101 System requirements

Rails LTS has been conceived as a drop-in replacement for Rails 2.3, 3.2, and 4.2. However, we do recommend that you go through the list below to make sure that installing Rails LTS will work without problems.

Rails 2.3 LTS

Rails version

Your application should run the latest release of the official Rails 2.3 gems.

If you are running an earlier version, we strongly recommend [upgrading to Rails 2.3.18](https://makandracar...

102 Installing Rails LTS

Please choose a guide for your version of Ruby on Rails:

If you have installed Rails LTS before and want to update to a newer version, please see our [update instructions](https://makandracards.com...

103 Installing Rails 2.3 LTS with Bundler

This document describes how to swap out the official Rails 2.3 gems with Rails 2.3 LTS. If you have installed Rails LTS before and want to update to a newer version, please see our update instructions.

Prerequisites

  1. Make sure your project satisfies the system requirement for Rails LTS. This involves [upgrading to Rails 2.3.18](https://makandracards.com/makandra/16951-upgrading-rails-2-from-2-3-8-through-...

103 Installing Rails 3.2 LTS

This document describes how to swap out the official Rails 3.2 gems with Rails 3.2 LTS. If you have installed Rails LTS before and want to update to a newer version, please see our update instructions.

Prerequisites

  1. Subscribe to a Rails LTS plan to receive your credentials. If you already have a paid subscription for another version of Rails LTS, you can use the same credentials for Rails...

103 Installing Rails 4.2 LTS

This document describes how to swap out the official Rails 4.2 gems with Rails 4.2 LTS. If you have installed Rails LTS before and want to update to a newer version, please see our update instructions.

Prerequisites

  1. Subscribe to a Rails LTS plan to receive your credentials. If you already have a paid subscription for another version of Rails LTS, you can use the same credentials for Rails...

103 Installing Rails 5.2 LTS

This document describes how to swap out the official Rails 5.2 gems with Rails 5.2 LTS. If you have installed Rails LTS before and want to update to a newer version, please see our update instructions.

Prerequisites

  1. Subscribe to a Rails LTS plan to receive your credentials. If you already have a paid subscription for another version of Rails LTS, you can use the same credentials for Rails...

104 Enabling additional security features in Rails LTS

This document describes how to configure Rails LTS and how to take advantage of its optional security features.

The default Rails LTS configuration (:compatible) has been built for maximum compatibility with the official Rails releases. We do however recommend the :hardened configuration, which includes improvements we believe to be reasonable defaults for increased security in most applications.

On Rails 2.3, to activate :hardened configuration, add the following to the Rails::Initializer block in your `...

104 Updating Rails LTS to a newer version

This document assumes you have installed Rails LTS before and want to update to a new version of the Rails LTS gem. As a subscriber to the Rails LTS service, you will be notified whenever a new version for Rails LTS becomes available.

  1. If you have installed Rails LTS with Bundler, simply run the following comment within your Rails project directory:

     bundle update rails
    

    After updating, check that your Gemfile.lock contains the expected changes.
    ...

105 How to find out your current Rails LTS version

Rails 3.2 LTS, 4.2 LTS, 5.2 LTS

Run the following command:

bundle show rails

This will display the path of the installed rails gem. The path will contain the version number, e.g. 3.2.22.8 below:

/home/alice/.rbenv/versions/2.1.2/lib/ruby/gems/2.1.0/gems/rails-3.2.22.8
                                                                 ^^^^^^^^

Rails LTS 2.3

Installation with bundler

As a customer of a paid plan who has installed Rails LTS with Bundler, run the fo...

106 RubyGems 2.x support for Rails 2.3 LTS

Starting with Rails LTS 2.3.18.19, it is possible to run Rails LTS with modern versions of RubyGems (2.6.13 at the time of writing) if you are using Rails 2.3 LTS with Bundler.

With RubyGems 2+, Rails LTS will restrict the following features which are now supplied by bundler:

  • You will no longer be able to use config.gem ... in environment.rb.
  • You can no longer freeze/unpack gems using rails:freeze:gems or rails:gems:unpack.
  • Rails will no longer search locally installed gems when looking for generators (in `...

110 Known issue: HTTP 403 error in "bundle install --verbose" output

When running bundle install --verbose on Bundler versions 1.12+, you might see errors of the form

HTTP 403 Forbidden https://username:password@gems.railslts.com/versions

These errors are not fatal, Rails LTS should still be installed correctly. This has been tested with all Bundler versions 1.12.x and 1.13.x.

Background:

Since version 1.12, Bundler includes a performance optimization called "compact gem index". Our gem server does not support this.

When trying to access this new index our web server will return a 403. B...

202 Rails 2.3 LTS Changelog

Jan 20th, 2023: Rails version 2.3.18.47

  • Fixed a ReDoS vulnerabilities in Rails: [CVE-2023-22796]
  • Fixed a DOS vulnerability in the PostgreSQL adapter for ActiveRecord [CVE-2022-44566]
    • ActiveRecord will now throw an exception, if you pass an integer > 64bit. You can opt out using
      config.active_record.raise_int_wider_than_64bit = false
      
  • See here for more details

Jan 20th, 2023: Rack version 1.4.7.12

  • Fixed multiple...

204 Rails 3.2 LTS Changelog

Jan 24th, 2023: Rails version 3.2.22.35

  • Bugfix for an issue with cookie domains introduced by [CVE-2023-22792]. Please read the details, if you had 3.2.22.34 running in production.

Jan 20th, 2023: Rails version 3.2.22.34

  • Fixed multiple ReDoS vulnerabilities in Rails: [CVE-2023-22792], [CVE-2023-22796]
  • Fixed a DOS vulnerability in the PostgreSQL adapter for ActiveRecord [CVE-2022-44566]
    • ActiveRecord will now throw an exception, if ...

205 Rails 4.2 LTS Changelog

Jan 24th, 2023: Rails version 4.2.11.28

  • Bugfix for an issue with cookie domains introduced by [CVE-2023-22792]. Please read the details if you had 4.2.11.27 running in production.

Jan 20th, 2023: Rails version 4.2.11.27

  • Fixed multiple ReDoS vulnerabilities in Rails: [CVE-2023-22792], [CVE-2023-22796], [CVE-2022-22795]
  • Fixed a DOS vulnerability in the PostgreSQL adapter for ActiveRecord [CVE-2022-44566]
    • ActiveRecord will now throw ...

206 Rails 5.2 LTS Changelog

Jan 24th, 2023: Rails version 5.2.8.16

  • Bugfix for an issue with cookie domains introduced by [CVE-2023-22792]. Please read the details if you had 5.2.8.15 running in production.

Jan 20th, 2023: Rails version 5.2.8.15

  • Fixed multiple ReDoS vulnerabilities in Rails: [CVE-2023-22792], [CVE-2023-22796], [CVE-2022-22795]
  • Fixed a DOS vulnerability in the PostgreSQL adapter for ActiveRecord [CVE-2022-44566]
    • ActiveRecord will now throw an ...

209 List of CVEs addressed by Rails LTS

This is a list of known CVEs relevant for Rails LTS 2.3+. All CVEs are fixed in all versions of Rails LTS (or may not affect some versions). If a versions of Rails LTS is not mentioned, the fix was already done in an official release Ruby on Rails release, and is therefore also part of Rails LTS.

  • XSS vulnerability in the translate helper method in Ruby on Rails

    • Fixed in 2.3 LTS.
  • Possible XSS Security Vulnerability in SafeBuffer#[]

    • Rails 2.3 with up to date versions of the rails_xss plugin is not affected.
  • CVE-2012-1099

    • F...

210 Fixing 'uninitialized constant / undefined class/module ActionDispatch::Http::ParamsHashWithIndifferentAccess' when migrating away from Rails LTS

Rails 2.3 and 3.2 LTS use ActionDispatch::Http::ParamsHashWithIndifferentAccess to represent params hashes, similar to Rails 5's ActionController::Parameters.

If you serialize data in Rails LTS, then upgrade to other Rails versions (such as Rails 5) and then try to deserialize the data, you might run into an error

uninitialized constant ActionDispatch::Http::ParamsHashWithIndifferentAccess

or

undefined class/module ActionDispatch::Http::ParamsHashWithIndifferentAccess

To fix this, add the following line to an initial...

211 Using strings in polymorphic helpers / CVE-2021-22885

Rails LTS (<= 4.2) contains a fix for CVE-2021-22885, but this includes a breaking change you can opt out of. In Rails 5.2 LTS you cannot opt out of this, because it was already fixed in the original 5.2 release.

Affected code looks like this

redirect_to(params[:redirect_url])

If params[:redirect_url] was, for example, the array ['my', 'secret'], this would cause the method my_secret_url to be called.

That can be problematic, for example

  • when there is a dangerous ..._path or ..._url method in your application,
  • or w...

250 Security standards and practices

Rails LTS is a service of makandra, a team of Ruby developers and Linux system engineers based in Germany. We have more than 10 years of experience developing and operating web applications, and have always taken security very seriously.

This is a brief overview of how we handle Rails security issues for LTS, and how we operate the service:

Handling of security issues

Rails LTS primarily fixes security vulnerabilities after they have been publicly disclosed for the official release of Ru...

290 Ruby 2.7 support for Rails 2.3 LTS

Rails 2.3 LTS works with Ruby 1.8.7, Ruby 2.5, and Ruby 2.7. Typical web apps see a 2x to 4x performance boost by switching from Ruby 1.8.7 to Ruby 2.5+. "Support" means that upgrading a Rails 2.3 application to Ruby 2.5 will not require Rails related monkey patches.

However, upgrading will still require some effort for the majority of Rails 2.3 applications, since your own code as well as some third-party gems will most likely have compatibility issues. You should only attempt this as a somewhat experienced Rub...

291 Ruby 2.7 support for Rails 3.2 LTS

Rails 3.2 LTS works with Ruby 1.8.7, 1.9.3, 2.3, 2.5, and 2.7. "Support" means that upgrading a Rails 3.2 application to Ruby 2.5 will not require Rails related monkey patches.

However, upgrading will still require some effort for the majority of Rails 3.2 applications, since your own code as well as some third-party gems might have compatibility issues. This is especially
true if you upgrade from Ruby 1.x. You should only attempt this as a somewhat experienced Ruby developer, and only if you have a good automat...

303 Backported patches for legacy Ruby versions

The Rails LTS service only covers security updates for the Rails framework, not for Ruby.

As a courtesy to our customers, we sometimes backport security patches to legacy Ruby versions, which you can find below. However, we cannot guarantee future patches for legacy Ruby versions.

Patches for Ruby 1.8.7

Download ruby_1_8_7-p374-fixes-2015-04-14.patch and rename it to download.patch.

This patch applies to Ruby version **...

310 rspec-rails 1.3 compatibility fork for Rails LTS 2.3

An expectation like this will fail with Rails LTS 2.3:

should render_template(:edit)

The error will look like this:

expecting <:edit> but rendering with <"">

This is an issue with rspec-rails 1.x monkey-patching into ActionController during controller specs.

Fix

To fix this, use our compatibility fork of rspec-rails 1.3.

With Bundler

If ...