Rails Daily: Trust the Boundary, Fix the Docs
A security fix closes a Markdown sanitization gap in Action Text, while three merged pull requests correct long-standing documentation errors in Active Record, and a MySQL fix removes an unnecessary connection call during empty index lookups.
Duration: PT2M12S
Episode overview
This episode is a short developer briefing from Rails Daily.
It explains recent repository work in plain language.
- Show: Rails Daily
- Published: 2026-08-24T06:01:52Z
- Audio duration: PT2M12S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning, it's August 24th, 2026, and this is Rails Daily.
Today's theme is trust boundaries — knowing what's safe input versus what isn't, and making sure documentation actually reflects that reality.
Start with PR 58543 from flavorjones. Action Text wraps rendered Markdown attachments in a special marker tag so the converter emits them verbatim. The problem: nothing stopped a user from typing that same tag directly into rich text content. That let user input bypass the URI scheme check meant to block dangerous…
Second theme: documentation drift in Active Record. Contributor 55728 landed two fixes today. PR 58538 corrects the documented return type for average calculations — the docs claimed Float, but integer and decimal columns actually return BigDecimal. PR 58539 fixes a Store dirty-tracking example that showed output as…
One more fix worth noting: PR 58545 from kamipo. MySQL's `fetch_indexes` was opening a database connection even when asked for an empty list of tables, because it read the database version too eagerly. It now returns early, matching SQLite's behavior, and fixes a flaky CI test that depended on connection state.
What to remember: sanitize based on structure,…
Nearby episodes from Rails Daily
- Query Internals and a Markdown Security Fix
- Weekly Recap - Ractor Safety and Query Correctness
- Documentation Cleanup and Lazy Loading Fixes
- Cleaning Up After Recent Regressions
- Ractor Safety Push and Test Determinism Cleanup
- Ractors Push Rails Toward Frozen State
- Correctness Fixes and Ractor Readiness
- Data Integrity Fixes Across the Association Layer