{"full_name":"rails/rails","owner":"rails","name":"rails","url":"https://github.com/rails/rails","description":"Ruby on Rails","homepage":"https://rubyonrails.org","topics":[],"language":"Ruby","license":"MIT","avatar":"https://avatars.githubusercontent.com/u/4223?v=4","created_at":"2008-04-11T02:19:47Z","pushed_at":"2026-11-10T08:30:48Z","metrics":{"stars":59089,"forks":23114,"watchers":2355,"issues":18750,"prs":40406,"releases":172,"issues_open":null,"issues_closed":null,"prs_open":null,"prs_closed":null,"prs_merged":null,"discussions":122},"growth":{"day":{"stars":7,"forks":-466,"base_day":"2026-11-09"}},"history":{"dates":["2026-11-09","2026-11-10"],"stars":[59082,59089],"forks":[23580,23114],"watchers":[2355,2355],"issues_open":[null,null],"prs_open":[null,null]},"boards":{},"same_owner":[],"issues":[{"number":20676,"title":"accepts_nested_attributes_for breaks the uniqueness with scope validation","comments":76,"created_at":"2015-06-23T20:46:13Z"},{"number":31228,"title":"Rails Router Catchall Picks Up ActiveStorage Routes","comments":49,"created_at":"2017-11-25T20:01:01Z"},{"number":52459,"title":"Enhance bin/dev to run server in foreground AND still use foreman","comments":48,"created_at":"2024-07-31T01:09:09Z"},{"number":14358,"title":"Rack::ETag middleware doesn't play nice with Live streaming when commit! is called before write","comments":46,"created_at":"2014-03-12T12:03:50Z"},{"number":40855,"title":"`ActiveStorage::Current.host` not set causing disk service to throw `URI::InvalidURIError`","comments":37,"created_at":"2020-12-16T00:15:40Z"},{"number":44312,"title":"ActiveRecord::Sanitization::ClassMethods#sanitize_sql surrounds Numerics with quotes","comments":32,"created_at":"2022-02-02T14:09:51Z"},{"number":49604,"title":"Rails 7.1: incorrect path when submitting form for a singular resource","comments":31,"created_at":"2023-10-12T13:40:59Z"},{"number":44800,"title":"Too much magic in `Rails.logger` and logging to `STDERR` causes duplicate output.","comments":29,"created_at":"2022-03-30T01:35:55Z"}],"discussions":[{"number":59049,"title":"Proposal: Detect external side effects inside Active Record transactions","comments":0,"category":"Ideas","created_at":"2026-10-13T09:33:45Z"},{"number":58942,"title":"Support optional counter caches for polymorphic associations.","comments":0,"category":"Ideas","created_at":"2026-10-05T14:15:40Z"},{"number":58831,"title":"Put the most used Rails features into a starter kit like Laravel starter kit","comments":0,"category":"Ideas","created_at":"2026-09-20T14:04:31Z"},{"number":58657,"title":"Deprecate DescendantsTracker?","comments":2,"category":"Ideas","created_at":"2026-09-03T13:22:31Z"},{"number":58598,"title":"Give `composed_of` a fresh start by dropping the `where()` integration?","comments":0,"category":"Ideas","created_at":"2026-08-28T04:56:52Z"},{"number":58536,"title":"Can we add something like Laravel Sail or Laravel Herd but for Rails?","comments":1,"category":"Ideas","created_at":"2026-08-22T01:06:12Z"},{"number":58438,"title":"How to make a guest connection in Action Cable?","comments":1,"category":"Docs","created_at":"2026-08-11T11:04:55Z"},{"number":57812,"title":"Source of Truth - Ruby Version","comments":1,"category":"Ideas","created_at":"2026-06-22T11:44:16Z"}],"latest_release":{"name":"8.1.4.1","tag":"v8.1.4.1","published_at":"2026-11-04T02:46:00Z","body":"## Active Support\r\n\r\n*   `ActiveSupport::MessagePack` no longer deserializes an unsafe\r\n    `ActiveSupport::SafeBuffer` as `html_safe`.\r\n\r\n    A `SafeBuffer` that was no longer `html_safe?`, for example after an\r\n    in-place `gsub!`, was deserialized as an `html_safe` `SafeBuffer`. It is now\r\n    serialized with an unsafe marker and deserialized as a `String`. Earlier\r\n    versions of Rails cannot read an unsafe buffer serialized this way.\r\n\r\n    [GHSA-2w9f-fxwj-w2qf]\r\n\r\n    *Jean Boussier*\r\n\r\n*   `ActiveSupport::Inflector#safe_constantize` matches the constant name in a\r\n    `LoadError` message as a literal string instead of building a `Regexp`\r\n    from it.\r\n\r\n    The name's segments were interpolated unescaped into the pattern, so input\r\n    that reaches `safe_constantize`, such as the channel identifier in an Action\r\n    Cable subscribe command, chose the source passed to the regexp compiler.\r\n\r\n    [GHSA-8474-xrp6-wh69]\r\n\r\n    *Jeremy Daer*\r\n\r\n## Active Model\r\n\r\n*   No changes.\r\n\r\n\r\n## Active Record\r\n\r\n*   No changes.\r\n\r\n\r\n## Action View\r\n\r\n*   Skip attribute names in tag helpers that are blank once converted to a\r\n    string.\r\n\r\n    A Symbol such as `:\" \"` is not blank, because `Symbol#blank?` is\r\n    `Symbol#empty?`, so it reached the escaping step and produced an attribute\r\n    with no name. The asset helpers symbolize their keys, so an ordinary String\r\n    key reached the same place.\r\n\r\n    [GHSA-68p9-83h6-5wpj]\r\n\r\n    *Mike Dalessio*\r\n\r\n*   Fix `strip_tags` to encode `\"` and `'` in its output.\r\n\r\n    `strip_tags` returns an `html_safe` string, but was not encoding quotation\r\n    marks. The method now encodes all five HTML-significant characters (`&`,\r\n    `<`, `>`, `\"`, `'`), consistent with the existing `html_safe` convention.\r\n\r\n    Output used outside HTML, such as in a text template or JSON, now contains\r\n    `&quot;` and `&#39;` where it contained `\"` and `'`. `CGI.unescapeHTML`\r\n    decodes them.\r\n\r\n    [GHSA-rq8q-p985-fjq7]\r\n\r\n    *Mike Dalessio*\r\n\r\n*   Escape the matched phrase before substituting it into `highlight`'s\r\n    `:highlighter`.\r\n\r\n    A match was copied into each `\\1` of the highlighter as it appeared in\r\n    the sanitized text, which keeps `\"` and `'` as they are, so a match\r\n    containing a quote ended a quoted attribute value such as the\r\n    documented `'<a href=\"search?q=\\1\">\\1</a>'` and added attributes of\r\n    its own. Each substituted group now goes through\r\n    `ERB::Util.html_escape_once`, so quotes in a match render as `&quot;`\r\n    and `&#39;`. Only the numbered placeholders `\\0` to `\\9` are expanded,\r\n    and a match never replaces the `>` that closes a tag.\r\n\r\n    [GHSA-v6rj-xm57-3p59]\r\n\r\n    *Jeremy Daer*\r\n\r\n*   Require rails-html-sanitizer 1.7.2 or later.\r\n\r\n    With the HTML5 sanitizer, Nokogiri before 1.19.5 left `<` and `>`\r\n    unescaped in attribute values. `highlight` and `simple_format`, which\r\n    edit the sanitized HTML as a string, could then turn markup inside an\r\n    attribute value into live elements. rails-html-sanitizer 1.7.2 requires\r\n    Loofah 2.25.3, which requires Nokogiri 1.19.5.\r\n\r\n    [GHSA-2p2f-4rq4-gjwc]\r\n\r\n    *Mike Dalessio*\r\n\r\n## Action Pack\r\n\r\n*   Apply `config.action_dispatch.cookies_same_site_protection` to every session\r\n    store.\r\n\r\n    `ActionDispatch::Session::CacheStore`, `MemCacheStore` and third-party\r\n    stores built on `AbstractStore` or the session mixins sent session cookies\r\n    with no `SameSite` attribute. Only `CookieStore` applied the configured\r\n    default.\r\n\r\n    [GHSA-gmj8-hvj3-49mw]\r\n\r\n    *Jean Boussier*\r\n\r\n*   Prevent `ActionController::Live` streams from blocking when a full buffer is\r\n    closed or aborted.\r\n\r\n    [GHSA-rwvh-fw6r-pwvp]\r\n\r\n    *Jeremy Daer*\r\n\r\n*   Set and extend the `Vary` header for rendered responses according to the\r\n    request headers used in format negotiation.\r\n\r\n    `Vary: Accept` was only added when the request carried a usable `Accept`\r\n    header. A response to a request without one, negotiated t"},"readme":true,"readme_zh":false,"news":[],"stale":false,"snapshot_at":"2026-11-10T09:35:25Z","history_start":"2026-09-06"}