How rails is put together
This repository is the Ruby on Rails web framework itself, a monorepo of independently shippable gems (each with its own gemspec, Rakefile, and CHANGELOG) implementing the Model-View-Controller pattern. The primary language is Ruby, organized as a collection of framework libraries: Active Record (ORM), Active Model, Action Pack (routing/controllers), Action View (templating), plus auxiliary frameworks for email, jobs, WebSockets, file storage, and rich text. Data flows from HTTP requests through Rack/Action Dispatch routing into controllers that load models via Active Record and render templates via Action View; JavaScript client-side counterparts (Action Cable, Active Storage, Action Text) are built with Rollup and published as npm packages under yarn workspaces. There is no deployed application here; the codebase is a library/framework consumed by end-user apps, so its 'runtime' surface consists of engine-mounted routes (e.g., Action Mailbox ingresses, Active Storage blob serving) and developer tooling (guides generator, release tooling).
Languages
Frameworks
Datastores
Infrastructure
Major components
activerecord
ORM layer mapping database rows to Ruby objects with business logic, supporting SQLite3, PostgreSQL, MySQL (mysql2/trilogy) adapters.
activemodel
Provides interfaces/abstractions (attributes, validations, callbacks) shared by Active Record and plain Ruby model classes.
actionpack
Bundles Action Dispatch (request routing/dispatch) and Action Controller (handling HTTP requests and generating responses), including abstract_controller.
actionview
View/template rendering layer responsible for producing representations (ERB etc.) for controller responses and emails.
activesupport
Utility classes and standard-library extensions used across all components and usable standalone.
activejob
Framework for declaring background jobs runnable on multiple queuing backends (Resque, Sneakers, Backburner, queue_classic, Solid Queue).
actioncable
WebSocket integration framework with a Rollup-built JS client (@rails/actioncable) tested via @web/test-runner.
activestorage
File attachment library serving blobs/variants via signed-id routes and direct uploads, backed by S3, Google Cloud Storage, or disk service.
A quieter week of fixes and polish, headlined by escaping attachment captions in Markdown output to prevent unsafe content from slipping through.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A quieter week of fixes and polish, headlined by escaping attachment captions in Markdown output to prevent unsafe content from slipping through.
Week of 2026-08-17
A busy week focused on Ractor safety across routing and caching, plus lazy route loading and sanitizing user-supplied Markdown tags.
Week of 2026-08-10
The biggest week yet, with schema reads batched for speed, configs frozen for Ractor sharing, and support for the HTTP QUERY method added.
Week of 2026-08-03
A large week centered on Ractor-safe templates and caches, MySQL defaulting to TRADITIONAL SQL mode, and bind parameters for find_by_sql.
Week of 2026-07-27
Foundation-laying week: deprecations targeting Rails 9.0, middleware stack hardening, and a set of small but sharp bug fixes.
The last few weeks on Rails show a heavy push toward making the framework safe for Ruby's new parallel 'Ractor' execution model, alongside a wave of performance work that batches database schema reads and trims needless object churn. Bug fixes concentrated on routing, Active Record associations and dirty tracking, and documentation examples were cleaned up across many modules. A notable security-adjacent fix escaped attachment captions in Markdown rendering, and several long-standing behaviors like Relation#uniq! and writing to primary keys via write_attribute were deprecated.
Week by week
2026-08-24A quieter week of fixes and polish, headlined by escaping attachment captions in Markdown output to prevent unsafe content from slipping through.latest6 changes
Fix
Escape attachment captions in Markdown
Attachment captions are now safely escaped when rendered as Markdown, closing a hole where raw user-supplied content could be injected.
Feature
Query predicate hooks merged
Work on letting Active Record types define how they compare in query conditions was merged after prior iterations.
Fix
Relative i18n scopes for translate
The translate helper's scope option now correctly resolves relative internationalization keys instead of failing silently.
Refactor
Faster url_for with hash appends
Building URLs with extra parameters now avoids copying hashes unnecessarily, reducing overhead on hot paths.
Fix
MySQL index lookups skip empty lists
MySQL no longer opens or touches a database connection when asked to fetch indexes for an empty table list.
Docs
Docs cleanup batch
Several documentation examples (store dirty tracking, AVG return types) were corrected so newcomers aren't misled by wrong sample code.
2026-08-17A busy week focused on Ractor safety across routing and caching, plus lazy route loading and sanitizing user-supplied Markdown tags.6 changes
Fix
Strip untrusted markdown tags
User-supplied <action-text-markdown> tags are stripped while content is canonicalized, keeping rich text input trustworthy.
Fix
Ractor-safe URL helpers
URL helpers and partial-path conversion were made safe to call from Ruby's new parallel Ractor threads.
Refactor
Load routes lazily
Routes now load on demand when a mounted helper is first called rather than eagerly, speeding up startup.
Fix
Async statement cache fix
Asynchronous queries through the statement cache no longer error when bind values fall outside expected ranges.
Refactor
Avoid needless array flattening
Reflection internals stopped flattening arrays unnecessarily, trimming allocations in frequently used code.
Fix
Attribute method patterns regression fixed
A regression affecting model attribute method pattern matching was repaired after recent refactors.
2026-08-10The biggest week yet, with schema reads batched for speed, configs frozen for Ractor sharing, and support for the HTTP QUERY method added.6 changes
Refactor
Batched database schema reads
Rails now asks the database about columns, primary keys, indexes, and table options for many tables at once instead of one query per table, dramatically speeding up boot and schema dumps.
Feature
HTTP QUERY method support
Routing and controllers now recognize the newer HTTP QUERY method, which lets clients send large search requests as a GET-like body.
Chore
Configs frozen for Ractors
Active Record and Action Dispatch configuration objects are frozen so they can be safely shared across parallel Ractors.
Fix
Association join constraints get comparisons
Comparison expressions can now be used in association join constraints, enabling more expressive custom joins.
Fix
Primary key clearing fixed
Clearing has_one and belongs_to foreign keys within composite primary keys now works correctly.
Refactor
Deprecate Relation#uniq!
The old uniq! relation method is being retired in favor of distinct, nudging apps toward the modern API.
2026-08-03A large week centered on Ractor-safe templates and caches, MySQL defaulting to TRADITIONAL SQL mode, and bind parameters for find_by_sql.6 changes
Refactor
ERB templates Ractor-readable
Compiled ERB templates and their caches can now be read from non-main Ractors, unlocking parallel template rendering.
Fix
Bind params for find_by_sql arrays
Array-form arguments to find_by_sql and count_by_sql now use bind parameters, protecting against SQL injection in raw queries.
Chore
MySQL TRADITIONAL mode by default
New MySQL connections append TRADITIONAL to sql_mode by default, catching more data-integrity problems early.
Fix
UTC times from Time.rfc3339
Parsing RFC3339 timestamps ending in Z now returns proper UTC time values consistently.
Fix
Optional route segments handle empty strings
Routes with optional segments no longer include them when given empty strings, producing cleaner URLs.
Refactor
Stop deserializing column defaults
Column defaults are no longer deserialized up front, avoiding wasted work at load time.
2026-07-27Foundation-laying week: deprecations targeting Rails 9.0, middleware stack hardening, and a set of small but sharp bug fixes.6 changes
Chore
Deprecations unified for Rails 9.0
Deprecation removal targets were aligned to the next major release, and passing binds to insert/update/delete plus writing to primary keys via write_attribute are now deprecated.
Fix
Relation#update keeps its scope
Updating records through a scoped relation now respects that scope, so you can't accidentally update rows outside it.
Fix
Middleware stack stays consistent
The controller middleware proxy was refrozen and kept in sync so stale middleware configurations can't linger.
Fix
search_field autosave crash fixed
Passing autosave: true to the search_field helper no longer raises a NameError.
Fix
parameterize nil separator fixed
String#parameterize no longer crashes with a TypeError when its separator argument is nil.
Refactor
asset_path skips redundant scan
Asset URL generation strips query strings and fragments without scanning the string twice, shaving per-request cost.
Dependencies and code review
Dependency advisories
Security Watch
16 vulnerable packages (27 advisories) across 762 scanned dependencies.
brace-expansion 1.1.11
3 advisories. Fixed in 5.0.7.
How it can be abusedThis JavaScript helper expands patterns like file globs, and a malicious or crafted pattern can make it consume huge amounts of time and memory, freezing or crashing the process. In this repository it is only used by build and development tools like Rollup and yarn workspaces on developer machines, so it is not exposed to attackers through the framework's runtime code.
- highGHSA-3jxr-9vmj-r5cpbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
- highGHSA-mh99-v99m-4gvgbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
- highGHSA-rgw5-rvv9-x895brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
deepmerge-ts 7.1.5
1 advisory. Fixed in 8.0.0.
How it can be abusedAn attacker could send deeply nested self-referencing data that gets passed to the merge function, causing the process to recurse until it crashes with a stack overflow. In this repository deepmerge-ts is only used in JavaScript build and tooling code, not in any runtime path that handles untrusted input, so end users of the Rails gems are not affected.
- highGHSA-ggr8-5vv4-36mxDeepmergeTS has stack exhaustion when merging recursive object graphs
extract-zip 2.0.1
1 advisory.
How it can be abusedThis package unzips files and can be tricked into following malicious symlinks inside an archive, letting an attacker write files anywhere on the machine. In this repository it is only developer build tooling, so it would matter mainly to contributors who extract untrusted archives locally, not to applications using Rails at runtime.
- highGHSA-jmr9-qjv8-65gvextract-zip unvalidated symlink path traversal
flatted 3.3.1
2 advisories. Fixed in 3.4.0.
How it can be abusedAn attacker could crash or hijack code that parses untrusted flatted strings, since the parser can recurse endlessly or write into unexpected object paths. In this repository flatted is only used for developer tooling rather than anything that handles attacker-controlled data, so real-world apps using Rails are not directly exposed.
- highGHSA-25h7-pfq9-p65fflatted vulnerable to unbounded recursion DoS in parse() revive phase
- highGHSA-rf6f-7fwh-wjghPrototype Pollution via parse() in NodeJS flatted
form-data 4.0.5
1 advisory. Fixed in 2.5.6.
How it can be abusedThis JavaScript package builds multipart upload requests, and it fails to escape field names and filenames, so a malicious server or crafted input could smuggle extra headers or forge request parts. In this repository it would only matter if some Node-based tooling or release scripts use it to send files, not in the Rails framework code itself that end-user apps consume.
- highGHSA-hmw2-7cc7-3qxxform-data: CRLF injection in form-data via unescaped multipart field names and filenames
ip-address 10.2.0
1 advisory. Fixed in 10.3.1.
How it can be abusedThe library treats IP octets with leading zeros as decimal while DNS resolvers treat them as octal, so an attacker can supply a crafted hostname or address that looks like a safe internal or allowed host but actually resolves somewhere else, enabling server-side request forgery or bypassing allowlists. This affects end-user Rails applications that use this library to validate or filter IP addresses and hosts, though the Rails framework codebase itself does not meaningfully rely on it at runtime.
- highGHSA-mwp4-54f8-5fhrip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
js-yaml 4.1.0
2 advisories. Fixed in 3.15.0.
How it can be abusedAn attacker who can get a malicious YAML file processed by the build or docs tooling could craft deeply nested merge keys that make parsing take quadratic time, freezing the developer machine during a build. This only affects Rails maintainers running tooling locally; js-yaml is not shipped in any framework gem or npm package end users install.
- highGHSA-52cp-r559-cp3mjs-yaml: YAML merge-key chains can force quadratic CPU consumption
- highGHSA-5p4m-2wfm-xmqjJS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
lodash 4.17.21
1 advisory. Fixed in 4.18.0.
How it can be abusedAn attacker would need an app to pass untrusted user input into lodash's _.template function, which could then run arbitrary code on the server. This repo is the Rails framework itself, where lodash is only used as a build-time tool for its bundled JavaScript, not to render user-supplied templates, so end users are not meaningfully affected.
- highGHSA-r5fr-rjxr-66jclodash vulnerable to Code Injection via `_.template` imports key names
minimatch 3.1.2
3 advisories. Fixed in 10.2.3.
How it can be abusedAn attacker who can influence file paths or patterns fed into the JavaScript build tooling, such as through a malicious pull request or a compromised dependency, could craft a pattern that makes matching take effectively forever, hanging developer machines or continuous integration jobs. Only people building or contributing to this repository are affected; applications that use Rails never run this package.
- highGHSA-23c5-xmqv-rm74minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
- highGHSA-3ppc-4f35-3m26minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
- highGHSA-7r86-cg39-jmmjminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
nanoid 3.3.12
2 advisories. Fixed in 3.3.16.
How it can be abusedAn attacker could send input that makes code pass a bad size value (negative or zero) to the ID generator, causing an infinite loop that hangs a server thread and blocks other requests. This mainly affects apps that call nanoid with user-controlled sizes; in this Rails framework repo, nanoid is not meaningfully used by any shipped gem or runtime code, so end users are not affected.
- highGHSA-28wg-ghj8-5hjvnanoid: non-secure generators can loop indefinitely with negative size
- highGHSA-2v37-7h3g-55p8nanoid: custom generators can loop indefinitely when size is zero
picomatch 2.3.1
1 advisory. Fixed in 4.0.4.
How it can be abusedPicomatch matches file paths against wildcard patterns, and a maliciously crafted pattern or filename can make it spin through endless matching steps and freeze whatever process calls it. In this repo it is only a JavaScript build tooling dependency for bundling client assets, not part of any runtime code that handles user input, so end users of Rails apps are not exposed.
- highGHSA-c2c7-rcm5-vvqjPicomatch has a ReDoS vulnerability via extglob quantifiers
rollup 2.79.1
2 advisories. Fixed in 3.29.5.
How it can be abusedThe JavaScript bundles Rails publishes (for Action Cable, Active Storage, and Action Text) are built with this vulnerable version of Rollup, so apps that load those scripts can be attacked if a page also contains attacker-influenced HTML like crafted element names or ids, which tricks the bundled script into running attacker JavaScript in the victim's browser. Anyone running a Rails app whose pages serve these built scripts alongside user-supplied content is affected.
- highGHSA-gcx4-mw62-g8wmDOM Clobbering Gadget found in rollup bundled scripts that leads to XSS
- highGHSA-mw96-cpmx-2vgcRollup 4 has Arbitrary File Write via Path Traversal
serialize-javascript 4.0.0
1 advisory. Fixed in 7.0.3.
How it can be abusedThis JavaScript helper library can let an attacker run arbitrary code on your machine when it serializes crafted data, but in this repo it is only used by build and release tooling, not by anything running in end-user apps. Only developers building Rails itself could be exposed, and even then an attacker would need to sneak malicious content into the build inputs.
- highGHSA-5c6j-r48x-rmvqSerialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
undici 6.26.0
1 advisory. Fixed in 6.27.0.
How it can be abusedAn attacker could crash a server by sending a flood of tiny WebSocket message fragments that the undici client fails to count correctly, exhausting memory or CPU. This only matters for JavaScript code that uses undici's WebSocket client at runtime, which this Rails framework repository does not, since its npm packages are just browser-side assets and its real code is Ruby.
- highGHSA-vxpw-j846-p89qundici WebSocket client vulnerable to denial of service via fragment count bypass
undici 7.27.2
3 advisories. Fixed in 7.29.0.
How it can be abusedAn attacker could trick the app into reusing another user's cached responses, sending requests to the wrong server through a shared proxy, or connecting without checking the server's certificate, exposing sensitive data or enabling interception. However, this package is only pulled in by JavaScript build tooling in this Ruby framework repo and is not part of any runtime code that end-user apps execute.
- highGHSA-4cwx-7wf7-3272undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
- highGHSA-hm92-r4w5-c3mjundici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
- highGHSA-vmh5-mc38-953gundici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
urijs 1.17.1
2 advisories. Fixed in 1.19.11.
How it can be abusedAn attacker could craft URLs with hidden newline or backslash characters so that this library parses them as pointing to a trusted site when they really point to an attacker-controlled one, enabling phishing or bypassing link checks. However, this npm package is not used by any of the gems or JavaScript packages in this repository, so no real code path exposes it.
- highGHSA-3vjf-82ff-p4r3Incorrect protocol extraction via \r, \n and \t characters
- highGHSA-p6j9-7xhc-rhwpURIjs Hostname spoofing via backslashes in URL
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required