#164 🚨 Malicious gems, a high-severity CVE, and patched Ruby crash bugs

Happy Wednesday!

Here is issue #164 of our newsletter, bringing you news and the best tools for your current or future Rails projects…

1. 🐘 Got a Postgres end-of-life email from Heroku? Juan walks through moving a Heroku Postgres database off a deprecated version by copying it into a freshly provisioned one. Heroku's own pg:copy and pg:backups:restore commands failed on him, so he fell back to a local pg_dump and pg_restore that finally worked. He breaks down how much downtime to expect for each of Heroku's three upgrade paths, plus the row count and sequence checks worth running once the new database is live.

2. ♟️ Zero breakages, five Rails versions. Ernesto walks through how FastRuby.io took the Irish Chess Union's Rails app from 7.0 to 8.1, dual-booting with next_rails and their open-source Claude Code Rails Upgrade Skill to hop one minor version at a time. Eight pull requests and about thirty to forty commits later, the ICU's all-volunteer team never paused feature work, and its Stripe-powered membership payments kept running the whole time.

3. 🚨 Hundreds of malicious RubyGems packages, one open question: why? Spencer Kitts, Thomas Larsen, and Sydney Von Arx trace the May 2026 GemStuffer campaign to what they believe was an OpenAI agent swarm that abused RubyDoc.info's build system for remote code execution and tried to steal other users' API keys, though RubyGems found no evidence those attempts succeeded. Read their evidence for why scraping public council data required hacking a registry at all, a question that stays unanswered.

4. 🚨 The mongo gem's GridFS has a high-severity flaw. Using the MongoDB Ruby driver's GridFS? RubySec's advisory for CVE-2026-88030 flags a high-severity (CVSS 8.3) flaw where a caller-supplied file identifier can be read as a query condition instead of a literal ID. Fixed in the mongo gem 2.26.0.

5. 🔗 allow_other_host: true is safe here for exactly one reason. Mehdi Farsi builds a URL shortener in pure Rails with no gem: one model, one controller, one route, self-generating slugs and an atomic click counter. See why redirect_to is safe only when the target comes from a row you control rather than the request, plus the collisions and expiry the build still skips.

6. 🐛 Ruby 4.0.7: squashing segfaults, heap overflows, and a 150x Ractor slowdown. Ruby 4.0.7 patches a run of crash bugs, including a win32 heap overflow in Kernel#system, a heap-use-after-free in fiber_switch, and a GC.auto_compact bug that could corrupt strings or segfault via String#tr. It also fixes a YJIT bug that grabbed the VM lock on every Proc materialization, a regression that had collapsed multi-Ractor throughput by up to 150x.

7. 🤖 Can an AI agent migrate 700 pages of Rails to Hugo on its own? With minimal supervision, GPT-6 Astra rebuilt mkdev.me's roughly 700 pages as Hugo files and stood up new CloudFront and S3 infrastructure through the existing Terraform setup. Kirill also watched it over-engineer the job with a $40-per-run test harness and skip the PostHog integration entirely, leaving none of the site's analytics migrated.

Check out our other articles on: ​​​​Ruby | Rails | Compatibility | ​​Upgrades​​​​ | ​​​​Tech Debt​​​ | AI​

Bookmark, share, or save them for later. We hope these links are helpful. 😉

Best,

The ​​​​​​FastRuby.io​​​​​​ Team