September 2026 - ruby-talk - ml.ruby-lang.org

[ruby-talk:444859] Montreal.rb September 2026: Ruby Version Managers in 2026
by Andy Maleh 29 Sep '26

29 Sep '26

The video and slides for the Montreal.rb September 2026 talk "Ruby Version Managers in 2026" have been published! Talk Description: It is often useful to install more than one Ruby version on one's machine, whether to explore newer Ruby versions before committing to them on a Rails project, or to support multiple Rails projects running on multiple Rubies. Additionally, being able to scope gems by a Ruby project can be very helpful in ensuring the safety of running a Ruby app in complete isolation from other Ruby apps. The Ruby ecosystem contains multiple Ruby Version Managers that help with installing Ruby and scoping Ruby gems by project. This talk will cover the common Ruby Version Manager options in 2026, such as RVM, RBENV, CHRUBY, and ASDF. YouTube Video : https://www.youtube.com/watch?v=UFMQOkEZUSc Presentation Slides : https://docs.google.com/presentation/d/e/2PACX-1vR_uc-FSdvKmMT0gzRRK-qJ-JSU… Blog post version : https://andymaleh.blogspot.com/2026/09/montrealrb-september-2026-ruby-versi…

1 0

[ruby-talk:444858] Dissecting DHH's RailsWorld 2026 Keynote Speech from a Software Engineering Point Of View
by Andy Maleh 28 Sep '26

28 Sep '26

Dissecting DHH's RailsWorld 2026 Keynote Speech from a Software Engineering Point Of View: https://youtu.be/VsM8Ej-em8I Video blog post: https://andymaleh.blogspot.com/2026/09/dissecting-dhhs-railsworld-2026-keyn…

1 0

[ruby-talk:444857] [ANN] rodauth-oauth 1.7.0 released
by Tiago Cardoso 22 Sep '26

22 Sep '26

rodauth-oauth 1.7.0 has been released. rodauth-oauth is a rack-compatible toolkit for building OAuth 2.0 authorization servers, as well as OpenID Authentication Providers. rodauth-oauth is certified <https://openid.net/certification/> for the following profiles of the OpenID Connect™ protocol: Basic OP, Implicit OP, Hybrid OP, Config OP, Dynamic OP, Form Post OP, 3rd Party Init OP Session Management OP, RP-Initiated Logout OP, Front-Channel OP, Back-Channel OP # as simple as rodauth do enable :oauth_authorization_code_grant # or enable :oidc end Among its features, it supports: * Authorization Code Grant * Refresh Token Grant * Implicit Grant * Client Credentials Grant * Device Code Grant * Token Revocation * Token Introspection * Auth Server Metadata * PKCE * Resource Indicators * JWT Access Tokens * mTLS Client Authentication * Assertion Framework * SAML 2.0 Bearer Assertion Grant * JWT Bearer Assertion Grant * JWT Secured authorization requests (JAR) * JWT Secured authorization response mode (JARM) * Pushed Authorization requests (PAR) * Demonstrating Proof-of-Possession at the Application Layer (DPoP) * Dynamic Client Registration * Client ID Metadata Document * OpenID * OpenID Discovery * OpenID Multiple Response types * OpenID Self Issued Tokens * OpenID Connect Dynamic Client Registration * OpenID Session Management * OpenID RP Initiated Logout * OpenID Frontchannel Logout * OpenID Backchannel Logout It can also be used with Rails (via the "rodauth-rails" gem). Website: rodauth-oauth · honeyryder <https://honeyryderchuck.gitlab.io/rodauth-oauth/> Documentation: Rodauth OAuth: OAuth 2.0 and OpenID for rodauth <https://honeyryderchuck.gitlab.io/rodauth-oauth/rdoc/> Wiki: Home · Wiki · OS / rodauth-oauth · GitLab <https://gitlab.com/honeyryderchuck/rodauth-oauth/wikis/home> CI: https://gitlab.com/honeyryderchuck/rodauth-oauth/pipeline These are the release notes since the last update: # 1.7.0 ## Features ### Client ID Metadata Document Support `rodauth-oauth` supports the Client ID Metadata Document Standard (also known as CIMD), via the `oauth_client_id_metadata_document` feature. In a nutshell, this provides a way by which a Client Application can identify itself to the authorization server, without prior dynamic client registration or other existing registration. More info about the feature [in the docs]( https://gitlab.com/os85/rodauth-oauth/-/wikis/Client-ID-Metadata-Document) ### 1.6.7 #### Improvements * Some new capabilities were built into `rodauth` recently, which `rodauth-oauth` now taps into: * plugins are now object shape friendly, by defining ivars using `rodauth`'s `:uses_instance_variables` auth method (introduced in v2.44) * `:oidc` plugin `get_oidc_param` and `get_additional_param` now have a default implementation, which raises an error (eliminates warnings). * `only_json?` auth method is no longer defined (unless the `:jwt` plugin is used). * some internal methods were now moved to private, instead of being needlessly exposed (eliminates security warnings). * a new auth method, `confidential?(oauth_application)`, was added to the `:oauth_base` plugin, which is now used internally to check in some key flows whether the OAuth client application is a public or a confidential client, as it's defined in the OAuth RFC: * when using the `:oauth_dynamic_client_registration` plugin, a client secret won't be generated for public clients (same logic will be applied for client registration management endpoints). * when using the `:oauth_application_management` plugin, default templates will include a client type column, and omit the client secret for public clients, where they would previously. #### Bugfixes * do not render null fields in the payload of the oauth server metadata endpoint (RFC 8414 section 2 requires omission of undefined values, so clients can apply the recommended defaults). * fixed regexp used for json requests (same fix as in [rodauth]( https://github.com/jeremyevans/rodauth/commit/3e0d7ab2d49a5733d1afcaaf1062b… )) ### 1.6.6 #### Improvements * Authorization form params will now be exposed to the HTML rendering via the `rodauth.authorize_form_params`; this not only reduces the size of the bundled forms, but also makes it much easier to add or remove features with their own required authorize params. * `:oauth_jwt_base` feature: new `:oauth_jwt_iat_leeway` option (defaults to 30, as in seconds), is used now to make the JWT claim `iat` claim tolerant to clock skew. This option is used in both the `jwt` and `json/jwt` gem integrations. * `:oauth_pkce` feature: new `:oauth_pkce_allow_plain_method` option, which may disallow the usage of `"plain"` as a PKCE challenge method * defaults to `true` in order not to break backwards compatibility, but this is going to change in a future version, so you are recommended to set it explicitly in order not to break your application in a future upgrade. #### Bugfixes * (critical) `:oauth_dynamic_client_registration` feature: `PUT /register` was incorrectly authenticating the request (responding with 200 when secret didn't match), thereby allowing anyone (else) to update application parameters. * (critical) `:oauth_dynamic_client_registration` feature: `PUT /register` was not hashing the client secret when hashing on the client secret was enforced. * `:oauth_authorization_code_grant` feature: escape untrusted values in the authorize form (hidden request params, the `"state"` in the cancel link, the client application name), in the authorize form post POST response form, and in the device verification template. * token endpoint: enforce 4XX HTTP responses with JSON encoded body when there are errors (instead of making it rely on the "accept" HTTP header). * client authentication: fallback to `oauth_default_token_endpoint_auth_methods` when the application being authentication has no `token_endpoint_auth_method` set (instead of assuming it as "none"). * `:oauth_dynamic_client_registration` feature: client metadata which the server does not understand is now ignored (RFC 7591 section 3.1), instead of failing the registration with an `"invalid_client_metadata"` error. * `:oauth_dynamic_client_registration` feature: fix typo which was exposing `client_secret` in the registration response in cases where it shouldn't. * `:oauth_dynamic_client_registration` feature: emit `"client_id_issued_at"` as epoch seconds instead of an ISO8601 string, as per [RFC 7591](https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.1). * `:oauth_dynamic_client_registration` feature: remove "registration_access_token" and "registration_client_uri" parameters from the payload (these are only valid for the OIDC counterpart). * `json/jwt`: decoding a JWT was bypassing claims verification. #### Security * Using `rodauth` `timing_safe_eql?` helper method, a string comparison function which is safe against timing attacks, in client secret matching and PKCE verification. ### 1.6.5 #### Bugfixes * `:oauth_dynamic_client_registration` feature: scoping to the client being updated, preventing thst the resulting database operations touch every row in the `"oauth_applications"` table. * `:json` feature: fixed implementation of `json_request?`. * `json-jwt` support: set explicit `:skip_verification` parameter when the jwt decoding algorithm is `"none"`. * rails generators: add missing uniqueness constraint to the index on the `"issuer"` column of the `"oauth_saml_settings"` table. * rails generators: remove the `"jti"` column entry from the `"oauth_dpop_proofs"` table (already made the pkey in the `create_table` instruction). * Make `password_hash` method public, which restores compatibility with `rodauth` v2.28 or more recent; `rodauth` **minimum supported version** becomes 2.28.0 as a result, which should not be perceived as a breaking change, as there are no other significant API changes, and ruby version support remains the same.

1 0

[ruby-talk:444856] JRuby 10.1.2.0 released
by Charles Oliver Nutter 21 Sep '26

21 Sep '26

The JRuby community is pleased to announce the release of JRuby 10.1.2.0. * Homepage: [https://www.jruby.org/](https://www.jruby.org/) * Download: [https://www.jruby.org/download](https://www.jruby.org/download) JRuby 10.1.x targets Ruby 4.0 compatibility. Thank you to our contributors this release, you help keep JRuby moving forward! [@aminmansuri], [@drzaiusx11], [@evaniainbrooks], [@gillesbergerp], [@jcharaoui], [@jwils], [@kares], [@lloeki], [@makenowjust], [@nobu], [@sampokuokkanen], [@shugo] Notable Changes --------------- ### Compatibility * Multiple fixes for fibers and fiber scheduler support. [#9604], [#9607], [#9622], [#9645], [#9649], [#9656], [#9660] ### Performance * Fixed a regression in startup time on MacOS by properly loading native JNR subsystem. [#9690] * Improve performance of Ruby subclasses of Java classes. [#9619], [#9557] * Improve performance of autoloads overridden by an actual require. [#9677] ### Java Integration * The location of the AppCDS JSA file can now be specified with JRUBY_JSA_HOME. [#9667] ### Standard Library * Update to jar-dependencies 0.6.1 using mima for dependency resolution instead of the ruby-maven gem. [#9515], [#9720] * Update default and bundled standard library gems. [#9705] #### Default gems * erb 6.0.7 * error_highligh 0.7.2 * ffi 1.17.4 * io-console 0.9.4 * ipaddr 1.2.9 * jruby-openssl 0.16.2 * json 2.21.2 * net-protocol 0.4.0 * pp 0.6.4 * psych 5.5.0 * resolv 0.8.0 * strscan 3.1.8 * syntax_suggest 3.0.0 * timeout 0.6.1 * win32-registry 0.1.2 #### Bundled gems * bigdecimal 4.1.2 (ruby parts only) * csv 3.3.6 * minitest 5.27.0 * net-imap 0.6.7 * nkf 0.3.0 * pstore 0.2.1 * rdoc 7.2.0 * reline 0.7.0 * resolv-replace 0.2.0 * rss 0.3.3 * test-unit 3.7.8 ### 76 Issues and PRs resolved for 10.1.2.0 https://www.jruby.org/2026/09/21/jruby-10-1-2-0 *Charles Oliver Nutter* *Architect and Technologist* Headius Enterprises https://www.headius.com headius(a)headius.com

1 0

[ruby-talk:444855] JRuby 10.0.7.0 released
by Charles Oliver Nutter 21 Sep '26

21 Sep '26

The JRuby community is pleased to announce the release of JRuby 10.0.7.0. * Homepage: [https://www.jruby.org/](https://www.jruby.org/) * Download: [https://www.jruby.org/download](https://www.jruby.org/download) JRuby 10.0.x targets Ruby 3.4 compatibility. Thank you to our contributors this release, you help keep JRuby moving forward! [@aminmansuri], [@evaniainbrooks], [@gillesbergerp], [@jwils], [@kares], [@lloeki] Notable Changes --------------- ### Performance * Fixed a regression in startup time on MacOS by properly loading native JNR subsystem. [#9688], [#9689] * Improve performance of autoloads overridden by an actual require. [#9677], [#9675] ### Java Integration * The location of the AppCDS JSA file can now be specified with JRUBY_JSA_HOME. [#9667] ### Standard Library ### Default gems * jruby-openssl 0.16.2 [#9538], [#9561] * resolv 0.7.2 [#9637], [#9641] ### 53 Issues and PRs resolved for 10.0.7.0 https://www.jruby.org/2026/09/21/jruby-10-0-7-0 *Charles Oliver Nutter* *Architect and Technologist* Headius Enterprises https://www.headius.com headius(a)headius.com

1 0

[ruby-talk:444854] Ptero Pro AI Chat — Now with a Developer API
by amine kheddache 20 Sep '26

20 Sep '26

Hello Ruby Community, I'm Amine KHD, maintainer of Ptero Pro AI Chat, a free open-source AI chat platform. I wanted to share that Ptero now has a developer API, so you can integrate AI chat and other tools directly into your Ruby applications using a simple REST interface.. What the API offers: - Access to multiple models (DeepSeek, Qwen, Mercury, and more) - Free to use — no credit card, Example use case: You could build a Ruby helper that uses the API to explain code, generate tests, or debug errors directly in your development workflow. Try it here: https://ptero.pro Source code: https://github.com/aminkheddache-dotcom/Ptero It's completely free and will always be free. If you find it useful, feedback is always welcome. Best regards, Amine KHD Founder & Lead Developer, Ptero aminekhd(a)ptero.pro https://ptero.pro

1 0

[ruby-talk:444853] [ANN] sexp_processor 4.17.6 Released
by Ryan Davis 20 Sep '26

20 Sep '26

sexp_processor version 4.17.6 has been released! * home: <https://github.com/seattlerb/sexp_processor> * rdoc: <http://docs.seattlerb.org/sexp_processor> sexp_processor branches from ParseTree bringing all the generic sexp processing tools with it. Sexp, SexpProcessor, Environment, etc... all for your language processing pleasure. ## Features/Problems: * Includes SexpProcessor and CompositeSexpProcessor. * Allows you to write very clean filters. * Includes MethodBasedSexpProcessor * Makes writing language processors even easier! * Sexp provides a simple and clean interface to creating and manipulating ASTs. * Includes new pattern matching system. Changes: ### 4.17.6 / 2026-09-20 * 2 bug fixes: * Improved coverage to 100% for some modules. More to go. Fixed some minor problems. * Minor cleanup in SexpProcessor.

1 0

[ruby-talk:444852] [ANN] ruby2ruby 2.6.2 Released
by Ryan Davis 19 Sep '26

19 Sep '26

ruby2ruby version 2.6.2 has been released! * home: <https://github.com/seattlerb/ruby2ruby> * rdoc: <http://docs.seattlerb.org/ruby2ruby> ruby2ruby provides a means of generating pure ruby code easily from RubyParser compatible Sexps. This makes making dynamic language processors in ruby easier than ever! ## Features/Problems: * Clean, simple SexpProcessor generates ruby code from RubyParser compatible sexps. Changes: ### 2.6.2 / 2026-09-19 * 2 bug fixes: * Fixed block lvar processing for it, _1, etc. * Fixed variable references in pattern match body. (ofedoren)

1 0

[ruby-talk:444851] [ANN] imap_processor 1.9.1 Released
by Ryan Davis 19 Sep '26

19 Sep '26

imap_processor version 1.9.1 has been released! * home: <https://github.com/seattlerb/imap_processor> * rdoc: <http://docs.seattlerb.org/imap_processor> IMAPProcessor is a client for processing messages on an IMAP server. It provides some basic mechanisms for connecting to an IMAP server, determining capabilities and handling messages. IMAPProcessor ships with several executables which can query and manipulate IMAP mailboxes in several different ways: imap_archive :: Archives old messages to a new dated mailbox. imap_cleanse :: Delete messages older than a certain age in specified mailboxes. imap_tidy :: Archive + Cleanse: Moves older messages to a dated mailbox. imap_flag :: Flag messages to/from certain people. imap_idle :: Shows new messages in a mailbox. imap_keywords :: Queries an IMAP server for keywords set on messages imap_learn :: Flags messages based on what you've flagged before. imap_mkdir :: Ensures that certain mailboxes exist. ## Features/Problems: * Connection toolkit * Executable toolkit * Only known to work with SASL/PLAIN authentication Changes: ### 1.9.1 / 2026-09-19 * 1 minor enhancement: * Added IMAP_CONF env to override the current config.

1 0

[ruby-talk:444850] [ANN] glimmer-dsl-web 0.10.5 Released
by Andy Maleh 14 Sep '26

14 Sep '26

Release video for Glimmer DSL for Web (Award-Winning Frontend Framework for Ruby on Rails) 0.10.5 Before & After Mutations. https://youtu.be/BJ0oSsyddMg GitHub : https://github.com/AndyObtiva/glimmer-dsl-web RubyGem : https://rubygems.org/gems/glimmer-dsl-web Blog Post : https://andymaleh.blogspot.com/2026/09/video-glimmer-dsl-for-web-0105-befor…

1 0