R
Ruby on Rails Blog
weblog.rubyonrails.org · Company blog · on HN since 2007
The official Ruby on Rails blog, announcing releases, release candidates, and new features of the Rails web framework.
What HN saysHN links it for Rails release announcements; commenters discuss release candidates for patch releases and point to it for release notes.
192HN people shared it
58linked it in comments
221stories submitted
9.7Kstory points
5 years agolast shared
2007people per year2026
Most-shared posts
- 1Rails 5.2.0 Released: Active Storage,Redis Cache Store, HTTP/2 Early Hints, CSP7 people · 5 points · first shared 2011 · 1 comments on HN
- 2Rails 5.0: Action Cable, API mode, and more6 people · 684 points · first shared 2016 · 219 comments on HN
- 3Rails 7.0 alpha 1 released6 people · 30 points · first shared 2021 · 1 comments on HN
- 4Rails 5.0.0.beta1 is out5 people · 9 points · first shared 2014 · 3 comments on HN
- 5Rails 5.0.0.beta1: Action Cable, API Mode, Rails Command4 people · 409 points · first shared 2015 · 132 comments on HN
- 6Why HTTP Streaming?4 people · 84 points · first shared 2011 · 33 comments on HN
- 7Rails 5.1 has been released4 people · 30 points · first shared 2017 · 3 comments on HN
- 8Ruby on Rails: A May of WTFs4 people · 9 points · first shared 2020 · discussion on HN
- 9New Rails CVEs4 people · 5 points · first shared 2019 · discussion on HN
- 10Rails 3.0: It's ready3 people · 385 points · first shared 2010 · 65 comments on HN
- 11Rails 5.1.0 Beta 13 people · 257 points · first shared 2017 · 69 comments on HN
- 12Rails 3.1: Release candidate3 people · 180 points · first shared 2011 · 26 comments on HN
- 13Merb gets merged into Rails 33 people · 77 points · first shared 2008 · 10 comments on HN
- 14Rails 3.0: Second beta release3 people · 23 points · first shared 2010 · 1 comments on HN
- 15Rails 6.1 RC13 people · 19 points · first shared 2020 · 1 comments on HN
What HN people wrote when they linked it
thibaut_barrere · 2013-03-20
Thanks for the blog post - and I didn't realize that patch releases also had RC.
It looks like this release was quite fat, for a patch release.
I added "check rails diff" to my deploy todo list.
EDIT: I just noticed that http://weblog.rubyonrails.org/ doesn't have a way to subscribe by email. I signed-up by email with this site instead http://blogtrottr.com, in case it helps other here.
foobar2k · 2013-03-20
I completely agree with this. We (bugsnag) are running on rails 4 beta right now to help iron out any production issues before that is released.
We didn't, however, realize that "patch" releases also have release candidates. I'd recommend following the rails blog (http://weblog.rubyonrails.org/) which announces release candidate builds too.
_gtly · 2020-12-09
The beginning of Horizontal Sharding support is great to see.
More refined release notes here:
https://edgeguides.rubyonrails.org/6_1_release_notes.html
And yet more release notes:
https://weblog.rubyonrails.org/2020/12/9/Rails-6-1-0-release/
emmanueloga_ · 2020-06-29
Does anybody have any insights about how rest came to be such a buzzword?
My pet theory is that rest was popularized by Rails. If you look at trends [1], rest itself shows up as a super slow trend ramp that only now is starting to diminish... But rails seems to have had the peak of its popularity between 2006/2007 [2], which happens to be the time Rails 1.2 came up with "restful routes" support. Even if this theory is correct, it begs the question how did the Rails developers come in contact with rest themselves and how did it happen that the whole thick thesis derived in just a simple HTTP routes convention ...
1: https://trends.google.com/trends/explore?date=all&geo=US&q=%2F…
2: https://weblog.rubyonrails.org/2007/1/19/rails-1-2-rest-admiration-htt…
AJAlabs · 2016-05-09
Here is the blog post on the topic
http://weblog.rubyonrails.org
jmorton · 2013-03-20
For what it's worth... "PATCH is going to be the primary method for updates in Rails 4.0." http://weblog.rubyonrails.org/2012/2/25/edge-rails-patch-is-the-new-pr…
That's not intended to be a counterpoint. In the wild, many companies don't use Rails. :)
thezilch · 2013-02-05
Not quite, thanks to Flash.
http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2…
Rails and Django patches/recommendations on the issue:
http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-…
https://docs.djangoproject.com/en/1.2/releases/1.2.5/#csrf-exception-f…
oelmekki · 2012-10-24
They could be using http streaming, like the feature introduced in rails 3.1 : http://weblog.rubyonrails.org/2011/4/18/why-http-streaming/
That actually makes <head> the preferred place for loading scripts.
Also, I find it a bit extreme to recommend putting inline javascript in a <script> tag. I'm ok with trying to maximize performances, but please, do not recommend to produce un-seperated and unclean code. Concatenating javascript in a single file (and compressing it) is way enough, having one single request to get all javascript is not so bad.
gtani · 2011-11-23
It's tricky. Note activity this week around getting XSS protection right
http://weblog.rubyonrails.org/
I'm not that familiar with lift and Yesod, but it seems like they're both able to use compile-time checks as additional layers of protection.
https://github.com/dpp/liftweb/wiki/lifts-security
freedrull · 2011-07-15
Its at the top of the blog page for me...
http://weblog.rubyonrails.org/
ionfish · 2009-09-02
Context failure: linking to Ryan Tomayko's article without linking to the article that's brought it to people's attention again, namely Josh Peek's 'Gem Packaging: Best Practices'.
http://weblog.rubyonrails.org/2009/9/1/gem-packaging-best-practices
Giles Bowkett has also written about the related issue of screwing up the load path:
http://gilesbowkett.blogspot.com/2009/04/unshiftfiledirnamefile.html
It's also worth noting that Ruby 1.9 requires rubygems automatically, as it's included in the standard library.
defunkt · 2009-09-02
No one has suggested, is suggesting, or will suggest that you stop using Rubygems. That is not what this is about in any sense of the phrase. Everyone loves Rubygems, including Ryan Tomayko.
This is about the best way to use Rubygems. Check out Josh Peek's recent article: http://weblog.rubyonrails.org/2009/9/1/gem-packaging-best-practices
There are ways to use Rubygems without putting "require 'rubygems'" in your code. Those are the correct, most portable, least painful ways of using Rubygems. Learn them and cherish them!
That is what this is about: how you are using Rubygems, not whether or not to use them.
Glimjaur · 2008-03-19
http://weblog.rubyonrails.org/2008/3/18/comparing-rails-2-0-to-1-2-for…
"Hongli Lai has compared a dummy scaffold application from Rails 1.2 to Rails 2.0 and found the latter to be 30-50% faster. That’s great to see.
But what I think is even more interesting is the progress we’ve been making on performance optimizations for more substantial applications. Rails 2.0 made a lot of progress for applications with lots of assets and for ones with big routes.rb files. The forthcoming Rails 2.1 will move things forward even further."
jhart3333 · 2013-01-10
Older than 2.3? http://weblog.rubyonrails.org/
scrose · 2021-11-19
> I’m sad about the move to mounds of JavaScript. Nothing can match the productivity of simple_form and bootstrap.
You might like some of the recent Rails 7 previews. I believe they’re removing Webpack out of the box and trying to simplify things on that end[0].
[0] https://weblog.rubyonrails.org/2021/9/15/Rails-7-0-alpha-1-released/
skunkworker · 2021-03-29
Rails 5.2.5, 6.0.3.6 and 6.1.3.1 were released with the updated dependencies.
https://weblog.rubyonrails.org/2021/3/26/marcel-upgrade-releases/
From the release:
"Before 1.0.0, Marcel—which is distributed under the terms of the MIT License, like Rails—indirectly depended on MIME type data released under the incompatible GNU General Public License. Marcel 1.0.0 instead directly packages MIME type data adapted from Apache Tika, released under the permissive and compatible Apache License 2.0."
house9-2 · 2019-09-10
> Running two production applications on 5.1.5.
I believe there are security vulnerabilities in that version. consider updating to a secure version: 5.1.7 is the latest revision of the 5.1.x series.
https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-be…
ksec · 2019-04-26
Any plans to join the Rank of Shopify / Github / BaseCamp running on near / close to Rails Master?
I believe Gitlab is still on Rails 5.
[1] https://weblog.rubyonrails.org/2019/4/24/Rails-6-0-rc1-released/
aboutruby · 2019-03-21
This was fixed in 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1 one week ago.
https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-be…
The two HN posts didn't get many upvotes though: https://hn.algolia.com/?query=https:%2F%2Fweblog.rubyonrails.org%2F201…
Admittedly there is probably a lot of applications out there running outdated versions.
edit: Kind of surprising this gets upvoted while we rarely see things from exploit-db / fulldisclosure
steveklabnik · 2017-04-04
> (and I believe the newer Rails version is integrating webpack to play nicer with the rest of the framework)
Yup http://weblog.rubyonrails.org/2017/2/23/Rails-5-1-beta1/
aindhaden · 2016-12-09
To expand on this, the tool of choice for the frontend part used to be PrototypeJS. In Rails 3.1 the relevant portions were decoupled and became options rather than baked-in, with jQuery as the default but still an option among several: http://weblog.rubyonrails.org/2011/4/21/jquery-new-default/
okket · 2016-06-30
No blog post yet, but it's on Ruby Gems
https://rubygems.org/gems/rails/versions/5.0.0
Update: Blog post
http://weblog.rubyonrails.org/2016/6/30/Rails-5-0-final/
maxforce · 2016-06-29
RC2 released 6 days ago http://weblog.rubyonrails.org/releases/
stigi · 2016-05-06
In case this is the first time you hear of Rails 5 and wonder what's new, this post sums it up:
http://weblog.rubyonrails.org/2015/12/18/Rails-5-0-beta1/
grey-area · 2014-02-19
Thanks for the links, which I think would lead to a more productive discussion because they are a comparison of similar frameworks. There are of course difficulties with gauging how much attention each gets (a lower CVE count is not proof of security), but overall Django looks better here.
I was thinking of the third one on this page (I suppose strictly speaking a vuln in a gem outside rails) which was pretty serious:
http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-an…
but there was a related YAML bug too at the same time with serialize, which also allowed users to supply input that was then instantiated (madness!). Do lots of people use serialize? I've never explicitly used it, unless it is used behind the scenes somewhere. I remembered the fuss being over JSON because of broader impact but may have misremembered.
rst · 2013-12-11
Is that completely adequate? There was an earlier round of changes due to attackers being able to forge the .xhr header on requests. (This was the patch set at which Rails started checking CSRF tokens on .xhr? requests; before that, they got a free pass.)
See http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-…
vasinov · 2013-12-04
Do you mean from yesterday? http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_be…
jadence · 2013-01-11
Per pixeltrix's comment it appears that you're safe.
"If you mean that your Ruby on Rails version is 1.2.6 then, no the vulnerability does not affect you as the feature was introduced in Ruby on Rails 2.0"
source: http://weblog.rubyonrails.org/2013/1/8/Rails-3-2-11-3-1-10-3-0-19-and-…
revacuate · 2013-01-10
I just updated our app from 2.3.14 to 2.3.15, yet when I run your curl command I'm getting:
Parameters: {"id"=>#<ActionController::Base:0xb570d2e8 @bar=1>}
Why do you think I'm still unprotected after updating to the fixed version 2.3.15 referenced here? http://weblog.rubyonrails.org/2013/1/8/Rails-3-2-11-3-1-10-3-0-19-and-…
Or is there something I'm missing?