--- title: Issue #824: How fast can you actually patch Ruby? — Ruby... description: After last week's CRuby security fixes, one developer timed how fast different distribution channels shipped the patch. The core team's own Docker image took... canonical: https://daily.dev/posts/issue-824-how-fast-can-you-actually-patch-ruby-ruby-weekly-0rd1dd9ai twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Issue #824: How fast can you actually patch Ruby? — Ruby Weekly | daily.dev og:description: After last week's CRuby security fixes, one developer timed how fast different distribution channels shipped the patch. The core team's own Docker image took... og:url: https://daily.dev/posts/issue-824-how-fast-can-you-actually-patch-ruby-ruby-weekly-0rd1dd9ai og:image: https://api.daily.dev/og/posts/0rD1dd9aI.png og:image:alt: Issue #824: How fast can you actually patch Ruby? — Ruby Weekly og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Issue #824: How fast can you actually patch Ruby? — Ruby Weekly **[Ruby Weekly](https://daily.dev/sources/rbywkly)** · 3 min read · 1 upvotes · 0 comments ## Summary After last week's CRuby security fixes, one developer timed how fast different distribution channels shipped the patch. The core team's own Docker image took eight minutes, while Docker's official Ruby image, the default for Rails and Kamal, took about 16 hours. Ruby core team members now have commit access to that Docker image repo and are looking into automating updates. The issue also covers a Rails middleware deep dive on junk requests, Spree 6.0's rewrite of the Rails e-commerce platform with a React admin and Next.js storefront, and releases including RubyGems/Bundler 4.1.0.beta3, Prosopite 2.5, OmniAuth 2.2 / 2.3, Git Gem 6.0 and ruby-duckdb 2.0. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How long did it take Docker's official Ruby image to get the recent CRuby security patch? About 16 hours, compared to just eight minutes for the Ruby core team's own Docker image. Docker's official Ruby image is the default base image used by Rails and Kamal deployments, so that delay left many production apps running vulnerable Ruby versions for much longer than necessary after the fix shipped. _daily.dev helps developers track patch lag across base images so you're not caught running a vulnerable Ruby build._ ### What changed in Spree 6.0 for Rails e-commerce apps? Spree 6.0 is a rewrite that moves marketplace, B2B, tax and inventory features into the open source core, splits carts and orders into separate models, and removes the checkout state machines entirely. Rails now only powers the backend, while a React admin panel and a Next.js storefront handle the frontend, making it a headless e-commerce platform rather than a monolithic Rails app. _Developers evaluating e-commerce stacks can follow architecture shifts like Spree's headless rewrite on daily.dev._ ### What's new in RubyGems and Bundler 4.1.0.beta3? Bundler 4.1.0.beta3 renames the new 'override' keys to 'in:' and 'with:', and it records overrides in a new 'OVERRIDES' section of Gemfile.lock. This gives teams clearer, more explicit syntax for managing gem overrides and better visibility into which dependencies have been overridden directly in the lockfile. _Ruby teams tracking Bundler's override syntax changes can keep up with beta releases on daily.dev._ ## Similar posts on daily.dev - [Patching fast and slow: Ruby devs delay to defend against supply chain attack](https://daily.dev/posts/patching-fast-and-slow-ruby-devs-delay-to-defend-against-supply-chain-attack-ywjknxskm) · InfoWorld · 0 upvotes · 0 comments - [Ruby Weekly Issue 791: March 12, 2026](https://daily.dev/posts/ruby-weekly-issue-791-march-12-2026-lrafffznx) · Ruby Weekly · 0 upvotes · 0 comments - [Faster bundler](https://daily.dev/posts/faster-bundler-rrqhsfren) · RUBYLAND · 0 upvotes · 0 comments - [Ruby Central’s OSS Changelog: October 2026](https://daily.dev/posts/ruby-central-s-oss-changelog-october-2026-pkql1jxvd) · RUBYLAND · 0 upvotes · 0 comments - [Ruby & Rails Weekly: KindaRails2Shell Exploited, Ractor Rails](https://daily.dev/posts/ruby-rails-weekly-kindarails2shell-exploited-ractor-rails-70dte5arg) · Ruby Flow · 3 upvotes · 0 comments --- Tags: [#docker](https://daily.dev/tags/docker), [#ruby](https://daily.dev/tags/ruby), [#rails](https://daily.dev/tags/rails) [View this post on daily.dev](https://daily.dev/posts/issue-824-how-fast-can-you-actually-patch-ruby-ruby-weekly-0rd1dd9ai) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Issue #824: How fast can you actually patch Ruby? — Ruby Weekly","url":"https://daily.dev/posts/issue-824-how-fast-can-you-actually-patch-ruby-ruby-weekly-0rd1dd9ai","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/issue-824-how-fast-can-you-actually-patch-ruby-ruby-weekly-0rd1dd9ai"},"datePublished":"2026-10-29T13:31:19.697Z","dateModified":"2026-10-29T13:31:48.838Z","description":"After last week's CRuby security fixes, one developer timed how fast different distribution channels shipped the patch. The core team's own Docker image took...","image":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","thumbnailUrl":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","isAccessibleForFree":true,"articleSection":"Ruby Weekly","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Ruby Weekly","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3caaad8c23954502ac0e20b2189fd420","url":"https://daily.dev/sources/rbywkly"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/issue-824-how-fast-can-you-actually-patch-ruby-ruby-weekly-0rd1dd9ai","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"docker,ruby,rails","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Ruby Weekly","item":"https://daily.dev/sources/rbywkly"},{"@type":"ListItem","position":3,"name":"Issue #824: How fast can you actually patch Ruby? — Ruby Weekly"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/issue-824-how-fast-can-you-actually-patch-ruby-ruby-weekly-0rd1dd9ai#faq","mainEntity":[{"@type":"Question","name":"How long did it take Docker's official Ruby image to get the recent CRuby security patch?","acceptedAnswer":{"@type":"Answer","text":"About 16 hours, compared to just eight minutes for the Ruby core team's own Docker image. Docker's official Ruby image is the default base image used by Rails and Kamal deployments, so that delay left many production apps running vulnerable Ruby versions for much longer than necessary after the fix shipped. daily.dev helps developers track patch lag across base images so you're not caught running a vulnerable Ruby build."}},{"@type":"Question","name":"What changed in Spree 6.0 for Rails e-commerce apps?","acceptedAnswer":{"@type":"Answer","text":"Spree 6.0 is a rewrite that moves marketplace, B2B, tax and inventory features into the open source core, splits carts and orders into separate models, and removes the checkout state machines entirely. Rails now only powers the backend, while a React admin panel and a Next.js storefront handle the frontend, making it a headless e-commerce platform rather than a monolithic Rails app. Developers evaluating e-commerce stacks can follow architecture shifts like Spree's headless rewrite on daily.dev."}},{"@type":"Question","name":"What's new in RubyGems and Bundler 4.1.0.beta3?","acceptedAnswer":{"@type":"Answer","text":"Bundler 4.1.0.beta3 renames the new 'override' keys to 'in:' and 'with:', and it records overrides in a new 'OVERRIDES' section of Gemfile.lock. This gives teams clearer, more explicit syntax for managing gem overrides and better visibility into which dependencies have been overridden directly in the lockfile. Ruby teams tracking Bundler's override syntax changes can keep up with beta releases on daily.dev."}}]} ```