Last 7 days
0
Features: 0
Changes: 0
Fixes: 0
Deprecations: 0
Ruby on Rails
Full-stack Ruby framework for database-backed web applications.
Latest Ruby on Rails changelog updates, official release notes, breaking changes, security patches, pricing changes, and developer reactions in one product feed.
Follow this Ruby on Rails release-notes page to spot useful features, risky migrations, noisy announcements, and source links before they hit your backlog.
Where Ruby on Rails updates are checked
Changes.Watch links back to official changelog and release-note sources so summaries stay easy to verify.
Related changelog channels
Use channels to follow groups of tools around a stack, workflow, or topic.
Ruby on Rails updates by type
Rolling windows show how many product updates landed in the last 7, 30, 90, and 365 days, grouped by existing changelog semantics.
0
3
3
17
Latest Ruby on Rails changelog updates
Active Storage disables libvips unfuzzed image loaders/savers, causing Vips::Error for BMP, ICO, PSD, SVG, JPEG XL, JPEG 2000, Netpbm and other formats – a breaking change for apps using those types
Active Storage disables libvips “unfuzzed” image loaders and savers (e.g., BMP, ICO, PSD, SVG, JPEG‑XL, JPEG‑2000), causing Vips::Error for those formats
Active Storage now disables libvips "unfuzzed" image loaders/savers, raising Vips::Error for BMP, ICO, PSD, SVG, JPEG XL, JPEG 2000, Netpbm, FITS and similar formats – a breaking change for image‑processing applications.
Fix JSON encoding of custom object hash keys and resolve several ActiveSupport/ActiveModel delegation warnings.
Fixed numerous ActiveSupport and ActiveRecord bugs: overlapping acronym inflections, insert/upsert log messages for anonymous classes, virtual column deduplication, SQLite and PostgreSQL schema dump issues, and handling of nil content ty...
Patched numerous security issues (CVE‑2026‑33170, ‑33176, ‑33167, ‑33168, ‑33173, ‑33174, ‑33195, ‑33202) affecting NumberConverter, SafeBuffer, view helpers, DebugExceptions, DirectUpload, streaming range limits, and DiskService.
Fixed multiple security vulnerabilities across Active Support, Action View, and Active Storage (CVE 2026‑33170, 33168, 33173‑33195, 33202) including scientific notation rejection, unsafe string handling, HTML attribute sanitization, meta...
ActiveSupport: Reject scientific notation in NumberConverter, fix SafeBuffer '%' handling, and improve NumberToDelimitedConverter performance (security fixes CVE-2026-33176, CVE-2026-33170, CVE-2026-33169).
Fix numerous bugs across ActiveSupport, ActiveRecord, and ActiveStorage including UTF‑8 handling for TimeWithZone JSON, SQLite and PostgreSQL schema handling, and CSP nonce errors in mailers
Action View now respects the remove_hidden_field_autocomplete config for hidden fields in form builders.
Fixes across Active Support (Enumerable#sole returns full tuple, parallel test hangs when workers die, NameError on instance singleton class attributes) and Action View (restored default name/id method).
ActiveSupport and ActiveModel receive a sweep of bug fixes, including Enumerable#sole returning the full tuple, BroadcastLogger block handling, HashWithIndifferentAccess key‑collision handling, MessageVerifier rotation callbacks and URL ...
Fixed ActiveRecord connection configuration errors, handling Timeout.timeout and improving error handling to avoid partially initialized connections.
Maintenance release with no new features
Fixed a wide range of bugs across ActiveSupport, ActiveRecord, ActiveStorage, and other components, including time unit reporting, memory store race conditions, connection leaks, MySQL schema dumping issues, and variant handling.
Removed several deprecated ActiveSupport time methods and added new time utilities like ActiveSupport::TimeZone#standard_name; updated config for timezone preservation.
Fixed numerous bugs across ActiveSupport, ActiveRecord, ActionView, ActionPack, Railties and related components (e.g., hash key transformation, cache and query handling, stale association detection, route reload issues).
Active Record now includes inspected IDs in RecordNotFound messages, addressing CVE‑2025‑55193.
Fixed Active Record RecordNotFound error to call inspect on IDs, addressing CVE‑2025‑55193.
- Fixed RecordNotFound error message to call inspect on IDs, addressing CVE‑2025‑55193.
Numerous bug fixes across ActiveSupport and ActiveRecord, including cache fetch behavior, timezone preservation, message verifier/encryptor rotation, and handling of connection‑pool errors.
Fix numerous bugs across Active Support, Active Record, Action View, Action Cable, and database adapters (e.g., ERB tokenization with multibyte chars, MySQL foreign key handling, race condition in attribute definition, prepared statement...
Action Pack adds validation to Content Security Policies, disallowing spaces and semicolons.
Action Pack adds validation to Content Security Policies, disallowing spaces and semicolons; developers should use separate arguments or directive methods (CVE‑2024‑54133).
Action Pack adds validation to Content Security Policies, disallowing spaces and semicolons.
Action Pack now validates content‑security‑policy directives, disallowing spaces and semicolons and requiring multiple arguments – fixes CVE‑2024‑54133.
Removed many deprecated APIs across ActiveSupport, ActiveRecord, and related components (e.g., array‑string deprecation warnings, ProxyObject, ENV["SCHEMA_CACHE"], enum keyword arguments) and deprecated time addition/since methods, intro...
Added instrumentation options for ActiveSupport::Cache::Store delete methods and improved test name output for parallel Rails tests.
Fixed Active Model alias_attribute regression and multiple Active Record bugs: unsaved association marshalling, left outer join handling, and ensuring Encryption config is ready before access.
Fixed NoMethodError in block format helper for Action Mailer.
Fix NoMethodError in Action Mailer's block format helper.
Fixed NoMethodError in Action Mailer block format helper (Michael Leimstaedtner)
Fix NoMethodError in block format helper for Action Mailer
Avoid regex backtracking vulnerabilities (CVE‑2024‑47887, CVE‑2024‑41128) in HTTP token authentication and query‑parameter filtering
Patched several regex backtracking vulnerabilities (CVE‑2024‑47887, CVE‑2024‑41128, CVE‑2024‑47889, CVE‑2024‑47888) across Action Pack, Action Mailer, and Action Text components.
Fixed regex backtracking vulnerabilities (CVE‑2024‑47887, CVE‑2024‑41128) in HTTP Token authentication and query parameter filtering.
Patched regex backtracking vulnerabilities in Action Pack HTTP token authentication (CVE‑2024‑47887) and query parameter filtering (CVE‑2024‑41128).
Extensive bugfixes and performance tweaks across ActiveSupport, ActiveRecord, ActionView, and Railties, addressing migration ordering, connection leaks, attribute method regressions, async job handling, and more.
ActiveRecord receives multiple bug fixes: enum detection with parallel tests, eager loading of nested nil associations, memory‑bloat mitigation in Fiber connection pools, correct Base.inspect output, validation of new enum syntax, proper...
Removed many deprecated ActiveSupport and ActiveRecord APIs (e.g., notification children/parent, deprecation helpers, SafeBuffer clone, config options, cache format version), marking a breaking change for existing code.
Action Pack adds HTTP Permissions Policy header to non-HTML responses (CVE‑2024‑28103)
Action Pack adds the HTTP Permissions Policy header for non‑HTML content types (CVE‑2024‑28103)
Action Pack now includes the HTTP Permissions Policy header for non‑HTML content types, addressing CVE‑2024‑28103.
Upgrade Action Text’s Trix editor to 2.1.1, fixing CVE‑2024‑34341.
Upgrade Action Text's Trix editor to version 1.3.2.
Fix raise on missing translations not working correctly with the translate method in controllers after the CVE-2024-26143 patch.
Fixed possible XSS vulnerability in the controller translate method (CVE‑2024‑26143).
Fixed XSS vulnerability in Action Pack translate method (CVE‑2024‑26143)
Active Storage disables the session in ActiveStorage::Blobs::ProxyController and ActiveStorage::Representations::ProxyController.
Fixed numerous bugs across ActiveSupport (nil backtrace handling, JSON duplicate keys, cache namespace reads, timezone after travel, MemoryStore write option, deprecation handling), Active Record (migration validation, association reload...
Fixed numerous cache, ActiveSupport, and ActiveRecord bugs including RedisCacheStore expiration handling, Marshal payload miss detection, and primary key index renaming for UUIDs in PostgreSQL
Added keyword‑argument support for custom logger delegation in ActiveSupport::BroadcastLogger and updated @rails/ujs to ignore data attributes on contenteditable elements (security fix CVE‑2023‑23913).
Added a public log broadcasting API and extensive cache store enhancements: new :serializer and :compressor options, boolean delete returns, a 7.1 cache format with bare‑string optimization.
Fixed multiple bugs across the stack, including TimeWithZone deprecation handling, Redis CacheStore write_multi, datetime precision in migrations, unscope behavior, STI associations, jbuilder caching, and hidden method inputs for namespa...
Fixed file permission issues introduced in the previous release.
No functional changes compared to 6.1.7.5
Use a temporary file for storing unencrypted files during editing to improve security.
Active Support now uses a temporary file for storing unencrypted files while editing, mitigating exposure risk.
Fix numerous ActiveSupport and ActiveModel bugs including Cache::NullStore local caching, Inflector.humanize(nil) errors, and improved error messages for EventedFileUpdateChecker and model errors
Fixed numerous bugs across ActiveSupport, ActiveRecord, ActionCable, and ActiveStorage, including EncryptedConfiguration values, autosave association validations, and FFmpeg rotation handling.
Action Pack now raises an exception for redirects containing illegal characters, fixing CVE‑2023‑28362.
Action Pack now raises an exception for redirects containing illegal characters, addressing CVE‑2023‑28362
Numerous bug fixes across ActiveRecord, Action Pack, Action View and other components (e.g., TimeWithZone errors, index checks, PostgreSQL handling, query cache, cookie domain, multipart EOFError, JSON parser errors).
Active Support adds SafeBuffer.bytesplice implementation to address CVE‑2023‑28120.
Implemented SafeBuffer#bytesplice in Active Support to address CVE‑2023‑28120
Fixes domain: :all handling for two‑letter top‑level domains (e.g., .ca) to restore compatibility.
Fix Action Pack handling of domain: :all for two-letter TLDs (e.g., .ca).
Active Support: fixed regex backtracking in Inflector.underscore (CVE‑2023‑22796).
Fixed regex backtracking vulnerabilities in Active Support Inflector.underscore and Action Pack header handling (CVE‑2023‑22796, CVE‑2023‑22795)
Tightened ActiveRecord SQL comment sanitization to prevent bypasses (CVE‑2023‑22794).
ActiveRecord::Coders::YAMLColumn now defaults to safe YAML loading, mitigating CVE‑2022‑32224
ActiveRecord::Coders::YAMLColumn now defaults to safe YAML loading, mitigating CVE‑2022‑32224.
ActiveRecord::Coders::YAMLColumn now defaults to safe_load, mitigating CVE‑2022‑32224.
ActiveRecord::Coders::YAMLColumn now defaults to safe YAML loading, mitigating CVE-2022-32224.
Updated Redis cache and Action Cable adapters to work with redis‑rb 5.0, dropping support for redis‑rb 3.x (breaking change).
Active Record now allows Symbol as default for YAML columns and fixes Store serialization to use plain Hash instead of HashWithIndifferentAccess.
Active Record now allows Symbol values by default for YAML columns.
Fixed numerous adapter and generator bugs including MariaDB default function handling, MySQL quoting for durations/rationals, foreign‑key removal logic, ActiveStorage redirect streaming, route URL generation for namespaced controllers, a...
Fixed XSS vulnerabilities by adding protections in ActionView helpers and ERB::Util, introduced ERB::Util.xml_name_escape and renamed :escape_attributes to :escape
Fixed a regression in Active Support's tag helper.
Fixed regression in Active Support tag helper.
Add XSS protections to ActionView::Helpers and ERB::Util, introducing ERB::Util.xml_name_escape for safe XML tag and attribute names.
Fixed XSS vulnerabilities in ActionView helpers and ERB::Util, adding `ERB::Util.xml_name_escape` for XML‑compliant tag/attribute name escaping
Added XSS protections in ActionView::Helpers and ERB::Util, including new `ERB::Util.xml_name_escape` method
Added XSS protections and a new ERB::Util.xml_name_escape method to safely escape tag and attribute names according to the XML specification.
Restored Ruby 2.2 compatibility for Active Support.
Fix ActiveSupport::Duration to correctly handle negative values and ensure Time objects preserve provided timezones; extensive bug fixes across ActiveRecord, ActiveModel, and ActionCable including schema cache issues, SQLite migration in...
Added configurable allow list for image transformation validation in Active Storage
Added configurable allow list for image transformation validation in Active Storage.
Added configurable allow list for image transformation validation in Active Storage.
Added configurable allow list for image transformation validation in Active Storage.
Fixed Action Pack Reloader method signature to be compatible with the new Executor signature.
Fixed Action Pack middleware issue where the response body closure was not communicated, causing request state to persist across requests (CVE‑2022‑23633).
Action Pack: Fixed the Reloader method signature.
Fixed Action Pack middleware bug where the response body wasn't properly closed, causing request state not to reset (CVE‑2022‑23633).
Updated Action Pack Reloader method signature to align with the new Executor signature.
Fixed CVE‑2022‑23633 in Action Pack where middleware may not be notified that the response body was fully closed, preventing request state leakage between requests.
Action Pack: Fixed the Reloader method signature to align with the new Executor signature.
Fixed Action Pack middleware bug where the response body closure wasn't communicated, causing request state to persist across requests.
Fix compatibility issues: ActiveSupport EncryptedConfiguration with Psych 4, ActiveRecord PG.connect keyword‑args deprecation warnings, and MySQL bulk‑fixture insertion errors.
Fix numerous compatibility and bug issues across Active Support, Active Record, and adapters (Ruby 3.1, SQLite, PostgreSQL, MySQL) and improve migration handling.
- Action Cable client now tracks pending subscriptions, adds random jitter and exponential backoff for reconnections, ships an ESM bundle, renames files, and drops IE11 support.
Fixed Action Pack host protection to allow hosts with ports in development.
No changes to Active Support, Model, Record, View, Pack, Job, Mailer, Cable, Storage, Mailbox, Text, and other components.
Action Pack: Fixed X-Forwarded-Host protection to address CVE‑2021‑44528
Action Pack: Fixed host protection bug that blocked hosts with ports in development.
Fix Action Pack host protection to allow localhost in development environments.
Fix X-Forwarded-Host protection in Action Pack (CVE-2021-44528).
- Numerous bug fixes across Active Support, Active Model, Active Record, Action Pack, Action View, Active Storage and other components (e.g., handling false values, rollback errors, upsert behavior, enum handling, strict loading, and tes...
Fix numerous ActiveSupport and ActiveRecord bugs: cache store options, enum conflict warnings, autosave handling, insert_all unique‑by guard, preload/eager load ordering, index comment preservation, and lock version bump for counter caches;
Action Pack hardened against open‑redirects, MIME‑parsing backtracking, HTTP token regex DoS, and unsafe polymorphic URL arguments (CVE‑2021‑22903, ‑22902, ‑22904, ‑22885).
Patched Action Pack to mitigate CVE-2021-22902 (catastrophic backtracking in MIME parsing) and CVE-2021-22904 (regex DoS in HTTP token authentication).
Action Pack now generates URL‑safe Base64 CSRF tokens and validates both URL‑safe and legacy strict tokens.
Patched regex DoS vulnerability in HTTP token authentication (CVE‑2021‑22904).
Active Storage's Marcel library upgraded to version 1.0.0, removing the GPL‑licensed mime types dependency.
No changes to most Rails components.
Active Storage’s Marcel library upgraded to version 1.0.0
Fixed MySQL adapter to correctly set connection collation/charset and handle time objects with prepared statements
Fixed DoS vulnerability in Active Record's PostgreSQL money type validator (CVE‑2021‑22880).
Fixed possible DoS via PostgreSQL money type regex (CVE-2021-22880)
Fix DoS vulnerability in Active Record PostgreSQL money type validation (CVE‑2021‑22880).
ActiveSupport::Cache::MemCacheStore now accepts an explicit nil for its addresses argument, easing migration from :dalli.
ActiveSupport now serializes IPAddr to its string form for JSON, aligning with the json gem behavior.
MemoryStore now disables compression by default and MemCacheStore checks ENV["MEMCACHE_SERVERS"] before falling back to localhost.
Action Pack: fixed CVE‑2020‑8264 XSS vulnerability in actionable exceptions
Fixed potential XSS vulnerability (CVE-2020-8185) in Action View's translate/t helper.
Fix potential XSS vulnerability (CVE‑2020‑15169) in Action View's translate/t helper.
Fixed CVE‑2020‑8185 in Action Pack: actionable errors now require detailed exceptions to be enabled
Deprecate Marshal.load on raw cache reads in RedisCacheStore and MemCacheStore.
Backported a missing commit fixing CVE‑2020‑8163 in Action View.
Action View restricts local variable names in templates to address CVE‑2020‑8163.
Deprecate Marshal.load on raw cache reads in RedisCacheStore and avoid it in MemCacheStore to address CVE‑2020‑8165.
Soft‑deprecate the `database` kwarg in `connected_to` by removing its documentation, signaling removal in Rails 6.2.
Fixed possible XSS vector in Action View's `escape_javascript` helper (CVE‑2020‑5267).
Fixed a possible XSS vector in Action View's escape_javascript helper (CVE‑2020‑5267).
Fixed information leak / session hijacking vulnerability in Action Pack (CVE‑2019‑16782).
Fixed possible information leak / session hijacking vulnerability in Action Pack (CVE‑2019‑16782).
Added eager translation loading, per‑thread CPU timing for ActiveSupport notifications, mountable‑engine route helpers in system tests, and Sidekiq job‑class exposure for Active Job.
ActiveSupport::Logger is now fiber‑safe, enabling per‑fiber log levels via Fiber.current.id.
Added Enumerator support to ActiveSupport::SafeBuffer and enhanced Range comparison methods for beginless/endless ranges.
Added ActiveSupport::HashWithIndifferentAccess assoc support for strings/symbols and enhanced Range methods (===, cover?) with broader argument handling.
Fixed Active Record touch option to behave consistently with Persistence#touch
Fixed numerous bugs across the framework—including ActiveSupport hash aliasing, URI.unescape Unicode handling, numericality validator behavior, query scoping, update columns, enum immutability, connection pool deadlocks, and cache key is...