Who contributed to Rails on July 16, 2026?

6 developers shipped this update, including bhumi1102, 55728, Ryuta Kamizono, Jerome Dalbert, Mike Dalessio, and Xavier Noria.

What were the notable Rails updates?

Properly restrict SVG href attributes, v1.7.1, and Add missing ActiveSupport core extension and feature requires.

@rails

Ruby on Rails — Shopify, Basecamp, GitHub all run on it

github ↗

Pick a date

Topics: Ruby Full archive →

The Wire · Showcase

SVG SANITIZER VULNERABILITY PATCHED, RAILS DOCS OVERHAULED

By RepoJournal · Filed 06:55 UTC on July 16, 2026 · About Rails

6 people shipped this

55728 @55728 2 cited

Mike Dalessio @flavorjones 2 cited

bhumi1102 @bhumi1102 1 cited

Ryuta Kamizono @kamipo

Jerome Dalbert @jeromedalbert

Xavier Noria @fxn

Rails-html-sanitizer 1.7.1 shipped overnight to plug an SVG href vulnerability that slipped through the xlink-only fix.

The rails-html-sanitizer team closed a critical gap in SVG sanitization [1] where plain `href` attributes on reference elements like `<use>` could still pull external documents, bypassing the security model that restricted only `xlink:href`. Version 1.7.1 [2] now enforces both attributes via Loofah's SVG_HREF_ATTRIBUTES set, matching upstream security fixes. Meanwhile, Rails core pushed forward on documentation and dependency fixes [4]. A follow-up PR addressing missing ActiveSupport requires across 27 files [3] ensures core extensions actually load without silent failures, fixing the kind of NoMethodError that only surfaces in production. Smaller polish landed on Relation query docs [5] and Rubocop violations, keeping the codebase clean between major cycles.

Action items

→ Upgrade rails-html-sanitizer to 1.7.1 before next deploy if using custom PermitScrubber with SVG elements rails/rails-html-sanitizer [immediate]
→ Review the ActiveSupport requires PR [ref:2] when it lands to understand which files need explicit loads in your app rails/rails [plan]
→ Monitor rails/rails for the 27-file requires merge to test in your suite rails/rails [monitor]

References

[1] Properly restrict SVG href attributes rails/rails-html-sanitizer
[2] v1.7.1 ↗ rails/rails-html-sanitizer
[3] Add missing ActiveSupport core extension and feature requires ↗ rails/rails
[4] [RF-Docs] [ci-skip] Update the Rails Generators guide ↗ rails/rails
[5] Fix `Relation#one?` doc example calling `any?` [ci skip] rails/rails

Quick answers

What shipped in Rails on July 16, 2026?: Rails-html-sanitizer 1.7.1 shipped overnight to plug an SVG href vulnerability that slipped through the xlink-only fix. In total, 18 commits, 10 pull requests, and 1 releases landed.
Who contributed to Rails on July 16, 2026?: 6 developers shipped this update, including bhumi1102, 55728, Ryuta Kamizono, Jerome Dalbert, Mike Dalessio, and Xavier Noria.
What were the notable Rails updates?: Properly restrict SVG href attributes, v1.7.1, and Add missing ActiveSupport core extension and feature requires.

RAILS REWIRES VIEW HELPERS, POSTGRES 18.4 GETS SHARPER FOREIGN KEY TESTS

Rails is reorganizing its view layer with a new NavigationHelper module, while PostgreSQL 18.4 users lose their superuser dependency for foreign key validation.

ruby 19 shipped 1-min read

@rails 2 days ago

ACTIVERECORD-SESSION_STORE DROPS RAILS 7.1 SUPPORT AND PATCHES SESSION FIXATION VULNERABILITY

The session store gem shipped breaking changes overnight, severing Rails 7.1 support and closing a critical session fixation hole that could let attackers extend sessions indefinitely.

ruby 57 shipped 2-min read

@rails 3 days ago

SQLITE3 FOREIGN KEYS GET THEIR NAMES BACK

SQLite3 migrations just stopped silently destroying the wrong foreign keys.

ruby 24 shipped 1-min read

@rails 5 days ago

RAILS TIGHTENS DESERIALIZATION ERROR HANDLING, PROPSHAFT EYES RUBY 4

Rails introduces a targeted deserialization error for orphaned job records, solving a production pain point at HEY while ActiveJob remains resilient.

ruby 12 shipped 1-min read

— or follow the whole beat:

Elsewhere on the wire

@cachyos about 9 hours ago

CACHYOS 7.2-RC3-3 LANDS WITH AMD DISPLAY FIXES AND TSC TUNING

CachyOS Linux 7.2-rc3-3 ships critical AMD graphics vblank handling consolidation and direct TSC synchronization for systems without IA32_TSC_ADJUST support.

infra 55 shipped 1-min read

Elixir & Phoenix about 9 hours ago

PHOENIX LIVE VIEW PATCHES WEBSOCKET DOS WHILE ECTO FIXES RELATION TRACKING

Phoenix Live View shipped a critical websocket memory exhaustion fix in its dependency chain, while Ecto quietly resolved a data integrity bug in relationship change detection.

elixir 13 shipped 1-min read

@dotnet about 9 hours ago

CLANGSHARP CLOSES THE C++ AST GAP, MACIOS SHIPS XCODE 26.6 SUPPORT

ClangSharp landed the native bridges and managed API expansion needed to faithfully parse real-world C++ headers, while .NET for macOS is now Xcode 26.6 ready.

dotnet 85 shipped 2-min read

@spring-projects about 9 hours ago

SPRING BOOT CLEANS HOUSE WHILE INTEGRATION FIXES KAFKA BATCH MODE

Spring Boot is removing deprecated code and exposing critical NIO APIs, while Spring Integration ships a fix for Kafka batch processing that was breaking downstream splitters.

java 37 shipped 1-min read