Who contributed to Rails on August 5, 2026?

6 developers shipped this update, including Rosa Gutierrez, kamipo, etiennebarrie, Gannon McGibbon, hmcguire-shopify, and Hartley McGuire.

What were the notable Rails updates?

Add NUL (\0) to the list of unsafe characters for storage, Use `ActiveRecord::Key` to unify single / composite FK handling in `BelongsToAssociation`, and Make Mime types ractor-shareable.

@rails

Ruby on Rails - Shopify, Basecamp, GitHub all run on it

github ↗

Pick a date

Topics: Ruby Full archive →

The Wire · Showcase

RAILS HARDENS FILE STORAGE, UNIFIES FOREIGN KEY HANDLING ACROSS 22 COMMITS

By RepoJournal · Filed 06:55 UTC on August 5, 2026 · About Rails

6 people shipped this

etiennebarrie @etiennebarrie 2 cited

hmcguire-shopify @hmcguire-shopify 2 cited

Hartley McGuire @skipkayhil 2 cited

Rosa Gutierrez @rosa 1 cited

kamipo @kamipo 1 cited

Gannon McGibbon @gmcgibbon 1 cited

Rails killed a filesystem vulnerability while Propshaft eliminates globbing from production asset lookups in coordinated pushes toward Ractor compatibility.

The null character, invalid in most filesystems, now joins Rails' sanitization list [1], closing a hole where untrusted filenames could slip through. Simultaneously, the framework unified single and composite foreign key handling through `ActiveRecord::Key` [2], reducing branching logic and improving maintainability. Rails also made MIME types ractor-shareable by freezing the registry on eager load [3], with registration deprecated post-freeze. Propshaft followed suit by replacing filesystem globbing with resolver-based lookups [4], removing a production bottleneck where it previously had to walk every asset path. The asset layer now uses precompiled manifests in production while falling back to dynamic resolution in development [5] [6], and Propshaft's manifest schema expanded to include an "app" key for Static resolution [7]. Proc layouts moved toward shareability [8], and attribute type access inside ractors was fixed [9]. The effort is clear: Rails and Propshaft are systematically removing production filesystem dependencies and freezing mutable state to unlock Ractor support.

Action items

→ Precompile assets with latest Propshaft before next deploy to populate new manifest schema rails/propshaft [plan]
→ Review custom MIME type registrations; deprecation window is open rails/rails [monitor]
→ Test proc layouts in your controller if running Ractor experiments rails/rails [monitor]

References

[1] Add NUL (\0) to the list of unsafe characters for storage rails/rails
[2] Use `ActiveRecord::Key` to unify single / composite FK handling in `BelongsToAssociation` ↗ rails/rails
[3] Make Mime types ractor-shareable ↗ rails/rails
[4] Look up :app stylesheets through the resolver ↗ rails/propshaft
[5] Look up :all stylesheets through the resolver ↗ rails/propshaft
[6] Look up :app stylesheets through the resolver rails/propshaft
[7] Add "app" key to maninfest for Static resolution rails/propshaft
[8] Make Proc layouts shareable ↗ rails/rails
[9] Merge pull request #58352 from Shopify/ec-attribute-type-fix rails/rails

Quick answers

What shipped in Rails on August 5, 2026?: Rails killed a filesystem vulnerability while Propshaft eliminates globbing from production asset lookups in coordinated pushes toward Ractor compatibility. In total, 22 commits and 13 pull requests landed.
Who contributed to Rails on August 5, 2026?: 6 developers shipped this update, including Rosa Gutierrez, kamipo, etiennebarrie, Gannon McGibbon, hmcguire-shopify, and Hartley McGuire.
What were the notable Rails updates?: Add NUL (\0) to the list of unsafe characters for storage, Use `ActiveRecord::Key` to unify single / composite FK handling in `BelongsToAssociation`, and Make Mime types ractor-shareable.

RAILS FIXES PLUCK REGRESSION, BOOTSNAP DITCHES MARSHAL FOR MSGPACK

Rails patched a critical regression in association plucking for new records that broke `ids` queries overnight, while bootsnap replaced Date marshalling with faster, more compact msgpack serialization.

ruby 40 shipped

@rails Aug 4

Rails fixes composite foreign key tracking across counter cache and autosave

Belongs_to associations with aliased or composite foreign keys were silently failing change detection, breaking counter cache increments, touch callbacks, and validation.

ruby 25 shipped

@rails Aug 3

RAILS RESTORES ALIAS_ATTRIBUTE IN ASSOCIATIONS, FIXES SILENT FAILURES

A performance optimization from Rails 4.2 has been quietly breaking alias_attribute in associations for years, and it's finally fixed.

ruby 23 shipped

@rails Aug 2

RAILS DEPRECATES BINDS PARAMETER, UNIFIES REMOVAL TARGET TO 9.0

Rails is killing the `binds` positional argument across `insert`, `update`, and `delete` after moving bind parameters into the Arel AST, forcing a migration to a cleaner API before Rails 9.0.

ruby 29 shipped

Elsewhere on the wire

AI Agents Aug 6

LANGCHAIN HARDENS ANTHROPIC TOOL CALLING AND GIT CREDENTIALS AS OPENHANDS SHIPS 1.10.0

LangChain fixed a critical credential leak in evaluation runs while Anthropic tool schemas get proper fallback handling, as three major agent frameworks push releases across the ecosystem.

ai-agents 54 shipped

Local LLMs Aug 6

OLLAMA FIXES KV CACHE CORRUPTION, LLAMA.CPP HARDENS FILE SEARCH, VLLM KILLS MOE LEGACY CODE

Ollama patched a critical cache corruption bug that corrupts lazy snapshots during multi-request prefills, while llama.cpp hardened Windows junction traversal and vLLM removed 14 hardcoded MoE shards across quantization methods.