#167 🧭 Where does Rails go when agents write the code?

Happy Wednesday!

Here is issue #167 of our newsletter, bringing you news and the best tools for your current or future Rails projects…

1. 💎 Rails World 2026: Aaron Patterson on the as-if rule, from Ractors to RubyGems.org. Ernesto recaps Aaron's closing keynote, where the compiler's as-if rule explains why class-level memoization like @x ||= was only ever safe for one kind of observer and raises in a non-main Ractor. The same idea also explains a real RubyGems.org security incident from earlier this year. Read the full recap for the ractor-sharing gem and the on_main method in an upcoming Rails release as ways out, plus how the incident unfolded.

2. 🔐 Rails World 2026: What if a vulnerable image library couldn't reach your secrets? Ernesto recaps Mike Dalessio's talk on how CVE-2026-66066 chained seven small issues into a crafted upload that could read your app's secrets, and how Hot Cell sandboxes Active Storage in a sibling container. Hot Cell's Active Storage gems need Rails 8.2, still unreleased, or Rails main. Read the recap, then check which libvips version your container image ships, because bumping activestorage might not be enough.

3. 🚂 Still using dynamic :controller and :action in your routes? In This Week in Rails, Greg Molnar's roundup of changes in the Rails codebase reports that routes with a dynamic controller and action, like get ":controller(/:action(/:id))", will raise an ArgumentError, after being deprecated since Rails 5.0. It also covers the new minimum Ruby version, 3.3.5, and the Rails World talk recordings, now on YouTube. See what to write instead, such as get "photos/:id", to: "photos#show".

Upcoming Events

⚡Philly.rb's Lightning Talks at Indy Hall: October 20th, 5:30–8:00 pm. Space
is limited, so RSVP here. Don't forget to submit a talk if you've got one to share.

4. 🤖 Need an AI agent to wait for a human before it refunds an order? Carmine Paolino's RubyLLM 2.0 release post shows how a tool declared with requires_approval stops the agent loop and saves the pending call in your database, so approval can arrive from another process, after two deploys. The release also adds video, speech, OCR, and reranking, plus a generator for upgrading Rails apps from 1.16. See the full refund example in code and a guide for each new feature.

5. 🧭 Where does Rails go when agents write the code? Matt Solt's Ruby AI News gathers the community's response to the Rails keynote. Sam Ruby argues Rails is a hidden 4GL and reports a compiled Campfire serves pages 7 to 8 times faster than Rails. Matt sketches a path for beginners starting with agents, from a CLI that wraps rails new to skills shipped in gems. Read the full edition for his proposal.

6. 🎲 Is your test suite quietly depending on row order? Evil Martians' Yaroslav Kurbatov and Travis Turner show how shuffling the rows of every unordered SELECT exposes hidden order dependencies, from a Gitea pagination bug to a nondeterministic Rails schema.rb. Keep reading to see how Rails 8.2's shuffle_unordered_selects and the pg_disorder extension compare, and which queries each one skips.

Check out our other articles on: ​​​​Ruby | Rails | Compatibility | ​​Upgrades​​​​ | ​​​​Tech Debt​​​ | AI​

Bookmark, share, or save them for later. We hope these links are helpful. 😉

Best,

The ​​​​​​FastRuby.io​​​​​​ Team