$ cat rails/week/2026-09-07.log
the week in review · Sep 7 – Sep 13, 2026
ActionText to_markdown delimiter escapes leave stored XSS
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Mission Control 1.3.0 ships Solid Queue batch browsing, and Ractor-safety fixes land across Active Record, time zones, and the event reporter.
Batch support for Solid Queue rails/mission_control-jobs
Built against solid_queue 1.7.0, Mission Control can now browse batches: a Batches tab lists them by status, each batch shows its progress and jobs broken down by status, and a job belonging to a batch links back to it. Batches shipped upstream in rails/solid_queue#142, so this is the dashboard catching up to the released feature.
v1.3.0 rails/mission_control-jobs
The 1.3.0 release adds the batch support alongside sorting failed jobs in descending order, described by the maintainers as a very requested change. If you run Mission Control against Solid Queue 1.7, failed-job triage now surfaces the most recent failures first.
Use Regexp#source instead of Regexp#to_s to detect deep filters rails/rails
ParameterFilter#compile_filters! only needs to know whether the pattern text contains an escaped dot, but Regexp#to_s renders the full (?-mix:...) form and re-serializes the regexp on every call. Switching to Regexp#source with a wrapper removes that per-call work from the parameter-filtering path.
Fix Active Support loading on JRuby without Ractor rails/rails
JRuby 10 reports RUBY_VERSION as 4.0.0 but does not define the Ractor constant, and Active Support was selecting its Ruby 4.0 Ractor implementation based only on the version, which broke loading of active_support/core_ext. The fix keys the implementation choice off the constant rather than the version string, so JRuby 10 can load Active Support again.
Fix retry_job to respect enqueue options when enqueue is deferred rails/rails
retry_job now respects enqueue options when enqueue is deferred, so options passed to the call are no longer dropped on the deferred path. Relevant if you retry jobs with explicit queue or scheduling options under a deferring adapter.
Make the event reporter usable from Ractor workers rails/rails
A new event reporter is created per Ractor, but because all framework subscriptions happen from the main Ractor those new reporters have no subscribers, which kills structured controller logging in Ractor workers. This change makes the event reporter usable from those workers.
Upgrade rubocop rails/rails
The rubocop upgrade comes with a temporary json < 3.0 lock: everything works with the newer json except the resque test suite, which needs a new multi_json release. Note the pin if your own Gemfile shares this dependency tree.
Encode the id as a URL path segment, not a form value rails/activeresource
Base.element_path and CustomMethods#custom_method_element_url escaped id with URI.encode_www_form_component, so a space became a + in the path: Person.find("ann mary") requested /people/ann+mary.json. IDs are now encoded as URL path segments, and any code asserting on the old escaped paths will need updating.
$ ls rails/week/ # the briefings behind this review
Keep up with Rails in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.