Rails Daily: Security Hardening and Relation Fixes
A cluster of security hardening commits leads the day across sessions, rendering, and helpers, alongside Active Record correctness fixes for grouped counts and merging. Performance work focused on cutting allocations in hot query and notification paths.
Duration: PT2M17S
Episode overview
This episode is a short developer briefing from Rails Daily.
It explains recent repository work in plain language.
- Show: Rails Daily
- Published: 2026-11-04T06:01:56Z
- Audio duration: PT2M17S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
It's November 4th, 2026, you're listening to Rails Daily.
The lead today is security, not features — a batch of hardening commits with G-H-S-A advisories touches session cookies, response negotiation, file handling, and view helpers.
First theme is session and response safety. One commit, 7723e49, moves same-site cookie protection from just the cookie store into shared session compatibility, so cache-based and custom stores send it too. Another, e38dd28, makes rendered and X-H-R responses vary by negotiation headers. Related fixes tighten Active…
Second is Active Record relation correctness. Pull requests 59559 and 59575 fix the one and many checks on grouped relations, where a grouped count returns a hash and later broke on selected aggregates — both now count all records. Pull request 59580 fixes merge dropping recursive from a common table expression…
Third is consistency and speed in hot paths. Pull requests 59566 and 59573 close stale reads where batched memcached writes and deletes bypassed the request-local cache. Pull requests 59562, 59576, and 59571 cut per-call allocations for subscriber dispatch, single-condition where clauses, and parameterless scopes.…
What's next:…
Nearby episodes from Rails Daily
- Ractor Connection Hardening and Button To Cleanup
- MessagePack Cache Fixes and Reliability Hardening
- Serialization Speedups and SQLite Fixes
- Performance Trims and Compatibility Fixes
- The Allocation Diet Sweep
- Weekly Recap - Default Order Fixes, Inheritance Propagation and Performance
- Default Ordering Fixes and Inheritance Propagation
- Routing Speed and Preload Correctness