Rails Daily: Silent Query Fixes, Forgery Gaps, and Upgrade Safety
Active Record dominates today with fixes for queries that silently returned wrong rows, invalid SQL, or lost updates. Merged changes for bound condition grouping, locked counters, and cache handling lead, alongside forgery protection corrections and operational polish.
Duration: PT2M3S
Episode overview
This episode is a short developer briefing from Rails Daily.
It explains recent repository work in plain language.
- Show: Rails Daily
- Published: 2026-11-13T06:04:50Z
- Audio duration: PT2M3S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning, it's Friday, November 13th, 2026, and this is Rails Daily.
The throughline today is correctness over new features: several Active Record changes fix cases where the database returned the wrong rows or no rows without an error.
First, query building. PR 59642, now merged, groups bound SQL literals in the where clause so a top-level OR can't escape a neighboring AND. Without it, combining a custom OR condition with a hash filter could return extra rows. Related proposals tackle schema-qualified table names generating invalid aliases, merges…
Second, forgery protection. One merged fix, PR 59759, restores protection in the Active Storage base controller, where a capability check always evaluated false so protection never turned on. A separate open proposal, PR 59778, would close a bypass where a POST with a method override to GET or HEAD skipped token…
Finally, operations and upgrade safety. A merged change makes counter increments fail loudly on stale lock versions instead of silently dropping the update, and a Message Pack cache entry referencing a removed class is now treated as a miss rather than a cached nil, with both fixes headed to stable branches. Also…
What's…
Nearby episodes from Rails Daily
- Security Hardening and Query Fixes
- Active Record Array Storage and Security Hardening Push
- Quiet Query Fixes and Allocation Cuts
- Through-Association Loading Fixes
- Weekly Recap - Speed Gains and Data Fixes
- Silent Query Bugs and Leaked Secrets
- Ractor Connection Hardening and Button To Cleanup
- MessagePack Cache Fixes and Reliability Hardening