The Wire · Showcase
ACTIVE STORAGE CRASH FIXED, JBUILDER PATCHED
By RepoJournal · Filed · About Rails
Rails plugged a critical crash in direct uploads when touch_attachment_records is disabled, while jbuilder shipped a one-line fix for a regression that broke partials with extra locals.
The Rails team fixed a nasty bug where disabling ActiveStorage.touch_attachment_records would crash on direct upload workflows [1]. This wasn't a theoretical edge case: it happened when attaching existing Blobs to records, and it cascaded from a prior refactor. Ship this fix before your next deploy if you're using that config. In parallel, jbuilder 2.15.1 landed a quick revert to fix partials for Active Model when extra locals are passed in [2]. That regression snuck in recently and broke downstream code; the patch is surgical. Rails core also tightened multiparameter attribute parsing to throw proper MultiparameterAssignmentErrors instead of raw NoMethodErrors when keys are malformed [3]. And Active Job got a new capability: job backends can now inspect the job itself in the stopping? callback, letting Solid Queue and Good Job pause long-running continuations based on queue attributes [4]. Finally, security hardening swept across sprockets and activeresource with explicit GitHub Actions workflow permissions pinned to contents: read [5], [6].
Action items
- → Deploy ActiveStorage touch_attachment_records fix [ref:1] immediately if using direct uploads with that config disabled rails/rails [immediate]
- → Upgrade jbuilder to 2.15.1 to restore partials with extra locals [ref:8] rails/jbuilder [immediate]
- → Monitor multiparameter attribute error messages for any application changes [ref:4] rails/rails [plan]
- → Review Active Job stopping? callbacks if using Solid Queue or Good Job [ref:5] rails/rails [monitor]
References
- [1] Prevent `ActiveStorage.touch_attachment_records = false` from crashing the attachment of a Blob rails/rails
- [2] v2.15.1 ↗ rails/jbuilder
- [3] Fix `NoMethodError` for malformed multiparameter attribute keys ↗ rails/rails
- [4] Active Job: pass job to `stopping?` for fine-grained control over interruption ↗ rails/rails
- [5] ci: add explicit workflow-level permissions to ci ↗ rails/sprockets
- [6] ci: add permissions: contents: read to ci ↗ rails/activeresource
FAQ
- What changed in Rails on May 27, 2026?
- Rails plugged a critical crash in direct uploads when touch_attachment_records is disabled, while jbuilder shipped a one-line fix for a regression that broke partials with extra locals.
- What should Rails teams do about it?
- Deploy ActiveStorage touch_attachment_records fix [ref:1] immediately if using direct uploads with that config disabled • Upgrade jbuilder to 2.15.1 to restore partials with extra locals [ref:8] • Monitor multiparameter attribute error messages for any application changes [ref:4]
- Which Rails repositories shipped on May 27, 2026?
- rails/rails, rails/jbuilder, rails/sprockets, rails/activeresource