Who contributed to Rails on August 10, 2026?

3 developers shipped this update, including federico-carrocera, kamipo, and Xavier Noria.

What were the notable Rails updates?

Allow ActiveSupport::ProxyLogger to ignore messages by pattern, Use bind parameters for array-form arguments in `find_by_sql` / `count_by_sql`, and Drop `Sanitization` stubs from `FakeKlass`.

@rails

Ruby on Rails - Shopify, Basecamp, GitHub all run on it

github ↗

Pick a date

Topics: Ruby Full archive →

The Wire · Showcase

RAILS TIGHTENS SQL SAFETY AND LOGGING CONTROL IN MAINTENANCE PUSH

By RepoJournal · Filed 06:55 UTC on August 10, 2026 · About Rails

3 people shipped this

kamipo @kamipo 3 cited

federico-carrocera @federico-carrocera 1 cited

Xavier Noria @fxn

Rails shipped five commits across parameter binding, logger filtering, and migration recording that tighten SQL injection prevention and give you finer control over noisy dependencies.

ProxyLogger can now silence specific messages by pattern without raising the global log level [1]. The feature lets you ignore noisy gems with regex or string matching, compiled once at registration time to avoid performance drag on every log call. Meanwhile, `find_by_sql` and `count_by_sql` now route array-form arguments through bind parameters instead of eager interpolation, closing a parity gap with the `where` API [2]. This consolidates placeholder dispatch into a shared `Sanitization#bound_sql_literal_for` method, reducing duplication. Rails also cleaned up test infrastructure by dropping stubs from `FakeKlass` and moving it to real `Sanitization` methods [3], and refactored `CommandRecorder` to store migration command args and kwargs separately instead of bundling them into a trailing hash [4]. The kwargs separation breaks code that inspects `recorder.commands` directly and expects 3-element tuples instead of the new 4-element shape.

Action items

→ Review any code that inspects recorder.commands directly and adapt to [cmd, args, kwargs, block] tuple structure rails/rails [plan]
→ Audit find_by_sql and count_by_sql calls for any custom sanitization workarounds that are now redundant rails/rails [monitor]
→ Consider using ProxyLogger.ignore for verbose dependencies in test or development environments rails/rails [monitor]

References

[1] Allow ActiveSupport::ProxyLogger to ignore messages by pattern ↗ rails/rails
[2] Use bind parameters for array-form arguments in `find_by_sql` / `count_by_sql` ↗ rails/rails
[3] Drop `Sanitization` stubs from `FakeKlass` rails/rails
[4] Refactor `CommandRecorder` to store args and kwargs separately ↗ rails/rails

Quick answers

What shipped in Rails on August 10, 2026?: Rails shipped five commits across parameter binding, logger filtering, and migration recording that tighten SQL injection prevention and give you finer control over noisy dependencies. In total, 22 commits and 10 pull requests landed.
Who contributed to Rails on August 10, 2026?: 3 developers shipped this update, including federico-carrocera, kamipo, and Xavier Noria.
What were the notable Rails updates?: Allow ActiveSupport::ProxyLogger to ignore messages by pattern, Use bind parameters for array-form arguments in `find_by_sql` / `count_by_sql`, and Drop `Sanitization` stubs from `FakeKlass`.

RAILS DEPRECATES CREATE ALIAS AS API CLEANUP CONTINUES

Rails is tightening its connection adapter API by deprecating the `create` method alias of `insert`, part of a broader push to align method names with their SQL equivalents.

ruby 19 shipped

@rails Aug 9

RAILS STRIPS REDUNDANT SYMBOL CACHING, BOOTSNAP FIXES YJIT CACHE MISSES

Rails eliminated a now-unnecessary symbol-to-string cache layer by leveraging Ruby 3.0's Symbol#name, while bootsnap's latest release stops discarding its entire compile cache when YJIT is toggled.

ruby 33 shipped

@rails Aug 8

RAILS TACKLES RACTOR SAFETY ACROSS ACTIVE RECORD, NOTIFICATIONS, AND STORAGE

Rails is shipping a wave of Ractor compatibility fixes that unlock concurrent execution in core frameworks while fixing a cache invalidation bug that's been silently nuking performance.

ruby 38 shipped

@rails Aug 7

RAILS WORLD 2026 PROGRAMME LIVE, ACTIONTEXT MARKDOWN FIXED, NESTED ATTRIBUTES INJECTION PATCHED

Rails World 2026 speakers and schedule go live on the website, while core ships critical fixes for markdown rendering and parameter injection in nested attributes.

ruby 27 shipped

Elsewhere on the wire

AI Agents Aug 11

LANGCHAIN PATCHES TOOL CALLS, OPENHANDS SURFACES HIDDEN INTEGRATIONS

LangChain's OpenAI wrapper shipped a fix for invalid tool calls that were silently dropped, while OpenHands surfaced integrations the automation layer was burying.

ai-agents 44 shipped

Local LLMs Aug 11

OLLAMA PATCHES CRITICAL PARSER BUG, NEMOTRON 3 LANDS WITH SPECULATIVE DECODING

Ollama shipped v0.32.7 with a critical fix for boundary token corruption in model invocation, while full MLX support for Nemotron 3 Nano Omni brings self-draft speculation to inference without a separate draft model.

+11

llms 271 shipped

@CachyOS Aug 11

CACHYOS LINUX 7.1.8 SHIPS WITH VMALLOC OPTIMIZATIONS; NOCTALIA CONFIG UPDATED FOR BETA 8

CachyOS Linux 7.1.8 landed overnight with upstream rebase and performance tuning across memory allocation, while Noctalia configuration hardened for beta 8 stability with direct_scanout gaming support.

infra 83 shipped

Elixir & Phoenix Aug 11

PHOENIX LIVE VIEW PATCHES OPEN REDIRECT VULNERABILITY ACROSS TWO VERSIONS

Phoenix Live View shipped emergency security fixes for CVE-2026-64941 in both v1.1.33 and v1.2.9 to close an open redirect hole via ASCII control characters in the redirect/2 function.