framework

Ruby on Rails: security advisories, deprecations and releases

Ruby web framework.

Get Ruby on Rails alerts Free. No account. One email, and only when something touches your stack.

Items, 90 days: 63
Critical: 0
Last critical: none
This week: 3

What your digest would have held this week

3 items from the last 7 days. Zero sends only the ones that touch your stack.

Security 4

HIGH Ruby on Rails Blog · 23 Oct 2026

Rails now creates tmp/local_secret.txt with 0600 permissions

Development and test secret_key_base files are now owner-only readable, tightening security on non-Windows platforms.
HIGH Ruby on Rails Blog · 23 Oct 2026

Rails fixes redirect template host injection vulnerability

redirect("/%{path}") templates now percent-encode delimiters to prevent host header injection attacks.
HIGH Ruby on Rails Blog · 9 Oct 2026

Stop setting public-read ACL on S3 uploads for public: true services

Rails now skips ACLs for S3 uploads when the service is set to public: true. Use bucket policies instead to avoid failures on ACL-rejecting buckets.
MEDIUM Ruby on Rails Blog · 9 Oct 2026

Fix rails.deprecation structured events not being emitted

Rails now ensures rails.deprecation events are emitted when using structured event subscribers for deprecation notifications.

Deprecations 8

LOW Ruby on Rails Blog · 23 Oct 2026

Rails deprecates ssl_default_redirect_status and raise_on_assign_to_attr_readonly

ssl_default_redirect_status is deprecated; raise_on_assign_to_attr_readonly will be removed in Rails 9.0.
MEDIUM Ruby on Rails Blog · 23 Oct 2026

Rails bumps minimum supported MySQL version to 5.7.9

MySQL 5.7.9 is now the minimum supported version; old ROW_FORMAT=DYNAMIC workarounds removed.
HIGH ACT BY 7 NOV 2026 endoflife.date · 8 Oct 2026

Ruby on Rails 8.0 reaches end of life on 2026-11-07

Ruby on Rails 8.0 reaches end of life on 2026-11-07, as listed by endoflife.date.
HIGH Ruby on Rails Blog · 3 Oct 2026

Bump minimum Ruby version to 3.3.5

Rails now requires Ruby 3.3.5 or later. This change removes the WeakKeyMap polyfill and enables performance improvements.
HIGH Ruby on Rails Blog · 3 Oct 2026

Remove support for dynamic controller/action in routes

Dynamic :controller and :action segments in routes are removed. Routes must explicitly map to controller#action.
LOW Ruby on Rails Blog · 3 Oct 2026

Deprecate supports_datetime_with_precision?

Method deprecated as all supported databases now handle datetime precision natively.
MEDIUM Ruby on Rails Blog · 3 Oct 2026

Deprecate ActiveRecord::Callbacks::CALLBACKS constant

CALLBACKS constant deprecated. It skips callbacks such as before_commit and will be removed in Rails 9.
MEDIUM ACT BY 7 NOV 2026 endoflife.date · 2 Oct 2026

Ruby on Rails 8.0 reaches end of life on 2026-11-07

Ruby on Rails 8.0 reaches end of life on 2026-11-07, as listed by endoflife.date.

Releases 44

LOW NEW THIS WEEK Ruby on Rails Blog · 30 Oct 2026

Header-only CSRF no longer renders tokens

Forms and button_to stop emitting authenticity tokens under :header_only strategy, eliminating per-request byte changes.
LOW NEW THIS WEEK Ruby on Rails Blog · 30 Oct 2026

Capybara and Selenium no longer load on boot

Gemfile now marks capybara and selenium-webdriver with require: false, speeding non-system-test boot times.
MEDIUM Ruby on Rails Blog · 23 Oct 2026

Rails fixes numericality validation for decimal columns with implicit scale

Numericality validation now correctly handles database-backed decimal columns without explicit scale.
LOW Ruby on Rails Blog · 23 Oct 2026

Rails allows Active Record objects in tuple where syntax

Column tuples in where() now accept Active Record objects, expanding them to primary key values.
LOW Ruby on Rails Blog · 23 Oct 2026

Rails fixes PostgreSQL search path truncation issues

db:truncate_all now correctly handles shadowed tables and dotted table names on PostgreSQL.
MEDIUM Ruby on Rails Blog · 23 Oct 2026

Rails raises when deliver_all_later called with already accessed message

deliver_all_later now raises when messages have already been accessed, matching deliver_later behavior.
MEDIUM Ruby on Rails Blog · 23 Oct 2026

Rails fixes in_order_of returning no records after double serialization

Fixed in_order_of for types where serialized values change on re-serialization, such as deterministic encryption and JSON columns.
MEDIUM Ruby on Rails Blog · 23 Oct 2026

Rails uses native RENAME COLUMN for SQLite rename_column

SQLite rename_column now uses ALTER TABLE RENAME COLUMN, preserving triggers, foreign keys, and indexes.
LOW Ruby on Rails Blog · 23 Oct 2026

Rails adds before_ractorize load hook for Ractor preparation

New before_ractorize hook allows gems and frameworks to prepare state before app ractorization.
MEDIUM Ruby on Rails Blog · 23 Oct 2026

Rails adds config.zjit to enable ZJIT after boot

New config.zjit option enables ZJIT post-boot, taking precedence over YJIT when available.
HIGH Ruby on Rails Blog · 23 Oct 2026

Rails 8.2: JSON default for signed messages, no more Marshal fallback

Rails 8.2 sets config.active_support.message_serializer to :json by default, stopping Marshal deserialization for signed IDs and Active Storage keys.
MEDIUM Ruby on Rails Blog · 17 Oct 2026

Fix composite-key association queries

Empty composite-key conditions return no rows without querying; bare IDs now raise an ArgumentError.
MEDIUM Ruby on Rails Blog · 17 Oct 2026

Fix join order when eager loading with merged joins

Rails now emits eager-load joins before merged joins, eliminating invalid SQL references.
INFO Ruby on Rails Blog · 17 Oct 2026

Render collections with fewer intermediate objects

Action View now renders non-cached collection partials into one buffer, cutting allocations.
INFO Ruby on Rails Blog · 17 Oct 2026

Speed up String#blank? for ASCII strings

String#blank? now scans ASCII bytes instead of regex, keeping the old path for non-ASCII strings.
LOW Ruby on Rails Blog · 17 Oct 2026

Keep Active Job retry counts out of the original payload

Retrying a job no longer mutates the original payload counters, preventing FrozenError and test pollution.
HIGH Ruby on Rails Blog · 17 Oct 2026

Keep connected_to state isolated between streaming and request threads

ActionController::Live now clones the connected_to stack so streaming threads cannot affect request threads.
INFO Ruby on Rails Blog · 17 Oct 2026

Only consult connection pools the execution context has used

Active Record now tracks used pools and skips unused ones when clearing caches and releasing connections.
HIGH Ruby on Rails Blog · 17 Oct 2026

Preserve the original error when SQLite rolls back a transaction

Rails now preserves the real SQLite error instead of masking it with a redundant rollback failure.
INFO Ruby on Rails Blog · 17 Oct 2026

Share read-only default attributes in Active Record

Active Record shares default attribute objects across instances, yielding 15 % faster benchmarks.
MEDIUM Ruby on Rails Blog · 17 Oct 2026

Fix eager loading with a limit and a CTE join

Rails now recognizes CTE joins in eager-load queries with limits, avoiding ConfigurationError.
MEDIUM Ruby on Rails Blog · 17 Oct 2026

Include PostgreSQL extension schemas in schema dumps

Schema dumps now emit CREATE SCHEMA IF NOT EXISTS for relocatable extensions outside dump_schemas.
MEDIUM Ruby on Rails Blog · 9 Oct 2026

Add maintenance_database option to PostgreSQL adapter

Rails now supports a maintenance_database option for PostgreSQL tasks, enabling compatibility with managed services that lack a postgres database.
LOW Ruby on Rails Blog · 9 Oct 2026

Fix 5.1 migrations to honor table_name_prefix and suffix

Rails 5.1 and earlier migrations now respect table_name_prefix and table_name_suffix settings during change_column operations.
LOW Ruby on Rails Blog · 9 Oct 2026

Freeze events emitted by ActiveSupport::EventReporter

ActiveSupport::EventReporter now freezes events to prevent subscribers from mutating events, raising FrozenError if attempted.
INFO Ruby on Rails Blog · 9 Oct 2026

Honor explicit type on SQLite references in 6.0 migrations

Rails 6.0 migrations on SQLite now honor explicit type declarations on references, leaving unspecified references as integers.
LOW Ruby on Rails Blog · 9 Oct 2026

Forward extra options from has_one_attached and has_many_attached

Rails now forwards additional options like deprecated to attachment declarations, allowing custom behavior on has_one_attached and has_many_attached.
LOW Ruby on Rails Blog · 3 Oct 2026

Drop needless schema qualification in PostgreSQL schema.rb

Extensions are now dumped without schema prefix unless explicitly created with SCHEMA clause.
MEDIUM Ruby on Rails Blog · 3 Oct 2026

Use stdin for MySQL db:schema:load

structure_load now pipes SQL via stdin, matching SQLite behavior and ignoring --commands flag.
HIGH Ruby on Rails Blog · 3 Oct 2026

Backport alias fallback fixes to 8-1-stable

Active Model alias fallback fixes for attribute_methods, serialization, and validations are backported to 8.1.
HIGH Ruby on Rails Blog · 3 Oct 2026

Restore integer bounds from JSON schema cache

Minimum and maximum integer values are now restored from the JSON schema cache, preventing FrozenError.
MEDIUM Ruby on Rails Blog · 3 Oct 2026

Remove SET FOREIGN_KEY_CHECKS from MySQL structure load

db:schema:load no longer sends SET FOREIGN_KEY_CHECKS; checks remain off for the session only.
HIGH Ruby on Rails Blog · 3 Oct 2026

Fix BigInteger casting truncation for large decimals

BigInteger now supports up to 2000 bytes on PostgreSQL, fixing truncation for decimal(20,0) columns.
HIGH Ruby on Rails Blog · 3 Oct 2026

Avoid deadlocks on concurrent find_or_create_by in MySQL

Shared lock is now used when reading after duplicate insert to prevent MySQL deadlocks.
MEDIUM Ruby on Rails Blog · 3 Oct 2026

Make ParamsWrapper ractor safe

ActionController::ParamsWrapper::Options is now deeply frozen and mutex-free for Ractor sharing.
HIGH Ruby on Rails Blog · 3 Oct 2026

Fix non-ASCII strict locals in ASCII templates

Non-ASCII default values in locals: magic comments now render correctly in ASCII-only ERB templates.
MEDIUM Ruby on Rails Blog · 3 Oct 2026

Fix BroadcastLogger#tagged for multiple loggers

BroadcastLogger now correctly handles #tagged when broadcasting to several tagging loggers.
LOW Ruby on Rails Blog · 3 Oct 2026

Avoid aliasing Kernel#respond_to? in ActiveModel

respond_to_without_attributes? is now defined with define_method instead of alias to avoid deprecation.
HIGH Ruby on Rails Blog · 3 Oct 2026

Active Record Ractor-friendly connection handling

New connection handler, pool, and proxy enable safe database access from non-main Ractors.
MEDIUM Ruby on Rails Blog · 3 Oct 2026

Schema-qualify regclass cast in foreign key check

check_all_foreign_keys_valid! now uses schema-qualified regclass casts for multi-schema setups.
HIGH Ruby on Rails Blog · 3 Oct 2026

Fix Server-Timing double-counting of nested events

Server-Timing header now correctly reports nested events that share the same name.
HIGH Ruby on Rails Blog · 3 Oct 2026

Rails 8.2 defaults to ERB::Herb for HTML templates

New config.action_view.erb_implementation default is :herb for HTML in Rails 8.2. Other formats still use Erubi.
INFO Ruby on Rails Blog · 3 Oct 2026

Rails Version 8.1.4 has been released

Rails 8.1.4 is now available with updates across all core components.
INFO Ruby on Rails Blog · 3 Oct 2026

Rails Version 7.2.4 has been released!

Rails 7.2.4 is the final release in the 7.2.x series. Only 8.0.x and 8.1.x will receive future security and bug fixes.

News and tools 7

INFO NEW THIS WEEK Ruby on Rails Blog · 30 Oct 2026

Performance tuning guide open for review

Pull request updates the Rails performance tuning guide; feedback from production engineers welcome.
INFO Ruby on Rails Blog · 22 Oct 2026

On Rails: Donorbox scales Rails app for nonprofits

Podcast episode with Donorbox engineers discussing their decade-old Rails app, traffic handling, CI on developer machines, and using agent docs to guide AI coding tools.
INFO Ruby on Rails Blog · 13 Oct 2026

Agents on Rails Stage 3 benchmark released

Rails team publishes Stage 3 of its AI agent benchmark, combining all stages into one leaderboard that tests long-running multi-step tasks on real Rails apps.
INFO Ruby on Rails Blog · 3 Oct 2026

Autoloading and Reloading guide community review

Updated autoloading documentation is open for community feedback before merging into the official Rails guides.
INFO Ruby on Rails Blog · 3 Oct 2026

Rails World recordings are online

All talks from the recent Rails World conference are now available to watch on YouTube one week after the event.
MEDIUM Ruby on Rails Blog · 3 Oct 2026

Asset Pipeline guide rewritten for Propshaft

The Asset Pipeline guide now focuses on developer usage and Propshaft. Composite primary keys guide also updated.
INFO Ruby on Rails Blog · 3 Oct 2026

Rails World 2026 recap: All talks online

All Rails World 2026 talks are now available on YouTube, covering Rails 8.2 features and AI-assisted development techniques.

Only hear about Ruby on Rails when it touches your stack

Tell Zero what you run. You get one email, and only on the days something above applies to you.

Get Ruby on Rails alerts