RepoJournal
Rails @rails
127 wires and counting

$ follow Rails

Keep up with Rails in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-16
stories 29
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

SVG SANITIZER VULNERABILITY PATCHED, RAILS DOCS OVERHAULED

By RepoJournal · Filed · About Rails · Composed from the cited sources · methodology

55728 Mike Dalessio bhumi1102 Ryuta Kamizono Jerome Dalbert Xavier Noria
6 people shipped this
55728 @55728 2 cited Mike Dalessio @flavorjones 2 cited bhumi1102 @bhumi1102 1 cited Ryuta Kamizono @kamipo Jerome Dalbert @jeromedalbert Xavier Noria @fxn

Rails-html-sanitizer 1.7.1 shipped overnight to plug an SVG href vulnerability that slipped through the xlink-only fix.

The rails-html-sanitizer team closed a critical gap in SVG sanitization [1] where plain `href` attributes on reference elements like `<use>` could still pull external documents, bypassing the security model that restricted only `xlink:href`. Version 1.7.1 [2] now enforces both attributes via Loofah's SVG_HREF_ATTRIBUTES set, matching upstream security fixes. Meanwhile, Rails core pushed forward on documentation and dependency fixes [4]. A follow-up PR addressing missing ActiveSupport requires across 27 files [3] ensures core extensions actually load without silent failures, fixing the kind of NoMethodError that only surfaces in production. Smaller polish landed on Relation query docs [5] and Rubocop violations, keeping the codebase clean between major cycles.

$ ls rails/reviews/ # the step-back reads

the week in review Active Storage gets a direct-upload kill switch the month in review Rails deepens Ractor safety, ships Marcel 2.0, and retires decade-old APIs
Topics: Ruby Full archive → Weekly reviews →

Quick answers

What shipped in Rails on July 16, 2026?
Rails-html-sanitizer 1.7.1 shipped overnight to plug an SVG href vulnerability that slipped through the xlink-only fix. In total, 18 commits, 10 pull requests, and 1 releases landed.
Who contributed to Rails on July 16, 2026?
6 developers shipped this update, including bhumi1102, 55728, Ryuta Kamizono, Jerome Dalbert, Mike Dalessio, and Xavier Noria.
What were the notable Rails updates?
Properly restrict SVG href attributes, v1.7.1, and Add missing ActiveSupport core extension and feature requires.
♥

$ log @rails --recent

Bootsnap guards d_type for Illumos, Rails trims Ractor test skips 17 shipped MySQL deadlock fix for find_or_create_by, Asset Pipeline guide rewrite 19 shipped kamipo retires three legacy Active Record holdovers 16 shipped Postgres index lookups scoped to the resolved table, mariadb replaces mysql5 in dbconsole 28 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.