🚨 Is your Ruby patched for the four Regexp CVEs?

Happy Wednesday, John!

Here is issue #170 of our newsletter, bringing you news and the best tools for your current or future Rails projects…

1. 🎨 Stuck on Bootstrap 4 in a big Rails app? Rishi shows how to run Bootstrap 4 and 5 side by side with npm aliases and pick the version per controller with a layout, so the migration ships as small pull requests instead of one big one. Read on for the helper that keeps shared partials working under both versions, which controllers to migrate first, and the cleanup pull request at the end.

2. 🤖 Is your AI agent safe to retry? Running an agent's loop in a Sidekiq job is not as simple as it may appear: when the job fails, Sidekiq retries the whole loop, and the model can write a different draft the second time. Mateus shows how to make a ticket-triage agent's side effects idempotent against Sidekiq retries by treating the ticket's own fields as the record of what already ran, and how to stream its progress to the user with Turbo Streams. Read on to see when these guards earn their keep and when you can skip them.

3. 🚨 Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp bugs behind four GitLab CVEs. GitLab found that crafted patterns could corrupt memory while Ruby compiles them and lead to remote code execution on its servers. Ruby says any app compiling regexps from attacker-controlled strings is affected, Regexp.timeout is no protection, and length limits aren't reliable either. Read the Ruby announcement for the patched versions in each series and the fix behind each CVE.

4. ⏱️ How fast can you actually patch Ruby? Dennis Paagman timed how long Ruby 4.0.9 took to reach version managers, containers and hosting platforms after release. The Ruby core team's rubylang/ruby image took 8 minutes, but the Docker community image that the Rails-generated Dockerfile uses took almost 16 hours. See his timings and how to patch faster, including automating dependency updates.

5. 🔐 Rails tightened three things last week: Marshal, a secret file, and redirects. config.load_defaults 8.2 stops the Marshal fallback for signed messages, tmp/local_secret.txt is now written as 0600, and /%{path} redirects no longer turn /old/%2Finjected.example into //injected.example. Open Emmanuel Hayford's weekly Rails roundup for config.zjit, native RENAME COLUMN on SQLite, and the new MySQL 5.7.9 minimum.

6. 🧩 Which part of your Rails 8 stack really needs Sidekiq, Redis or AnyCable? Wilbert Ribeiro compares Solid Queue, Solid Cache and Solid Cable with Sidekiq, Redis and AnyCable (latest versions as of October 2026) and recommends keeping the Solid defaults for new apps on one or a few servers, swapping a component only when measured numbers demand it. Coming from Sidekiq's 25 retries over roughly three weeks? Add retry_on to ApplicationJob, since Solid Queue doesn't retry automatically. See his decision table, component by component.

Check out our other articles on: Ruby | Rails | Compatibility | Upgrades | Tech
Debt | AI

Bookmark, share, or save them for later. We hope these links are helpful. 😉

Best,

The FastRuby.io Team