Rails 4 received new update

Ruby on Rails 4 received new 4.2.9 update that solves security issues.
27 June 2017   1857

Ruby

A dynamic, open source programming language, focused on simplicity and productivity
 

Ruby on Rails

Ruby on Rails (RoR) - a framework written in the Ruby programming language

New update for "old" RoR has been released recently. According to the developers' maintenance policy, since the release of Rails 5.1.0, the 4.2 series will only receive new releases in case of security issues. 

Changelists

  • Action Pack:
    • Use more specific check for :format in route path
      The current check for whether to add an optional format to the path is very lax and will match things like :format_id where there are nested resources, e.g:

      resources :formats do
        resources :items
      end

      Fix this by using a more restrictive regex pattern that looks for the patterns (.:format).:format or / at the end of the path. Note that we need to allow for multiple closing parenthesis since the route may be of this form:

      get "/books(/:action(.:format))", controller: "books"
      
  • Active Record:

    • Fixed regression caused by collection_singular_ids= ignoring different primary key on relationship.

    • Fix rake db:schema:load with subdirectories.

    • Fix rake db:migrate:status with subdirectories.

    • Fix regression of #1969 with SELECT aliases in HAVING clause.

    • Fix wait_timeout to configurable for mysql2 adapter.

    • Make table_name= reset current statement cache, so queries are not run against the previous table name.

  • Active Support:

    • Fixed bug in DateAndTime::Compatibility#to_time that caused it to raise RuntimeError: can't modify frozen Time when called on any frozen Time. Properly pass through the frozen Time or ActiveSupport::TimeWithZoneobject when calling #to_time.

    • Restore the return type of DateTime#utc
      In Rails 5.0 the return type of DateTime#utc was changed to Time to be consistent with the new DateTime#localtime method. When these changes were backported in #27553 this inadvertently changed the return type in a patcn release. Since DateTime#localtime was new in Rails 4.2.8 it's okay to restore the return type of DateTime#utc but keep DateTime#localtime as returning Time without breaking backwards compatibility.

    • In Core Extensions, make MarshalWithAutoloading#load pass through the second, optional argument for Marshal#load( source [, proc] ). This way we don't have to doMarshal.method(:load).super_method.call(sourse, proc) just to be able to pass a proc.

    • Cache ActiveSupport::TimeWithZone#to_datetime before freezing.

    • AS::Testing::TimeHelpers#travel_to now changes DateTime.now as well as Time.now and Date.today.

Check full list of changes. 

SHA-256

Feel free to use this checksum in order to verify your gem's version:

$ shasum -a 256 *-4.2.9.gem
bffbd5830a26af64d92548a831624a5422c77d97b2115c08b668fcbcc26f34ad  actionmailer-4.2.9.gem
8471fb1f9cc4962f3e000325821f1de0538a12cb580b0772ff9f89fbc8c1f9cd  actionpack-4.2.9.gem
d7fbbe069f74a6e7ce76cf91d0fede1593a0ed0db875f4630d8343551fb96f12  actionview-4.2.9.gem
a0086b19823d056efc1c8e7052d6684f54bebe7c9101ba69bd1a58c33d737451  activejob-4.2.9.gem
dbcd32a5e6294323b893565c0c334f6d89bb92d5085ce5e3d0454de0ed8eb5e3  activemodel-4.2.9.gem
0be77a1f77b2c8ae0e767c6fafb4c8fdda89c0be49ded0ae6f9644e81a4827a2  activerecord-4.2.9.gem
5717d2fe6409d4df72f0d20e46d7261503ccafc80ab228e91455d47185190ab4  activesupport-4.2.9.gem
eaaa4c1cafb3f9bd9f8dd58dd142522e398a5ad0d03abf2e3de364a63d4b7d1a  rails-4.2.9.gem
ad7b7765849a9aff0c42674f9512c39c098af63bb8476a4076a252fac3b4b2bc  railties-4.2.9.gem

 

Charles Nutter. How to move your Ruby project to JRuby and why

Charles Nutter works on JRuby and JVM language support at Red Hat.
03 October 2018   1199

— How did you get into programming and into Ruby world?

— In 2004, I was working at a government contracting firm as a Java Enterprise Architect. I was in charge of a large mainframe conversion for the United States Department of Agriculture, which meant I spent a couple weeks a month in the Washington D.C. area. One of those trips coincided with RubyConf 2004, and since a close friend had been recommending I look at Ruby, I decided to attend. So there I was sitting in a Ruby conference without ever having learned Ruby...and I understood every piece of code, every example. I was amazed and vowed to find a way to bring Ruby into my Java world.

— Which projects are you working on now?

— My primary role is as co-lead of JRuby. This also means supporting several side projects like our native-library backend (Ruby's FFI library is maintained by us using this backend on JRuby) and our String encoding subsystem (an elaborate port of the logic from CRuby). I also do much of the outreach to the community and try to make sure our users are getting their issues addressed. There's always plenty to work on!

— Which one would have the biggest general impact from you opinion?

— I like to think that JRuby, while not the most popular JVM language, has at least helped to change the JVM platform. Because of our collaborations with Sun Microsystems, Oracle, and others, we have solid dynamic language support at the JVM level along with many other projects to support alternative languages. The JVM today is a much more hospitable home for non-Java languages than it used to be, and I hope we've played some small part in that change.

— Which languages are you writing on in your everyday life? Which one do you like most? Why?

— Most days I write in a mix of Ruby and Java, since JRuby is implemented using both. I like both languages for different tasks. Ruby is a better language for building applications that need to evolve and adapt quickly. Java is a great language for writing high-speed, reliable libraries and services. JRuby gives you the best of both worlds!

— Do you like to program in Java?

— I do, especially with all the language improvements that have been added recently, like lambdas (closures or blocks in Ruby) and the new "var" syntax for declaring local variables when the static type is unambiguous.

— What do you think about Rust?

— Rust is a great language! I did a lot of C++ development in my college years, and I can tell you right now if I'd had Rust available then I would have used it. I'm especially jealous of the static-typed ownership model, which helps avoid thread-safety issues like races and data corruption. I hope to see other languages adopt this pattern in the future.

— What do you think about the Ruby language perspective? Is it or its community dying?

— After all these years working on JRuby, I do still love Ruby syntax and the Ruby way of doing things. However I worry that the language is held back too much by limitations of its primary runtime. JRuby has been fighting to make true parallel threading a reality for Ruby developers, but still today the vast majority of Ruby services are run using multiple isolated processes, wasting tremendous amounts of CPU and memory resources. I believe this is due to the C API for writing Ruby extensions being so large and so invasive...it prevents many improvements -- including parallel threading -- from being developed. Hopefully we'll see this change some day.

— Which upcoming or not well-known features of Ruby language would rush in future?

— I look forward to strings becoming immutable-by-default, as they are in most other languages. Parallel programming would be much simpler if more of Ruby's objects supported pure-immutable or "deep freeze" semantics. It's a bit like the Rust ownership model...if you're going to be sharing an object across threads, choose the version of that object that you know can't be modified anymore. This extends to arrays, hashes, and just about every other mutable object in Ruby: we need to make it easier to lock down mutable data.

— Could you give me an advice on how to move my ancient monolithic project to JRuby? And should I?

— The first question really is whether such a move would benefit you. There's many good reasons to consider a move to JRuby:

  • Reducing CPU  and memory costs in a shared hosting environment by utilizing JRuby's true parallel threading
  • Deploying a Ruby application into a JVM-heavy environment, such as used by larger financial or government organizations
  • Needing access to libraries that only exist on the JVM, or that are more portable or scalable on the JVM than their Ruby or C equivalents
  • Getting a little performance boost out of CPU-heavy or concurrency-heavy applications.

— I would say if your application is scaling well and not costing you too much today, perhaps you don't need to make a move. But if you decide you need more out of Ruby, here's the process for migrating:

  • Do a clean bundle of your application, paying special attention to C extensions you may be using. You can also do this bundling *on* JRuby, and then deal with missing or unsupported libraries one by one.
  • For each extension, search for a JRuby equivalent. We have some pages on the JRuby wiki to help with this. Most popular libraries have JRuby versions. If no JRuby version exists, you may look for a pure-Ruby version (it might be fast enough on JRuby) or a JVM library (in Java or Scala or Clojure or whatever) that could be used as a replacement.
  • Once your bundle completes, you should have a working JRuby application! We've worked very hard on compatibility, and try to be responsive if users find new issues, but a successfully-bundled application is expected to work.

The steps beyond this involve deciding how to take advantage of your newfound power: how many threads to throw at a given server, what you're going to do with all the money you're saving, etc.

— What should nowadays students learn to become good programmers?

— When I was at university, my earliest computer science courses used the Scheme language, a Lisp-like functional language that's great for teaching the fundamentals of programming. I still recommend that serious new programmers work through at least some of the Structure and Interpretation of Computer Programs book from MIT. Beyond that, I'd say learn as many different and unusual languages as you can; they'll all give you new ideas and new ways to look at programming problems.

— How do you keep yourself motivated for programming? Have you ever been "burned-out"?

— Burn-out is a real problem in our industry, and working in open source brings with it huge amount of stress. We've all felt that way sometimes...too much work to do and not enough time to do it, missing out on time with family and friends, ignoring our own health so we can fix one more bug. These days I try to center myself by keeping up with hobbies: playing video and board games, learning to play guitar, studying foreign languages, and traveling around the world to meet new friends. There's always this nagging workaholic telling me to get back on the job, but I'm learning how to maintain the right balance.

— What do you think about Russia and what do you expect of the upcoming RubyRussia event?

— I love Russia, and my speaking trips the past few years have been some of the most rewarding of my life. This will be my fourth visit, having been to Saint-Petersburg, Moscow, and Novosibirsk (!!!) previously. I'm looking forward to returning to Moscow and meeting the RubyRussia community I've heard so much about!

Questions by Dmitry Matveyev PM at Evrone https://www.facebook.com/matveyev.d