Happy Wednesday! Here is issue #158 of our newsletter, bringing you news and the best tools for your current or future Rails projects… Rails & Ruby Engineering1.🛠️ Think Rake is just for migrations and seeds? Think again. Francois shows you how Rake is the build tool you already have integrated into your Rails app, from Docker workflows to CI scripts. Learn how to trade scattered shell scripts for a single, self-documenting automation hub. 2. 😵 Still running sass-rails in 2026? LibSass is already end-of-life, so there is no excuse to wait. Julio walks through migrating your Rails app to Dart Sass, covering the move from @import to @use, the deprecated / division operator, and the Sass Migrator tool that does most of the work for you. 3. ⚙️ Need code that only runs inside your web server, never in rake tasks or the console? Ben Sheldon rounds up four ways to hook into Rails' boot sequence: the server do block, config.ru, a Puma plugin, or plain Rack middleware, plus the tradeoffs of each for your own app versus a gem you're distributing. 4. 🔧 62 PRs, 20 repos, one mission: Close the invisible gaps where reliability breaks. Samuel Williams’ Making Failure More Predictable in Ruby Systems dives into CRuby signal-race fixes, safer HTTP retries with body rewinding, and Falcon’s new load-aware clustering (with Envoy integration). It’s rare to see reliability engineering laid out so concretely: not just “we fixed bugs,” but how—and why those narrow timing windows matter. Security Updates5. 🚨 Patch day is today if you're running Rails — and "patch day" might take more than one command. The headline item on this week's RubySec advisory archive is CVE-2026-66066: a flaw in Active Storage's libvips variant processing that can let an unauthenticated attacker read arbitrary files, including your secret_key_base, and potentially escalate to RCE. Upgrade activestorage immediately. ➡️ Gelsey shows that patching activestorage alone won’t fix CVE-2026-66066; you also need libvips 8.13+ in your container base. A stale base image can either crash your app or silently leave it vulnerable, proving that identical gems can yield vastly different security outcomes depending on your underlying image. The same week also brought a cluster of smaller but real issues worth a look:
6. Separately, RubyGems.org disclosed a nine-year-old CDN caching bug that could hand one account's legacy API key to another signer-in for up to an hour. All legacy keys have been revoked — if you push gems, check your API key history and move to scoped keys with MFA enabled. AI, Agents & Rails7. 📊 Your LLM features are burning tokens, but is anyone watching the meter? Henrique shows you how to instrument every LLM call in your Rails app with the new Rails 8.1 Event Reporter, turning opaque API requests into structured events for cost, latency, and failure tracking. See how tagging and request context turn those events into per-feature, per-user visibility into your AI spend. 8. 🧑💻 Tech debt audits shouldn't mean an afternoon stitching together nine tools by hand. Ernesto built a Claude Code skill that automates your entire tech debt audit, combining security, dependency freshness, coverage, and complexity into one report. See how a single slash command replaces nine separate tools. 9. 🤖 Every quickstart gets you a server that runs locally and disappears when the client exits, not one a team can rely on. Amanda breaks down what changes once real deployment is on the table: session state that quietly breaks across Puma workers, the Host and Origin security advisory the mcp gem shipped with, and what OAuth actually requires once a shared token isn't enough. 10. 🎨 "Just describe it and let the model generate it" only gets you so far. Fiona breaks down what it actually takes to turn a customer's request into a manufacturable, brand-aligned product design with AI, from capturing domain knowledge to choosing the right image generation model. Discover why the system around the model matters more than the model itself. 11. 🤖 Turns out the same conventions that made Rails great for humans also make it great for AI agents. Josef Strzibny makes the case for Rails in agentic coding: strong token efficiency, Convention over Configuration removing guesswork, and a training-data edge from decades of idiomatic open source code. A long, thorough read on where Rails stands in the AI-agent era. 12. 📉 Is AI actually killing Ruby jobs, or just a convenient story? Marian Posaceanu dug into seven years of Hacker News hiring threads and found Ruby and Rails visibility declining well before ChatGPT launched, with no statistically clear link between AI-language mentions and target-stack share afterward. A careful, data-heavy rebuttal to easy narratives. Check out our other articles on: Ruby | Rails | Compatibility | Upgrades | Tech Debt | AI Bookmark, share, or save them for later. We hope these links are helpful. 😉 Best, The FastRuby.io Team
|
Don't wait to bring your Rails application up to date.
We will get on a quick call and recommend a couple of options to start upgrading your Rails app.
