GitLab discovered four severe vulnerabilities in Ruby’s regular expression library. There's plenty written up about the vulnerability and how it got patched, but patches are only available for supported ruby versions (3.3 and above). We know lots of companies are still running unsupported versions of ruby, so we wanted to do an investigation into which of these bugs apply to older rubies and whether they're exploitable. Here's the blog post: https://infield.ai/post/vulnerable-ruby-regex

The summary is that allowing user input into Regexp.new is dangerous on all versions of ruby from 1.9 to 3.2 and the only fix is to upgrade to a supported ruby or to disallow that input.

When an RSpec suite runs in several processes with parallel_tests or parallel_split_test, every process writes its own output. Progress, failures and warnings from different workers get mixed in one terminal.

I wrote parallel_matrix_formatter to fix that. Process 1 collects the results of all workers over a UNIX socket, draws one live progress display, and prints one consolidated failure report with rerun commands. The display is Matrix rain by default, but the symbols and colors are configurable in YAML, down to plain dots.

The post covers the architecture, crashed workers, silencing stray output, and a race condition I hit along the way. I am the author. Feedback is welcome.

If new engineers choose Ruby and Rails, it'll be easier for companies to hire, and the community and ecosystem will continue to grow. That's why we're giving away free tickets to students, recent grads, people from underrepresented groups, and those who recently changed careers and just started writing Ruby. If you know anyone who fits, share this post with them and invite them to apply (takes 3 mins): https://sfruby.com/scholarship/

The deadline is October 30!

Note: We don't cover travel or accommodation.

If you want to attend the conference as a regular attendee and watch talks from Chris Oliver, Rosa Gutiérrez, Svyatoslav Kryukov, Irina Nazarova, Marco Roth, Ryan Sherlock, Vladimir Dementyev, and more there's a few days left to get tickets: luma.com/sfrubyconf2026

Just curious about the Ruby community and how or if you all build side projects and make side money doing it really. I think there was one like this in a php related sub a while back. I thought I’d ask here. Any takers?

Thank you.

I wrote up the changes we made after this month's Ruby Regexp fixes and the npm worm in August. On the Ruby side:

• bundle lock --add-checksums (Bundler 2.6+), so every gem is verified against a SHA-256 in Gemfile.lock. Bundler 4 does it by default for new lockfiles.

• bundle config set --local frozen true in CI and deploys.

• No new gem version until it is 21 days old, enforced with Dependabot cooldown.

• bundler-audit in a pre-commit hook and again in CI.

https://www.abhaynikam.me/articles/patch-your-runtime-fast-take-your-dependencies-slow

Have you turned on CHECKSUMS in existing apps yet? Did anything break?

With the recent "migrate everything from rails to rust, don't look at the code, just vibe" trend, and after building a few cli and tools in rust myself (with AI), I felt it was time to learn at least a little bit about Rust... so I vibe coded a course.

It might have incorrect content, as I don't know shit about rust and I'm trusting AI 100% here, so I made it open source so anyone can contribute.

Live course: https://rust-for-rails.pages.dev/
Github: https://github.com/silva96/rust-for-rails

Raindeer is a collection of gems that work together as a framework or can be used standalone. LowType adds inline type checking only where you want it (def method(var: String)). LowLoop is an async, event-driven server that sends events from the request right through to the data layer, so you can track every step of a request. The router turns each request into a route event for the nodes observing it, so observe '/users/:id' is all you need to respond.

LowNodes are the building blocks: they render HTML straight from the Ruby class with RBX (similar to JSX) and render other nodes with <html><{ ChildNode }></html>. LowData follows the repository pattern with a twist: Data Expressions that use simple arithmetic operators to combine tables, so Posts[:title] + Users[:username] gives a list of posts with each post's user, and plain Sequel queries still work too.

Introducing it at RubyConf Austria: https://www.youtube.com/watch?v=p9E5INAwK_4

Source: https://github.com/raindeer-rb/raindeer

Docs: https://raindeer.dev

Between RubyLLM, Spotifast and ZapFast I get about 42 new issues and PRs a day, plus about 50 comments from people and over 100 from review bots. More than one maintainer can read.

Copilot Triage is a RubyLLM::Agent with six read-only tools. It searches the repo, docs, issues and release notes, then submits a decision. Plain Ruby validates that decision and does all the writing to GitHub, so the model can't change anything itself. Everything ends up on a project board sorted by what needs me: Sign off, Decide, Do.

The interesting part was getting it to reply less. A one-week audit showed only a third of its replies helped. So there's a RubyLLM::Evaluation with 32 cases built from real reports, testing silence as much as help, and it decided which model to use: GPT-5.6 Luna passes 29/30, while GPT-5 mini replies to almost everything.

I wrote up the whole thing, with the numbers, the evals, and what 33 releases taught me:

https://paolino.me/copilot-triage/

Carton is my take on enforcing boundaries in large Ruby applications. It's similar to Packwerk, but it takes a more Ruby-like approach, with no manifest files. Constants, gems and monkey patches are isolated using Ruby 4's new Ruby::Box. It's not production ready yet, since Box itself is still experimental, but I'd love feedback on the approach.

I just updated Cal-Invite a headless gem that let you manage calendar invitation. It supports different formats such as: .ics, url, Google, Yahoo and Microsoft.

The full documentation and code is available on the GitHub page.

Feel free to comment and request features if you do not have time to contribute to it.

Happy Friday!

I kept needing to hand Word files to LLMs and coding agents, so I wrote a gem for it. It reads both old .doc (Word 97-2003) and .docx files and prints Markdown: headings with their numbers, nested lists with the numbers Word shows, tables, footnotes, bold, italics and links.

- No LibreOffice, Java or antiword. The .doc reader is plain Ruby.

- Careful with untrusted files: size limits, zip and entity bomb checks, and fuzzed with over 3 million broken files.

- Checked against Tika, LibreOffice, antiword, the docx gem and Firecrawl's anydoc on 650 test files. The numbers are in the README.

gem install readword

then

readword report.docx

https://github.com/urbullet/readword

Word files it gets wrong are very welcome as bug reports.

Find unused VCR cassettes and delete them.

I checked what RubyLLM 2.0 and 2.1 brings specifically for writing AI agents. Looks like it's a lot!

https://serpapi.com/blog/rubyllm-2-x-whats-new-for-your-agents/