$ ls rails/reviews/ # the step-back reads
Rails in review
One review per week (and month): what shipped, what broke, what to act on.
Nov 2–8, 2026 weekly [act] 8 stories
Rails ships 8.0.5.2 and 8.1.4.1 with four security fixes
Active Storage direct uploads to Google Cloud Storage and filename handling both carry advisories, plus an Action Pack content negotiatio...
Oct 26–Nov 1, 2026 weekly [act] 8 stories
Trilogy 2.13.2 patches SQL injection escape bug
The period's only security fix lands alongside a SQL string escape correction, an Action Cable ordering fix, and cleanup of url_for route...
Oct 19–25, 2026 weekly [plan] 8 stories
Rails raises MySQL floor to 5.7.9
Active Record also stops rebuilding its constant Arel SQL fragments per query, and ssl_default_redirect_status is now deprecated.
Oct 12–18, 2026 weekly 8 stories
Ractor-ready Active Record and Active Job land in Rails
A week of fixes repair what ractorize! broke: job serializers, rescue_from, deprecation warnings, plus a read-only attribute set to recov...
Oct 5–11, 2026 weekly 8 stories
Postgres adapter gains maintenance_database option
Rails also added adapter-specific migration regression coverage and moved Action Pack and Action Mailer docs from RDoc to Markdown.
Oct 1–31, 2026 monthly [act] 8 stories
Rails drops dynamic controller routes, MySQL 5.6, and Trilogy patches
The five-year deprecation for dynamic controller and action routes now raises ArgumentError, and Trilogy 2.13.2 closes an escape SQL inje...
Sep 28–Oct 4, 2026 weekly [act] 8 stories
Rails drops dynamic controller routes, rewrites JSON escaping
Routes reading controller or action from the URL now raise ArgumentError, and JSON escaping moves to String#tr! on Ruby 3.4+.
Sep 21–27, 2026 weekly [act] 8 stories
Active Model drops Ruby 4.3 alias, breaking nightly
Rails nightly against ruby 4.1.0dev has failed since September 17 in every framework that loads Active Model.
Sep 14–20, 2026 weekly [plan] 8 stories
Active Storage gets a direct-upload kill switch
Active Record also fixed Postgres primary key and schema introspection bugs that misread covering indexes and shadowed table names.
Sep 7–13, 2026 weekly [act] 8 stories
ActionText to_markdown delimiter escapes leave stored XSS
Mission Control 1.3.0 ships Solid Queue batch browsing, and Ractor-safety fixes land across Active Record, time zones, and the event repo...
Sep 1–30, 2026 monthly [act] 8 stories
Herb becomes Rails 8.2 default
The Ractor-readiness push runs across Rails internals all month, and ActionText's to_markdown escaping keeps getting patched.
Aug 31–Sep 6, 2026 weekly
Rails moves config to class attributes
A coordinated set of Rails and Propshaft patches replaces class variables with instance and singleton class attributes for thread and Rac...
Aug 24–30, 2026 weekly
Solid Queue hardens job finalization, Marcel 2 lands, ERB gains HTML-aware Herb
This week, Solid Queue stopped workers on finalization failure to clear stuck job claims, Marcel shipped its typeless Tika decoding and a...
Aug 1–31, 2026 monthly
Rails deepens Ractor safety, ships Marcel 2.0, and retires decade-old APIs
August saw Rails push forward on three fronts: a sustained campaign to make Active Record safer under Ractor and concurrency, the release...
Keep up with Rails in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.