RepoJournal
Rails @rails
159 wires and counting

$ follow Rails

Keep up with Rails in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-08-18
stories 22
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

RELATION#UPDATE IGNORES SCOPE: SILENT CROSS-TENANT WRITES

By RepoJournal · Filed · About Rails · Composed from the cited sources · methodology

skryukov pierry01 matthewd arzezak Saidbek
5 people shipped this
skryukov @skryukov 3 cited pierry01 @pierry01 2 cited matthewd @matthewd 1 cited arzezak @arzezak 1 cited Saidbek @Saidbek 1 cited

A one-line fix that closes a silent cross-tenant write hole in Rails' association updates.

Rails' `Relation#update` and `#update!` currently ignore the relation's scope, so `post.comments.update!(comment_id, ...)` can write a comment belonging to another post when the id comes off a request [1][2]. This is a textbook tenant-boundary breach: when the association is the tenant boundary (`buyer.suppliers`, `account.users`), the relation's conditions never reach the query because the id is resolved by the class-level `find`. The PR keeps the scope in the query, and the maintainer notes it's a follow-up to the PK-overlapping FK clearing fix [3], which now also handles the case where keeping all FK parts would lose the set-to-nil operation. Meanwhile, `bin/rails test:system` raises a `LoadError` on fresh apps because `rails new` no longer generates a `test/system` folder but the generated CI still runs the command [4]. That's a one-line guard in the test runner. Elsewhere, the Agents on Rails second report is live with Grok 4.6, GLM 5.3, Gemini 3.7 Flash, and Opus 4.8 results [5], and the Opus 4.8 comparison to Opus 5 has been corrected [6]. The report's run logs are published in `rails/ai-evals` [7], and `bin/rails console` gets a `--no-banner` flag for scripts and CI [8].

Action items

References

  1. [1] Keep the relation scope in `Relation#update` and `#update!` ↗ rails/rails
  2. [2] Keep the relation scope in `Relation#update` and `#update!` ↗ rails/rails
  3. [3] Fix clearing PK-overlapping association keys when assigning nil ↗ rails/rails
  4. [4] Don't raise LoadError when a test:* folder is missing ↗ rails/rails
  5. [5] Agents on Rails: second report ↗ rails/website
  6. [6] Fix comparison of Claude Opus versions (#723) ↗ rails/website
  7. [7] Add atomic tasks run logs ↗ rails/ai-evals
  8. [8] Add --no-banner to bin/rails console ↗ rails/rails

$ ls rails/reviews/ # the step-back reads

the week in review Ractor-ready Active Record and Active Job land in Rails the month in review Herb becomes Rails 8.2 default
Full archive → Weekly reviews →

Quick answers

What shipped in Rails on August 18, 2026?
A one-line fix that closes a silent cross-tenant write hole in Rails' association updates. In total, 14 commits and 8 pull requests landed.
Who contributed to Rails on August 18, 2026?
5 developers shipped this update, including matthewd, pierry01, arzezak, Saidbek, and skryukov.
What were the notable Rails updates?
Keep the relation scope in `Relation#update` and `#update!`, Keep the relation scope in `Relation#update` and `#update!`, and Fix clearing PK-overlapping association keys when assigning nil.
♥

$ log @rails --recent

Attribute-read regression fixed, decimal numericality corrected 79 shipped in_order_of double-serializes values, id_value alias restored 50 shipped Inlined attribute writers, leaner ActiveRecord::Key 31 shipped MySQL 5.6 falls off the support floor as Arel stops rebuilding literals 27 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training verl standardizes low-precision rollout kernels on DeepGEMM Agent Security Guardrails exposes hooks over HTTP, certifi floor raised in agent-scan

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.