Who contributed to Rails on July 30, 2026?

8 developers shipped this update, including rafaelfranca, Mike Dalessio, Ryuta Kamizono, sapandiwakar, rosa, Amanda Perino, hmcguire-shopify, and Hartley McGuire.

@rails

Ruby on Rails - Shopify, Basecamp, GitHub all run on it

github ↗

Pick a date

Topics: Ruby Full archive →

The Wire · Showcase

RAILS PATCHES LIBVIPS IMAGE VULNERABILITY ACROSS THREE VERSIONS

By RepoJournal · Filed 06:55 UTC on July 30, 2026 · About Rails

8 people shipped this

rafaelfranca @rafaelfranca 3 cited

Mike Dalessio @flavorjones 1 cited

sapandiwakar @sapandiwakar 1 cited

rosa @rosa 1 cited

hmcguire-shopify @hmcguire-shopify 1 cited

Ryuta Kamizono @kamipo

Amanda Perino @AmandaPerino

Hartley McGuire @skipkayhil

Rails shipped emergency updates to 7.2, 8.0, and 8.1 this morning, disabling untrusted image loaders that could expose your attachment pipeline to arbitrary content.

The Active Storage fix [1][2][3] closes a gap where libvips's unfuzzed loaders and savers were re-enabled despite being flagged as unsafe for untrusted input. Both the Vips analyzer and transformer were passing unvetted attachments to them, creating an attack surface that persisted since 8.2 edge. Rails will now call `Vips.block_untrusted(true)` at boot to disable them [4]. If your app processes user uploads through Active Storage, patch before your next deploy. Separately, Solid Queue 1.5.1 shipped [6] with fixes for flaky tests, migration generators, and a critical improvement: forked processes that fail to boot are now tracked and replaced within a configurable timeout [5], solving a production problem where hung boot callbacks could orphan workers. The Rails ecosystem also shipped four releases across 34 commits and 13 PRs this period [7], including Propshaft's eager manifest initialization in production, cutting first-request latency by moving asset parsing from request time to boot time.

Action items

→ Upgrade Rails to 7.2.3.2, 8.0.5.1, or 8.1.3.1 (pick your line) before next deploy rails/rails [immediate]
→ Upgrade Solid Queue to 1.5.1 to fix worker boot tracking and flaky test issues rails/solid_queue [plan]
→ Review any custom libvips configuration in Active Storage; test image uploads after patching rails/rails [plan]

References

[1] 8.0.5.1 ↗ rails/rails
[2] 7.2.3.2 ↗ rails/rails
[3] 8.1.3.1 ↗ rails/rails
[4] Disable libvips's unfuzzed image loaders and savers rails/rails
[5] Replace forked processes that fail to boot ↗ rails/solid_queue
[6] v1.5.1 ↗ rails/solid_queue
[7] Eagerly initialize Manifest in Resolver::Static ↗ rails/propshaft

Quick answers

What shipped in Rails on July 30, 2026?: Rails shipped emergency updates to 7.2, 8.0, and 8.1 this morning, disabling untrusted image loaders that could expose your attachment pipeline to arbitrary content. In total, 34 commits, 13 pull requests, and 4 releases landed.
Who contributed to Rails on July 30, 2026?: 8 developers shipped this update, including rafaelfranca, Mike Dalessio, Ryuta Kamizono, sapandiwakar, rosa, Amanda Perino, hmcguire-shopify, and Hartley McGuire.
What were the notable Rails updates?: 8.0.5.1, 7.2.3.2, and 8.1.3.1.

RAILS FIXES PLUCK REGRESSION, BOOTSNAP DITCHES MARSHAL FOR MSGPACK

Rails patched a critical regression in association plucking for new records that broke `ids` queries overnight, while bootsnap replaced Date marshalling with faster, more compact msgpack serialization.

ruby 40 shipped

@rails Aug 5

RAILS HARDENS FILE STORAGE, UNIFIES FOREIGN KEY HANDLING ACROSS 22 COMMITS

Rails killed a filesystem vulnerability while Propshaft eliminates globbing from production asset lookups in coordinated pushes toward Ractor compatibility.

ruby 35 shipped

@rails Aug 4

Rails fixes composite foreign key tracking across counter cache and autosave

Belongs_to associations with aliased or composite foreign keys were silently failing change detection, breaking counter cache increments, touch callbacks, and validation.

ruby 25 shipped

@rails Aug 3

RAILS RESTORES ALIAS_ATTRIBUTE IN ASSOCIATIONS, FIXES SILENT FAILURES

A performance optimization from Rails 4.2 has been quietly breaking alias_attribute in associations for years, and it's finally fixed.

ruby 23 shipped

Elsewhere on the wire

AI Agents Aug 6

LANGCHAIN HARDENS ANTHROPIC TOOL CALLING AND GIT CREDENTIALS AS OPENHANDS SHIPS 1.10.0

LangChain fixed a critical credential leak in evaluation runs while Anthropic tool schemas get proper fallback handling, as three major agent frameworks push releases across the ecosystem.

ai-agents 54 shipped

Local LLMs Aug 6

OLLAMA FIXES KV CACHE CORRUPTION, LLAMA.CPP HARDENS FILE SEARCH, VLLM KILLS MOE LEGACY CODE

Ollama patched a critical cache corruption bug that corrupts lazy snapshots during multi-request prefills, while llama.cpp hardened Windows junction traversal and vLLM removed 14 hardcoded MoE shards across quantization methods.