最新のセキュリティ情報
10月20日(火)
Crass : Large numeric exponents cause CPU and memory denial of service
影響: rubygems:crass < 1.0.7 → 1.0.7 Impact Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting in a crash. Patches This is fixed in Crass 1.0.7. Related - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/crass/GHSA-6wmf-3r64-vcwv.yml
10月16日(金)
Faster blank? checks, safer SQLite rollbacks, and more!
Hi, it’s Vipul. Let’s explore this week’s changes in the Rails codebase.
10月13日(火)
Agents on Rails: Stage 3. Can a model build on its own work?
Now that we understand better how agents deal with contained tasks and contained codebases, it’s time to push them a little harder. Stage 3 adds a set of large multi-step tasks that test how well a model can build on its own work over multiple sessions without turning it into a hot mess. We’ve also greatly expanded the variety of apps we test the models on.
10月12日(月)
Ruby 4.1.0-preview1 Released
We are pleased to announce the release of Ruby 4.1.0-preview1. Ruby 4.1 introduces Ractor local GC, Windows support of YJIT, autoload_relative, and adds many improvements. Ractor improvements A lot of work has gone into making Ractors more stable, performant, and usable. These improvements bring Ractor implementation closer to leaving experimental status. The default GC now runs per Ractor : each Ractor collects its own heap on its own thread without stopping the others, and a stop-the-world collection only runs when it is really needed (explicit full GC.start , shareable-object growth, recla…
10月9日(金)
Better ACL S3 control and more
Hi, Wojtek here. Let’s explore this week’s changes in the Rails codebase.
10月2日(金)
Rails World recordings are online, new minimum Ruby version and more!
Hi, it’s Greg. Let’s explore this week’s changes in the Rails codebase.
10月1日(木)
Rails World 2026 recap: All talks online
Happy to report that in record time, all Rails World 2026 talks are now online.
9月25日(金)
See you in Lisbon!
Hi, it’s Claudio Baccigalupo with your updates on the Rails codebase.
Rails Version 7.2.4 has been released!
Hi everyone,
Rails Version 8.1.4 has been released!
Hi everyone,
9月23日(水)
Ruby 3.4.11 Released
Ruby 3.4.11 has been released. This is a regular scheduled update release includes bugfixes. Please see the GitHub releases for further details. Download https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.11.tar.gz SIZE: 22492449 SHA1: ed687c91e79b20a755666adbc290695accd49d79 SHA256: 5c22be44524312b3d433d68739bcc530633b1da5ef8ba0afa0a37680da17d3de SHA512: cb951af61fb237ddf3213f5efec893a50524216800359514baded26189a5aa1640cc83e344aedd001cc57c4479cfabcf20033be77c28401333f57f2ac13c6640 https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.11.tar.xz SIZE: 16712500 SHA1: c36b1142f3d45441edbe0bb9146ddda3…
9月21日(月)
Agents on Rails: Maximum effort and DeepSeek 4.1 Flash
In the Stage 2 report we shipped 20 feature tickets on Fizzy and promised to explore benchmarking the agents all on max-effort. Now we have run it: every model on the board, same tickets, reasoning turned all the way up. We also tested a new model: DeepSeek 4.1 Flash.
9月18日(金)
Rails World 2026 Update: Livestream & Sponsors
As we gear up for Rails World 2026 next week, we’re so grateful to the companies showing up to make the first Rails World in the US a great one.
9月15日(火)
Ruby 4.0.7 Released
Ruby 4.0.7 has been released. This is a routine update that includes bugfixes. Please see the GitHub releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent release. Ruby 4.0.8 will be released in November. If a change arises that significantly affects users, a release may occur earlier than planned. Download https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.7.tar.gz SIZE: 23937964 SHA1: 730d4f8cebb60a1f5b556e7b58d86d0301772558 SHA256: 911ace20f90d068ca0e4dda6d0e4f0f81e52e52f2dd4f4004c72…
8月27日(木)
Security advisories: CVE-2026-80212 and CVE-2026-80213
Two vulnerabilities have been discovered in the resolv gem bundled with Ruby. They have been assigned the CVE identifiers CVE-2026-80212 and CVE-2026-80213 . We recommend upgrading the resolv gem. CVE-2026-80212: Memory exhaustion through malicious DNS responses An application that resolves a hostname an attacker can influence, such as a webhook target or a user-supplied URL, can be made to consume memory without bound. The attacker points a domain at a name server they control and returns responses that the library retains permanently. Repeated lookups grow the process until it runs out of m…
7月16日(木)
Ruby 3.3.12 Released
Ruby 3.3.12 has been released. This release includes security fixes. Please check the topics below for details. CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / def_class This release updates the default gem erb to 4.0.3.1 and the bundled gem net-imap to 0.4.25. The net-imap update fixes CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258, CVE-2026-47240, CVE-2026-47241 and CVE-2026-47242. Please see the release notes of net-imap v0.4.24 and net-imap v0.4.25 for the details of these fixes. Please see the GitHub releases for furth…
7月14日(火)
Ruby 4.0.6 Released
Ruby 4.0.6 has been released. This is a routine update that includes bugfixes. Please see the GitHub releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent release. Ruby 4.0.7 will be released in September, and 4.0.8 in November. If a change arises that significantly affects users, a release may occur earlier than planned, and the subsequent schedule may shift accordingly. Download https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.6.tar.gz SIZE: 23904779 SHA1: bd2b5a5bdf0ac9947eab242f41…
6月30日(火)
Ruby 3.4.10 Released
Ruby 3.4.10 has been released. This release is a regular stable package release contains the version update of bundled gem net-imap. The net-imap.gem update contains some security fixes. Please see the release note of net-imap v0.5.15 for the detailed update of net-imap.gem. Please see the GitHub releases for further details. Download https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.10.tar.gz SIZE: 22476870 SHA1: 5eac73bce00e770e19b50b69032578df9b2bb41c SHA256: ecee2d072a14f2d14347dd56dfd8fe5c3130abf5117bfaacbda0f4ef9cc429ec SHA512: 493c9be80a78a4ddf983620295c79ae9f1c8e4c60da8237e12965fa6f95…
5月20日(水)
Ruby 4.0.5 Released
Ruby 4.0.5 has been released. This release only contains a security fix for CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler and a build system regression in Ruby 4.0.4 under C locale [Bug #22065] . Please see the GitHub releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent regular release. Ruby 4.0.6 will be released in July, 4.0.7 in September, and 4.0.8 in November. If a change arises that significantly affects users, a release may occur earlier than plann…
CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler
A use-after-free vulnerability has been discovered in the pthread-based getaddrinfo timeout handler of Ruby. This vulnerability has been assigned the CVE identifier CVE-2026-46727 . This issue has been fixed in Ruby 4.0.5. We recommend upgrading Ruby. Details A race condition exists in the timeout cancellation path of rb_getaddrinfo used by Addrinfo.getaddrinfo(..., timeout:) and Socket.tcp(..., resolv_timeout:) . A remote attacker who can delay DNS responses near the specified timeout may cause the Ruby process to dereference freed memory and crash. Recommended action Please update to Ruby 4…
5月12日(火)
Ruby 4.0.4 Released
Ruby 4.0.4 has been released. This is a routine update that includes bugfixes. Please see the GitHub Releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent regular release. Ruby 4.0.5 will be released in July, 4.0.6 in September, and 4.0.7 in November. If a change arises that significantly affects users, a release may occur earlier than planned, and the subsequent schedule may shift accordingly. Download https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.4.tar.gz SIZE: 23816838 SHA1: 363…
3月6日(金)
Swift at scale: building the TelemetryDeck analytics service
TelemetryDeck is an app analytics service specifically for developers, designed to manage usage analytics that are anonymized, privacy-focused, and really easy to use. TelemetryDeck is managing the data of over 16 million people every month, helping thousands of app publishers improve their products, and we’re doing it all with a Swift-based infrastructure. The decision to go with Swift brought a lot of unexpected advantages for us. We come from a world of iOS in the frontend, Python, Node, or Ruby in the backend for server-based applications. Compared to these languages and frameworks, Swift…
6月6日(月)
DevConf 2016
DevConf 2016 in Moscow, Russia on June 17-18. DevConf is the ultimate meeting place for russian-speaking web-developers, combining several language-specific conferences under one roof. This year the conference will take place in . Skolkovo Moscow School of Management DevConf 2016 will include the following sections: DevConf::PHP(); DevConf::Python(); DevConf::Javascript(); DevConf::Storage(); DevConf::Golang(); DevConf::DevOps(); DevConf::Ruby(); Each section will feature several talks from the active contributors/authors of the language. Among the invited speakers are Dmitry Stogov (Zend), E…
5月26日(火)
DevConf 2015
DevConf 2015 in Moscow, Russia on Jun 19-20 DevConf is the ultimate meeting place for russian-speaking web-developers, combining several language-specific conferences under one roof. This year DevConf will include the following sections: DevConf::PHP(); DevConf::Ruby(); DevConf::Python(); DevConf::Javascript(); DevConf::Storage(); Each section will feature several talks from the active contributors/authors of the language. Among the invited speakers are Dmitry Stogov (Zend), Egor Homakov (Sakurity), Sveta Smirnova (Percona), speakers from 1C, Avito, Badoo, LinguaLeo, Mail.ru, Wamba and other…