January 09, 2026
Good morning, I'm your host with Rails Daily for January 13th, 2026. Three pull requests were merged into Rails yesterday. Jean Boussier merged a security update removing the X-XSS-Protection header from default Rails…
Duration: PT1M37S
Episode overview
This episode is a short developer briefing from Rails Daily.
It explains recent repository work in plain language.
- Show: Rails Daily
- Published: 2026-01-09T00:00:00Z
- Audio duration: PT1M37S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning, I'm your host with Rails Daily for January 13th, 2026.
Three pull requests were merged into Rails yesterday. Jean Boussier merged a security update removing the X-XSS-Protection header from default Rails headers. This deprecated security header no longer provides meaningful protection in modern browsers and has been removed starting with Rails 8.2.
Khasinski fixed a bug in ActiveModel's Errors#added? method that incorrectly returned false when querying errors with callback options like allow_nil or conditional validations. The issue was in the strict_match method which created an asymmetric comparison between stored errors and query parameters.
Shivabhusal enhanced the ActionView bug report template by adding clearer guidance for developers reporting view template rendering issues. The improved template includes structured examples to help contributors provide more reproducible code when filing bug reports.
Additional commits included Ryuta Kamizono removing unused uniqueness comparison code from ActiveRecord adapters, and Jean Boussier updating the Trix dependency in ActionText to resolve a compatibility issue.
What's next: Rails 8.2 continues removing legacy security…