RubyFlow The Ruby and Rails community linklog

×

The Ruby and Rails community linklog

Made a library? Written a blog post? Found a useful tutorial? Share it with the Ruby community here or just enjoy what everyone else has found!

Submit a post

You can use basic HTML markup (e.g. <a>) or Markdown.
Note that your post may be edited to suit the format of the site.

As you are not logged in, you will be
directed via GitHub to signup or sign in

Post Preview

Note: Only the first pargraph is shown on the front page and overly long paragraphs may be broken up.

  Today

Active Storage image optimization at scale: lessons from 1,916 conference photos

https://avohq.io/blog/active-storage-image-optimization-at-scale-lessons-from-1-916-conference-photos

We replaced a hosted gallery with a Rails 8.1 app on one box for Friendly.rb, then open sourced it. Nine Active Storage derivatives per photo, AVIF measured 31.6% under WebP, and the things the guides do not warn you about past a few dozen images. Read the full article on:

Adrian Marin  
 Leave a comment here

Amazing Print v3.0.0

Amazing Print, the maintained fork of the popular Awesome Print gem to enhance the pretty-printing of Ruby objects, has been updated to version 3. It works with the next version of Rails (8.2, or 9, or whatever the next version number will be). If you are still using Awesome Print, you will want to migrate to Amazing Print v3 as part of your next Rails upgrade, or your app will crash on boot! Thankfully it should be a drop-in replacement, since the coloring default behavior has been updated to be closer to Amazing Print’s defaults. A new colors option has been introduced for further tweaking. Pro-tip: are you migrating from Awesome Print and missing the old-school hash rocket visual style? Add AmazingPrint.defaults = { hash_format: :rocket } to your ~/.irbrc or ~/.pryrc.

Jerome Dalbert  
 Leave a comment here

Beskar 0.2: Rails security with coordinated rate limits and session revocation

I’ve released Beskar 0.2.0, an MIT-licensed security engine for Rails 8+. It combines authentication rate limits, scanner detection, configurable account locks, persistent IP bans, and a mountable security dashboard. This release moves enforcement state into the shared database, coordinates limits across application workers without requiring Redis, and adds durable session revocation. [more inside]

Maciej Litwiniuk  
 Leave a comment here

Montreal.rb February 2026 Crystal: Ruby with Static Typing

https://andymaleh.blogspot.com/2026/09/montrealrb-february-2026-crystal-ruby.html

The video and slides for the Montreal.rb February 2026 talk “Crystal: Ruby with Static Typing” have been published! The real exciting bit to any real Rubyist is that Crystal has similar syntax to Ruby’s and similar performance to that of C/C++/Rust. That is extremely exciting and awesome!!! It means Rubyists don’t have to struggle through C or Rust’s syntax to get performance enhancement as they have a much more elegant option in Crystal.

Andy Maleh  
 Leave a comment here

Coldwire: offline support for Rails, Hotwire, and Hotwire Native

https://github.com/noreastergroup/coldwire-rails

We build Rails apps and needed one to work with no network - our client’s users are out on islands off the Maine coast with no cell service. Hotwire doesn’t ship with anything for this, and a naive service worker breaks once Turbo is handling navigation. So we built a service worker plus precache manifest, a fallback page Turbo will actually render, and a settings screen where users can force a sync before heading out and inspect what’s cached. It’s been in production for a while, so we extracted it into a gem. [more inside]

John Nagro  
 Leave a comment here

A URL shortener in pure Rails, and the one line that decides who it redirects to

https://launchkit.codes/yield/rails-url-shortener

One model, one controller, one route. The slug generates itself through the attribute API and SecureRandom.alphanumeric, so a record is valid before it has ever been saved, which a database default cannot do. The click counter goes through increment_counter, which deliberately leaves updated_at alone. And allow_other_host: true is both the line that makes the redirect work and the line that turns the whole thing into an open redirect the moment the target comes from params instead of from a row you control. Write-up plus a 9-minute video. [more inside]

Mehdi FARSI  
 Leave a comment here

Ruby, Rails & AI Daily: Active Storage RCE Under Active Exploitation, ZJIT Inlines GC

https://rubyinsights.blog/en/blog/ruby-rails-ai-daily-september-10-2026-description-a-critical-active-storage-rce-is-now-under-active-exploitation-zjit-learns-to-inline-gc-allocations-and-google-anthropic-and-openai-all-ship-cybersecurity-grade-ai-models-this-week

Kicking off a daily roundup on RubyInsights covering Ruby, Rails, and AI. Today’s edition leads with CVE-2026-66066 (“KindaRails2Shell”), the Active Storage RCE that’s now confirmed under active exploitation months after patches shipped for Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1, worth a fleet check even if you patched back in July. Also covered: ZJIT learning to inline GC allocations, this week’s Rails codebase updates, Claude Fable 5.1 topping the Agents on Rails benchmark, Chrome 153’s 230 security fixes, and the new wave of cybersecurity-focused models from OpenAI, Anthropic, and Google. Full roundup with sources.

Wilbert Ribeiro  
 Leave a comment here
Next page »
Loading older posts