Who contributed to Rails on July 31, 2026?

5 developers shipped this update, including etiennebarrie, Xavier Noria, Ryuta Kamizono, Mike Dalessio, and dependabot.

What were the notable Rails updates?

Make the Action View dependency tracker registry Ractor-shareable, Merge pull request #58322 from rails/fxn/polish-migrations-dump, and Merge pull request #58310 from kamipo/deprecate_to_sql_binds_arg.

@rails

Ruby on Rails - Shopify, Basecamp, GitHub all run on it

github ↗

Pick a date

Topics: Ruby Full archive →

The Wire · Showcase

RAILS TIGHTENS RACTOR SUPPORT AND DEPRECATES BINDS ARGUMENT

By RepoJournal · Filed 06:55 UTC on July 31, 2026 · About Rails

5 people shipped this

etiennebarrie @etiennebarrie 1 cited

Xavier Noria @fxn 1 cited

Ryuta Kamizono @kamipo 1 cited

Mike Dalessio @flavorjones 1 cited

dependabot @dependabot 1 cited

Rails is making ActionView's dependency tracker Ractor-shareable while removing a migrations filter that cluttered schema dumps, signaling the framework's push toward better concurrency and cleaner database tooling.

The ActionView dependency tracker registry is now Ractor-shareable [1], which means non-main Ractors can safely read the template digest path without isolation errors. The fix requires calling `share_registry` before the tracker becomes shareable, though this won't be added to initializers yet to preserve compatibility with custom trackers that might not be shareable themselves. Rails will call this from `Rails.application.ractorize!`, setting the stage for broader Ractor adoption across the framework [1]. Separately, Xavier Noria has removed the migrations filter from schema dumps [2], a cleanup that simplifies database introspection for teams managing complex migration histories. On the deprecation front, Rails is now deprecating the `binds` argument to `to_sql` [3], signaling a shift in how the framework handles SQL binding. The forensics team has also added tooling for CVE-2026-66066 [4], helping teams determine whether the Active Storage libvips vulnerability was exploited in their applications, a critical step before rotating secrets. Tailwindcss-rails bumped its dependency to v4.3.3 [5], tracking upstream fixes.

Action items

→ Review custom ActionView tracker registration for Ractor compatibility before next Rails upgrade rails/rails [plan]
→ Audit any code passing binds to to_sql and plan migration away from deprecated argument rails/rails [plan]
→ If using Active Storage with libvips, run CVE-2026-66066 forensic check on object store and logs rails/rails-forensics-CVE-2026-66066 [monitor]
→ Update tailwindcss-rails to 4.3.3 in next dependency refresh rails/tailwindcss-rails [monitor]

References

[1] Make the Action View dependency tracker registry Ractor-shareable ↗ rails/rails
[2] Merge pull request #58322 from rails/fxn/polish-migrations-dump rails/rails
[3] Merge pull request #58310 from kamipo/deprecate_to_sql_binds_arg rails/rails
[4] Add forensic tooling and method for CVE-2026-66066 rails/rails-forensics-CVE-2026-66066
[5] build(deps): bump tailwindcss-ruby from 4.3.2 to 4.3.3 ↗ rails/tailwindcss-rails

Quick answers

What shipped in Rails on July 31, 2026?: Rails is making ActionView's dependency tracker Ractor-shareable while removing a migrations filter that cluttered schema dumps, signaling the framework's push toward better concurrency and cleaner database tooling. In total, 12 commits and 6 pull requests landed.
Who contributed to Rails on July 31, 2026?: 5 developers shipped this update, including etiennebarrie, Xavier Noria, Ryuta Kamizono, Mike Dalessio, and dependabot.
What were the notable Rails updates?: Make the Action View dependency tracker registry Ractor-shareable, Merge pull request #58322 from rails/fxn/polish-migrations-dump, and Merge pull request #58310 from kamipo/deprecate_to_sql_binds_arg.

RAILS FIXES PLUCK REGRESSION, BOOTSNAP DITCHES MARSHAL FOR MSGPACK

Rails patched a critical regression in association plucking for new records that broke `ids` queries overnight, while bootsnap replaced Date marshalling with faster, more compact msgpack serialization.

ruby 40 shipped

@rails Aug 5

RAILS HARDENS FILE STORAGE, UNIFIES FOREIGN KEY HANDLING ACROSS 22 COMMITS

Rails killed a filesystem vulnerability while Propshaft eliminates globbing from production asset lookups in coordinated pushes toward Ractor compatibility.

ruby 35 shipped

@rails Aug 4

Rails fixes composite foreign key tracking across counter cache and autosave

Belongs_to associations with aliased or composite foreign keys were silently failing change detection, breaking counter cache increments, touch callbacks, and validation.

ruby 25 shipped

@rails Aug 3

RAILS RESTORES ALIAS_ATTRIBUTE IN ASSOCIATIONS, FIXES SILENT FAILURES

A performance optimization from Rails 4.2 has been quietly breaking alias_attribute in associations for years, and it's finally fixed.

ruby 23 shipped

Elsewhere on the wire

AI Agents Aug 6

LANGCHAIN HARDENS ANTHROPIC TOOL CALLING AND GIT CREDENTIALS AS OPENHANDS SHIPS 1.10.0

LangChain fixed a critical credential leak in evaluation runs while Anthropic tool schemas get proper fallback handling, as three major agent frameworks push releases across the ecosystem.

ai-agents 54 shipped

Local LLMs Aug 6

OLLAMA FIXES KV CACHE CORRUPTION, LLAMA.CPP HARDENS FILE SEARCH, VLLM KILLS MOE LEGACY CODE

Ollama patched a critical cache corruption bug that corrupts lazy snapshots during multi-request prefills, while llama.cpp hardened Windows junction traversal and vLLM removed 14 hardcoded MoE shards across quantization methods.