mailwal

We’re going to Portland! RubyConf 2027 is official

Ruby Central

Ruby Central

README

Your monthly digest of Ruby Central updates, community highlights, and Ruby ecosystem news.

Ruby Central

October 2026 Edition

01 · From Ruby Central

Organization updates, program changes, announcements

RubyConf 2027: It's official!

May 24–26 · Portland, Oregon

If you've been following our socials, you may have caught the hints we've been dropping about where and when. We hope you had fun playing along! Now for the big reveal:

RubyConf 2027 is coming to Portland, Oregon, May 24–26 at the Hilton Portland Downtown. Mark your calendars!

Over the coming weeks, we'll share updates on our blog, on social media, and soon on a refreshed rubyconf.org. Keep an eye out for news about the program committee, program and themes, the CFP launch, registration (early-bird and general admission), and other ways to get involved.

Why we took our time

Before planning this year's event, Ruby Central stepped back to ask some big questions. What is our purpose? How do our events bring people together and support them? What makes sense in today's climate?

In-person events are getting harder to attend. We are seeing this across ecosystems and industries, both. Travel is more difficult, funding for conferences and professional development is harder to secure, and finding time to attend is a real challenge for many people.

We individually feel these stressors too. Our events have never been about profit, and anything left over goes straight into the next event. As costs rise and sponsorships get harder to land, we needed time to plan with mindfulness at the forefront. RubyConf 2027 is designed to scale and grow with support. As we reach milestones, we'll add the extras that make the event feel special. We want RubyConf to stick around, but never at the expense of Ruby Central's other programs.

What RubyConf is about

At its core, RubyConf's purpose remains a place where Ruby's past, present, and future can gather; a connection between generations. We look towards our roots of what made us love Ruby and prepare for what is next by sharing our wealth of knowledge, experiences, and expertise in our respective fields. RubyConf remains as a space where Ruby is more than just the language, it is a community of people who build with the language, lead with it, and care about its future. That's why we keep hosting RubyConf, and it's where we believe we shine.

What to expect

RubyConf kicks off with an optional Community Day on May 24, included with your ticket at no extra cost. May 25 and 26 bring talks, keynotes, and more conference programming. Full program details are coming soon.

Thank you for sticking with us and being part of this process. There's a lot of work ahead, and we can't wait to see you in Portland next May. Let's bring the weird to PDX!

~ Ally

02 · Ruby News Roundup

A curated snapshot of major Ruby ecosystem news.

Patch This First

▸
Regex security fixes in Ruby 4.0.9, 3.4.12, and 3.3.13. GitLab found bugs in Onigmo, Ruby's regex engine, that could allow remote code execution on its servers (CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264). Apps are only exposed if they build regexps from untrusted input, through Regexp.new, Regexp.union, or interpolation into a regex literal. Regexp.timeout does not protect against these bugs, and limiting pattern length doesn't reliably help either. Upgrade, or stop building patterns from user input. (advisory)
▸
The Active Storage flaw from our August issue is now being actively exploited. It's CVE-2026-66066, nicknamed "KindaRails2Shell." If you haven't upgraded yet, do it now. VulnCheck warns that patching may not be enough if secrets leaked first. If an affected app was exposed before you patched it, you should probably rotate your secrets. (SecurityWeek)
▸
Rails 7.2.4 was the last 7.2 release, and Rails 8.0 security support ends November 7. After that, only 8.1 gets security fixes, through October 10, 2027. (7.2.4 announcement · maintenance policy)
▸
Also patch Dalli and rubyzip. In Dalli before 5.2.2, a namespaced client that retried after a network error could read or overwrite another key's value; fixes were also backported to 5.1.4, 5.0.10, and 4.3.7. Rubyzip before 3.4.0 has a path traversal bug (CVE-2026-85396).

Ruby and Rails

▸
Ruby 4.1.0-preview1 is out. Highlights:
  • Garbage collector per Ractor
  • YJIT on Windows
  • A new allocator, plus faster startup
▸
ZJIT has caught up to YJIT. Shopify runs it on part of its storefront in production. There, response times match or slightly beat YJIT, and it uses about 20% less JIT memory.
▸
Ractors are coming to Rails. Automatic spelling correction thinks that they should be tractors, and not ractors, but maybe that's just because they can get so much work done? Edouard Chin at Shopify reports nearly 7x memory savings using kino, a ractor-compatible web server, compared with Puma on a real world app.
▸
Rails 8.2 is taking shape on main:
  • New apps compile HTML+ERB templates with Herb by default.
  • Lexxy 1.0, the editor Basecamp uses, can replace Trix in Action Text and adds tables and Markdown shortcuts.
  • New apps no longer fall back to Marshal for signed messages.
  • Enum predicates are about 4.5x faster under YJIT.
  • The minimum Ruby version moves to 3.3.5.

Gems and Tools

▸
RubyGems.org now shows security warnings. Each gem version page lists known advisories from OSV, refreshed hourly. Versions flagged by the OpenSSF Malicious Packages project are labeled as malware.
▸
RubyGems and Bundler 4.1 are in beta. Changes:
  • The dependency resolver switches from Molinillo to PubGrub.
  • Gems become content-addressable.
  • Gem signing adds a post-quantum option (ML-DSA)
  • --cooldown comes to gem install, gem update, and gem outdated.
Try it with gem update --system --pre.

Worth Reading

▸
The 2026 Rails Community Survey from Planet Argon drew nearly 1800 developers from 80 countries. A few interesting tidbits from it include Kamal use jumping from 2.4% in 2024 to 24% now, mise (38%) has nearly caught rbenv (39%) as a version manager, 41% of developers are using agentic coding workflows, and 51% feel anxious about the long-term value of their skills, yet 78% would still tell a new developer to learn Rails.

03 · Community Spotlights

Celebrating the people who make our ecosystem thrive.

Berlin.rb's organizers

Berlin got a new monthly Ruby meetup in September. Berlin.rb meets on the second Tuesday of each month, is free, and moves between venues across the city. It livestreams and posts its talks, and it welcomes first-time speakers alongside deep technical talks. Carmine Paolino of RubyLLM is one of the organizers. The group describes itself as a complement to the long-running RUG::B, not a replacement. Its first night, September 8, included the first public talk on RubyLLM 2.0. (announcement)

KJ Loving: from Scholar to speaker

KJ had no programming experience before learning Ruby through Code the Dream and The Odin Project curriculum, and attended RubyConf 2026 as a Ruby Central Scholar. Next month KJ will speak at Helvetic Ruby in Zurich, with a talk called "Mirrors Don't Have Opinions." That's the path the Scholars & Guides program exists to open up. (Scholar profile · Helvetic Ruby talks)

New committers: Kevin Menard and Mike Dalessio

Kevin Menard became a CRuby core committer in September. He has been part of the Ruby community since 2008, spent years on TruffleRuby, and wrote ZJIT's method inliner, which we covered in August. On the Rails side, Mike Dalessio, longtime Nokogiri maintainer, joined Rails Core this year and shipped Hot Cell 1.0 in October. Congratulations to both. (Kevin's nomination · Rails Core team)

Know someone who belongs here? Send us a name.

04 · Support Ruby Central

Thank You to Our Newest Supporters

NaCl (Network Applied Communication Laboratory Ltd.) logo
Def Method logo

We're thrilled to welcome two new supporters to the Ruby Central community. Thank you to NaCl (Network Applied Communication Laboratory Ltd.), our very first supporter from Japan through the Ruby Association's new RubyGems.org Supporters Program. And thank you to Def Method, a new RubyGems Supporter. Your generosity helps keep RubyGems.org fast, secure, and reliable for Rubyists everywhere.

Help sustain and grow the Ruby ecosystem.

RubyGems.org powers millions of applications, and keeping it fast, secure, and reliable takes real, ongoing investment. That work, along with RubyConf, our Scholars and Guides mentorship program, and the day-to-day of running the organization, is what your support funds.

Looking ahead, we're hoping to grow into more: regional meetup grants, expanded mentorship, and new ways to support Rubyists wherever they are. None of it happens without you.

Ways to Support:

→
Become an Individual Member, Community Supporter, or RubyGems Supporter → Sign up
→
Make a one-time donation → Donate
→
Based in Japan? Join through the Ruby Association → Learn more

Your support directly funds community programs, grants, conferences, and the open-source work that keeps Ruby thriving.

05 · Quick Links & Upcoming Dates

Deadlines

▸
November 7: Rails 8.0 security support ends. Plan your move to 8.1. (maintenance policy)
▸
December 1, 23:59 UTC: the Ruby devroom at FOSDEM 2027 stops taking proposals. This is the first Ruby devroom since 2024, so let's make it a good one! Submit your talk proposals! (CfP)
▸
December 1, 23:59 UTC: the Package Management devroom at FOSDEM 2027 stops taking proposals. If you work on RubyGems, Bundler, or registry tooling, this room wants talks on dependency resolution, signing, reproducibility, and supply chain attacks, and it is especially looking for topics that don't get discussed much. (CfP)

On the Calendar

November

10–12

San Francisco Ruby Conference, SFJAZZ Center, San Francisco, CA, USA

19–20

Helvetic Ruby, Zurich, Switzerland

21

RubyConf India, Hyderabad, India

December

3–4

RubyWorld Conference, Matsue, Shimane, Japan

25

Ruby 4.1 expected, by tradition

Ruby Central

Ruby Central is a nonprofit dedicated to supporting the Ruby language and community through conferences, open-source work, grants, education, and community programs.

Want to support Ruby Central at a grassroots level? Become a member today.

Twitter/X Mastodon LinkedIn Bluesky

Contact: [email protected]