Rails Daily: Boot Failures, a Security Fix, and a Broken Main
Rails spent the day patching a chain of libvips boot failures in Active Storage, closing a stored XSS hole in Action Text's markdown conversion, and cleaning up a botched merge that left main red. Two more PRs from yaroslav quietly speed up common time zone and inflector operations.
Duration: PT2M28S
Episode overview
This episode is a short developer briefing from Rails Daily.
It explains recent repository work in plain language.
- Show: Rails Daily
- Published: 2026-09-13T06:02:07Z
- Audio duration: PT2M28S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning. It's September 13th, and today's Rails activity is dominated by one theme: boot reliability for Active Storage's image processing.
Three separate PRs from flavorjones, plus community input from nicolasva, chase down the same underlying problem. Since an earlier change, apps with ruby-vips installed but missing or outdated libvips simply wouldn't boot — even if they never used the vips processor. PR 58734 fixed the case where mini_magick apps…
Second theme: a real security fix. PR 58754 closes a stored cross-site scripting hole in Action Text's markdown conversion. Code and pre tags skip markdown escaping and rely on their delimiters holding — but Trix encodes double line breaks as literal break tags, so a determined author could break out of a code span…
Third theme: process integrity. PR 58261 restored a silenced check on Action View's render instrumentation, but the merge landed a stale branch and broke main with a NameError on Rails.root. Flavorjones caught it fast with PR 58753, removing a stub that no longer matched the current test setup. A reminder that…
Smaller but notable: yaroslav's two performance PRs, 58751 and 58752, speed up time zone formatting and…
What's…
Nearby episodes from Rails Daily
- Ractor Safety and Boot-Time Failures
- The Ractor Safety Push
- Edge Cases, Ractors, and Cleanup
- Cleanup, Concurrency, and a JSON Wake-Up Call
- The JSON Gem Ripple Effect
- Weekly Recap - Preparing Rails for Ractor Concurrency
- Performance Cleanup and Edge Case Fixes
- Correctness Fixes and a Doc Cleanup Push