Rails LTS has been conceived as a drop-in replacement for Rails 2.3, 3.2, and 4.2. However, we do recommend that you go through the list below to make sure that installing Rails LTS will work without problems.

Rails 2.3 LTS

Rails version

Your application should run the latest release of the official Rails 2.3 gems.

If you are running an earlier version, we strongly recommend [upgrading to Rails 2.3.18](https://makandracar...

Please choose a guide for your version of Ruby on Rails:

• Installing Rails 2.3 LTS
• Installing Rails 3.2 LTS
• Installing Rails 4.2 LTS
• Installing Rails 5.2 LTS
• Installing Rails 6.1 LTS

If you have installed Rails LTS before and want to update to a newer version, please see our ...

This document describes how to swap out the official Rails 2.3 gems with Rails 2.3 LTS. If you have installed Rails LTS before and want to update to a newer version, please see our update instructions.

Prerequisites

1. Make sure your project satisfies the system requirement for Rails LTS. This involves [upgrading to Rails 2.3.18](https://makandracards.com/makandra/16951-...

This document describes how to swap out the official Rails 3.2 gems with Rails 3.2 LTS. If you have installed Rails LTS before and want to update to a newer version, please see our update instructions.

Prerequisites

1. Subscribe to a Rails LTS plan to receive your credentials. If you already have a paid subscription for another version of Rails LTS, you can use the same credentials for Rails...

This document describes how to swap out the official Rails 4.2 gems with Rails 4.2 LTS. If you have installed Rails LTS before and want to update to a newer version, please see our update instructions.

Prerequisites

1. Subscribe to a Rails LTS plan to receive your credentials. If you already have a paid subscription for another version of Rails LTS, you can use the same credentials for Rails...

This document describes how to swap out the official Rails 5.2 gems with Rails 5.2 LTS. If you have installed Rails LTS before and want to update to a newer version, please see our update instructions.

Prerequisites

1. Subscribe to a Rails LTS plan to receive your credentials. If you already have a paid subscription for another version of Rails LTS, you can use the same credentials for Rails...

This document describes how to swap out the official Rails 6.1 gems with Rails 6.1 LTS. If you have installed Rails LTS before and want to update to a newer version, please see our update instructions.

Prerequisites

1. Subscribe to a Rails LTS plan to receive your credentials. If you already have a paid subscription for another version of Rails LTS, you can use the same credentials for Rails...

This document describes how to configure Rails LTS and how to take advantage of its optional security features.

The default Rails LTS configuration (:compatible) has been built for maximum compatibility with the official Rails releases. We do however recommend the :hardened configuration, which includes improvements we believe to be reasonable defaults for increased security in most applications.

On Rails 2.3, to activate :hardened configuration, add the following to the Rails::Initializer block in your `...

This document assumes you have installed Rails LTS before and want to update to a new version of the Rails LTS gem. As a subscriber to the Rails LTS service, you will be notified whenever a new version for Rails LTS becomes available.

1. Run the following comment within your Rails project directory:

    bundle update rails
   

   After updating, check that your Gemfile.lock contains the expected changes.

   If booting Rails now gives you this error:
   ...

Rails 3.2 LTS, 4.2 LTS, 5.2 LTS

Run the following command:

bundle show rails

This will display the path of the installed rails gem. The path will contain the version number, e.g. 3.2.22.8 below:

/home/alice/.rbenv/versions/2.1.2/lib/ruby/gems/2.1.0/gems/rails-3.2.22.8
                                                                 ^^^^^^^^

Rails LTS 2.3

Installation with bundler

As a customer of a paid plan who has installed Rails LTS with Bundler, run the fo...

Starting with Rails LTS 2.3.18.19, it is possible to run Rails LTS with modern versions of RubyGems (2.6.13 at the time of writing) if you are using Rails 2.3 LTS with Bundler.

With RubyGems 2+, Rails LTS will restrict the following features which are now supplied by bundler:

• You will no longer be able to use config.gem ... in environment.rb.
• You can no longer freeze/unpack gems using rails:freeze:gems or rails:gems:unpack.
• Rails will no longer search locally installed gems when looking for generators (in `...

We use a mailing list to inform customers about security vulnerabilities and new releases of Rails LTS.

You can subscribe to this list during the order process. You can also manually subscribe here: https://account.railslts.com/notifications/subscribe

When running bundle install --verbose on Bundler versions 1.12+, you might see errors of the form

HTTP 403 Forbidden https://username:password@gems.railslts.com/versions

These errors are not fatal, Rails LTS should still be installed correctly. This has been tested with all Bundler versions 1.12.x and 1.13.x.

Background:

Since version 1.12, Bundler includes a performance optimization called "compact gem index". Our gem server does not support this.

When trying to access this new index our web server will return a 403. B...

Please choose a Changelog for your version of Ruby on Rails:

• Rails 2.3 LTS Changelog
• Rails 3.2 LTS Changelog
• Rails 4.2 LTS Changelog
• Rails 5.2 LTS Changelog
• Rails 6.1 LTS Changelog

May 9th 2025, Rack version 1.4.7.23

• Backported fixes for 2 CVEs. Read the announcement. This includes fixes for
  • Unbounded-Parameter DoS in Rack::QueryParser (CVE-2025-46727)
  • Session Reuse in Rack::Session::Pool (CVE-2025-32441)

March 13th, 2025, Rack version 1.4.7.22

• Fixed CVE-2025-27610: Local File Inclusion in Rack::Static. Read the announcement

March 11t...

May 9th 2025, Rack version 1.4.7.23

• Backported fixes for 2 CVEs. Read the announcement. This includes fixes for
  • Unbounded-Parameter DoS in Rack::QueryParser (CVE-2025-46727)
  • Session Reuse in Rack::Session::Pool (CVE-2025-32441)

March 13th, 2025, Rack version 1.4.7.22

• Fixed CVE-2025-27610: Local File Inclusion in Rack::Static. Read the announcement

March 11t...

May 9th 2025, Rack version 1.6.13.21

• Backported fixes for 2 CVEs. Read the announcement. This includes fixes for
  • Unbounded-Parameter DoS in Rack::QueryParser (CVE-2025-46727)
  • Session Reuse in Rack::Session::Pool (CVE-2025-32441)

March 13th, 2025, Rack version 1.6.13.20

• Fixed CVE-2025-27610: Local File Inclusion in Rack::Static. Read the announcement

March...

May 9th 2025, Rails version 5.2.8.31

• No changes in Rails.
• Bumped Rack version requirement to version 2.2.14.10.

May 9th 2025, Rack version 2.2.14.10

• Merged upstream changes from Rack 2.2.14. Read the announcement. This includes fixes for
  • Unbounded-Parameter DoS in Rack::QueryParser (CVE-2025-46727)
  • Session Reuse in Rack::Session::Pool (CVE-2025-32441)

March 13th 2025, Rails version 5.2.8.30

• No changes in Rails.
• Bumped Rack version requireme...

May 9th 2025, Rails version 6.1.7.27

• No changes in Rails.
• Bumped Rack version requirement to version 2.2.14.10.

May 9th 2025, Rack version 2.2.14.10

• Merged upstream changes from Rack 2.2.14. Read the announcement. This includes fixes for
  • Unbounded-Parameter DoS in Rack::QueryParser (CVE-2025-46727)
  • Session Reuse in Rack::Session::Pool (CVE-2025-32441)

March 13th 2025, Rails version 6.1.7.26

• No changes in Rails.
• Bumped Rack version requireme...

This is a list of known CVEs relevant for Rails LTS 2.3+. All CVEs are fixed in all versions of Rails LTS (or may not affect some versions). If a versions of Rails LTS is not mentioned, the fix was already done in an official release Ruby on Rails release, and is therefore also part of Rails LTS.

• XSS vulnerability in the translate helper method in Ruby on Rails

  • Fixed in 2.3 LTS.

• Possible XSS Security Vulnerability in SafeBuffer#[]

  • Rails 2.3 with up to date versions of the rails_xss plugin is not affected.

• CVE-2012-1099

  • F...

Rails 2.3 and 3.2 LTS use ActionDispatch::Http::ParamsHashWithIndifferentAccess to represent params hashes, similar to Rails 5's ActionController::Parameters.

If you serialize data in Rails LTS, then upgrade to other Rails versions (such as Rails 5) and then try to deserialize the data, you might run into an error

uninitialized constant ActionDispatch::Http::ParamsHashWithIndifferentAccess

or

undefined class/module ActionDispatch::Http::ParamsHashWithIndifferentAccess

To fix this, add the following line to ...

Rails LTS (<= 4.2) contains a fix for CVE-2021-22885, but this includes a breaking change you can opt out of. In Rails 5.2 LTS and upward you cannot opt out of this, because it was already fixed in the original 5.2 release.

Affected code looks like this

redirect_to(params[:redirect_url])

If params[:redirect_url] was, for example, the array ['my', 'secret'], this would cause the method my_secret_url to be called.

That can be problematic, for example

• when there is a dangerous ..._path or ..._url method in your applicat...

Rails LTS is a service of makandra, a team of Ruby developers and Linux system engineers based in Germany. We have more than 10 years of experience developing and operating web applications, and have always taken security very seriously.

This is a brief overview of how we handle Rails security issues for LTS, and how we operate the service:

Handling of security issues

Rails LTS primarily fixes security vulnerabilities after they have been publicly disclosed for the official release of Ru...

We have made all versions of Rails LTS compatible with Ruby 3.3 or below. All Rails components should work as expected with no deprecation warnings.

However, upgrading Ruby will require manual effort. Your application may contain code that does not work on the latest Ruby. It is likely that some of your third-party dependencies do not work on the latest Ruby. The upgrading steps vary for every Rails application, and increase with the number of third-party gems.

We have ourselves successfully upgraded several older applications. Usual...