Ruby: security advisories, deprecations and releases

Rails now creates tmp/local_secret.txt with 0600 permissions

Development and test secret_key_base files are now owner-only readable, tightening security on non-Windows platforms.

Rails fixes redirect template host injection vulnerability

redirect("/%{path}") templates now percent-encode delimiters to prevent host header injection attacks.

Ruby 4.0.9 / 3.4.12 / 3.3.13 fix Onigmo RCE bugs

Ruby patches memory-corruption bugs in its Regexp engine that GitLab found could be exploited for remote code execution when an attacker controls the pattern passed to Regexp.new or similar.

CVE-2026-110264 CVE-2026-89078 CVE-2026-93577 CVE-2026-97229

GitHub expands malware advisories to eight ecosystems via OpenSSF

GitHub integrated OpenSSF malicious-packages data into its Advisory Database, extending malware detection from npm to PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer.

Stop setting public-read ACL on S3 uploads for public: true services

Rails now skips ACLs for S3 uploads when the service is set to public: true. Use bucket policies instead to avoid failures on ACL-rejecting buckets.

Fix rails.deprecation structured events not being emitted

Rails now ensures rails.deprecation events are emitted when using structured event subscribers for deprecation notifications.

Rails deprecates ssl_default_redirect_status and raise_on_assign_to_attr_readonly

ssl_default_redirect_status is deprecated; raise_on_assign_to_attr_readonly will be removed in Rails 9.0.

Rails bumps minimum supported MySQL version to 5.7.9

MySQL 5.7.9 is now the minimum supported version; old ROW_FORMAT=DYNAMIC workarounds removed.

Ruby on Rails 8.0 reaches end of life on 2026-11-07

Ruby on Rails 8.0 reaches end of life on 2026-11-07, as listed by endoflife.date.

Bump minimum Ruby version to 3.3.5

Rails now requires Ruby 3.3.5 or later. This change removes the WeakKeyMap polyfill and enables performance improvements.

Remove support for dynamic controller/action in routes

Dynamic :controller and :action segments in routes are removed. Routes must explicitly map to controller#action.

Deprecate supports_datetime_with_precision?

Method deprecated as all supported databases now handle datetime precision natively.

Deprecate ActiveRecord::Callbacks::CALLBACKS constant

CALLBACKS constant deprecated. It skips callbacks such as before_commit and will be removed in Rails 9.

Ruby 3.3 reaches end of life on 2027-03-31

Ruby 3.3 reaches end of life on 2027-03-31, as listed by endoflife.date.

Ruby on Rails 8.0 reaches end of life on 2026-11-07

Ruby on Rails 8.0 reaches end of life on 2026-11-07, as listed by endoflife.date.

Header-only CSRF no longer renders tokens

Forms and button_to stop emitting authenticity tokens under :header_only strategy, eliminating per-request byte changes.

Capybara and Selenium no longer load on boot

Gemfile now marks capybara and selenium-webdriver with require: false, speeding non-system-test boot times.

Rails fixes numericality validation for decimal columns with implicit scale

Numericality validation now correctly handles database-backed decimal columns without explicit scale.

Rails allows Active Record objects in tuple where syntax

Column tuples in where() now accept Active Record objects, expanding them to primary key values.

Rails fixes PostgreSQL search path truncation issues

db:truncate_all now correctly handles shadowed tables and dotted table names on PostgreSQL.

Rails raises when deliver_all_later called with already accessed message

deliver_all_later now raises when messages have already been accessed, matching deliver_later behavior.

Rails fixes in_order_of returning no records after double serialization

Fixed in_order_of for types where serialized values change on re-serialization, such as deterministic encryption and JSON columns.

Rails uses native RENAME COLUMN for SQLite rename_column

SQLite rename_column now uses ALTER TABLE RENAME COLUMN, preserving triggers, foreign keys, and indexes.

Rails adds before_ractorize load hook for Ractor preparation

New before_ractorize hook allows gems and frameworks to prepare state before app ractorization.

Rails adds config.zjit to enable ZJIT after boot

New config.zjit option enables ZJIT post-boot, taking precedence over YJIT when available.

Rails 8.2: JSON default for signed messages, no more Marshal fallback

Rails 8.2 sets config.active_support.message_serializer to :json by default, stopping Marshal deserialization for signed IDs and Active Storage keys.

Ruby 4.0.9 Released

Ruby 4.0.9 fixes Regexp compilation bugs exploited by GitLab CVEs. Update recommended for all Ruby 4.0.x installations.

CVE-2026-110264 CVE-2026-89078 CVE-2026-93577 CVE-2026-97229

Ruby 3.4.12 Released

Ruby 3.4.12 patches Regexp compilation bugs exploited by four GitLab CVEs and includes other fixes.

CVE-2026-110264 CVE-2026-89078 CVE-2026-93577 CVE-2026-97229

Ruby 3.3.13 Released

Ruby 3.3.13 is a security and bug-fix release that patches two resolv CVEs and several Regexp compilation issues exploited in GitLab CVEs.

CVE-2026-110264 CVE-2026-80212 CVE-2026-80213 CVE-2026-89078 CVE-2026-93577 CVE-2026-97229

Ruby 4.0.8 Released

Ruby 4.0.8 is a routine bug-fix release; upgrade to get the fixes.

Fix composite-key association queries

Empty composite-key conditions return no rows without querying; bare IDs now raise an ArgumentError.

Fix join order when eager loading with merged joins

Rails now emits eager-load joins before merged joins, eliminating invalid SQL references.

Render collections with fewer intermediate objects

Action View now renders non-cached collection partials into one buffer, cutting allocations.

Speed up String#blank? for ASCII strings

String#blank? now scans ASCII bytes instead of regex, keeping the old path for non-ASCII strings.

Keep Active Job retry counts out of the original payload

Retrying a job no longer mutates the original payload counters, preventing FrozenError and test pollution.

Keep connected_to state isolated between streaming and request threads

ActionController::Live now clones the connected_to stack so streaming threads cannot affect request threads.

Only consult connection pools the execution context has used

Active Record now tracks used pools and skips unused ones when clearing caches and releasing connections.

Preserve the original error when SQLite rolls back a transaction

Rails now preserves the real SQLite error instead of masking it with a redundant rollback failure.

Share read-only default attributes in Active Record

Active Record shares default attribute objects across instances, yielding 15 % faster benchmarks.

Fix eager loading with a limit and a CTE join

Rails now recognizes CTE joins in eager-load queries with limits, avoiding ConfigurationError.

Include PostgreSQL extension schemas in schema dumps

Schema dumps now emit CREATE SCHEMA IF NOT EXISTS for relocatable extensions outside dump_schemas.

Ractor ownership enforcement breaks monkey-patching

Non-owner Ractors can no longer modify classes/modules, breaking shared monkey-patches and autoload registration.

Add maintenance_database option to PostgreSQL adapter

Rails now supports a maintenance_database option for PostgreSQL tasks, enabling compatibility with managed services that lack a postgres database.

Fix 5.1 migrations to honor table_name_prefix and suffix

Rails 5.1 and earlier migrations now respect table_name_prefix and table_name_suffix settings during change_column operations.

Freeze events emitted by ActiveSupport::EventReporter

ActiveSupport::EventReporter now freezes events to prevent subscribers from mutating events, raising FrozenError if attempted.

Honor explicit type on SQLite references in 6.0 migrations

Rails 6.0 migrations on SQLite now honor explicit type declarations on references, leaving unspecified references as integers.

Forward extra options from has_one_attached and has_many_attached

Rails now forwards additional options like deprecated to attachment declarations, allowing custom behavior on has_one_attached and has_many_attached.

Drop needless schema qualification in PostgreSQL schema.rb

Extensions are now dumped without schema prefix unless explicitly created with SCHEMA clause.

Use stdin for MySQL db:schema:load

structure_load now pipes SQL via stdin, matching SQLite behavior and ignoring --commands flag.

Backport alias fallback fixes to 8-1-stable

Active Model alias fallback fixes for attribute_methods, serialization, and validations are backported to 8.1.

Restore integer bounds from JSON schema cache

Minimum and maximum integer values are now restored from the JSON schema cache, preventing FrozenError.

Remove SET FOREIGN_KEY_CHECKS from MySQL structure load

db:schema:load no longer sends SET FOREIGN_KEY_CHECKS; checks remain off for the session only.

Fix BigInteger casting truncation for large decimals

BigInteger now supports up to 2000 bytes on PostgreSQL, fixing truncation for decimal(20,0) columns.

Avoid deadlocks on concurrent find_or_create_by in MySQL

Shared lock is now used when reading after duplicate insert to prevent MySQL deadlocks.

Make ParamsWrapper ractor safe

ActionController::ParamsWrapper::Options is now deeply frozen and mutex-free for Ractor sharing.

Fix non-ASCII strict locals in ASCII templates

Non-ASCII default values in locals: magic comments now render correctly in ASCII-only ERB templates.

Fix BroadcastLogger#tagged for multiple loggers

BroadcastLogger now correctly handles #tagged when broadcasting to several tagging loggers.

Avoid aliasing Kernel#respond_to? in ActiveModel

respond_to_without_attributes? is now defined with define_method instead of alias to avoid deprecation.

Active Record Ractor-friendly connection handling

New connection handler, pool, and proxy enable safe database access from non-main Ractors.

Schema-qualify regclass cast in foreign key check

check_all_foreign_keys_valid! now uses schema-qualified regclass casts for multi-schema setups.

Fix Server-Timing double-counting of nested events

Server-Timing header now correctly reports nested events that share the same name.

Rails 8.2 defaults to ERB::Herb for HTML templates

New config.action_view.erb_implementation default is :herb for HTML in Rails 8.2. Other formats still use Erubi.

Rails Version 8.1.4 has been released

Rails 8.1.4 is now available with updates across all core components.

Rails Version 7.2.4 has been released!

Rails 7.2.4 is the final release in the 7.2.x series. Only 8.0.x and 8.1.x will receive future security and bug fixes.

Ruby 3.4.11 Released

Ruby 3.4.11 is a regular scheduled maintenance release that adds bug fixes.

Performance tuning guide open for review

Pull request updates the Rails performance tuning guide; feedback from production engineers welcome.

On Rails: Donorbox scales Rails app for nonprofits

Podcast episode with Donorbox engineers discussing their decade-old Rails app, traffic handling, CI on developer machines, and using agent docs to guide AI coding tools.

Agents on Rails Stage 3 benchmark released

Rails team publishes Stage 3 of its AI agent benchmark, combining all stages into one leaderboard that tests long-running multi-step tasks on real Rails apps.

Autoloading and Reloading guide community review

Updated autoloading documentation is open for community feedback before merging into the official Rails guides.

Rails World recordings are online

All talks from the recent Rails World conference are now available to watch on YouTube one week after the event.

Asset Pipeline guide rewritten for Propshaft

The Asset Pipeline guide now focuses on developer usage and Propshaft. Composite primary keys guide also updated.

Rails World 2026 recap: All talks online

All Rails World 2026 talks are now available on YouTube, covering Rails 8.2 features and AI-assisted development techniques.