors, the hierarchy is simply process – threads – fibers. With Ractors, it becomes:

I recently joined ShopTalk Show… episode 711 to be exact. Which… now has me thinking I should probably go get myself a Slurpee.

A few things we got into…

• Oh My Zsh started as shared aliases for teammates… and turned into a plugin ecosystem that keeps growing.
• Ruby on Rails in 2026… scaling isn’t the question anymore. Teams are wrestling with restraint and keeping systems understandable.
• LLMs and contribution… more people can open meaningful PRs now. Conventions and structure matter more than ever.
• Dependencies… every one feels small when added. Over time… they stack up and stick around longer than expected.

If you haven’t listened to ShopTalk Show… go subscribe.

Every two years, the team at Planet Argon runs the Rails Developer Survey. And every two years, I go through the same process… a long list of questions, a hard look at how much time we’re asking of respondents, and a lot of cutting.

If you’ve filled it out before, thank you. If this is new to you, here’s the short version: it’s an open survey for Rails developers at all experience levels and across all kinds of organizations. We compile the results and share everything publicly. No paywalls. No vendor spin. Just a snapshot of what the community is actually doing.

We first ran this in 2009… back when ”should I use Rails?” was still a serious question… and have been doing it every two years…

It’s become…

AI is everywhere right now. New models, agents, and tools appear almost daily, each promising to transform how companies work. But when teams come to us asking for help with AI, the challenge is rarely how to build something; instead, the question is what to build, and whether AI is even the right tool in the first place.

I was listening to an episode of the Super Data Podcast where Jon Krohn interviewed John Roese, Global CTO and Chief AI Officer at Dell, and one moment stuck with me. They were discussing why so many AI projects fail to move the needle inside organizations, and Roese put it succinctly: in many cases, AI is being used to automate work that was essentially BS to begin with.

Let's talk about what's really going on.

Continue Reading

13 years ago today I released the very first version of Mustermann.

It allows you to create Regexp-like pattern objects:

require "mustermann"

pattern = Mustermann.new("/hello/:name")

pattern =~ "/hello/world"      # => 0
pattern.params("/hello/world") # => {"name" => "world"}

This is what Sinatra uses to match routes and extract parameters from the request path.

Since then other projects besides Sinatra have started using Mustermann, which I think is fantastic, and it has been maintained by a great community of contributors over the years. I myself took a break from Mustermann from 2017 until two weeks ago!

Performance, performance, performance!

You can find the full list of…

The Rails Way in 2026

We had an interesting discussion at the Arkency weekly call today. The topic was how to define “the Rails Way” in 2026. The discussion branched in many directions, but I want to capture the result here.

We get to see a lot of Rails repositories. There’s a pattern that shows up so consistently that I think it now deserves to be called “the Rails Way” of 2026:

A fat model with a callback. The callback triggers a service object. The service object is executed as a background job.

That’s the clue of this post. If you zoom out across the Rails applications written or maintained in 2026, that’s the shape.

The disclaimer

A word about where we’re coming from. Arkency is a…

Hi, it’s Claudio Baccigalupo. Let’s explore what happened this week in Ruby on Rails.

Apply as a speaker for Rails World
Don’t miss out on the opportunity to join 1,200+ Rails developers this year at the Palmer Center, Austin, TX. Corporate Support tickets are on sale now. General admission tickets will be released on May 12.

How do you use Ruby on Rails?
The 2026 Ruby on Rails Community Survey is open! Takes just a few minutes. Please fill out and share with your team!

Bump required PostgreSQL version to 10.0
Until now Rails claimed support for PostgreSQL 9.3, which is incompatible with PostgreSQL 18 (released in 2025). The pg gem v1.6 already raised its minimum required PostgreSQL.…

This BREAKING NEWS episode is a candid reaction to Ruby Central’s latest shakeup, with Chris, Andrew, and David unpacking leadership departures, financial strain, the cancelled gala, and what all of it says about the organization’s direction. The conversation moves beyond the headlines into bigger questions about trust, transparency, community values, conference strategy, RubyGems sustainability, and whether Ruby Central can rebuild credibility by involving more of the community in what happens next. Hit download now to hear more! 

Links

• Judoscale- Remote Ruby listener gift
• A New Chapter for Ruby Central
• RubyConf 2026- July 14-16, Las Vegas, NV

Your hesitation before a big software project might be the strategy.

Continue Reading

You gave a handful of your devs access to Claude Code Max… and things moved fast. Output went up. Then things started to drift. Not just formatting or naming. Structure. Approach. Assumptions. One developer builds guardrails around it. Another uses it like autocomplete. A third treats it like a thinking partner. Same tool, same codebase… different results. The code starts to reflect how each person uses the tool, not how the team builds software together.

There’s a tension here that most teams are sidestepping. You can feel the inconsistency creeping in, but saying “we should align on how we use this” sounds heavy-handed. So it gets framed as experimentation. Let people figure it out. Give…

Hi everyone! Rails World is back heading to Austin, Texas on September 23-24, 2026 for the largest Rails World yet, with space for 1,200 developers, founders, and teams building with Rails, and we have a huge Rails World update for you!

First: The Rails World website is finally live thanks to our website sponsor WyeWorks, and the amazing work of developers Jessica Ferreira and Lucas Troncoso and designer Jomiro Eming. Big thanks to the team!

Check it out.

Apply to speak at Rails World 2026

Most of all, we’re excited to announce that the CFP for Rails World 2026 is officially open.

Submit your talk by May 16: https://sessionize.com/rails-world-2026/

What we’re looking for in 2026…

JavaScript errors (either vanilla or with Stimulus controllers) often happen silently in the browser, leaving your users confused about what went wrong. “Why did nothing happen?”. “I just did click the button!” “Let’s try again…”. Still nothing… Starts furiously clicking the button now.

This poor user experience can be frustrating and can lead to more support tickets that could have been prevented. In this article I want to show how to build a simple class that catches unhandled JavaScript errors and displays them to the user in a friendly banner. It’s a small but meaningful improvement to your app’s user experience.

As always, the code can be found on GitHub.

The silence of the errors

Whe…

MapView Flyers are at RubyKaigi 2026 – Here's the Must-Watch Talk Schedule April 22, 2026 Scan to try Live Demo Available Introducing MapView Render beautiful, production-ready maps directly from your Ruby backend. No external APIs. No dependencies. Just pure speed and control. ✓ Zero external dependencies ✓ Lightning-fast rendering ✓ Production-ready & battle-tested Try … Continue reading MapView Flyers are at RubyKaigi 2026 – Here’s the Must-Watch Talk Schedule →

If you haven't yet seen the statement from the Ruby Central Board, the organization has been preparing for some significant changes. RubyConf, our flagship annual event, is also moving and adapting with these transitions.

This year, we ambitiously envisioned several exciting new programs designed to reimagine RubyConf and bring new energy, new voices, and new opportunities to the conference. We took a step back, reevaluated each of these programs, and took fresh creative approaches to bringing a clearer vision for what RubyConf can and should be. 

Here’s what some of the new programming will look like going forward.

Steering Committees and Town Hall Sessions

This year, we want to try something…

The agent-led growth playbook: how to make AI agents discover, use, and pay for your developer tool, and defend against the ones you didn't invite. LLM discoverability, agent-first onboarding, agent payments, AX security.

In early 2025, Matt Biilmann, CEO of Netlify, coined the term "agent experience" or AX: how AI agents experience your product as a user. AX extends developer experience and drives agent-led growth: adoption that happens because agents recommend, set up, and integrate your tool without a human in the loop. Three things to get right: make agents discover your tool. Make agents use your…

How much of your day to day life is based on using digital tools?

95% of U.S. adults use the internet, 91% own a smartphone, and 78% subscribe to high-speed internet at home. 41% report being online “almost constantly.” Americans now average over 5 hours a day on their phones, a 14% jump from the prior year, not including time spent working or other types of screen time. (Pew Research Center, survey conducted Feb. 5 to June 18, 2025.)

Of the adult population, more than 7 million Americans are living with uncorrectable vision loss, including over 1 million who are blind. Broader survey data shows that nearly 50 million adults report some difficulty seeing, even when wearing glasses.

In an…

The JRuby community is pleased to announce the release of JRuby 10.1.0.0.

• Homepage: https://www.jruby.org/
• Download: https://www.jruby.org/download

JRuby 10.1.0.x targets Ruby 4.0 compatibility.

Thank you to our contributors this release, you help keep JRuby moving forward!

JRuby 10.1: Experimenting and Evolving

JRuby 10.1.0.0 is our first major release since catching up with Ruby compatibility. We have used this opportunity to explore many experimental optimizations and improvements we have been chasing for many years. Ruby 4.0 compatibility is largely complete, but there will be additional features added in update releases. We also plan to continue with large scale experiments…

Ruby 4.0.3 has been released.

This release only contains ERB 6.0.1.1, which fixes CVE-2026-41316.

If your application calls Marshal.load on untrusted data AND has both erb and activesupport loaded, please update your ERB to 4.0.3.1, 4.0.4.1, 6.0.1.1, 6.0.4 or later. You may use this Ruby 4.0.3 release to do so.

Release Schedule

We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent regular release. Ruby 4.0.4 will be released in May, 4.0.5 in July, 4.0.6 in September, and 4.0.7 in November.

If a change arises that significantly affects users, a release may occur earlier than planned, and the subsequent schedule may shift…

Last year I moved the LLM streaming jobs in Chat with Work to Async::Job. It was fast. Genuinely fast. Fiber-based execution with Redis, thousands of concurrent jobs on a single thread. I was so convinced that I wrote a whole post about why async Ruby is the future for AI apps and recommended it to everyone.

Then I started hitting walls.

Async::Job doesn’t persist jobs. They go into Redis and they’re gone. Mission Control shows nothing. Background jobs in Rails are already quieter than the rest of your application – they fail without anyone noticing unless you go looking. Even with Honeybadger catching exceptions, I still want to see the full picture: which jobs are queued, which are…

We published security advisory for CVE-2026-41316.

CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / def_class

A deserialization vulnerability exists in ERB. This vulnerability has been assigned the CVE identifier CVE-2026-41316. We recommend upgrading the erb gem.

Scope

Any Ruby application that calls Marshal.load on untrusted data AND has both erb and activesupport loaded is vulnerable to arbitrary code execution. This includes:

• Ruby on Rails applications that import untrusted serialized data – any Rails app (every Rails app loads both ActiveSupport and ERB) using Marshal.load for caching, data import, or IPC
• Ruby tools that import untrusted…

Details

ERB…

April 20, 2026 Scan to try Live Demo Available Introducing MapView Render beautiful, production-ready maps directly from your Ruby backend. No external APIs. No dependencies. Just pure speed and control. ✓ Zero external dependencies ✓ Lightning-fast rendering ✓ Production-ready & battle-tested Try the Live Demo → Read Docs In 2025, at the RubyWorld Conference, … Continue reading Generating thousands of maps per minute in Ruby →

A few weeks ago, Axios, the popular HTTP client for JavaScript, suffered a supply chain attack on NPM. An attacker compromised the lead maintainer’s NPM account through social engineering and published two backdoored versions that delivered a cross-platform remote access trojan (RAT) to macOS, Windows, and Linux systems. Axios has over 100 million weekly downloads. The blast radius was enormous.

Not long before that, LiteLLM, a popular Python AI gateway, had a similar incident on PyPI. Compromised credentials were used to push malicious packages that harvested environment variables, SSH keys, cloud credentials, and database passwords.

Both attacks followed the same playbook: gain access…

Over the last few months, there has been a lot of talk about making Bundler faster, both by improving it directly, or by reimplementing it in another language, and while it may surprise some, that didn’t excite me much.

Don’t get me wrong, all other things being equal, faster is better, so if Bundler gets faster without me having to change my toolchain one bit, I’ll happily take it. But I certainly would not bother migrating to something else just for speed.

Instead, there are a number of features I believe Bundler is missing, and that over the years, I tried to convince Bundler’s maintainers to consider them, but without any success.

Why Bundler Is Fast Enough For Me

Given how much I…

The story starts with Rust 1.85.0 giving me a surprise SIGTRAP in some test code. For reasons not important here, I had to bump opt-level from 0 to 1 for tests. That made a bunch of tests fail with SIGTRAP, whose default signal handler terminates the process.

The SIGTRAP happened in Rust code code that call C.

Passing a Rust closure through C code

The code that broke passes a Rust closure through a C function and invokes the closure in a callback.

The C API takes a user data argument in addition to the callback function, for passing through context:

// Calls (*proc)(data). VALUE is uintptr_t.
VALUE rb_protect(VALUE (* proc) (VALUE), VALUE data, int *pstate);

Each closure has a…

Back in November last year, I started a new job at Intercom, and one of the first projects I got to work on was improving the Intercom monolith CI with some of my new colleagues.

Interestingly, I never got around to talking about CI on this blog, even though I consider it to be one of my main areas of expertise. That topic is way beyond the subject I’d like to talk about here, but just to give a bit of context, a key driver in CI performance and user experience is how fast you can get a Ruby process ready to run tests.

When working with very large test suites, it becomes essential to run tests in parallel. If you have a test suite that runs in say, 1 hour, on paper, you can run it in 15…

In this episode of RECORDABLES, we dive into the thinking behind the ONCE open source app server and what it takes to turn self-hosted software into something anyone can run. David Heinemeier Hansson and Kevin McConnell walk through the shift from single-app installs to a console-like system that can run multiple applications on one machine, and the philosophy that guided that evolution.

Along the way, they explore the tradeoffs between simplicity and flexibility, the role of Docker and Kamal in making deployments seamless, and why ease of use matters more than raw capability. This conversation is a look at packaging complexity into something approachable and how ONCE aims to make running…

Chris and David welcome guest John Athayde, who runs the branding and UX consultancy, Meticulous. They dive into John’s unusual path through the Rails world as a designer, front-end developer, consultant, author, and UX thinker. The conversation moves from early Rails history and The Rails View into a broader discussion about why designers need to understand implementation, how AI is changing product and UI work, where component-based design is headed, and why browser support is still one of the messiest parts of modern web development. Hit download now to hear more!

Links

• John Athayde Website
• John Athayde X
• John Athayde Bluesky
• Meticulous
• Build Software Like Pixar Makes Movies with John…

Hi, Wojtek here. Let’s see what’s new in the Rails on this finally sunny day (at least in my corner of the world ;-)

Query command for read-only database queries
Adds rails query — a read-only database query command with structured JSON output.

rails query "Account.where(plan: 'premium').limit(2)"

{
  "columns": ["id", "name", "plan", "created_at"],
  "rows": [
    [1, "Acme", "premium", "2025-01-15T10:30:00Z"],
    [2, "Widgets Co", "premium", "2025-03-22T14:00:00Z"]
  ],
  "meta": {
    "row_count": 2,
    "query_time_ms": 4.2,
    "page": 1,
    "per_page": 100,
    "has_more": false,
    "sql": "SELECT \"accounts\".* FROM \"accounts\" WHERE \"accounts\".\"plan\" = 'premium' LIMIT 2"…

There are many more possibilities and additional subcommands available, such as query schema, query models, and query explain.

Add charset=utf-8 to Content-Type for static CSS and HTML files
ActionDispatch::FileHandler#try_files now appends ; charset=utf-8 to the Content-Type header for CSS and HTML static files. This is consistent with the rest of the Rails stack, which already…

Add offline fallback page to the PWA scaffold
New Rails apps now include an app/views/p…

If you’re building LLM-powered features in a regulated industry, sending unfiltered PII to a third-party provider isn’t just risky, it may violate compliance requirements like HIPAA or GDPR.

That’s why we originally built Top Secret. However, when we first released it, RubyLLM was still in its early days, and I found I was working with provider APIs directly, such as Ruby OpenAI or OpenAI Ruby. This meant I needed to manually orchestrate the filtering and restoration process, which looked something like this:

require "openai"
require "top_secret"

openai = OpenAI::Client.new

original_messages = [
  "Ralph lives in Boston.",
  "You can reach them at ralph@thoughtbot.com or 877-976-2687"
]

…