$ cat rails/week/2026-10-26.log
the week in review · Oct 26 – Nov 1, 2026
Trilogy 2.13.2 patches SQL injection escape bug
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
The period's only security fix lands alongside a SQL string escape correction, an Action Cable ordering fix, and cleanup of url_for route scoring.
v4.7.0 rails/tailwindcss-rails
The gem's install and upgrade tasks passed an interpolated string to system, so a shell metacharacter in the gem path broke them; the tasks now work when the gem lives under a path with spaces. Anyone installing on a machine with spaces in the Ruby or gem directory can rerun the task.
Process each Action Cable connection's commands in order rails/rails
Socket#receive handed each incoming WebSocket message to the worker pool as its own job, so with the default four threads two messages from one connection could be processed out of order. Stream callbacks and periodic timers in perform_work now go through the same serialization, which closes the window where they ran against a half-torn-down channel.
Match URL-decoded query parameter names when filtering logs rails/rails
filtered_path and filtered redirects matched filter_parameters against the raw query name, so a request sending %70assword or access+token was logged in the clear while the decoded name would have matched. Log filtering now compares the decoded parameter name.
Scope `immutable_strings_by_default` to string columns rails/rails
The setting was being applied to every column type that subclassed ActiveModel::Type::String, which caught text and PostgreSQL's xml, citext, ltree, tsvector and macaddr columns. Those columns now keep their own inferred types instead of being treated as immutable strings.
Keep the optimized URL helper for options that do not shape the path rails/rails
Any option besides a sole :format dropped named helpers off the optimized path, so post_url(post, host: "example.org") or posts_path(page: 2) ran the full url_for pipeline. Helpers now stay optimized for options that do not shape the path; a companion change skips redirects and mounted Rack apps before scoring routes for the unnamed url_for case.
Skip redirects and Rack apps before scoring routes in url_for rails/rails
url_for without a route name scored every route lacking required defaults, redirects and mounted apps included, then sorted them only for generate to skip the non-dispatchers. Those routes are now set aside before scoring.
Exclude default_order from aggregate calculations rails/rails
by kehra
Aggregate calculations already discard explicit ordering but kept default_scope order, which produced invalid PostgreSQL queries, including SELECT DISTINCT statements ordering by columns outside the select list. Default ordering is now excluded there too.
Deprecate ActiveRecord::Validations::NumericalityValidator rails/rails
The class was removed earlier because Active Model's validator can now look up the attribute type itself, but outside code still references the constant to inspect a model's validators. The ColumnDefinition option accessors generated via module_eval from a string are deprecated as well, since bootsnap's compile cache cannot cache them.
$ ls rails/week/ # the briefings behind this review
Keep up with Rails in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.