Together with  AppSignal logo

🔒 RubyGems Revokes Legacy API Keys After Possible Cache Leak — A CDN caching bug, which has existed for years, could have served accounts' legacy API keys to other users. There's no evidence of malicious use, but it's worth affected owners checking their gems over nonetheless.

Colby Swandale (Ruby Central)

💡 Luke Marshall, from Truffle Security, discovered this bug and did a full technical writeup of how the bug could have been exploited.

💡 If you want to understand how Bloom filters work at a high level, Sam Rose's visual Bloom filter explainer is fantastic.

⚡️ IN BRIEF:

📄 Active Model Conditional Validations – A tour of conditional validations, from custom contexts to validation_context, plus a case for splitting divergent behavior into separate classes instead. Kevin Murphy

📄 A Proposal for Deprecating ruby2_keywords – Dropping the compatibility mechanism introduced for the Ruby 2-to-3 keyword arguments separation seems obvious, but will have knock-on effects. Shugo Maeda

📄 'Poor Man's Escape Analysis': A Proposed CRuby Optimization Yusuke Endoh

TableTennis 1.0: Stylish Terminal Tables — A library for printing tabular data on the terminal that includes theming, automatic layout, automatic formatting of dates and numbers, coloring of numeric values, and more.

Adam Doppelt

💡 Alternatively, Rouge is a pure Ruby Pygments-compatible code highlighter.

🤖 No vibes, just vitals. AppSignal's MCP server brings Rails errors, traces & metrics into Claude, Cursor & Copilot. Debug in your editor.

Your Rails app logs events all day. TimescaleDB turns them into real-time analytics, right in the Postgres you already run.

😅  An Old/New Ruby Discovery of the Week

I recently got the itch to see what I'm getting for Christmas. Well, what's coming in Ruby 4.1, anyway. It's not going to be a big release syntax-wise, but there are a variety of new methods and features I'll share in coming weeks.

My first surprise, though, was the enhancement of a method added back in Ruby 2.4 that I had not noticed: String#unpack1

unpack1 is basically unpack that only returns the first extracted value. You'd use these methods when working with packed data, perhaps when parsing binary files, random protocols, network data, and the like.

So if, like me, you didn't know about unpack1 or the Ruby docs' surprisingly thorough Packed Data page which is *ahem* packed with examples, now you do.

The Ruby 4.1 change? unpack/unpack1 are getting new directives:

  • R for unsigned LEB128 (Little Endian Base 128) as used in DWARF and WASM.
  • r for signed LEB128.
  • ^ to return the current byte offset (more useful than it sounds).
  • x! and @! are new alignment directives to handle padding in binary formats by advancing the cursor to aligned byte positions, relative to the record's starting offset (e.g. x!4) and the whole string (@!4) respectively.

If you're not tinkering around with packing and unpacking data, you might not have any use for these, but for my sins I enjoy low-level noodling with binary data in Ruby, so am looking forward to experimenting more.

This is a niche topic, but I learnt something, this is my newsletter, and hopefully I'll get to some more useful Ruby 4.1 additions for you next time ;-)