What shipped in Rails on August 18, 2026?

A one-line fix that closes a silent cross-tenant write hole in Rails' association updates. In total, 14 commits and 8 pull requests landed.

Who contributed to Rails on August 18, 2026?

5 developers shipped this update, including matthewd, pierry01, arzezak, Saidbek, and skryukov.

What were the notable Rails updates?

Keep the relation scope in `Relation#update` and `#update!`, Keep the relation scope in `Relation#update` and `#update!`, and Fix clearing PK-overlapping association keys when assigning nil.

@rails

Ruby on Rails - Shopify, Basecamp, GitHub all run on it

github ↗

Pick a date

Topics: Ruby Full archive →

The Wire · Showcase

RELATION#UPDATE IGNORES SCOPE: SILENT CROSS-TENANT WRITES

By RepoJournal · Filed 06:55 UTC on August 18, 2026 · About Rails

5 people shipped this

skryukov @skryukov 3 cited

pierry01 @pierry01 2 cited

matthewd @matthewd 1 cited

arzezak @arzezak 1 cited

Saidbek @Saidbek 1 cited

A one-line fix that closes a silent cross-tenant write hole in Rails' association updates.

Rails' `Relation#update` and `#update!` currently ignore the relation's scope, so `post.comments.update!(comment_id, ...)` can write a comment belonging to another post when the id comes off a request [1][2]. This is a textbook tenant-boundary breach: when the association is the tenant boundary (`buyer.suppliers`, `account.users`), the relation's conditions never reach the query because the id is resolved by the class-level `find`. The PR keeps the scope in the query, and the maintainer notes it's a follow-up to the PK-overlapping FK clearing fix [3], which now also handles the case where keeping all FK parts would lose the set-to-nil operation. Meanwhile, `bin/rails test:system` raises a `LoadError` on fresh apps because `rails new` no longer generates a `test/system` folder but the generated CI still runs the command [4]. That's a one-line guard in the test runner. Elsewhere, the Agents on Rails second report is live with Grok 4.6, GLM 5.3, Gemini 3.7 Flash, and Opus 4.8 results [5], and the Opus 4.8 comparison to Opus 5 has been corrected [6]. The report's run logs are published in `rails/ai-evals` [7], and `bin/rails console` gets a `--no-banner` flag for scripts and CI [8].

Action items

→ Review and test Relation#update scope fix before your next deploy rails/rails [immediate]
→ Patch bin/rails test:system LoadError if you use generated CI rails/rails [immediate]
→ Read the Agents on Rails second report for model benchmark results rails/website [monitor]
→ Try bin/rails console --no-banner in your scripts rails/rails [plan]

References

[1] Keep the relation scope in `Relation#update` and `#update!` ↗ rails/rails
[2] Keep the relation scope in `Relation#update` and `#update!` rails/rails
[3] Fix clearing PK-overlapping association keys when assigning nil ↗ rails/rails
[4] Don't raise LoadError when a test:* folder is missing ↗ rails/rails
[5] Agents on Rails: second report ↗ rails/website
[6] Fix comparison of Claude Opus versions (#723) rails/website
[7] Add atomic tasks run logs ↗ rails/ai-evals
[8] Add --no-banner to bin/rails console ↗ rails/rails

Quick answers

What shipped in Rails on August 18, 2026?: A one-line fix that closes a silent cross-tenant write hole in Rails' association updates. In total, 14 commits and 8 pull requests landed.
Who contributed to Rails on August 18, 2026?: 5 developers shipped this update, including matthewd, pierry01, arzezak, Saidbek, and skryukov.
What were the notable Rails updates?: Keep the relation scope in `Relation#update` and `#update!`, Keep the relation scope in `Relation#update` and `#update!`, and Fix clearing PK-overlapping association keys when assigning nil.

SPROCKETS CACHE LIMITS GET AN OFF SWITCH

Sprockets just shipped an escape hatch for environments where the cache cleaner costs more than the cache it protects.

ruby 49 shipped

@rails Aug 17

Rails cuts schema cache dumps in half for large databases

The columns method now batches table reads instead of hammering the database one table at a time, slashing statements by 50 percent on schema dumps.

ruby 18 shipped

@rails Aug 16

SOLID_CABLE SHIPS ENCRYPTION, RAILS CUTS SCHEMA CACHE READS IN HALF

Solid Cable now encrypts messages at rest [ref:1], while Rails optimizes schema caching to batch database queries across entire tables instead of reading them one at a time [ref:8].

ruby 12 shipped

@rails Aug 15

RAILS TACKLES RACTOR SAFETY AND SCHEMA DUMP PERFORMANCE IN OVERNIGHT PUSH

Rails is systematically freezing mutable configuration to unlock ractor concurrency, while schema dumping gets a massive speed boost that slashes database round trips by orders of magnitude on large schemas.

ruby 23 shipped

Elsewhere on the wire

AI Agents Aug 19

CLINE DESKTOP GOES NATIVE WITH BACKGROUND ALERTS

Cline's desktop app just became a tool you can leave running while you grab coffee, and LangChain is quietly fixing the token math that makes DeepSeek caching actually count.

ai-agents 97 shipped

@CachyOS Aug 19

CACHYOS PUSHES KERNEL 7.1.8 AND SCHEDULER FIXES ACROSS THE STACK

CachyOS is shipping a new kernel meanwhile patching its scheduler stack, and that combination is exactly what you want before your next deploy.

infra 58 shipped

Elixir & Phoenix Aug 19

LiveView memory leak fix leads overnight Elixir cleanup

A handful of pull requests across Elixir and Phoenix are quietly fixing leaks and edge cases that have been nagging at production apps.

elixir 19 shipped

@dotnet Aug 19

MAUI Overhauls NuGet Publishing as FSharp Preps for VS 18.11

MAUI is replacing its custom NuGet publishing with Microsoft's 1ES.PublishNuget, and FSharp is rolling Microsoft.Build deps forward to VS 18.11, two moves that reshape release engineering across the .NET ecosystem.