Who contributed to Rails on July 14, 2026?

10 developers shipped this update, including Ruby on Rails Bot, Rafael Mendonça França, claudiob, p8, Niklas Haeusele, Lemayian JN, Iván Guardado Castro, and Hartley McGuire, and 2 more.

What were the notable Rails updates?

Drop support to Rails 7.1, Remove deprecated ssid fallback code, and Improvoves the trim trask to prevent session fixation.

@rails

Ruby on Rails — Shopify, Basecamp, GitHub all run on it

github ↗

Pick a date

Topics: Ruby Full archive →

The Wire · Showcase

ACTIVERECORD-SESSION_STORE DROPS RAILS 7.1 SUPPORT AND PATCHES SESSION FIXATION VULNERABILITY

By RepoJournal · Filed 06:55 UTC on July 14, 2026 · About Rails

10 people shipped this

Rafael Mendonça França @rafaelfranca 2 cited

p8 @p8 2 cited

Ruby on Rails Bot @rails-bot 1 cited

Niklas Haeusele @codergeek121 1 cited

Lemayian JN @Lemmah 1 cited

Iván Guardado Castro @IvanGuardado 1 cited

Hartley McGuire @skipkayhil 1 cited

bensheldon @bensheldon 1 cited

claudiob @claudiob

Jean Boussier @byroot

The session store gem shipped breaking changes overnight, severing Rails 7.1 support and closing a critical session fixation hole that could let attackers extend sessions indefinitely.

ActiveRecord Session Store is shipping major cleanup this cycle [1]. The gem is dropping Rails 7.1 support entirely and removing deprecated ssid fallback code [2], signaling a push toward newer versions for any teams still on the old release train. More importantly, the trim task now prevents session fixation by removing sessions created before a cutoff period [3], closing a documented attack vector where an attacker could extend a session forever. The deprecator itself has been removed since there's nothing left to deprecate [4]. Over in GlobalID, a recent change to how Rails uses the library broke integrations on non-ActiveRecord objects, prompting maintainers to surface the requirement that custom models must define a `where` method higher in the README [5]. This caught at least one production user off guard. Meanwhile, across the rails/rails repository, maintainers are quietly improving developer experience: the guides now show controllers before views in the request lifecycle order [6], ellipses in code examples are being commented to prevent copy-paste syntax errors [7], and several guide references have been fixed [8] [9]. Ruby 4.0.6 has been added to the devcontainer matrix [10], keeping the local dev experience current.

Action items

→ If running ActiveRecord Session Store on Rails 7.1, plan migration to Rails 7.2+ before next major release cycle rails/activerecord-session_store [plan]
→ If using GlobalID with custom models, ensure your models implement the `where` method rails/globalid [monitor]
→ Review session store trim task configuration to ensure session fixation countermeasures are active rails/activerecord-session_store [plan]

References

[1] Drop support to Rails 7.1 rails/activerecord-session_store
[2] Remove deprecated ssid fallback code rails/activerecord-session_store
[3] Improvoves the trim trask to prevent session fixation. rails/activerecord-session_store
[4] Remove deprecator now that we don't have anything to deprecate rails/activerecord-session_store
[5] Document necessity of model defining `where` higher up in README ↗ rails/globalid
[6] Change the order of Views and Controllers in the guides ↗ rails/rails
[7] Comment ellipsis in guides examples ↗ rails/rails
[8] Fix the broken #with reference rails/rails
[9] Fix settings navigation test in authentication guide rails/rails
[10] Add Ruby version: 4.0.6 ↗ rails/devcontainer

Quick answers

What shipped in Rails on July 14, 2026?: The session store gem shipped breaking changes overnight, severing Rails 7.1 support and closing a critical session fixation hole that could let attackers extend sessions indefinitely. In total, 39 commits, 15 pull requests, and 3 releases landed.
Who contributed to Rails on July 14, 2026?: 10 developers shipped this update, including Ruby on Rails Bot, Rafael Mendonça França, claudiob, p8, Niklas Haeusele, Lemayian JN, Iván Guardado Castro, and Hartley McGuire, and 2 more.
What were the notable Rails updates?: Drop support to Rails 7.1, Remove deprecated ssid fallback code, and Improvoves the trim trask to prevent session fixation.

SQLITE3 FOREIGN KEYS GET THEIR NAMES BACK

SQLite3 migrations just stopped silently destroying the wrong foreign keys.

ruby 24 shipped 1-min read

@rails 3 days ago

RAILS TIGHTENS DESERIALIZATION ERROR HANDLING, PROPSHAFT EYES RUBY 4

Rails introduces a targeted deserialization error for orphaned job records, solving a production pain point at HEY while ActiveJob remains resilient.

ruby 12 shipped 1-min read

@rails 4 days ago

RAILS FIXES FROZEN CACHE BUGS IN RACTORIZED APPS, SOLID QUEUE CATCHES UP

Rails shipped fixes for FrozenErrors that break ractorized applications when caches freeze with the app, while Solid Queue patched a breaking change in ActiveJob's shutdown protocol.

ruby 11 shipped 1-min read

@rails 5 days ago

RAILS CLEANS UP FORM HELPERS WHILE RACTOR SUPPORT EXPANDS

Rails merged a refactor that eliminates duplication in ColorField rendering, while core work continues on Ractor integration for multi-threaded applications.

ruby 17 shipped 1-min read

— or follow the whole beat:

Elsewhere on the wire

@cachyos about 4 hours ago

CACHYOS LINUX 7.2-RC3 SHIPS WITH HARDWARE FIXES AND EXPANDED LANGUAGE SUPPORT

CachyOS Linux 7.2-rc3-1 is live with Razer Blade speaker fixes and v4l2loopback updates, while the package installer now speaks Turkish and Azerbaijani.

infra 63 shipped 1-min read

Elixir & Phoenix about 4 hours ago

PHOENIX LIVE VIEW PATCHES SCHEME VALIDATION BYPASS

Phoenix LiveView 1.2.7 ships an emergency security fix for a scheme validation bypass that could let attackers inject malicious URLs into your application.

elixir 6 shipped 1-min read

@dotnet about 4 hours ago

RUNTIME FIXES DECIMAL AND BIGINTEGER ROUNDING BUGS THAT LOST PRECISION

Three critical numeric conversion bugs that silently corrupted precision in decimal, BigInteger, and floating-point math are now fixed across the stack.

dotnet 122 shipped 1-min read

@spring-projects about 4 hours ago

SPRING BOOT PLUGS FILE HANDLE LEAK IN IMAGE BUILDPACK

Spring Boot's image buildpack was leaking file handles and orphaning temp files when resolving missing builder images, but a fix just landed to clean up both the streams and the intermediate artifacts.

java 16 shipped 1-min read