$ cat rails/week/2026-10-19.log
the week in review · Oct 19 – Oct 25, 2026
Rails raises MySQL floor to 5.7.9
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Active Record also stops rebuilding its constant Arel SQL fragments per query, and ssl_default_redirect_status is now deprecated.
Bump the minimum supported MySQL version to 5.7.9 rails/rails
On 5.6, InnoDB creates tables as ROW_FORMAT=COMPACT, whose 767-byte index prefix cannot hold a varchar(255) at four bytes per character, so indexing a utf8mb4 string column there needs innodb_file_per_table, innodb_file_format = 'Barracuda' and innodb_large_prefix set on the server. If any of your environments still report 5.6, that is the migration work.
Inline `_write_attribute` in generated writer methods rails/rails
Generated writers now inline _write_attribute, which saves a method call in the common path and strips much of the attr_readonly overhead. The flag becomes baked in at compile time, so flipping ActiveRecord.raise_on_assign_to_attr_readonly back to false later may not take effect as expected.
Share the constant Arel.sql literals instead of building them per query rails/rails
The SQL fragments Active Record writes into queries are constant, but they were rebuilt through Arel.sql on every call at 5 objects each. Following the earlier change that shared Arel.star, those literals are now shared, which cuts allocations on the query-construction path.
Merge pull request #59181 from bensheldon/deprecate-ssl-default-redirect-status rails/rails
The ssl_default_redirect_status: argument of ActionDispatch::SSL is deprecated. Applications passing it explicitly have a deprecation to clear; the default behavior is unchanged while the argument remains.
Add config.zjit to enable ZJIT after boot rails/rails
config.zjit turns on ZJIT after boot, following the pattern config.yjit uses, so the JIT doesn't compile code that only runs while booting. Ruby runs one JIT at a time, and RubyVM::ZJIT.enable refuses while YJIT is on.
Check content security policy sources for whitespace without copying them rails/rails
ContentSecurityPolicy#validate runs on every header build and previously copied each source with whitespace removed. It now checks with match?, so the validation no longer allocates. Configurations with stray whitespace in sources still get the check they had.
Unroll request header getters rails/rails
Request header getters are unrolled instead of created dynamically, which makes them cacheable by bootsnap. Same follow-through as the other unrolling work this period: less per-request overhead in the middleware stack.
Fix in_order_of serializing values twice rails/rails
cast_values_for_in_order_of serialized values to drop the ones the column type cannot represent, then column.eq and column.in wrapped them in Casted nodes and Arel quoted them a second time. That double pass is gone. Alongside: numericality on decimals with implicit scale, restored id_value= and where(id_value:), and permissive attribute reads that don't raise on a missing value.
$ ls rails/week/ # the briefings behind this review
Keep up with Rails in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.