Rubyland

news, opinion, tutorials, about ruby, aggregated
Sources About
Ruby on Rails 

A class method to introspect delegated types, schema_dump configuration via DATABASE_URL, etc

As the morning sun casts its gentle glow, I find myself aboard a train bound for Szklarska Poręba. I’m literally on Rails! I thought, what better setting to share the latest updates on Rails than while traversing these literal rails?

Define a class method to introspect valid delegatable types This PR introduces a <role>_types class method within ActiveRecord::DelegatedType to enable introspection of delegated types.

Make schema_dump, query_cache, replica & database_tasks configurable via DATABASE_URL Enable configurability for schema_dump, query_cache, replica, and database_tasks via DATABASE_URL. Previously, this functionality faced limitations due to boolean values being incorrectly…

Fi…

Glauco Custódio 

Migrating From Dokku to Kamal: Setting up the Servers

This is the second post of the series "Migrating From Dokku to Kamal" and today I am gonna show you how I've set up my servers with Kamal, click here to read the first post of the series in case you've missed it.

The author assumes you've a basic understanding of how Kamal works, you can familiarize yourself by checking the official documentation.

Below you can find part of my final deploy.yml:

servers:
  web:
    hosts:
      - <%= ENV['KAMAL_WEB_IP'] %>
    labels:
      traefik.http.routers.domain.rule: Host(`*.domain.com`)
      traefik.http.routers.domain.entrypoints: websecure
      traefik.http.routers.domain.tls.certresolver: letsencrypt

  worker:
    hosts:
      - <%=…
Write Software, Well 

Learn to Program Ruby with Me

Learn to Program Ruby with Me

Ever since I started writing on this blog, I've been getting questions from people who aren't programmers – like product managers, sales reps, and people from other domains – questions about how they can learn programming and break into the software industry.

So far, I've been pointing them to an article I wrote last year, that lists all the Ruby and Rails books I found really helpful. It also gives a step-by-step path they can follow to learn enough before moving to the next step.

A List of Books to Learn Programming with Ruby and Rails
This post provides a curated list of books to learn to code in Ruby and build web applications with Rails. It also gives a step-by-step path you can follow to…
BigBinary Blog 

How we added sleep when idle feature to neetoDeploy and reduced cost

We are building neetoDeploy, a compellingHeroku alternative. Stay updated by following neetoDeploy onTwitter and reading ourblog.

What is sleep when idle feature

"Sleep when idle" is a feature of neetoDeploy which puts the deployedapplication to sleep when there is no hit to the server for 5 minutes. Thishelps reduce the cost of the server.

"Sleep when idle" feature can be enabled not only for the pull request reviewapplications but for staging and production applications too. Many folks buildapplications to learn and for hobby. In such cases there is no point in runningthe server when the server is not likely to get any traffic. Since neetoDeploybilling is based on the usage "Sleep when idle"…

The RubyMine Blog : Intelligent Ruby and Rails IDE | The JetBrains Blog 

RubyMine 2024.1 Early Access Program is Open!

The RubyMine 2024.1 Early Access Program has now started! In this blog post, we’ll share our plans for the upcoming release and the areas we’re currently focusing on.

The first EAP build includes performance and usability improvements, bug fixes, and updates to RBS language support.Now, you can quickly leave your feedback and tell us about your experience with RubyMine by clicking the Share Feedback button in the IDE’s status bar. Share your thoughts in the Feedback form to let us know your preferences and suggestions for improvement.

The Feedback form in the Ruby IDE

What’s coming in RubyMine 2024.1?

In this release cycle, we’ll build on our previous work in the 2023.3 release, while also introducing some…

Island94.org 

Two stories about technical debt, I guess

One activity I don’t enjoy very much: griping about “technical debt”; that label just never seems descriptive enough. And the things people gripe about seem to mostly fall into:

  • Deferred maintenance: we haven’t updated to the latest version of X, or it’s written in A language/framework but now everyone is much more familiar with B, or we know M raises an exception at N when they O while P
  • Just not the quality we expect, because reasons. It’s ok, we’re all winging it.

…and those categories crowds out the real sweaty palms stuff, the “we did do a good job but we know more now” that I think is the real deal. I can talk about that.

I’ve never found the particular post/video/talk? again…

Awesome Ruby Newsletter 

💎 Issue 400 - Ruby (3.3) on Rails (1.0)

RubyGems Blog 

3.5.5 Released

RubyGems 3.5.5 includes enhancements, bug fixes and documentation.

To update to the latest RubyGems you can run:

gem update --system

To install RubyGems by hand see the Download RubyGems page.

## Enhancements:

  • Installs bundler 2.5.5 as a default gem.

## Bug fixes:

  • Fix require activation conflicts when requiring default gems under some situations. Pull request #7379 by deivid-rodriguez
  • Use cache_home instead of data_home in default_spec_cache_dir. Pull request #7331 by mrkn

## Documentation:

  • Use squiggly heredocs in Gem::Specification#description documentation, so it doesn’t add leading whitespace. Pull request #7373 by bravehager

SHA256 Checksums:

  • rubygems-3.5.5…
Evil Martians 

5 cool (and surprising) ways to configure Lefthook for automation joy

Authors: Valentin Kiselev, Backend Engineer, and Travis Turner, Tech EditorTopics: Tools, Full Cycle Software Development, Backend Development, Performance Audit and Optimization, Go, Ruby, JavaScript, Git

At first, Lefthook was just a wrapper for calling custom scripts on Git hooks, but it has evolved into a tool that provides a clean and flexible way to automate your development routine, both in obvious and quite surprising ways. Read and see real project examples.

Lefthook has been under active development for more than 4 years. While at first it was just a wrapper for calling custom scripts on Git hooks, as time has gone on, Lefthook has evolved into a tool that provides a clean and…

Gusto Engineering - Medium 

From Interns to Engineers: Class of 2023’s Transition to Full-Time Roles at Gusto

Co-authored by Bryce Tsuyuki, Christine Lee, Dean Wahle, Jessica Fan, and Joey He

Gusto interns gathered together and smiling in the SF office.

Hello! Welcome to our 2-part blog where we’re excited to share our reflections as former interns at Gusto. Part 1 of the series will feature Jessica and Joey who interned at the San Francisco office. In Part 2, you’ll hear from Bryce, Christine, and Dean who interned at the San Francisco and Denver offices. Read more to learn about their intern experiences, professional development, and what it means to build with Gusto.

Why Gusto? A Personal Journey Back to Familiar Grounds

Joey’s Reflections

Gusto provides engineers with many opportunities to grow.…

Rails at Scale 

Shopify at RubyConf 2023

Shopify continues investing in Ruby and Rails to help ensure that they are 100-year tools. Moving them forward and bringing the community with us are a large part of that work, and participating in community events like RubyConf is an important part of that.
Glauco Custódio 

Migrating From Dokku to Kamal: Provisioning with Terraform

I have a 2 GB Memory, 1 vCPU, 50 GB Disk VPS on Digital Ocean which cost me 12 USD per month. Comparing the prices with Hetzner I noticed I could have 3x 4 GB, 2 vCPU Arm64, 40 GB Disk for 13.53 EUR per month. That's a lot more power for almost the same price.

The droplet is running a Rails application with Dokku. I really enjoyed my time with Dokku, it makes our lives so much easier when setting up a VPS from scratch. The major downside of Dokku is the lack of support to multi-host though.

After the introduction of Kamal I thought in giving it a try, but this time using Hetzner instead of Digital Ocean.

Provisioning Resources on Hetzner with Terraform

Since I would be…

RubySec 

CVE-2024-22411 (avo): Cross-site scripting (XSS) in Action messages on Avo

Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12 any HTML inside text that is passed to `error` or `succeed` in an `Avo::BaseAction` subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A malicious user could exploit this vulnerability to trigger a cross site scripting attack on an unsuspecting user. This issue has been addressed in the 3.0.2 release of Avo. Users are advised to upgrade.
Ruby Weekly 

All aboard the Rails 1.0 train

#​686 — January 18, 2024

Read on the Web

Ruby Weekly

Ruby (3.3) on Rails (1.0) — Rails 1.0 was released about eighteen years ago (I know!) – just a day after Ruby 1.8.4. Things have changed a bit since then [citation needed], but surely a modern Ruby could still run Rails 1.0? Sort of..! (It’s funny to see bundler being used, though, as it didn’t even exist at the time, and even RubyGems itself wasn’t a default part of Ruby 1.8!)

Vasiliy Ermolovich

Stuck on a Tough Ruby Challenge? Shift’s Got Your Back — Need a hand with writing cleaner code, improving your tests or solving those tricky Ruby issues? At…

Ruby Rogues 

Powering Rails Applications with Postgres - RUBY 621

Andrew Atkinson is a software engineer, PostgreSQL specialist, and author. They delve deep into the world of database management and development. They engage in an insightful discussion covering various aspects of Postgres and Ruby on Rails. They explore topics such as database scalability, cache management, and data partitioning strategies, providing valuable insights for developers looking to optimize their applications. Join them as they uncover the latest trends and best practices in the world of database development.


Sponsors


Links


Socials

Notes to self 

Reading Kamal configuration

If you configured your config/deploy.yml file for Kamal, you might thought about working with this very configuration outside Kamal. Here’s how.

Kamal config

Reading Kamal’s configuration from Ruby is pretty straight-forward. We just initialize Kamal::Configuration object from a passed config file:

config_file = Pathname.new(File.expand_path("config/deploy.yml"))
config = Kamal::Configuration.create_from(config_file: config_file)

puts config.inspect

Now we can access the whole YAML configuration as Kamal sees it:

> config.image
=> "strzibnyj/template"
> config.service
=> "template"

Registry

Registry is a Hash of username and password as you would expect:

> config.registry
=> {"us…
Ruby News 

Ruby 3.2.3 Released

Ruby 3.2.3 has been released.

This release includes many bug-fixes. See the GitHub releases for further details.

This release also includes the update of uri.gem to 0.12.2 which contains the security fix. Please check the topics below for details.

Download

RubySec 

CVE-2024-22191 (avo): avo vulnerable to stored cross-site scripting (XSS) in key_value field

### Summary A **stored cross-site scripting (XSS)** vulnerability was found in the **key_value** field of Avo v3.2.3. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim's browser. ### Details The value of the key_value is inserted directly into the HTML code. In the current version of Avo (possibly also older versions), the value is not properly sanitized before it is inserted into the HTML code. This vulnerability can be exploited by an attacker to inject malicious JavaScript code into the key_value field. When a victim views the page containing the malicious code, the code will be executed in their browser. In…
Giant Robots Smashing Into Other Giant Robots 

Upcoming Ruby and Rails Conferences in 2024

We’ve always found the Ruby community to be one of the most welcoming, diverse, brilliant and newcomer friendly groups around. Any chance to meet new #rubyfriends (it’s a thing), learn about new developments in the ecosystem and grow our skills as rubyists is one we won’t pass up.

Ruby Central puts on the two large tentpole events of the discerning rubyist’s social calendar: RailsConf and RubyConf, will be held this year in Detroit and Chicago respectively. You’ll usually be able to say hello to a thoughtbotter or two there, but 2024 is exciting because so many regional conferences are reappearing after a bit of global hibernation. (thanks, 2020)

Regional conferences can usually be more…

Greg Molnar 

Penetration testing for PCI DSS compliance

Penetration testing for PCI DSS compliance

Hire me for a penetration test

Let's find the security holes before the bad guys do.

First of all, let’s cover what PCI DSS is. PCI DSS stands for Payment Card Industry Data Security Standard. Think of it as a set of rules that companies need to follow when they handle your credit card information. It’s like a playbook for keeping this sensitive data safe from cyber criminals.
These rules were created by the major credit card companies, and they’re pretty serious about making sure businesses stick to them. Whether it’s a small café swiping your card for a…

Shopify Engineering - Shopify Engineering 

Horizontally scaling the Rails backend of Shop app with Vitess

Shop app horizontally scaled a Ruby on Rails app with Vitess. This blog describes Vitess and our detailed approach for introducing Vitess to a Rails app.

More

Ruby Central 

State of the Ruby Gems

We’re proud to say RubyGems.org’s uptime has been uninterrupted for over 8 and a half years since Ruby Together, and then Ruby Central, began funding maintenance on RubyGems. With 147,326,326,048 total gem downloads, 181,745 users, and an average of 2 billion requests per weekday as of October 2023, this has been no easy feat. Security Lead on RubyGems and Ruby Central’s AWS Security Engineer in Residence Samuel Giddins gave a talk at RubyConf 2023 outlining the history of the vital gem hosting service used by Rubyists every day, and all that it has taken to “keep the lights on” at RubyGems.org, then and now. 

This graph shows the total bytes served from the Rails app each day (through…
Honeybadger Developer Blog (Ruby Articles) 

Composite primary keys in Rails

Primary keys are vital in the design of a relational database. They are crucial in uniquely identifying records.

For example, if you have a table of users, you will need to identify each record uniquely. This is where primary keys are used. Primary keys are usually single columns that auto-increment. There might be cases where you'll need a combination of column to serve as the primary key - this is where composite primary keys become helpful. This article will explore composite primary keys, how they work in Rails, when they should be used, and what to consider when using them.

Explanation of primary keys

Primary keys help ensure that records are uniquely identifiable. This ensures data…

Felipe Vogel 

Job networking for developers

tl;dr I learned some job networking. Thanks to my handy dandy list of tips below, you can too!

For the past few months I’ve been back on the job hunt, after two years in a wonderful first developer job. I wanted to stay longer, but a…

RubyGems Blog 

December 2023 RubyGems Updates

Welcome to the RubyGems monthly update! As part of our efforts at Ruby Central, we publish a recap of the work that we’ve done the previous month. Read on to find out what updates were made to RubyGems and RubyGems.org in December.

RubyGems News

In December, we released the following version of RubyGems 3.5.0, 3.5.1, 3.5.2, 3.5.3 and Bundler 2.5.0, 2.5.1, 2.5.2, 2.5.3. These updates mark significant milestones in our continuous effort to enhance the Rubygems development experience.

With the yearly minor version release of RubyGems 3.5 and Bundler 2.5, we have dropped support for Ruby versions less than 3.0.0. This enables the usage of more modern features of the Ruby language; improving…

Saeloun Blog 

Rubygems introduced a file option to specify Ruby version in Gemfile

We add ruby version in the Gemfile or in the .ruby-version files. This ensures that the application runs on the correct version of Ruby.

In case of version mismatch bundler throws an error.

Your Ruby version is 3.1.0, but your Gemfile specified 3.2.2

Before

We needed to add the ruby version in the Gemfile so the bundler uses correct ruby version or warns if incorrect ruby version is in use.

.ruby-version file is used by tools like rvm or rbenv to switch the ruby version.

Gemfile

source 'https://rubygems.org'

ruby 3.2.2

.ruby-version

3.2.2

The problem with this approach is that we have to update the version in both the files.

After

Rubygems introduced a :file option that can…

N…

The Ruby on Rails Podcast 

Episode 503: Katya Dreyer-Oren on Ethical Software Development

What do we owe to each other? Over the last several years, the tech industry has had a reckoning about ethics within our industry. Katya Dreyer-Oren gave a excellent talk and workshop at RubyConf in San Diego about how to ethically build software. She joined the show to share her thoughts and ideas from her experience as a student of philosophy.

We’re starting something new on the podcast. We’d love to hear from you! If you have comments about this episode, send an email to comments@therubyonrailspodcast.com. You can send text or record a comment using Voice Memos or Google Recorder on your phone and we’ll respond to some of them in a future show. 

Show Notes
Talk from RubyConf…

Ruby Magic by AppSignal 

Speed Up Your Ruby on Rails Application with LiteCache

In this series, we have looked at the "musts" (databases) and "shoulds" (asynchronous jobs, websockets) of a web application. Now we turn to one of the "coulds" (that is nonetheless recommended for scaling businesses): caching. In particular, we mean caching HTML fragments and other snippets of data, as referred to in Rails Guides. We are not concerned with HTTP or SQL query caching.

In this part, we'll see how to speed up our Rails app using LiteCache. But first, we'll touch on Russian doll caching and how it comes in handy.

Russian Doll Caching in Ruby on Rails

At first glance, it might seem counterintuitive to employ the same technology for the main database as well as the cache. After…

All about coding 

First commits in a Ruby on Rails app

I had the idea for this project (Ruby and Ruby on Rails courses over email) three months ago and created the Ruby on Rails repo around that time.

I was unsure what form the product would have, so I focused first on setting up coding styles, static analysis checks, and some other defaults that I consider essential when starting a project.

In this article, I will explore what I added and why I chose that specific tool, talking specifically from the perspective of a single-person side project.

What I wanted to achieve with my first commits

There is a kind of inertia to the code design: new code tends to be similar to existing code.

Here is a better quote from Edmond Lau book called The Effective…

Notes to self 

Business Class 1.4 with SEO-optimized blogging

Business Class is developing at a rapid speed. The 1.4 version brings Framer-inspired blogging.

SEO-optimized blogging

The major addition for this release is a built-in blog. Everybody and my grandpa could use a blog when starting a business, but which one to choose? WordPress or Ghost? Wouldn’t it be expensive? How do I connect the DNS records? Managing access to two applications for your admins?

Sounds tedious – because it is. But not anymore.

Business Class now gives you a blog for free. A small blog like the one in Framer of Hey, but yours, connected with your application and entirely free. No more extra setup or costs!

blog

These blogs come preconfigured for SEO. From slugs, title…

Ruby on Rails 

Rails 7.1.3 has been released!

Hi everyone,

I am happy to announce that Rails 7.1.3 has been released.

CHANGES since 7.1.2

To see a summary of changes, please read the release on GitHub:

7.1.3 CHANGELOG

To view the changes for each gem, please read the changelogs on GitHub:

Full listing

To see the full list of changes, check out all the commits on GitHub.

SHA-256

If you’d like to verify that your gem is the same as…

Island94.org 

The answer is in your heap: debugging a big memory increase in Ruby on Rails

I recently participated in an interesting series of debugging sessions tracking down the source of a large increase in memory when upgrading a Rails application. We ultimately tracked down the cause using John Hawthorn’s Sheap heap analyzer and successfully submitted a patch to Rails. I thought it was interesting enough to write up because maybe the general approach to debugging memory issues would be helpful (and this is the kind of stuff that I very quickly forget unless I write it down).

How it started: Reddit

Lots of people ask for help on r/rails, and it can be difficult to debug at a distance. This time it was a little different. I recognized the username’s owner, Jonathan Rochkind,…

GoRails Screencasts 

Send Notifications in Rails with Noticed gem v2

Notifications in Rails applications are even easier now with the new release of Noticed gem v2. We'll explore how to add notifications to your Rails app in just a few minutes.
Jardo.dev: Blog 

A Printable Diagonal TwixT Board

I really like this board game from the 1960s called TwixT. I’ve never played the physical board game, but my friend and I used to play it on pen and paper more than a decade ago. I’ve only had the opportunity to play it a couple of times since then.

The rules (for the pen and paper version) are relatively simple. The game is played by two players. The only equipment needed is a printed board and two differently coloured writing implements, like a blue and a red pen.

Each player’s goal is make a continuous line between opposite sides of the board. Players take alternating turns claiming a point on the grid by colouring it in. They can then optionally connect that point to any other of…

Saeloun Blog 

Rails 7.1 Adds path_params Option For url_for Helper Method

In Rails, the url_for helper method is used to generate URLs with given set of parameters for different actions within our application.

# Generating a URL for a specific controller action

url_for(controller: 'posts', action: 'show', id: 1)

# Output: "/posts/1"
# Generating a URL with named routes

url_for(controller: 'posts', action: 'index')

# Output: "/posts"
# Generating a URL with additional parameters

url_for(controller: 'posts', action: 'index', page: 2)

# Output: "/posts?page=2"
# routes.rb
Rails.application.routes.draw do
  get 'posts/:id', to: 'posts#show', as: 'post'
end
# Generating a URL using a named route

url_for(post_path(1))

# Output: "/posts/1"
# Generating a…
The Bike Shed 

412: Vertical Slices

Joël shares a unique, time-specific bug he encountered, which causes a page to crash only in January. This bug has been fixed in previous years, only to reemerge due to subsequent changes. Stephanie talks about her efforts to bring more structure to her work-from-home environment. She describes how setting up a bird feeder near her desk and keeping chocolates at her desk serve as incentives to work more from her desk.

Together, Stephanie and Joël take a deep dive into the challenges of breaking down software development tasks into smaller, more manageable chunks. They explore the concept of 'vertical slice' development, where features are implemented in thin, fully functional…

BigBinary Blog 

Rails 7.1 allows subscribing to Active Record transaction events for instrumentation

The Active Support instrumentation API provides us with hooks which allows us tochoose to be notified when certain events occur inside our application. Railsprovides a set of built-in events that we can subscribe to.Hereis the list of framework hooks.

One of the recent additions to this is the transaction.active_record eventthat is triggered when Active Record managed transactions occur. This isparticularly useful if you want to build a monitoring system like NewRelic whereyou need to track and analyze database transactions for performance monitoringand optimization purposes.

The event payload contains the connection, outcome and the timing details. Theconnection helps us identify the…

Test Double 

Stop overthinking video calls for remote work

Many people now work remotely — whether or not they were prepared or trained for that.

Some people on your team might love that, appreciating the calm of fewer distractions at home. Others miss working in an office where you can casually bump into people. Some still feel uncomfortable with having themselves or their home visible on video conference calls.

As we continue to establish and refine our “new normal” in a remote working era, it’s important to continually and intentionally reflect on how to improve collaboration with your team while working remotely.

At Test Double, we’ve always worked remotely with both our colleagues and our clients.

So here are some best practices I’ve…

Radan Skorić's personal site 

Should you use Hotwire or a Frontend framework on your next Rails project?

I am writing this for the senior engineer or tech lead that is deciding whether to use Hotwire or a Frontend framework (e.g. React, Vue, Svelte …) for the frontend portion of the next Rails project. If this is you, read on. The key factor You have already gone over the usual list of factors that you consider for every new project no matter what tech stack it is on: the expertise of your team ...
EquiValent 

Inline SVG in Ruby on Rails

SVG image/icon has the benefit that it can be rendered as a part of HTML rendering

<!DOCTYPE html>
<html>
<head>
  <title>SVG can be inline</title>
</head>
<body>
  <h2>Here is a SVG inline 👍</h2>

  <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class="w-6 h-6">
    <path stroke-linecap="round" stroke-linejoin="round" d="M21 12a9 9 0 1 1-18 0 9 9 0 0 1 18 0Z" />
    <path stroke-linecap="round" stroke-linejoin="round" d="M9 9.563C9 9.252 9.252 9 9.563 9h4.874c.311 0 .563.252.563.563v4.874c0 .311-.252.563-.563.563H9.564A.562.562 0 0 1 9 14.437V9.564Z" />
  </svg>

  <p>Solution will save us extra HTTP call </p>


 …
avdi.codes 

Setting Usermeta via the WordPress REST API

So, you need to talk to your WordPress server from some other service. Specifically, you need to look up a user by their email and set some user metadata. You’d think this would be straightforward. You would be wrong.

The examples here are using Ruby Net::HTTP, but that’s not really the important part. The code samples are not complete, and this is not a from-scratch tutorial. A bunch of prior experience with WordPress is assumed.

First, know how to authenticate

You’ll need an application password from the user admin screen. You might be tempted to throw this into an Authorization: Bearer ... header like a sensible person, but jokes on you: that doesn’t work in WordPress. You have…

Short Ruby Newsletter 

Short Ruby News - Edition #74

Discover what's new in Ruby 3.3, merged PRs for Rails 7.1, and plans for Rails 8 and Turbo 8. This edition covers the last two weeks of 2023 and the first week of 2024.
Nithin Bekal 

Long exposure images from videos

Last summer, I was at the Chaudiere Falls in Ottawa. A long exposure photo would have been perfect to capture the turbulent cascades of the falls. Unfortunately, I didn’t have an ND filter with me. Instead, I decided to capture a short video on my phone to see if I could convert its frames into a long exposure.

There’s probably better ways to do this using Photoshop or GIMP, but I wanted to do this using a simple command line script that takes a video and generates an image.

Steps to convert a video to a long exposure image

This will involve three steps:

  1. Extract frames from the video
    • ffmpeg can do this for us
  2. Align the images
    • It was a handheld…
Write Software, Well 

How to Process a Turbo Stream Response in JavaScript using Stimulus

How to Process a Turbo Stream Response in JavaScript using Stimulus

TL;DR: If you want to process (append, replace, etc.) a Turbo Stream response received from a fetch request in JavaScript, simply render the stream HTML with Turbo.renderStreamMessage(html) and let Turbo take care of it, instead of manipulating the DOM yourself.

Here's a simple Stimulus controller showing how it works:

import { Controller } from "@hotwired/stimulus"

// Connects to data-controller="replace"
export default class extends Controller {
  // click->replace#swap
  swap() {
    fetch("/test/replace", {
      method: "POST",
      headers: {
        Accept: "text/vnd.turbo-stream.html"
      }
    })
      .then(r => r.text())
      .then(html => Turbo.renderStreamMessage(html))

   …
code.avi.nyc 

Rails Nested Forms with Turbo Streams

A common UX pattern is to have a form with the ability to add and remove nested records. For example, a form for a blog post might have a section for adding tags. The user can add as many tags as they want, and remove tags they no longer want.

Nested Form Example

For such a common pattern, I always scratch my head a little when I have to implement it. Generally, I end up doing it entirely in JS and make use of some sort of <template> tag. There's even a great Stimulus Component for Nested Forms that works exactly this way.

For whatever reason, I decided to implement the pattern using as little JS as possible, no templates, and rely on Turbo Streams to handle the DOM manipulation. I'm not sure if this is a good…

code.avi.nyc 

Turbo Frame Slide Over

Another common UI pattern is a slide over. This is a modal that slides in from the side of the screen.

Slide Over

It's really easy it turns out to implement this with a Turbo Frame. Let's do it.

Step 1: The Slide Over Turbo Frame

First, we need to create a Turbo Frame that will be the slide over. We'll call it slide-over and we'll put it at the bottom of the post index page.

app/views/posts/index.html.erb

<div class="w-full">  <% if notice.present? %>    <p class="inline-block px-3 py-2 mb-5 font-medium text-green-500 rounded-lg bg-green-50" id="notice"><%= notice %></p>  <% end %>  <div class="flex items-center justify-between">    <h1 class="text-4xl font-bold">Posts</h1>    <%= link_to "New post",…%>

We've basically create a frame or a slot that the eventual slide over will occupy on the dom the second that frame…

Alchemists - Articles 

Git Notes

Cover
Git Notes

Git Notes are great for adding supplementary information to commits, tags, and/or trees. They are also mutable which means they can be added, edited, and deleted as often as you like without altering the original commit, tag, and/or tree.

Unfortunately, Git Notes are not automatically enabled by default. They are not even visible via the various hosting services either. For example, GitHub stopped supporting notes in 2014 for no reason. The other hosting services are no better in this regard. Despite the lack of hosting support, Git Notes are fully supported via the Git Command Line Interface (CLI) which is all that matters.

This article will teach you how to leverage…

Bootrails 

Rails flash messages and UX

Rails flash messages and UX Flash message is a very old notion of Ruby-on-Rails. This article will be focused on the usability of these messages. Flash is a designer vocabulary Flash messages are not specific to Rails. Actually, if you google around “flash messages”, you will show you some web designer examples. Flash messages are these small feedback that the user receives, after an intera...
Everyday Rails 

Using devcontainers in GitHub Actions CI workflows

It's simpler than ever to wire CI pipelines, thanks to devcontainers. Here's how I run Rails test suites these days in GitHub workflows.
Blog 

Ruby (3.3) on Rails (1.0).

Rails 8.0 has recently branched out on Github, and I found myself curious about the feasibility of running Rails 1.0 on the latest Ruby version. While I was pretty sure it wouldn’t work right off the bat, I wondered: how many modifications would be necessary to at least reach the iconic “Welcome aboard! You’re riding the Rails!” screen?

So, let’s dive in. My starting point was this Gemfile:

source "https://rubygems.org"
gem "rails", "1.0.0"

Since I knew that it would be required to make some changes to Rails gems I install it with bundle install --local. This would allow for easier modifications later on. My first attempt was running bundle exec rails --help:

/activesupport-1.2.5/lib/a…
code.avi.nyc 

Turbo Frame Slide Over

Another common UI pattern is a slide over. This is a modal that slides in from the side of the screen.

Slide Over

It's really easy it turns out to implement this with a Turbo Frame. Let's do it.

Step 1: The Slide Over Turbo Frame

First, we need to create a Turbo Frame that will be the slide over. We'll call it slide-over and we'll put it at the bottom of the post index page.

app/views/posts/index.html.erb

<div class="w-full">  <% if notice.present? %>    <p class="inline-block px-3 py-2 mb-5 font-medium text-green-500 rounded-lg bg-green-50" id="notice"><%= notice %></p>  <% end %>  <div class="flex items-center justify-between">    <h1 class="text-4xl font-bold">Posts</h1>    <%= link_to "New post",…%>

We've basically create a frame or a slot that the eventual slide over will occupy on the dom the second that frame…

RubySec 

CVE-2024-0227 (devise-two-factor): Devise-Two-Factor vulnerable to brute force attacks

Devise-Two-Factor does not throttle or otherwise restrict login attempts at the server by default. When combined with the Time-based One Time Password algorithm's (TOTP) inherent entropy limitations, it's possible for an attacker to bypass the 2FA mechanism through brute-force attacks. ### Impact If a user's username and password have already been compromised an attacker would be able to try possible TOTP codes and see if they can hit a lucky collision to log in as that user. The user under attack would not necessarily know that their account has been compromised. ### Patches Devise-Two-Factor has not released any fixes for this vulnerability. This library is open-ended by design and…
Nithin Bekal 

Favorite books of 2023

28 books. 8900 pages. That’s more than I was expecting to read this year. I also just realized that my first favorite books post was written almost exactly 10 years ago!

Fiction

Despite not being much of a graphic novel reader, two of this year’s favorites of mine are graphic novels. Aside from those, this year’s fiction reading was dominated by fantasy novels.

Maus (Art Spiegelman)

This graphic novel tells the story of the author’s father, Vladek, a Jewish survivor of the Holocaust. The story is presented through the lens of conversations that Art has with Vladek in the modern day. Although primarily about Vladek’s experiences in a concentration camp, it also shows the complexity of…

Ruby on Rails 

Updated Puma configuration, Object#with block support, and more!

Hi! Vipul here with the second edition of This Week in Rails for 2024!

This second week continues with a flurry of activity with more than 140+ changes making in.

Lets dive into some of these changes!

Update the default Puma configuration
There was an extensive discussion in this issue about - setting a new default for the Puma thread count, over the last few days. Give it a read to get some insights from different members in community sharing details about latency vs throughput tradeoffs wrt to the number of threads in Puma config. Based on this discussion, the default number of threads in Puma config has now been updated from 5 to 3.

Yield instance to Object#with block
The…

naildrivin5.com - David Bryant Copeland's Website 

Ideas for RailsConf

Andy Croll asked on Mastodon for good/bad/indifferent experiences at previous RailsConfs’ and I wrote him a wall of text in my email client that I instead turned into this blog post.

General Thoughts

I would recommend every Ruby professional—regardless of experience level—attend RailsConf at least once in their career, and I think for less experienced-with-Ruby developers, frequent attendance would be valuable. When I was first starting out with Ruby, these conferences validated a lot of my feelings and impressions about Ruby. They taught me a great deal and gave me a sense of community when I was the only person writing Ruby at a Java shop.

For me, however, “community” is not…

code.avi.nyc 

Rails Nested Forms with Turbo Streams

A common UX pattern is to have a form with the ability to add and remove nested records. For example, a form for a blog post might have a section for adding tags. The user can add as many tags as they want, and remove tags they no longer want.

Nested Form Example

For such a common pattern, I always scratch my head a little when I have to implement it. Generally, I end up doing it entirely in JS and make use of some sort of <template> tag. There's even a great Stimulus Component for Nested Forms that works exactly this way.

For whatever reason, I decided to implement the pattern using as little JS as possible, no templates, and rely on Turbo Streams to handle the DOM manipulation. I'm not sure if this is a good…

Aha! Engineering Blog 

Improving the editing experience in Aha! whiteboards

img { max-height: 400px; margin-left: auto; margin-right: auto; }
by Greg Brown

Our team at Aha! loves using Aha! software. It's not only a great way to build our own lovable product, but it also helps us to find rough edges before customers do and develop empathy for our users.

So when one of our principal engineers, Maeve Revels, wanted to share some insights on our internal data architecture, an Aha! whiteboard was the obvious choice — whiteboards make it straightforward to build out a rich visual presentation and navigate through the frames in sequence. The end result was a whiteboard with thousands of shapes illustrating complex data relationships, including how…

Test Double 

Breaking Change Podcast from Justin Searls

Good news everyone, Justin Searls has a new podcast: It’s called “Breaking Change”.

He’s hosting it from his personal site because it’s his own project. That means the rest of Test Double can’t take credit, but don’t hold us responsible either.

That disclaimer is mostly tongue-in-cheek. Even at episode one it’s already among my favorite podcasts. I’ve known Justin for many years now and I always enjoy hearing his perspective.

The first episode talks a little about Japan, Florida, and entertainment media, and a lot about software and technology. I bet that will end up being representative.

He’s not promising any kind of schedule, but RSS means that we can get new episodes as they…

Awesome Ruby Newsletter 

💎 Issue 399 - Just discovered the !~ operator (the "not match" operator)

Gusto Engineering - Medium 

Unraveling a Spaghetti Model

In many established Ruby on Rails applications, there are often a couple of classes that become entangled with the rest of the code base. These early models start small and simple, possibly present for the first commit, but over time, the rest of the code base becomes entangled with them.

Some call them god objects (omniscient or all-knowing objects) since they reference a large number of other objects and often have unrelated methods. It’s a well-known anti-pattern or code smell [1996 Reference].

In Gusto’s journey to create a modularized monolith, we leverage Packwerk to move domain concepts into packs. For example. we created a payments pack and then moved all the models, controllers,…

Ruby Weekly 

All aboard the train to Rails 8

#​685 — January 11, 2024

Read on the Web

Ruby Weekly

Here's What's Coming in Rails 8 — Rails 7.1 was released only a few months ago, but Rails 8 is expected later this year, packing in even more new features, like the inclusion of Solid Queue and Solid Cache as defaults, a PWA-focus that includes push notification support (it’s DHH’s #1 objective), a default Rubocop setup and, of course, much more.

Harrison Broadbent

Memetria: Secure, Scalable Redis Hosting — High performance Redis hosting with large key tracking, detailed metrics, and a superior uptime record.

Memetria sponsor

Reconfiguring…

Write Software, Well 

The Rails Config File

The Rails Config File

Since I started learning Rails, I must have created dozens and dozens of Rails applications for learning, experiments, and side projects. I had a text file that documented all the gems I wanted to install for a fresh Rails app, along with the common app settings. Every time I created a new project, I used to go through the file to install all the gems I wanted.

I wish somebody had told me about the Rails config file.

With the ~/.railsrc file, you don’t need to do that. Rails will configure your applications for you. This is even more useful if you find yourself using --skip or --no-skip flags and installing specific gems every time you create a new Rails application.

Let's learn how it works.

S…

All about coding 

Finding where a method is defined in Ruby using IRB

After many years in Ruby, I am still fascinated by the flexibility, simplicity, and power of IRB and rails console. Even with IDEs getting better, I like the experience of using IRB or rails console to explore the code.

In this article, I will show how to find the source where a method is defined.

There are three ways to find out where a method is defined in Ruby using IRB:

  • using the source_location defined on the Method object

  • using the IRB show_source command

  • displaying information about an object using ls (for displaying the object but not the source file)

Before we start, here is my IRB configuration:

# .irbrc content# I use the Dracula theme for IRB from…
Saeloun Blog 

ECMAScript - Grouping arrays using Object.groupBy and Map.groupBy

As JavaScript, being one of the most dynamic and widely-used programming languages, constantly evolves to meet the needs of developers.

JavaScript has introducd Object.groupBy and Map.groupBy for grouping data in the latest proposal that has reached stage 4,

Before

Prior to the introduction of Object.groupBy() in JavaScript, array elements were normally grouped using a combination of Array.reduce() and other array manipulation techniques. Here is an example of how we can organize the timesheetEntries array based on the ‘project’ property:

const timesheetEntries = [
  {
    date: '2024-01-08',
    startTime: '09:00 AM',
    endTime: '05:00 PM',
    project: 'Miru',
    description: 'Work…
Evil Martians 

How to cultivate capital: 6 tips from developer tools founders and VCs

Authors: Victoria Melnikova, Head of New Business, and Travis Turner, Tech EditorTopic: Business

A quick guide on the crossroads of bootstrapping and fundraising with experience-backed tips that provides a roadmap to successful fundraising for developer tool founders.

In the complex landscape of startup financing, many founders find themselves at the pivotal crossroad between bootstrapping and fundraising. So, we’ve made a quick guide with handpicked, experience-backed tips (inspired by a number of industry rockstars) which provides a roadmap to successful fundraising for developer tool founders.

Ruby Rogues 

Unveiling Open-Source Ruby Projects - RUBY 620

Pete Matsyburka is a Ruby developer and the mind behind DocuSeal. They delve into the world of Ruby development, with a special focus on different open-source projects. Together, they uncover the journey of creating an open-source document signing tool and the challenges and triumphs of commercializing an open-source project. From parsing HTML tags to handling PDFs, the conversation delves into the technical aspects of the project and also touches on the broader themes of open-source development and the Ruby ecosystem.


Sponsors


Links


Socials




Advertising…
Ruby Magic by AppSignal 

Keep your Ruby Code Maintainable with Draper

Design patterns can help to simplify your codebase so you don't need to reinvent the wheel.

In this post, we'll go into how to use Draper. But first, we will start with an overview of the decorator pattern and how to use it with Ruby's standard library.

Let's get started!

The Decorator Pattern for Ruby

According to Refactoring.Guru:

Decorator is a structural design pattern that lets you attach new behaviors to objects by placing these objects inside special wrapper objects that contain the behaviors.

Decorator can also be called a wrapper. The idea is that you initialize an instance of a decorator class by passing the object you want to decorate to that decorator class initializer.

The…

Test Double 

Welcome new board member Jennifer Haas

I’m excited to announce Test Double has added a fourth member to our board of directors to accelerate our business growth.

Jennifer Haas brings impressive business success as both a CEO and chief revenue officer, as well as prior experience as a board member for both for-profit companies and nonprofit causes.

Why we expanded our board

Since our board was established in 2020, it has primarily consisted of myself, Justin Searls, and Adam Torres, who was our only independent member until now. Last year we developed a strategy to add an additional member as we felt it would help us accomplish a number of objectives:

  • Another independent member would broaden our experience and minimize…
The Ruby on Rails Podcast 

Episode 502: New Years Resolutions with Jemma Issroff

Our cohost Jemma Issroff joined me to talk about my tenure as host so far, Jemma's work on Prism, fostering communities, building habits, how to be lucky, and we reveal our New Year's Resolutions!

What are your New Years Resolutions? If you'd like to share them, send an email to comments@therubyonrailspodcast.com. You can send text or record a short clip with Voice Memos or Recorder and attach it to the email. We'll respond to some of these comments in the future.

Show Notes
2023 New Years Resolutions Episode

Sponsors
Honeybadger

As an Engineering Manager or an engineer, too much of your time gets sucked up with downtime issues, troubleshooting, and error tracking. How can you…

BigBinary Blog 

Building the metrics dashboard in neetoDeploy with Prometheus

We are building neetoDeploy, a compellingalternative to Heroku. Stay updated by following neetoDeploy onTwitter and reading ourblog.

One of the features that we wanted in our cloud deployment platform,neetoDeploy was application metrics. We decided to usePrometheus for building this feature. Prometheus is anopen source monitoring and alerting toolkit and is a CNCF graduated project.Venturing into the Cloud Native ecosystem of projects apart from Kubernetes wassomething we had never done before. We ended up learning a lot about Prometheusand how to use it during the course of building this feature.

Initial setup

We installed Prometheus in our Kubernetes cluster by writing a…

Jardo.dev: Blog 

Don’t assert return types

Last Friday, during a mob session we were testing a data object that represented a room. (We were doing an Advent of Code puzzle.) Below is the full text of the class, but you don’t need to understand what it does. It’s an immutable object that’s constructed via a factory method.

Room = Data.define(:encrypted_name, :sector_id, :checksum) do
  def self.from(room_code)
    /
      (?<encrypted_name>.*)-
      (?<sector_id>\d+)
      \[(?<checksum>\w+)\]
    /x =~ room_code

    new(encrypted_name, Integer(sector_id), checksum)
  end

  def decoy?
    checksum != encrypted_name
      .delete("-")
      .chars
      .tally
      .sort_by { |a, b| [-b, a] }
      .map(&:first)
     …
Giant Robots Smashing Into Other Giant Robots 

Update from RubyConf 2023

If you missed out on RubyConf 2023 or just want to relive the action, video recordings of thoughtbot’s presentations are now available on YouTube. Please check them out!

Which Time Is It?

By Joël Quenneville

Can you add two time values together? Yes. No. Not so fast!

Reset your clocks and join me on a graphical tour of time itself. You’ll discover how “time” is more than a single thing, build intuition around what different operations mean, and get a sense of when some operations are nonsensical. You’ll leave with a better mental model for thinking about time and avoiding subtle time-related bugs in your own code.

The Unbreakable Code Whose Breaking Won WWII

RubySec 

CVE-2024-21647 (puma): Puma HTTP Request/Response Smuggling vulnerability

### Impact Prior to versions 6.4.2 and 5.6.8, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. ### Patches The vulnerability has been fixed in 6.4.2 and 5.6.8. ### Workarounds No known workarounds. ### References * [HTTP Request Smuggling](https://portswigger.net/web-security/request-smuggling) * Open an issue in [Puma](https://github.com/puma/puma) * See our [security policy](https://github.com/puma/puma/security/policy)
Saeloun Blog 

Ruby 3.3 Implements Range#reverse_each Method For Very Large or Beginless Ranges And Error Handling For Endless Ranges

In Ruby, a Range is an object that represents a range of values with a defined beginning and end. It’s a fundamental data structure used to express a sequence or span between two values, whether they are numeric, alphabetical, or even dates.

We have two ways to define ranges.

# Inclusive Range (includes both start and end values)

inclusive_range = (start_value..end_value)

inclusive_range = (1..5)  # Includes 1, 2, 3, 4, 5
# Exclusive Range (excludes the end value)

exclusive_range = (start_value...end_value)

exclusive_range = (1...5)  # Includes 1, 2, 3, 4 (excludes 5)

reverse_each

The Range#reverse_each method is used to iterate through a range of values in reverse order.

range.re…
Radan Skorić's personal site 

Pagy Out, Turbo In: Transforming Pagination with Infinite Scrolling and Turbo

Radan here. This is a guest post by Miha. He’s been using Hotwire tools for a while on his side projects Visualizer and ECT Business. For a recent feature enhancement he did he made extenstive use of Turbo. The work fits the theme of my blog so I was very happy when he suggested to write a guest article on it. Handing it over to Miha now. The problem with pagination I recently made a substant...
Island94.org 

Trigger GitHub Actions workflows with inputs from Apple Shortcuts

I’ve been using Apple Shortcuts to invoke GitHub Actions workflows to create webpage bookmarks. It’s been great! (disclosure: I do work at GitHub)

My use case: I’ve been wanting to quit Pinboard.in, so I needed an alternative way to create and host my web bookmarks, some of which date back to ~2005 del.icio.us vintage. It’s been easy enough for me to export of all my bookmarks (settings -> backup -> JSON) and convert them to YAML files to be served by Jekyll and GitHub Pages. But I also needed an easy way to create new bookmarks that would work on all my Apple devices. I ended up with:

  1. Bookmarks are organized as individual yaml files, in this blog’s repository.
  2. A Ruby script to take…
katafrakt’s garden 

Reconfiguring your application live with dRuby

dRuby is a pretty old but relatively unknown part of Ruby standard distribution. I first wrote about it here in 2018 and I have to admit that to this day I haven really found a production use case for it. However, I still think it a gem worth knowing, even if only to impress you Ruby friends on a conference afterparty.

To demonstrate what dRuby can do, we will write a simple application. It will periodically check Mastodon API of ruby.social server and check for new messages (called toots). To keep things as simple as possible, we’ll just use net/http as an HTTP client. Here’s our first draft:

require "net/http"
require "json"

class RubySocialChecker
  ENDPOINT = "https://ruby.social/api…
Short Ruby Newsletter 

Short Ruby News - Edition #73

Discover what's new in Ruby 3.3, merged PRs for Rails 7.1, and plans for Rails 8 and Turbo 8. This edition covers the last two weeks of 2023 and the first week of 2024.
Test Double 

4 tools for your Python developer toolkit

I love being a Python developer right now! We’ve seen exciting libraries like Pydantic and FastAPI picking up steam, which is fantastic. That said, there are also some smaller utilities that are gems in their own right. Some, like pytest-sugar, can be dropped into a project with minimal fuss. Others, like ptpython, can be used by an individual on a team without impacting the team. Here are four can’t-live-without Python tools that I’ve recently added to my dev utility belt because they make me a faster developer (and they’re doggone fun to use):


4. ptpython

Website: https://github.com/prompt-toolkit/ptpython

Installation: python -m pip install ptpython, Python 3.6+

Ptpython is what…

Saeloun Blog 

Tailwind vs Bootstrap

Choosing the right CSS framework can significantly impact our project’s design and development. Two of the most popular options are Tailwind CSS and Bootstrap, each offering a distinct approach to styling and layout. But how do we choose between them?

Let’s look into a comprehensive comparison.

Customization and Flexibility:

Tailwind: Tailwind’s utility-first approach offers unparalleled flexibility. We can build any design imaginable with low-level classes for typography, spacing, colors, and more. For instance, creating a custom button could look like this:

<button class="bg-blue-500 text-white font-bold p-4">
    Custom Button
</button>

Bootstrap: Bootstrap offers pre-built…

Posts on Kevin Murphy 

Slowing Down

The plan going forward 🔗

I’ve been consistently publishing at least one article a month on the internet for more than three years. I’ve since formalized that so that by the third Monday of the month, there’d be a new article. That may not sound like much, but it’s been what’s worked for me.

I’m no longer going to hold myself to that content calendar. I’m still going to write, but I’m going to intentionally break the streak to have something new every month. There will be a new post when I’m inspired or incentivized to do so.

Historical context 🔗

I started writing to kick-start a technical blog of my employer at the time. I did benefit from getting editing and early review from my peers, but…

Drifting Ruby Screencasts 

Turbo 8

With Turbo 8 comes a lot of new features and in this episode, we'll explore an upgrading a blog post with comments to add in the new functionality.
Dhaval Singh's Blog 

How Truly Random are Random Numbers?

We have all generated random numbers at one point or another, be it for calculations or HTTP cookies. If you havent manually generated one and you are working on a real-life project, there is a high chance somewhere it is being generated for you in "Sumdi" ('Sumdi' is a Marathi word which means to do your work quietly and not let anyone take notice).

In this post, I want to dive into how these random numbers are generated, how random are they actually and what goes behind the scenes. It is really interesting and even though you wont be "using" this knowledge irl, it will generate a lot of interesting conversations and deepen your understanding of the technology you interact with daily

Most of…

Ruby on Rails 

Omakase RuboCop, Brakeman, Ruby 3.1+, allow_browser, rate_limit, and more

Hi, zzak here with the first edition of This Week in Rails for 2024.
This year started off with a ton of contributions, nearly 170 commits, sorry we couldn’t fit everything in a single newsletter.

Rails UJS has been deprecated since Rails 7, time to die
While the official package @rails/ujs is still published on NPM, and the final compiled targets for the asset pipeline remain, all of the source files, tests, and internal packaging tasks were removed.

Add default PWA manifest and service worker file
Freshly generated Rails apps now include a manifest and service worker file to become full-fledged Progressive Web Applications.

Add rubocop-rails-omakase to new Rails applications
This…

Julia Evans 

Do we think of git commits as diffs, snapshots, and/or histories?

Hello! I’ve been extremely slowly trying to figure how to explain every core concept in Git (commits! branches! remotes! the staging area!) and commits have been surprisingly tricky.

Understanding how git commits are implemented feels pretty straightforward to me (those are facts! I can look it up!), but it’s been much harder to figure out how other people think about commits. So like I’ve been doing a lot recently, I went on Mastodon and started asking some questions.

how do people think about Git commits?

I did a highly unscientific poll on Mastodon about how people think about Git commits: is it a snapshot? is it a diff? is it a list of every previous commit? (Of course it’s…

RubySec 

CVE-2024-21636 (view_component): view_component Cross-site Scripting vulnerability

### Impact _What kind of vulnerability is it? Who is impacted?_ This is an XSS vulnerability that has the potential to impact anyone rendering a component directly from a controller with the view_component gem. Note that only components that define a [`#call` method](https://viewcomponent.org/guide/templates.html#call) (i.e. instead of using a sidecar template) are affected. The return value of the `#call` method is not sanitized and can include user-defined content. In addition, the return value of the [`#output_postamble` method](https://viewcomponent.org/api.html#output_postamble--string) is not sanitized, which can also lead to XSS issues. ### Patches _Has the problem been patched?…
RailsNotes, the Ruby on Rails guides you wished you had. 

Here's what's coming in Rails 8

Work on Rails 8 is starting, so I dug through the official GitHub milestone to break down all the upcoming goodies for you. There's plenty coming, including Solid Queue, Solid Cache and Kamal becoming defaults, better support for PWAs, an official LSP, and more!
Awesome Ruby Newsletter 

💎 Issue 398 - Inheritance in Ruby, in pictures

Ruby Weekly 

New Year, New Ruby

#​684 — January 4, 2024

Read on the Web

We're back! What a fantastic end to the year Ruby had. We're going to cover as much of it as we can today, so be prepared, there's a lot.. :-)
__
Peter and the Cooperpress team

Ruby Weekly

🎉  Ruby 3.3 Released — It's not exactly breaking news, but I was too busy eating turkey on Christmas Day to dig into this new, mammoth release of Ruby till now 😉 If you’ve been playing with the preview and RC releases, little has changed, but here’s the big picture regarding improvements:

RubySec 

CVE-2024-21632 (omniauth-microsoft_graph): Omniauth::MicrosoftGraph Account takeover (nOAuth)

### Summary The implementation did not validate the legitimacy of the `email` attribute of the user nor did it give/document an option to do so, making it susceptible to [nOAuth](https://www.descope.com/blog/post/noauth) misconfiguration in cases when the `email` is used as a trusted user identifier
RubyGems Blog 

3.5.4 Released

RubyGems 3.5.4 includes enhancements and bug fixes.

To update to the latest RubyGems you can run:

gem update --system

To install RubyGems by hand see the Download RubyGems page.

## Enhancements:

  • Always avoid “Updating rubygems-update” message. Pull request #7335 by deivid-rodriguez
  • Installs bundler 2.5.4 as a default gem.

## Bug fixes:

  • Make gem update --system respect ruby version constraints. Pull request #7334 by deivid-rodriguez

SHA256 Checksums:

  • rubygems-3.5.4.tgz
    bf70fee8dcc11ebea76d31399c3b6eea90590b06c1c587cef1b6e53ec32b0128
  • rubygems-3.5.4.zip
    3252eecdff7aa05edcebea61651ec581c910925cf5968d3f321f0e8c3356dc82
  • rubygems-update-3.5.4.gem
    41d4c93a79426a7e034080cc…
RailsNotes, the Ruby on Rails guides you wished you had. 

Edit Rails Credentials using VS Code

This short guide shows you how to use VS Code to edit secrets in your Ruby on Rails app when you run `rails credentials:edit`. I also include a handy `bin/credentials:edit` script to simplify things.
Island94.org 

Recently, January 3, 2023

  • I’ve now watched the Taylor Swift Eras movie twice, once at home, and a second time over the holidays with niece (completely) and nephew (partly). My most burning question is whether Taylor menaces the same dancer every show’s “Tolerate it”, or if they share rhetorical pain. My Apple Music Replay also ranked highly with Taylor Swift, though also apparently Andrew McMahon; unexpected.
  • I started playing Talos Principle 1 after beating 2, though it’s a lot more intense with guns and exploding things and so many timing-based puzzles. I’ve almost beaten it… but also took a break to play Super Mario Wonder which is much more fun fun (especially, again, with niece and nephew).
  • I finished…
Posts on Kevin Murphy 

Blue Ridge Ruby Coverage Talk Video

Blue Ridge Ruby Videos 🔗

I had a great time at Blue Ridge Ruby last year. This was the first time I shared “Enough Coverage To Beat the Band” with an in-person audience. The first stop on my “Ruby’s Got You Covered” World Tour that didn’t stream from the office in my house.

You can now view all the talks from the conference on YouTube! That includes mine, which started off the events on day 1. Because I went first, they were still ironing out some kinks, like with the audio, but I hope you enjoy it nonetheless.

Giant Robots Smashing Into Other Giant Robots 

Introducing Superglue: React ❤️ Rails

At thoughtbot, we rely on Rails to build applications at high velocities. When faced with adding modern client-side interactivity, we may have many forms of progressive enhancement to turn to. In particular, gaining popularity within the team are the trio of companion libraries: Hotwire, Turbo, Stimulus. These frameworks make it easy to add sprinkles of interactivity to HTML and have been a much easier option to reach for than React, Redux, and friends.

But React is so tempting!

Components make organizing testable units of interactivity a breeze. Being declarative, it’s a lot easier and sensible to manipulate state as a simple data structure than to carefully manipulate the DOM. And while…

The Ruby Dispatch 

8 Turbo 8 "Gotchas"

As the final release of Turbo 8 nears, there are a few “gotchas” worth knowing about that will make life easier as you start updating existing Rails Turbo apps to take advantage of all the new features that Turbo 8 offers, like page morphs

1. Don’t scroll: preserve All The Things™

There are two scroll properties in Turbo 8 that instruct the browser how to behave when users click on a link or submit a form: the new preserve property and the existing reset property.

The reset property is the default behavior and it’s what Turbo has always been using. It starts pages at the top of the viewport when the user navigates after clicking a link. Nothing too surprising there—it’s how web browsers…

Ruby Rogues 

Unraveling Ruby's AI Journey with Alex Rudall - RUBY 619

Alex Rudall is the creator of the ruby-openai gem. They explore the latest developments in the world of technology. They dive into the fascinating world of Ruby development and artificial intelligence. Join them as they delve into conversations about utilizing large language models for Rails apps, navigating the challenges and opportunities within the Ruby community, and the potential of Ruby in the context of AI and machine learning. From the renaming of Rails AI to the Peaceterms project to discussions about the future of Ruby and AI, this episode offers insights into the cutting-edge intersection of technology and programming.


Sponsors

The Ruby on Rails Podcast 

Episode 501: Ruby For All Crossover!

I joined Julie and Andrew from Ruby For All to talk about Test Driven Development, attending conferences, and using TDD as a thinking tool.. This episode was recorded at RubyConf in San Diego.

Show Notes
[Ruby For All] - https://www.rubyforall.com/

Sponsors
Honeybadger

As an Engineering Manager or an engineer, too much of your time gets sucked up with downtime issues, troubleshooting, and error tracking. How can you spend more time shipping code and less time putting out fires?

Honeybadger is how. It’s a suite of monitoring tools specifically for devs.

Get started today in as little as 5 minutes at Honeybadger.io with plans starting at free!

Giant Robots Smashing Into Other Giant Robots 

Turn Your Code Into Pixel Art

In 2022, I found out what the average programming language color was. Today, I want to transform code itself into pixel art (in less than 100 LOC).

What?

The plan is very simple: I’ll parse a Ruby file to collect all token types, assign each token a color, and then render each one as a pixel in a grid. Sounds like a plan, right?

If you’re only interested in the script, here it goes. Just run ruby code_picture.rb your-file.rb, and you’ll get your abstract pixel art. I’ll be going over some of the most interesting parts of that code. Stick around, and you might learn something cool.

Parsing Ruby

The whole reason this silly idea exists is me trying out the new Ruby…

Test Double 

Only you can give meaning to your career

I have, for whatever reason, live-blogged my career. Posting technical tips I’ve learned. Complaining about bugs I’ve uncovered. Elaborating on struggles my teams have faced. Mixed in with the substantive stuff has been plenty of vain ephemera that many would rightly describe as “over-sharing.” My brother sent me this last week and I felt personally attacked:

Everyone is fighting a battle you don’t know about. Except for me. I am complaining loudly about my battle. Everybody knows about it.

So if you’ve borne witness to how much of my life I have spewed indiscriminately onto the Internet: first, I’m sorry. And second, please know that my vocation as a limelight enthusiast is…

Write Software, Well 

Why You Need Strong Parameters in Rails

Why You Need Strong Parameters in Rails

You’ve used strong parameters in your Rails applications, but did you know what problem they are solving? I didn’t. So did some reading and learned about a common security vulnerability. In this post, I will explain the Mass Assignment vulnerability and how you can use the Rails strong parameters API to address it.

Mass Assignment Vulnerability

What is it? Mass Assignment means assigning values to multiple variable or object properties at a time.

Why is it bad?

Consider the following object:

user = {
  name: "Jason",
  company: "37signals",
  owner: true
}

Now let’s say we want to update the company’s name to “Basecamp”. The typical web-application way to do this would be to receive some data,…

Notes to self 

Business Class 1.3 with support for Stripe and an improved CRUD generator

Start your 2024 business on Business Class 1.3!

Stripe

The major addition for this release is initial Stripe support.

You can start, cancel, and update payment details for Stripe subscriptions. Right now you can have both Paddle and Stripe subscriptions side by side, with one provider being the primary one people subscribe too. I also made the plans hard-coded as I think they don’t change often enough to warrant auto-fetching and caching. Simple is almost always better.

More is to come in future versions.

Admin CRUD

The team CRUD generator that can generate team-scoped resources now generates admin pages too. A simple CRUD was never easier. And while the generator will never reach the…

Saeloun Blog 

Rails 7.1 Introduced Validate Option For Enums

An Enum is a data type that allows us to define a set of named constants. Rails 7.1 brings a notable enhancement to enum handling by introducing the :validate option.

It will allow more flexible and robust validation of enum values within the ActiveRecord models.

In this blog post, we’ll explore how this change affects our code and how the validations for enum values were handled in previous versions of Rails.

Before

In previous versions of Rails, if we assign an incorrect value to the enum then it used to raise an ArgumentError.

We can illustrate this by the following example.

class Holiday < ApplicationRecord

  enum type: [:national, :regional]

end

holiday = Holiday.last

holiday.
'optional' is not a valid type (ArgumentError)

In the above snippet, we…

BigBinary Blog 

Upgrading React state management with zustand

From React context to zustand: A seamless transition

Global state refers to data that needs to be accessible and shared acrossdifferent parts of an application. Unlike local or component-specific state,global state is not confined to a particular component but is availablethroughout the entire application.

Let's dive into a real-world scenario to understand the need for a global statein a React application.

Imagine we're building a sophisticated e-commerce platform with variouscomponents, such as a product catalog, a shopping cart, and a user profile. Eachof these components requires access to shared data, like the user'sauthentication status and the contents of their shopping cart.

In the…

Jake Zimmerman 

Abstract singleton class methods are an abomination

Abstract singleton class methods do not belong in a well-behaved type system. Sorbet allows them anyways, which causes problems. Here's why they're bad and what to do instead.
lucas.dohmen.io 

Sneak Peek on Rails 8

Planning for Rails 8 has started. I assume it will be released at Rails World Toronto on September 26 and 27, 2024 (as a certain bruised ego would probably not make a release at RailsConf). This is a quick summary of what we can expect:

Database-backed Jobs, Caching and Web Sockets

Rails 8 will feature new default adapters for Active Job, Caching and Action Job. They will all use the database as their backend. This is due to Basecamp’s conviction that SSDs are so fast these days that in-memory stores like Redis are not providing enough benefit over databases like…

Julia Evans 

Some notes on NixOS

Hello! Over the holidays I decided it might be fun to run NixOS on one of my servers, as part of my continuing experiments with Nix.

My motivation for this was that previously I was using Ansible to provision the server, but then I’d ad hoc installed a bunch of stuff on the server in a chaotic way separately from Ansible, so in the end I had no real idea of what was on that server and it felt like it would be a huge pain to recreate it if I needed to.

This server just runs a few small personal Go services, so it seemed like a good candidate for experimentation.

I had trouble finding explanations of how to set up NixOS and I needed to cobble together instructions from a bunch of…

Olivier Lacan 

Constant Variable

12 years ago today, I spoke these words into a microphone after writing them late at night. If you forgive my 26 year old pompousness I think they aged… OK. The test of time might be passed when something you wrote for yourself ends up coming back in your mind for over a decade.

A constant variable.

Life is, love is, work is.

Things change, perpetually.

Change is frightening but it’s good. We idealize it and rarely realize how tedious it is until we face it.

The universe is nothing but change. Unstoppable, beautiful, change.

Science brought us tools to understand the universe and ourselves.

Out of these tools emerged the Internet, a tool originally designed to help…

Andy Croll 

Year in Review 2023

Steady & determined.

January-March

The major change at work was the arrival of Ollie and Olivia, fresh-ish from their Le Wagon bootcamp. I can only express what a wonderful experience it has been to see them grow into their new careers and to see how well the existing folks have turned into valued mentors and coaches.

We also executed a (first ever) price rise for all our non-entry level customers, while equalising our US/UK pricing at the same time.

We tried to be considerate, our base plan pricing stayed the same, plus a bunch of folks end up reviewing their pricing and ending up on plans that’ll fit better for their usage. I did spend much of early January frantically battling…

Julia Evans 

2023: Year in review

Hello! This was my 4th year working full time on Wizard Zines! Here are a few of the things I worked on this year.

a zine!

I published How Integers and Floats Work, which I worked on with Marie.

This one started out its life as “how your computer represents things in memory”, but once we’d explained how integers and floats were represented in memory the zine was already long enough, so we just kept it to integers and floats.

This zine was fun to write: I learned about why signed integers are represented in memory the way they are, and I’m really happy with the explanation of floating point we ended up with.

a playground: memory spy!

When explaining to people how your computer…