Rails Daily: Query Internals and a Markdown Security Fix
Rails core landed two major query-execution refactors from matthewd, while Action Text picked up a second security fix in two days for unescaped Markdown output. Several smaller fixes address silent failures in associations, parameters, and rate limiting.
Duration: PT2M32S
Episode overview
This episode is a short developer briefing from Rails Daily.
It explains recent repository work in plain language.
- Show: Rails Daily
- Published: 2026-08-25T06:01:49Z
- Audio duration: PT2M32S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning, it's August 25th, 2026, and this is Rails Daily.
The biggest signal today: Active Record's query execution layer is getting a serious rework, and Action Text just closed out a two-part security fix around Markdown conversion.
Start with matthewd's pair of merges. PR 58479 lets Active Record types define Arel expressions for comparisons directly, replacing scattered special-casing — like Range handling — that used to live in the predicate builder. PR 58049 changes how query results get delivered, routing them through what's called Query…
Second theme: Action Text's Markdown output had a real gap. Flavorjones shipped two fixes back to back. PR 58543 stripped user-supplied action-text-markdown tags during canonicalization, closing a path where a crafted rich text body could bypass URI scheme checks. Then PR 58553 found the same class of bug one layer…
A few smaller but concrete fixes worth knowing: PR 58550 fixes a silent nil return in has-and-belongs-to-many join models — the left-side association was looking for a column that never existed. PR 58557 restores permit's documented compatibility promise around double-array filtering. And PR 58558 documents that…
What's next:…
Nearby episodes from Rails Daily
- Weekly Recap - Ractor Safety and Query Correctness
- Trust the Boundary, Fix the Docs
- Documentation Cleanup and Lazy Loading Fixes
- Cleaning Up After Recent Regressions
- Ractor Safety Push and Test Determinism Cleanup
- Ractors Push Rails Toward Frozen State
- Correctness Fixes and Ractor Readiness
- Data Integrity Fixes Across the Association Layer