Ruby Weekly

Bundler's new dependency cooldown feature

Thu, 4 Jun 2026 00:00:00 +0000

#803 — June 4, 2026

Ruby Weekly

Cool Down Before You Install: Give New Gems a Few Days to Be Vetted — A compromised account can ship a malicious gem and your next bundle install can pull it within minutes. Bundler 4.0.13, released yesterday, provides an opt-in 'cooldown' to hold back releases until they've 'aged' a few days. Meanwhile, bundle outdated shows what’s waiting and for how long.

Hiroshi Shibata (RubyGems)

What Is Legacy Software in the Age of AI? — Software becomes legacy by succeeding long enough to accumulate the weight of every decision and shortcut made along the way. AI creates speed, but also many unintended consequences resulting in more user friction, not less.

Test Double sponsor

Beyond Enumerable: For Want of Better Windows — Enumerable gives names to most of the loops you’d otherwise hand-write, but not all of them. Brandon goes after a shape it doesn't have, stateful sliding windows, and builds his own efficient implementation.

Brandon Weaver

💡 I've been using Ruby for decades but still enjoy an occasional browse through the Enumerable docs as I still haven't internalized it all!

⚡️ IN BRIEF:

Matz's Spinel Ruby AOT compiler has continued to improve over the past few weeks, adding support for Time, Rational/Complex, keyword args, GC introspection, and initial steps towards networking and gem support.
📺 The videos from Tropical on Rails, which took place in Brazil this April, are now available on YouTube.
🎂 Shopify, perhaps the world's largest Rails monolith, launched 20 years ago this week.

Managing Ruby Versions with Mise — A very basic introduction, but as I’ve fallen in love with Mise this year for managing all of my languages (e.g. Go, Node, Rust) and multiple Ruby implementations (e.g. TruffleRuby and JRuby, alongside CRuby) I want it to be on everyone’s radar. It’s great!

Georgi Mitrev

💰 37signals became Mise's first 'premier' sponsor this week.

What If Hanami Had Templateless Views? — It doesn’t take much to add this to Hanami, showing just how flexible the web framework can be.

Paweł Świątkowski

Jidoka: Automation with a Human Touch — Pair coding agents with senior engineers to modernize legacy code and ship faster with built-in quality.

JIDOKA by SINAPTIA sponsor

📄 How to Choose a Gem Wisely – The basics of dependency hygiene. Gelsey Torres

📄 Implementing Account-Specific Rate Limits in Rails Tejas Bubane

🛠 Code & Tools

Meet Mata: Live Reloading with DOM Morphing for Rack Apps — A lightweight "live reload" solution for views in Rack apps. It uses Server-Sent Events (SSE) and idiomorph for updating the DOM. GitHub repo.

Rails Designer

⚡ If you only need Rails, Hotwire Spark offers a broader live reloading approach.

Depot's Sherlock Can Now Analyze Your CI Builds — Ask it to break down your pipeline analytics, debug slow builds, or open a support ticket. It just works.

Depot sponsor

SimpleCov 1.0 RC1: The Code Coverage Analysis Tool — SimpleCov provides an effective way to use the code coverage data collected during testing by Coverage. The changelog is a rather long list, but shows big strides forward in its config, parallel test support, and coverage for unloaded files.

Berlin, Fleischer, Matsuda, et al.

🔒 Console1984: A More Secure, Auditable Rails Console — rails console can often come in handy in prod, but it can also provide users with a little too much power. This extension helps to protect against easy access of sensitive information and provides an audit trail for when it happens.

Basecamp

💡 Back in 2023, 37signals wrote about how they use Console1984 and other tools to allow employees to navigate customer information with care.

Tmuxinator: A Tool to Manage Complex tmux Sessions Easily — tmux is a terminal multiplexer a lot like screen but with more features (and increasingly popular in the LLM era as a way to give agents persistent, controllable terminal sessions).

Bargi and Chow

🎁 Gem in a Box 3.1 – Self-hosted gems server with push support. v3.1 deprecates the RubyGems proxy.
RuboCop 1.87.0 – Adds --enable-all-cops and --disable-all-cops options along with an experimental Rubydex integration.
Ratomic 0.2 – Mike Perham's library of Ractor-safe mutable data structures.
🔒 Puma 8.0.2 and 7.2.1 – Two security-related bugs patched.
Excon 1.5 – Fast HTTP 1.1 client library.
Cucumber 11.1, RMagick 7.0.3, Passenger 6.1.4

📰 Classifieds

🔬 Shipping AI code? Undercover CI catches untested methods in your PRs before you merge. Coverage percentages won't. Free for open source.

📢 Elsewhere in the ecosystem

🗣️ The Ruby Users Forum (above) launched earlier this year as a venue for Rubyists to ask questions and hang out with other Rubyists. It has also become a way to get support for numerous Ruby projects, now including Sidekiq and Faktory, with creator Mike Perham ready to answer your questions.
As well as being a Rubyist, Remi Mercier is also a glass-maker and is going to make a limited-edition stained glass to commemorate Ruby.
DHH makes the argument that agents 'democratize open source'.
PostgreSQL 19, currently in beta, is getting built-in support for graph style SQL/PGQ queries and traversal.

A Unix shell powered by Ruby

Thu, 28 May 2026 00:00:00 +0000

#802 — May 28, 2026

Read on the Web

Ruby Weekly

A New Register Allocator For ZJIT — Deep-in-the-engine-room stuff, but the kind that makes Ruby faster for us all. Tenderlove’s walkthrough of ZJIT’s new register allocator shows how processing an entire method at once lets the JIT keep more values in CPU registers and lays the groundwork for bigger optimizations to come, including method inlining.

Aaron Patterson

Hone Your Postgres Skills - Choose from 44 POSETTE 2026 Talks — Pick from talks about PostgreSQL-backed app development, Postgres performance, scaling, graph data, AI agents, Postgres 19 and more in the Ultimate Guide to POSETTE: An Event for Postgres. This free & virtual developer event is happening 16-18 June.

Microsoft | AMD sponsor

Extending Ruby LSP with Prism — The author adds ‘Go To Definition’for render calls in Rails templates via a Ruby LSP add-on, though it could be a useful starting point for any Ruby LSP extension.

Janko Marohnić

⚡️ IN BRIEF:

Mike Perham reports on (and fixes – in v8.1.6) a 'possible thread/memory leak' in Sidekiq on Ruby 4.0. The root cause is not yet known.
Hitoshi Hasumi, the creator of picoruby, proposes adding bit operations (e.g. bit_at) to String. He already has a prototype in library form.
The Ruby team is planning to move RBS type definitions for core libraries from ruby/rbs into ruby/ruby itself.
Bridgetown, the Ruby site generator, has introduced a first-party theme called Willamette.

▶ 24 Videos from Blue Ridge Ruby 2026 — Blue Ridge Ruby was a few weeks ago and the well-recorded talks are already on YouTube. Some highlights:

Ifat Ribon's Yes, &…: Ruby’s Secret Talent for Improvisation
Brooke Kuhlmann's Terminus: A Hanami + htmx App for E-ink Devices
Joël Quenneville's State is the First Decision You Never Made
Kevin Murphy's InstiLLMent of Successful Practices in an Agentic World
Rachael Wright Munn's Your First Open-Source Contribution

Blue Ridge Ruby

💡 Kevin Murphy has a trip report (including photos) of how Blue Ridge Ruby went, and Christine Seeman describes her experience of speaking there too.

🧑‍💻 Ready to Turn your SDLC into an AI-DLC? — Custom, human-in-the-loop, Claude skills embedded across planning, QA & release, built with 60k hrs of Rails expertise.

Ombulabs.ai | Custom AI Solutions sponsor

📄 Running Migrations Once During a Multi-Host Kamal Deploy – Using a pre-deploy hook to prevent migration errors when multiple web containers boot at the same time. Anthony Drake

📄 Rails 8.1's Native Markdown Rendering Support – Via format.md and render markdown: Amol Joshi

📄 How Rails Turns a Controller Action Into a Response Syed Aslam

🤖 My Agent Skill for Test-Driven Development Jason Swett

🛠 Code & Tools

Rubish: A Unix Shell Written in Pure Ruby — A Unix shell that retains bash compatibility but adds many Rubyisms like expressions for conditions, method chaining, iterator methods, and more. You can embed it into a Ruby program too. Along similar lines, older Ruby hands might remember Adam Wiggins’ Rush.

Akira Matsuda (amatsuda)

Unlimited Postgres for Developers and Their Agents — "Databases were long-lasting infra. Now I spin one up for an afternoon and kill it when done. Feels wasteful. It's not."

Ghost sponsor

Rouge 5.0: The Pure-Ruby Code Highlighter — A long-standing and mature solution with support for 233 languages, plus compatibility with Pygments styles so there are tons of themes. v5.0 drops Ruby 2.7 support, fixes bugs, and adds five new lexers for Thrift, Dylan, 6502 assembly, PDF, and Veryl.

The Rouge Team

Discard 2.0: Soft Deletes for ActiveRecord Done Right — A mixin to add conventions for flagging records as discarded with a nice API.

John Hawthorn

Rubyzen: A Modern Architectural Linter for Ruby — Rubyzen is an ‘architectural linter’ where you can write linting rules as RSpec tests (simpler than RuboCop’s approach). The aim is to provide architectural and structural guardrails for AI developed code.

Perry Street Software

zxcvbn-ruby 2.0: A Password Strength Estimator — A Ruby port of Dropbox’s zxcvbn JavaScript library to show users how secure their passwords are or to enforce password strength. v2.0 changelog.

Envato

Retriable 4.0 – A DSL for retrying failed code blocks with randomized exponential backoff.
wasmtime-rb 45.0 – Ruby embedding of the Wasmtime WebAssembly runtime.
⏱️ Hitimes 3.2 – Fast, high-resolution timer library for recording perf metrics.
Petite Vite Rails – Rails plugin that wires a Vite frontend into a Rails app.

📰 Classifieds

💎 Elasticsearch-quality Full-Text Search for Postgres, now with native ActiveRecord support.

RailsPilot — Can't work through your backlog? Staff engineers with AI-augmented workflows deliver 12 production-ready features/month for $4K. First PR in 24 hours.

📢 Elsewhere in the ecosystem

📱 Joe Masilotti, the creator of Ruby Native — a way to build native mobile apps with Rails — shares an update on a paid app he built with it that's now on both the App Store and Google Play Store.
🏆 KaiCode is an annual open source 'festival' where you submit an open source project you've built (of between 1-5 years in age), all the projects get reviewed, and you could win a prize. Submissions close on June 1st.
🎉 Congratulations to The Bike Shed podcast (a Ruby-leaning general dev discussion podcast from thoughtbot) upon celebrating its 500th episode.
It's a JavaScript thing, but I really enjoyed this JavaScript crossword this week. Can someone make a Ruby one? If not, I might have to!
💰 Curious about the cost of running a mid-size Ruby event? RubyConf Austria has shared their numbers.
🕒 If you're a Postgres user, did you realize that now() doesn't necessarily return the current time? Somehow I didn't.

Why Ruby still feels like home

Thu, 21 May 2026 00:00:00 +0000

#801 — May 21, 2026

Read on the Web

Ruby Weekly

🛠️ One Year of Ruby on Rails Configuration — The creator of GoodJob shares a tour of the monkey patches, extensions, and appwide behaviors that have accumulated in his Rails app’s /config directory. It’s heavy on examples and things you might want to ~~steal~~ be inspired by.

Ben Sheldon

Ruby 4.0.5 Released — An off-schedule release to address a critical use-after-free race condition in the getaddrinfo timeout handler. It also resolves a build system regression under the C locale introduced in 4.0.4.

Takashi Kokubun

🤖 Claude Skills Built Around Your Engineering Process — We created an open-source Claude Code skill for Rails upgrades, leveraging 60,000+ hours of experience. Individual, general skills can only go so far; we build skills that understand your process. Take the next step into AI-assisted development.

Custom Solutions | Ombulabs.ai sponsor

⚡️ IN BRIEF:

thoughtbot has joined the Ruby Alliance – nothing to do with Star Wars but a program announced in Ruby Central's recent reboot to allow companies to support RubyGems and the broader ecosystem.
🕹️ The DragonRuby Game Toolkit (a Ruby implementation targeted at game development) is free for the next 24 hours to celebrate the start of the Ancient & Nameless & Fun & Stupid GameJam which runs till June 15.
🇪🇺 Euruko 2026 takes place this September 17-18 in Brno, Czechia and its CFP is open till June 16 if you'd like to speak.
Jerome Paul noticed end-less methods can lead to endless rescues, too…

🗓️ What is Date::ITALY? — If you guessed that it has something to do with Julian and Gregorian calendars, you’re right, but that’s just the start of it. A fun journey through some date/time esoterica.

John DeSilva

Why Ruby Still Feels Like Home After All These Years — A warm retrospective on why Ruby, fifteen years and several language affairs later, remains satisfying to use. Caio highlights language features like refinements, Forwardable, and numbered params, alongside modern tooling like Ruby LSP and Steep, and the performance ceiling YJIT raised.

Caio Bianchi

Build a Fantasy Adventure Game With Rails and RCS — Step into Eldrathia! Build a branching fantasy RPG using Rails and RCS, complete with monsters, magic, and rich cards.

Vonage sponsor

📄 Inbound Email in Rails Apps with Fuik – How to use the Fuik webhook engine to accept email webhooks from common providers. Rails Designer

📄 Ruby vs. Java vs. TypeScript for Building a Claude Cowork Plugin – Not a positive outcome for Ruby here (Tanin likes types!) but some interesting perspectives. Tanin Nanakorn

📄 Safely Dropping Columns in Rails Akshay Khot

🛠 Code & Tools

SmarterCSV: The Fastest End-to-End CSV Library for Ruby — A CSV parsing and generation library that leans upon C for performance, can handle CSV parsing failures that Ruby's usual CSV library can’t, and with a nicer API too (though migrating to SmarterCSV is a one-line change). The latest release adds support for non-seekable/streaming IO sources.

Tilo Sloboda

Your Gemfile Doesn't Need an Analytics Database — TimescaleDB extends the Postgres your Rails app already uses. Analytics at scale, no new stack. $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

Bundlebun: Pack Bun into Your Ruby App with No External Setup — An approach to packaging the Bun JS runtime in a Ruby gem. Yaroslav explains the gem’s architecture and its integrations with Vite and ExecJS.

Yaroslav Markin

🤖 LLM Cost Tracker: Self-Hosted LLM Cost Management for Rails — A self-hosted LLM cost-tracking engine for Rails monoliths that captures token usage, latency, and costs directly from SDKs and Faraday middleware (no proxies required).

Sergii Khomenko

Bridgetown 2.2 – The powerful Ruby site generator has added support for wikilinks and uses the Falcon web server by default.
Passenger 6.1.3 – The app server adds support for Rack 3's response_finished post-response hooks.
rubyfmt 0.14 – The Ruby code autoformatter that Stripe recently used to format 25 million lines of code.
Peddler 5.4 – Ruby interface to the Amazon Selling Partner API (SP-API).
🔎 Marcel 1.2 – Identify the MIME type of files from data and extensions.
📄 HexaPDF 1.8 – AGPL-licensed PDF creation and manipulation library.
OmniAuth LDAP 3.0 – LDAP authentication strategy for OmniAuth.
Comma 4.9 – DSL-based CSV generator for diverse Ruby objects.

📰 Classifieds

Stop wasting time on slow Docker builds. How to correctly structure caching for your Gemfile, multi-stage builds, and more.

Autoscaling that doesn’t suck. Try Judoscale and see what all the fuss is about.

🔬 Shipping AI code? Undercover CI catches untested methods in your PRs before you merge. Coverage percentages won't. Free for open source.

💎 Elasticsearch-quality Full-Text Search for Postgres, now with native ActiveRecord support.

📢 Elsewhere in the ecosystem

🇺🇸 Blastoff Rails is a Rails conference taking place this June 11-12 in Albuquerque, New Mexico. There's also a game to help promote the event featuring a 'Professor Matz' (above)!
A brief reminder to take the 2026 Ruby on Rails Community Survey from Planet Argon, if you haven't yet. It only takes place every two years – here are the results from 2024.
🤖 At Google I/O this week, Google unveiled Modern Web Guidance, a set of expert-vetted skills to guide your coding agents to build accessible, performant, and secure web experiences, e.g. "Set up my app to begin preloading pages when users hover over important links."
🤖 Evil Martians' Ivan Chepurin says AI-assisted engineers are burning out, looks at the problems involved, and suggests how to avoid such burnout.
If you've got time, you can help TruffleRuby complete its Ruby 4.0 support.

Why regexes starting with 'k' or 's' got slower in Ruby 4.0

Thu, 14 May 2026 00:00:00 +0000

#800 — May 14, 2026

Read on the Web

Ruby Weekly

One Engine, Many Tools: Introducing Rubydex — Prism unified Ruby’s parsing layer, and now Vinicius Stock (creator of Ruby LSP) is betting the Rubydex static analysis toolkit can do the same one-level-up for code indexing, with Ruby LSP, Tapioca, and Packwerk already migrating.

Vinicius Stock

Adopting Herb at GitHub — GitHub spent the past few months integrating the Herb ERB toolchain into its Rails monolith. Joel tells the tale, including what Herb caught that erb_lint missed in GitHub’s ~500,000 lines of ERB.

Joel Hawksley (GitHub)

Jidoka: Automation with a Human Touch — Turn your roadmap into a supervised software delivery line. Jidoka pairs coding agents with senior engineers, so teams can modernize legacy code, ship faster, with quality built-in.

JIDOKA by SINAPTIA sponsor

⚡️ IN BRIEF:

🔒 Jun Aruga proposes adding post-quantum cryptography support to Ruby's standard libraries, something he's already worked on in Ruby's openssl.
🤗 Richard Schneeman suggests RubyGems.org should have a concept of 'alumni' to remember/recognize former maintainers of gems.
🇯🇵 Kaigi on Rails 2026 is a Japanese Rails conference taking place this October 16-17 in Tokyo. Dave Thomas and DHH are booked to keynote.
🇺🇸 The CFP for Rails World (September 23-24) closes in two days.

Ruby 4.0.4 Released — The latest CRuby is here. It’s a scheduled, routine update (which the latest stable release gets every two months) so there are no new features, but a lot of bugfixes, so it’s worth the upgrade.

Takashi Kokubun

🤓 My favorite fix is for a regression in 4.0 where regexes starting with 'k' or 's' became slower. Why? s and k are the only two ASCII letters with two other characters that become case-equivalent with them (namely, S/ſ - long S, and K/K - the Kelvin sign) causing Onigmo to de-optimize such regexes.

RubyGems Signups Down as Spammers Target London Councils — RubyGems.org has temporarily disabled user signups (installs and pushes remain live) due to a ‘GemStuffer’ campaign where, oddly, public data shared by local councils in the UK is being turned into junk gems en masse.

Joseph Edwards (Socket)

A Ruby Timeout That Works (on Linux) — In 2015, Mike Perham called Timeout Ruby’s most dangerous API and its problems remain (namely that it won’t interrupt a blocking syscall). Brad is now working on an alternative approach, leaning on Linux’s TCP_USER_TIMEOUT.

Brad Gessler

How Depot Got CI MicroVMs Booting in Under a Second — Stop waiting for CI warm pools. Depot CI uses just-in-time microVMs that cold boot in under a second for faster builds.

Depot sponsor

📄 Solidus vs. Spree – Solidus and Spree are Rails-based e-commerce platforms that share a common ancestry. (Note: This telling of the story is from the Solidus POV.) Jared Norman (SuperGood)

📄 Use class_names to Conditionally Apply CSS Classes in Rails – If you’re interpolating strings into class attributes, do this instead. Andy Croll

📄 A Reusable Drag-and-Drop Image Preview in Rails – How to build a drag-and-drop image upload custom element that works in Rails forms. Rails Designer

🛠 Code & Tools

▶ Rails Just Made Your Database Agent-Ready — A recent PR to Rails core adds rails query to allow read-only queries from the command line. The video covers the essentials with numerous examples. Of course, there’s an agent skill that lets agents use it well to answer queries too.

Emmanuel Hayford

🤖 Need Claude Skills Tailored to Your Engineering Org? Let’s Talk! — We open-sourced our Rails upgrade skills based on 60,000 hours of experience. Let’s build yours for a11y, dead code, or QA.

Ombulabs.ai | Custom AI Solutions sponsor

ASTro: AST-Based Reusable Optimization Framework — Ruby core’s ko1 is working on an experimental optimization framework that generates specialized C code from AST interpreters. Numerous sample implementations span various subsets of Ruby, Lua, Pascal, and others.

Koichi Sasada

💡 Two of Koichi's ASTro-based Ruby implementations (abruby and koruby) can run the optcarrot benchmark, and faster than CRuby (without YJIT) too.

ruby-warning 1.6: Custom Processing for Warnings — A tidy way to customize Ruby warnings. For example: Warning.dedup to deduplicate them, Warning.ignore(:missing_ivar, __FILE__) to ignore a specific warning in the current file, or you can even hide all warnings from gem dependencies.

Jeremy Evans

rbspy 0.47 – The live sampling profiler has added Ruby 4.0.4 support.
Rack::JsonSchema 1.6 – JSON Schema-based Rack middleware offering request/response validation, mocking, and API documentation.
FriendlyId 5.7 – The "Swiss Army bulldozer" of slugging and permalink plugins for Active Record.
Cutoff 1.1 – Enforcing total execution-time 'deadlines' with checkpoints.
☎︎ Phonelib 0.10.20 – Phone number validation and formatting library.
MiniScheduler 0.20 – Adds recurring job scheduling to Sidekiq.
Chusaku 1.5 – Annotate your Rails controllers with route info.