Ruby on Rails: Boot Failures and a Stored XSS Fix
Active Storage's image processing stack got two same-day patches to stop applications from crashing at boot, while Action Text closed a stored cross-site scripting hole in its markdown conversion — both signs of fast follow-up work landing quickly after root causes were found.
Duration: PT2M46S
Episode overview
This episode is a short developer briefing from Ruby on Rails.
It explains recent repository work in plain language.
- Show: Ruby on Rails
- Published: 2026-09-13T13:09:44Z
- Audio duration: PT2M46S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning. It's September 13th, 2026, and this is your Ruby on Rails briefing.
The clearest pattern today: boot-time reliability in Active Storage's image variant processing, fixed twice in one day by Mike Dalessio.
PR 58734 addressed applications crashing at startup when ruby-vips was installed but too old, or libvips itself was too old — even for apps using Mini Magick instead of Vips. The fix keeps the security guard loading for every processor, but only raises errors where Vips is actually used. Hours later, PR 58743 caught…
Second theme: cleanup after a merge that broke main. PR 58261 restored a "silenced" check to Action View's render subscriber, but its branch was stale and reintroduced an old way of stubbing Rails root. That broke the test suite with a NameError. Mike Dalessio's follow-up, PR 58753, dropped the outdated stub. Worth…
On security: PR 58754 closed a stored cross-site scripting gap in Action Text's markdown conversion. Code and pre blocks were trusted not to break their own delimiters, but blank-line handling in Trix let an attacker's link syntax escape that boundary in seven different ways. All are now escaped properly.
Smaller but notable: PR 58555 fixes…
Nearby episodes from Ruby on Rails
- Ractors, Vips, and the Performance Push
- Getting Serious About Ractor Safety
- Multi-Database Correctness and Quiet Data Bugs
- Performance Fixes and Real-World Bug Reports
- Dependency Cleanup and Cross-Platform Fixes
- Performance Cleanup and Release Damage Control
- Weekly Recap - Getting Rails Ready for Ractors
- Docker Boot Fix and a Documentation Overhaul