$ the-wire · showcase
RAILS HARDENS FILE STORAGE, UNIFIES FOREIGN KEY HANDLING ACROSS 22 COMMITS
By RepoJournal · Filed · About Rails · Composed from the cited sources · methodology
Rails killed a filesystem vulnerability while Propshaft eliminates globbing from production asset lookups in coordinated pushes toward Ractor compatibility.
The null character, invalid in most filesystems, now joins Rails' sanitization list [1], closing a hole where untrusted filenames could slip through. Simultaneously, the framework unified single and composite foreign key handling through `ActiveRecord::Key` [2], reducing branching logic and improving maintainability. Rails also made MIME types ractor-shareable by freezing the registry on eager load [3], with registration deprecated post-freeze. Propshaft followed suit by replacing filesystem globbing with resolver-based lookups [4], removing a production bottleneck where it previously had to walk every asset path. The asset layer now uses precompiled manifests in production while falling back to dynamic resolution in development [5] [6], and Propshaft's manifest schema expanded to include an "app" key for Static resolution [7]. Proc layouts moved toward shareability [8], and attribute type access inside ractors was fixed [9]. The effort is clear: Rails and Propshaft are systematically removing production filesystem dependencies and freezing mutable state to unlock Ractor support.
Action items
- → Precompile assets with latest Propshaft before next deploy to populate new manifest schema rails/propshaft [plan]
- → Review custom MIME type registrations; deprecation window is open rails/rails [monitor]
- → Test proc layouts in your controller if running Ractor experiments rails/rails [monitor]
References
- [1] Add NUL (\0) to the list of unsafe characters for storage rails/rails ↗
- [2] Use `ActiveRecord::Key` to unify single / composite FK handling in `BelongsToAssociation` ↗ rails/rails
- [3] Make Mime types ractor-shareable ↗ rails/rails
- [4] Look up :app stylesheets through the resolver ↗ rails/propshaft
- [5] Look up :all stylesheets through the resolver ↗ rails/propshaft
- [6] Look up :app stylesheets through the resolver ↗ rails/propshaft
- [7] Add "app" key to maninfest for Static resolution ↗ rails/propshaft
- [8] Make Proc layouts shareable ↗ rails/rails
- [9] Merge pull request #58352 from Shopify/ec-attribute-type-fix rails/rails ↗
