Ruby on Rails consulting
As of 4 September 2026 only Rails 8.0.x and 8.1.x receive security fixes: 8.0.x until 7 November 2026, 8.1.x until 10 October 2027. Allerin is a Rails consultancy founded in 2005, headquartered in Austin, Texas, with engineering in Navi Mumbai. We upgrade Rails applications, build new Rails products, place senior Rails engineers inside product teams, and take over Rails codebases other teams left broken. We do not sell monthly maintenance plans and we do not quote before we have read the code.
What we are
Allerin has written Rails since 2005; the public record of that work starts with client recommendations from 2007, when the framework was on its 1.x and 2.x series. We are an expert firm, not a body shop. That shows up in three ways. You choose your engineers from full profiles before kickoff, and the engineers you choose stay on the engagement. The CEO, Naveen Joshi, leads every US engagement from Austin and reads every first message. And we start every engagement with questions about your stack, not with a rate card.
Sources: Rails maintenance policy.
Start with twelve questions
Answer as many as you can. Each one has a command or a grep behind it. Send us your answers and we will tell you what they mean before anyone talks about scope. The full reasoning behind each question, with the check that answers it, is on the questions page. Read the questions page.
1. Which Rails series and patch level does production run today, and on what date does its security support end?
Why it matters: Only 8.0.x and 8.1.x receive security fixes. 7.2.x ended on 9 August 2026, 8.0.x ends on 7 November 2026, and 8.1.x runs to 10 October 2027 (bug fixes end 10 October 2026), so 8.1 is the target of every upgrade scoped this year. 7.0.10 and 7.1.6 were the final releases of their series on 29 October 2025. Rails 8.1 still accepts Ruby 3.2, so a Rails version alone does not tell you whether you are supported.
Sources: Rails maintenance policy; End of support post.
2. What does vips --version print inside your production image, and which activestorage version is in Gemfile.lock?
Why it matters: CVE-2026-66066 (CVSS 9.5, advisory dated 29 July 2026) is fixed only in 7.2.3.2, 8.0.5.1 and 8.1.3.1, and the fix needs libvips 8.13 or newer; below that floor the patched gem raises at boot. load_defaults 7.0 is what switched Active Storage to :vips, and Debian bullseye ships libvips 8.10.5 while Ubuntu jammy ships 8.12.1, so the exposure sits in the Dockerfile, not the Gemfile. An app that never raised its defaults may still be on mini_magick and outside the advisory.
3. Which Ruby does production actually boot, and who owns the base image?
Why it matters: Ruby 3.2 reached end of life on 1 April 2026, 3.3 is security-only with an expected end of 31 March 2027, and 3.4 and 4.0 are in normal maintenance. Rails 8.1.3.1 still accepts Ruby 3.2.0, so a green Gemfile can hide an unsupported runtime. The image also decides libyaml (unbundled since Ruby 3.2) and libvips; Heroku's default Ruby is 3.3.9.
Sources: Ruby branches; Heroku Ruby support.
4. Which gems on the request path have had no release in 24 months, which are pinned to a git SHA, and which patch Rails internals?
Why it matters: Gems block more hops than the framework does. paranoia pinned activerecord below 8.1 in October 2025; data-migrate broke on 7.1 until 9.2.0 despite an open-ended gemspec; 23 gems had undocumented 7.1 incompatibilities. Patches on private API (the ActiveSupport::Deprecation singleton, removed in 7.2) fail with no deprecation to grep for.
5. Which of csv, base64, bigdecimal, logger, ostruct, benchmark and cgi does your Gemfile declare explicitly?
Why it matters: Ruby 3.4 (25 December 2024) moved csv, base64 and bigdecimal, among others, from default to bundled gems; Ruby 4.0 (25 December 2025) did the same for ostruct, pstore, benchmark, logger, rdoc, win32ole, irb and reline and cut cgi down to cgi/escape. Under Bundler each undeclared require is a bare LoadError, usually raised inside an older gem rather than your code. Ruby 3.3 warns about the 3.4 set and Ruby 3.4 warns about the 4.0 set, which is why both are staging stops.
Sources: Ruby 3.4 NEWS; Ruby 4.0 NEWS.
6. What does config.load_defaults say versus the Rails you run, and how many lines in new_framework_defaults_X_Y.rb are still commented out?
Why it matters: The 7.1 template carries 28 settings (cache format, message serializer, column serializer, HTML5 test parser); 7.2 adds enqueue_after_transaction_commit, validate_migration_timestamps and yjit; 8.0 sets to_time_preserves_timezone = :zone, strict_freshness = true and Regexp.timeout = 1; 8.1 adds six more, including raise_on_missing_required_finder_order_columns. The version in your Gemfile and the behavior your app runs are two different numbers, and the gap between them is the real upgrade backlog.
7. Can the app boot on two Gemfiles today, and does CI run the suite on both?
Why it matters: Dual boot (next_rails 1.7.0, released 6 August 2026, or Shopify's bootboot) is how an upgrade ships behind a flag instead of behind a code freeze. One Medical moved a 175,000-line, ten-year-old monolith from Rails 5 to 6 to 7 this way with two rollbacks that affected two users. It is table stakes, not a differentiator; if a firm presents it as novel, ask what else they are behind on. If the answer is no, that is the first task, not a finding.
Sources: next_rails; One Medical, 17 May 2023.
8. What is your test coverage on the money, auth and PII paths, including system tests for the JavaScript flows, and is CI green today?
Why it matters: The Rails guide says the best protection is good coverage before you start, and coverage is the variance driver every firm names first; the niche leader will not start below roughly 80 percent. Some changes pass tests while meaning something else: 7.2 makes tests honor the configured queue adapter, and 6.1 turned where.not with several conditions into NAND. Those only surface where the paths are covered.
Sources: Upgrading guide; FastRuby, 6 March 2026; 6.1 release notes.
9. Which asset pipeline are you on (Webpacker, Sprockets, Propshaft), and who owns that migration?
Why it matters: Webpacker is retired; Rails 7.0 dropped sprockets-rails from the rails gem's dependencies; 8.0 (7 November 2024) made Propshaft the default for new apps while upgraded apps keep Sprockets with an explicit pin. Practitioners report the front-end move takes more effort than the framework hop, and the Propshaft maintainer says staying on Sprockets is fine, so it is scoped as its own decision.
10. Which Active Job adapter do you run, and is it still in Rails core?
Why it matters: Rails 8.1 (22 October 2025) deprecated the built-in sidekiq adapter (sidekiq 7.3.3 or newer ships its own), and the 8.2 edge notes remove it and deprecate the delayed_job, resque, queue_classic, backburner and sneakers adapters. Since 7.2, enqueues defer until after the transaction commits, which changes job timing with no warning in the log. Solid Queue is a product decision, not an upgrade step: it wants MySQL 8 or newer, MariaDB 10.6 or newer or PostgreSQL 9.5 or newer for FOR UPDATE SKIP LOCKED and its own database.
11. How many people can deploy and roll back today, how many minutes does a rollback take, and which migrations in the upgrade branch are irreversible?
Why it matters: Rollbacks fail on three things: irreversible migrations, cache entries written in a format the old version cannot read (7.0 and 7.1 each need a two-step deploy), and gem faults seen only in production (a Ruby 4.0.2 rollback to 3.4.9 on latency in April 2026 is the recent public example). strong_migrations 2.8.0 (14 May 2026) guards the first; a named second deployer guards the rest.
12. Which LLM or model calls run inside the request cycle instead of a job, and which of your data leaves your boundary in a prompt?
Why it matters: These are the two questions Rails leads ask each other in public. The Ruby side is current: the anthropic gem reached 1.68.0 on 1 September 2026 and the openai gem 0.85.0 on 3 September 2026 (still pre-1.0). The pattern the community converged on is a job, a Turbo broadcast and an Active Record row, not a blocking controller call, and 8.1's Active Job Continuations exist for exactly the long, interruptible work an inference call becomes under a deploy with a thirty-second shutdown. Training and heavy inference still belong in a Python service beside Rails, because the GVL serializes Ruby code inside one process.
Send your answers. No form fields beyond the ones you need. Naveen reads it first.
Four ways we work with Rails teams
Rails upgrades and modernization
One minor at a time, Ruby hops between Rails hops, dual boot in your CI, a gem verdict for every dependency, the front-end decision scoped separately. The target in 2026 is Rails 8.1.3.1 or later on Ruby 3.4, or 4.0 with your app's own evidence.
Learn moreBuild a Rails product
Validation before code. A first release that ships with authentication, jobs, cache, cable, deploy and CI already in the box, because Rails 8.0 and 8.1 put them there. Upgradeability decided on day one. A handoff your next hire can own.
Learn moreForward-deployed Rails engineers
Embedded senior Rails engineers who stay on your team. Your repo, your Slack, your standups, a named outcome, and an exit when it is done. You choose them from full profiles. They stay.
Learn moreRails rescue and takeover
For the app where deploys are feared and the upgrade branch has sat for a quarter. Stabilize first. Rebuild only when the assessment says so, in writing.
Learn morePerformance work and AI features inside Rails are part of every door; they are described below rather than sold as separate products.
How an engagement starts: the Rails review
Every engagement opens with a review of your application, whichever door you came through. It produces: a gem verdict list (upgrade, fork, vendor, replace, delete) for every dependency on the request and job paths; a deprecation inventory from your own logs; the gap between load_defaults and the Rails you run, setting by setting; the Ruby and image path (which Ruby production boots, which libvips, which libyaml); a coverage map on the money, auth and PII paths; the rollback plan, including the migrations that cannot be reversed; and the sequence of Ruby and Rails hops with the front-end decision scoped on its own.
The review is not a sales document. You are under no obligation to continue with us after it, and some teams use it to do the work themselves. We do not publish its price, and we do not quote before it is done, because a flat quote before reading the code is the red flag the market itself names.
Sources: Rails Fever on choosing an upgrade firm, 19 March 2026.
You choose the engineers. They stay.
Before kickoff you see full profiles and you pick. The engineers you pick stay for the whole engagement; nobody is swapped in behind the scenes. Overlap hours are in US Central. Work runs async across time zones by default, which is how a 2026 embed of one engineer in one platform team is done in the open market too. There is no retainer and no monthly plan. Engagements have a named end state, and you hire full-time at your own pace.
Sources: Evil Martians on the Gusto embed, 2 September 2026.
Performance inside Rails
Slow queries, N+1 on the pages that matter, background queues that back up, test suites that take thirty minutes. We profile, measure, fix, and hand back before-and-after numbers from your own app. The performance story for an upgrade is mostly a Ruby story: YJIT in Ruby 3.4 is about 92 percent faster than the interpreter on Shopify's headline benchmarks and 5 to 7 percent faster than YJIT 3.3.6, per the YJIT team. ZJIT in Ruby 4.0 is off by default and Ruby core says to hold off on production use; we do not sell it. Our 2014 note on eager loading still ranks because includes, preload, eager_load, strict_loading and load_async are still the tools. Read the eager loading note.
Sources: YJIT 3.4, Rails at Scale, 10 January 2025; Ruby 4.0 release; Active Record querying guide.
AI features inside Rails
A Rails app can call Claude or GPT through vendor-maintained SDKs updated this week, store embeddings in the Postgres it already runs through pgvector, and orchestrate the work with Solid Queue and Continuations. It should not train models or run heavy inference in-process: the GVL runs one thread of Ruby at a time per process, and Ractors on Rails reached a scaffolded-app milestone only in August 2026.
Our own products are built on that split: iPAM v2 runs Rails 8.1.3.1 services beside a Python ML service with MLflow; NeuroSight runs a Rails alert manager beside YOLOv8 edge inference. We bring that pattern, and its failure modes, to your app. We also say when a feature should wait.
Sources: anthropic gem 1.68.0, 1 September 2026; openai gem 0.85.0, 3 September 2026; neighbor; The Ruby GVL, Speedshop; Ractors on Rails, 11 August 2026.
In their words
Twenty-four people wrote public recommendations of our CEO between 2007 and 2012, nineteen of them clients, ten naming Rails. The themes: clean code and honest deadlines, rescues of other developers' work, available across time zones, engineering judgment. Several of them now lead engineering organizations. Read them, by year and relationship. Two anonymous case studies are on the site, with the detail behind them under NDA: a fintech Rails API upgrade and a healthcare Rails resurrection.
Rails in 2026, in six sourced lines
- Rails 8.0 (7 November 2024) made a Redis-free, PaaS-free stack the default; 37signals reports Solid Queue at 20 million jobs a day for HEY and Solid Cache at 10 terabytes for Basecamp (their own report). (Rails 8.0 release post)
- Rails 8.1 (22 October 2025) added Active Job Continuations, structured event reporting and local CI; HEY's 30,000-assertion suite went from over ten minutes in the cloud to 1 minute 23 seconds on a desktop, per 37signals. (Rails 8.1 release post)
- Shopify's SEC-filed Black Friday 2025 release reports 489 million requests per minute at the edge and 14.8 trillion database queries for 14.6 billion dollars in sales; the Rails Foundation lists Shopify as a Core member running a Rails monolith. (SEC filing; Rails Foundation)
- GitHub.com is a Rails monolith of nearly two million lines with more than 1,000 engineers on it daily and weekly Rails bumps (GitHub's own post from 2023, updated June 2024). (GitHub engineering blog)
- Rails is used by 5.9 percent of all respondents in the 2025 Stack Overflow survey, against Node.js at 48.7 percent and Next.js at 20.8 percent. A small, senior, stable pool. That is what an expert firm is for. (Stack Overflow 2025)
- The Rails Foundation commissioned a benchmark of coding agents on Rails codebases on 12 August 2026; we will cite results when they exist and not before. (rubyonrails.org, 12 August 2026)
Support calendar, as of 4 September 2026
| Series | Bug fixes until | Security fixes until |
|---|---|---|
| Rails 8.1.x | 10 October 2026 | 10 October 2027 |
| Rails 8.0.x | ended 7 May 2026 | 7 November 2026 |
| Rails 7.2.x | ended | ended 9 August 2026 |
| Rails 7.0 and 7.1 | final releases 7.0.10 and 7.1.6 on 29 October 2025 | ended |
Ruby 4.0 and 3.4 are in normal maintenance; 3.3 is security-only until an expected 31 March 2027; 3.2 reached end of life on 1 April 2026. Full calendar with libvips and Heroku rows.
Sources: Rails maintenance policy; End of support post; Ruby branches.
When Allerin is not the right fit
A single-version hop on a small app with a green suite is an afternoon's work for a maintenance specialist; we will say so and point you at one. If you want a rewrite decided before anyone reads the code, or a fixed price before the review, we are the wrong firm. If you want engineers under your own management with no named outcome, hire, do not embed.
Rails World 2026
Rails World is in Austin on 23 and 24 September 2026 at the Palmer Events Center, with 1,200 or more developers expected. We are an Austin firm and we will be there. If you want to walk through your twelve answers in person, say so in your message.
Sources: Rails World 2026.
Library
Part of Ruby on Rails consulting at Allerin. Founded 2005. Austin, Texas and Navi Mumbai.