The Wire · Showcase
RAILS ADDS ATOMIC CACHE READS, TIGHTENS FORM SECURITY
By RepoJournal · Filed · About Rails
Rails merged support for one-shot cache deletions via Redis GETDEL while fixing a security guidance issue in the getting-started docs.
The headline feature is a new `delete: true` option for `Rails.cache.read` [1] that atomically reads and deletes a cache entry in RedisCacheStore, eliminating race conditions in one-time-read patterns. This lands the Redis GETDEL command directly in the cache API—useful for tokens, OTPs, and other single-use secrets you want guaranteed to vanish after consumption. On the forms side, Rails removed `autocomplete="off"` from the authenticity_token example in the getting-started guide [2], correcting guidance that contradicted browser security best practices. A separate PR added datalist support to FormBuilder [3], expanding form capabilities without breaking changes. Over in bootsnap, the team updated documentation to reflect recent header size optimizations [4], a housekeeping change that ensures developers get accurate benchmarking expectations. The Rails changelog itself got a URL fix [5] to clean up fallout from an earlier PR. These are solid, incremental improvements—nothing that demands immediate action, but the cache deletion feature is worth knowing about for your next OTP or session management implementation.
Action items
- → Review Rails.cache.read delete option for one-time-use patterns in your codebase rails/rails [plan]
- → Update any form examples or internal guides that still show autocomplete off on tokens rails/rails [monitor]
References
- [1] Rails.cache.read: add support to new option delete: true ↗ rails/rails
- [2] Merge pull request #57304 from ryu/fix-getting-started-autocomplete-off rails/rails
- [3] Add datalist to FormBuilder ↗ rails/rails
- [4] Use the latest header size in the readme ↗ rails/bootsnap
- [5] Fix changelog url rails/rails
FAQ
- What changed in Rails on May 8, 2026?
- Rails merged support for one-shot cache deletions via Redis GETDEL while fixing a security guidance issue in the getting-started docs.
- What should Rails teams do about it?
- Review Rails.cache.read delete option for one-time-use patterns in your codebase • Update any form examples or internal guides that still show autocomplete off on tokens
- Which Rails repositories shipped on May 8, 2026?
- rails/rails, rails/bootsnap