7 ms·

Rails 5.0.1 has been released

162 points by CoachRufus87 10y ago

wjossey 10y ago
Anyone have a tl;dr?
- hartator 10y ago
  JQuery is not by default anymore.
  - faitswulff 10y ago
    I think you might be thinking of the upcoming 5.1 release.
    - hartator 10y ago
      Yes, my bad.
- faitswulff 10y ago
  The changelogs on the point releases for each gem are essentially TL;DRs. It took ~10 minutes to read through all of them. The meatiest one is probably ActiveRecord: https://github.com/rails/rails/blob/v5.0.1/activerecord/CHANGELOG.md https://github.com/rails/rails/blob/v5.0.1/activerecord/CHAN...
jph 10y ago
TLDR: Definitely worth upgrading. Approximately hundreds of small bug fixes, across much of Rails. The fixes include some important ones for database types, time comparisons, thread issues, record reloading, etc. IMHO these fixes address dozens of bugs that could cause major puzzlement for a typical Rails developer. Thanks to all the contributors for excellent work on this release.
- avitzurel 10y ago
  One of the best (or worst) bugs fixed was the aborted transaction for PGsql. I am pretty sure hundreds of Rails developers are battling it every day and don't understand where it's coming from. Even if you don't upgrade, this is something you should backport using a monkeypatch.
  - seanp2k2 10y ago
    Do you have a link to the bug or the fix? We've seen this in prod for sure.
    - Exuma 10y ago
      Can you explain more what you saw? What fails, and how does it fail? Does it raise an exception and the transaction undoes all queries, or does a query 'half execute' and save a dirty state to the DB?
  - faitswulff 10y ago
    I think that might be a 5.0.0 change, not a 5.0.1 change, if you're referring to: > Restore aborted transaction state when disable_referential_integrity fails due to missing permissions.
  - Exuma 10y ago
    Do you have a link to that?
- sfilargi 10y ago
  > IMHO these fixes address dozens of bugs that could cause major puzzlement for a typical Rails developer. That has been the reason I always avoid huge frameworks like RoR. If I was to hit a bug like this, I wouldn't know where to start debugging. How do people deal with obscure bugs in the framework with something like RoR?
  - Haydos585x2 10y ago
    They probably do it with all the spare time they have from using a framework to handle so many other features.
Sivart13 10y ago
If anyone's been holding off on upgrading to 5.x because of the deprecation warnings you get about requiring `params` as w keyword argument in keyword tests, I wrote a gem that could help: https://github.com/tjgrathwell/rails5-spec-converter https://github.com/tjgrathwell/rails5-spec-converter
- urs2102 10y ago
  This is awesome. Are there other gems and resources available for accelerating the migration from 4 to 5? Been thinking about doing it for a project for a little while.
sergioocon 10y ago
Updated and testing. Thanks!
sergioocon 10y ago
Updated and testing... Thanks!
JelteF 10y ago
Serving the SHA-1 hashes over an HTTP connection doesn't really seem useful at all to me. If you're worried about MITM the hashes could easily be changed as well.
- IanCal 10y ago
  It does still allow you to check for corruption though.
pandafoo 10y ago
How is Rails still doing in the world of NodeJS, Microservices and React?
- hashmal 10y ago
  pretty well actually. not much hype or talks about it anymore, but it's still used to get the job done.
- TheSmoke 10y ago
  react-rails is really good.
  - idra 10y ago
    react_on_rails is even better.
    - debaserab2 10y ago
      Not really. Depends completely on what you need. Not integrating with your existing asset pipeline isn't necessarily a plus depending on what your goals are. There's also a weird amount of self promotion going on with that repo. Not sure what it is about that but it's kind of been a turn off to me.
      - ch4s3 10y ago
        Its not so different from thoughtbot's repos, just a different personality.
      - deleted 10y ago
        [deleted]
- musaffa 10y ago
  In the world of Hype, I still use Ember at the frontend and Rails API at the backend.
- rebelidealist 10y ago
tinco 10y ago
If you're using Rails 5 ActionCable and you're not on Passenger, I would recommend upgrading to this release as soon as possible. Phusion[0] and other Rails 5 users[1] found a slow client issue with its implementation that was not protected against by the default app server Puma. We contacted the Rails team early on about this issue and worked closely with them to have this issue solved. Now that 5.0.1 is released we are at liberty to disclose details about this security issue. I've written a blog post[2] on the problem, using OS X network shaping tools and a simple app to demonstrate it. Rails apps running on Passenger were never affected as Passenger implements response buffering for regular requests as well as websockets connections. Note that even popular reverse proxies like Nginx don't perform response buffering for websockets as far as I know, so this is something to be aware of if you're running on other frameworks than Rails as well. [0] GH merge of patch: https://github.com/rails/rails/pull/26646 https://github.com/rails/rails/pull/26646 [1] GH related issue: https://github.com/rails/rails/issues/26409 https://github.com/rails/rails/issues/26409 [2] Blog post: https://blog.phusion.nl/2016/12/21/actioncable-under-stress-protecting-your-application-against-slow-clients-using-passenger/ https://blog.phusion.nl/2016/12/21/actioncable-under-stress-...
martijn_himself 10y ago
Slightly off-topic: is learning Rails still a good career choice? I'm not particularly keen on JavaScript on the server and I think I am slightly tired using .NET on a daily basis.
- isaac_is_goat 10y ago
  Where I'm from (Toronto, Canada), Rails development pays significantly more than any other stack and there is substantially more work available.
  - gavingmiller 10y ago
    I'd love to DM you with some questions about Toronto. Can you ping me via my profile info?
  - cknoxrun 10y ago
    Same here, on the other side of the country.
- janklimo 10y ago
  In Bangkok the demand for Rails developers is as strong as ever. With enough experience you will have no problem finding a job that pays better than other stacks. There are a number of companies like ours that'd be happy to help you with visa if you're willing to relocate. Happy to answer any questions! (contact info under my profile)
- 40_pending 10y ago
  It's worked out well for me. I started picking it up almost 2 years ago and I make more than I ever did before. Where I work we are always advertising for Senior Rails Devs. There are plenty of stable companies out there running Rails apps and I'd venture a guess that a lot of start-ups probably still use it as it's great for small teams and rapid-prototyping. On a side note, we also have hired devs who don't have Ruby experience but who are generally smart, experienced people, who know more than one programming language and are willing to learn whatever stack they need to for getting the job done.
nickjj 10y ago
If anyone is using Rails together with Docker, I just updated orats[1] to use Rails 5.0.1. [1]: https://github.com/nickjj/orats https://github.com/nickjj/orats

162 points by CoachRufus87 10y ago

wjossey 10y ago

Anyone have a tl;dr?

hartator 10y ago
JQuery is not by default anymore.
- faitswulff 10y ago
  I think you might be thinking of the upcoming 5.1 release.
  - hartator 10y ago
    Yes, my bad.
faitswulff 10y ago
The changelogs on the point releases for each gem are essentially TL;DRs. It took ~10 minutes to read through all of them. The meatiest one is probably ActiveRecord: https://github.com/rails/rails/blob/v5.0.1/activerecord/CHANGELOG.md https://github.com/rails/rails/blob/v5.0.1/activerecord/CHAN...

jph 10y ago

TLDR: Definitely worth upgrading. Approximately hundreds of small bug fixes, across much of Rails. The fixes include some important ones for database types, time comparisons, thread issues, record reloading, etc. IMHO these fixes address dozens of bugs that could cause major puzzlement for a typical Rails developer. Thanks to all the contributors for excellent work on this release.

avitzurel 10y ago
One of the best (or worst) bugs fixed was the aborted transaction for PGsql. I am pretty sure hundreds of Rails developers are battling it every day and don't understand where it's coming from. Even if you don't upgrade, this is something you should backport using a monkeypatch.
- seanp2k2 10y ago
  Do you have a link to the bug or the fix? We've seen this in prod for sure.
  - Exuma 10y ago
    Can you explain more what you saw? What fails, and how does it fail? Does it raise an exception and the transaction undoes all queries, or does a query 'half execute' and save a dirty state to the DB?
- faitswulff 10y ago
  I think that might be a 5.0.0 change, not a 5.0.1 change, if you're referring to: > Restore aborted transaction state when disable_referential_integrity fails due to missing permissions.
- Exuma 10y ago
  Do you have a link to that?
sfilargi 10y ago
> IMHO these fixes address dozens of bugs that could cause major puzzlement for a typical Rails developer. That has been the reason I always avoid huge frameworks like RoR. If I was to hit a bug like this, I wouldn't know where to start debugging. How do people deal with obscure bugs in the framework with something like RoR?
- Haydos585x2 10y ago
  They probably do it with all the spare time they have from using a framework to handle so many other features.

Sivart13 10y ago

If anyone's been holding off on upgrading to 5.x because of the deprecation warnings you get about requiring `params` as w keyword argument in keyword tests, I wrote a gem that could help: https://github.com/tjgrathwell/rails5-spec-converter https://github.com/tjgrathwell/rails5-spec-converter

urs2102 10y ago
This is awesome. Are there other gems and resources available for accelerating the migration from 4 to 5? Been thinking about doing it for a project for a little while.

sergioocon 10y ago

Updated and testing. Thanks!

sergioocon 10y ago

Updated and testing... Thanks!

JelteF 10y ago

Serving the SHA-1 hashes over an HTTP connection doesn't really seem useful at all to me. If you're worried about MITM the hashes could easily be changed as well.

IanCal 10y ago
It does still allow you to check for corruption though.

pandafoo 10y ago

How is Rails still doing in the world of NodeJS, Microservices and React?

hashmal 10y ago
pretty well actually. not much hype or talks about it anymore, but it's still used to get the job done.
TheSmoke 10y ago
react-rails is really good.
- idra 10y ago
  react_on_rails is even better.
  - debaserab2 10y ago
    Not really. Depends completely on what you need. Not integrating with your existing asset pipeline isn't necessarily a plus depending on what your goals are. There's also a weird amount of self promotion going on with that repo. Not sure what it is about that but it's kind of been a turn off to me.
    - ch4s3 10y ago
      Its not so different from thoughtbot's repos, just a different personality.
    - deleted 10y ago
      [deleted]
musaffa 10y ago
In the world of Hype, I still use Ember at the frontend and Rails API at the backend.
rebelidealist 10y ago

tinco 10y ago

If you're using Rails 5 ActionCable and you're not on Passenger, I would recommend upgrading to this release as soon as possible. Phusion[0] and other Rails 5 users[1] found a slow client issue with its implementation that was not protected against by the default app server Puma. We contacted the Rails team early on about this issue and worked closely with them to have this issue solved. Now that 5.0.1 is released we are at liberty to disclose details about this security issue. I've written a blog post[2] on the problem, using OS X network shaping tools and a simple app to demonstrate it. Rails apps running on Passenger were never affected as Passenger implements response buffering for regular requests as well as websockets connections. Note that even popular reverse proxies like Nginx don't perform response buffering for websockets as far as I know, so this is something to be aware of if you're running on other frameworks than Rails as well. [0] GH merge of patch: https://github.com/rails/rails/pull/26646 https://github.com/rails/rails/pull/26646 [1] GH related issue: https://github.com/rails/rails/issues/26409 https://github.com/rails/rails/issues/26409 [2] Blog post: https://blog.phusion.nl/2016/12/21/actioncable-under-stress-protecting-your-application-against-slow-clients-using-passenger/ https://blog.phusion.nl/2016/12/21/actioncable-under-stress-...

martijn_himself 10y ago

Slightly off-topic: is learning Rails still a good career choice? I'm not particularly keen on JavaScript on the server and I think I am slightly tired using .NET on a daily basis.

isaac_is_goat 10y ago
Where I'm from (Toronto, Canada), Rails development pays significantly more than any other stack and there is substantially more work available.
- gavingmiller 10y ago
  I'd love to DM you with some questions about Toronto. Can you ping me via my profile info?
- cknoxrun 10y ago
  Same here, on the other side of the country.
janklimo 10y ago
In Bangkok the demand for Rails developers is as strong as ever. With enough experience you will have no problem finding a job that pays better than other stacks. There are a number of companies like ours that'd be happy to help you with visa if you're willing to relocate. Happy to answer any questions! (contact info under my profile)
40_pending 10y ago
It's worked out well for me. I started picking it up almost 2 years ago and I make more than I ever did before. Where I work we are always advertising for Senior Rails Devs. There are plenty of stable companies out there running Rails apps and I'd venture a guess that a lot of start-ups probably still use it as it's great for small teams and rapid-prototyping. On a side note, we also have hired devs who don't have Ruby experience but who are generally smart, experienced people, who know more than one programming language and are willing to learn whatever stack they need to for getting the job done.

nickjj 10y ago

If anyone is using Rails together with Docker, I just updated orats[1] to use Rails 5.0.1. [1]: https://github.com/nickjj/orats https://github.com/nickjj/orats