Rails and Ruby support calendar
Each Rails minor receives one year of bug fixes and two years of security fixes from its release, so as of 4 September 2026 every 7.x application is off security support and 8.0.x has until 7 November 2026. This page adds what each date means for an app on that version, the Ruby floor per series, the libvips floor behind CVE-2026-66066, and Heroku's dates. It is updated on each release and advisory; the change log is at the bottom.
Rails
| Series | Bug fixes until | Security fixes until | What it means |
|---|---|---|---|
| Rails 8.1.x | 10 October 2026 | 10 October 2027 | The target. Latest release 8.1.3.1 (29 July 2026). |
| Rails 8.0.x | ended 7 May 2026 | 7 November 2026 | One hop from the target; the smallest upgrade on this page. Latest 8.0.5.1. |
| Rails 7.2.x | ended | ended 9 August 2026 | Off security support. The last patch, 7.2.3.2, carried the CVE-2026-66066 fix; nothing follows it. |
| Rails 7.1.x | ended | ended 1 October 2025 | Final release 7.1.6 on 29 October 2025. No fix for CVE-2026-66066 exists; reach 7.2 first. |
| Rails 7.0.x | ended | ended 1 April 2025 | Final release 7.0.10 on 29 October 2025. Same exposure as 7.1. |
| Rails 6.1.x | ended | ended 1 October 2024 | Latest 6.1.7.10. Zeitwerk and the SHA-256 digest change stand between it and 7.0. |
| Rails 8.2 | not released | not released | No release as of 4 September 2026; edge notes only. When it ships, the target line changes; the 8.0.x date does not move. |
Ruby
| Branch | Status | Dates | What it means |
|---|---|---|---|
| Ruby 4.0 | normal maintenance | released 25 December 2025; latest 4.0.6 (14 July 2026) | ZJIT off by default and not for production per Ruby core. Rails states no first compatible patch level; the gem requires 3.2.0 or newer. Adopt with per-app evidence. |
| Ruby 3.4 | normal maintenance | latest 3.4.10 (30 June 2026) | The default target for an 8.1 app. Warns about the gems 4.0 moves out of the default set. |
| Ruby 3.3 | security maintenance | expected end 31 March 2027 | Warns about the gems 3.4 moved; a staging stop, not a destination. |
| Ruby 3.2 | end of life | 1 April 2026 | Rails 8.1 still accepts it, which is how a green Gemfile hides an unsupported runtime. |
| Ruby 3.1 | end of life | 26 March 2025 | The floor for Rails 7.2; Psych 4 work happens here. |
Sources: Ruby branches; Ruby news; Ruby 4.0 release; rails gem.
Ruby floor per Rails series
| Rails | Minimum Ruby |
|---|---|
| Rails 5.x | Ruby 2.2.2 |
| Rails 6.0 and 6.1 | Ruby 2.5. Rails 6.0 does not run on Ruby 3.0; Ruby 3 work waits for 6.1. |
| Rails 7.0 and 7.1 | Ruby 2.7 |
| Rails 7.2 | Ruby 3.1 |
| Rails 8.0 and 8.1 | Ruby 3.2 |
CVE-2026-66066
CVSS 9.5, advisory dated 29 July 2026: arbitrary file read and possible remote code execution through Active Storage variant processing with libvips. Fixed in 7.2.3.2, 8.0.5.1 and 8.1.3.1. The fix requires libvips 8.13 or newer and ruby-vips 2.2.1 or newer; below the floor, the patched gem raises at boot. load_defaults 7.0 is what switched Active Storage to :vips; an app that never raised its defaults may still be on mini_magick and outside the advisory. Check with vips --version inside the running image.
| Distribution | libvips | Verdict |
|---|---|---|
| Debian bullseye | 8.10.5 | fails the 8.13 floor |
| Ubuntu jammy (22.04, Heroku-22) | 8.12.1 | fails the floor if the app uses the distro package rather than a buildpack |
| Debian bookworm | 8.14.1 | passes |
| Ubuntu noble (24.04) | 8.15.1 | passes |
| Debian trixie | 8.16.1 | passes |
Sources: GHSA-xr9x-r78c-5hrm; FastRuby, 3 August 2026; bullseye; bookworm; trixie; jammy; noble.
Heroku
| Item | Status |
|---|---|
| Business model | Sustaining-engineering model announced 6 February 2026; no sunset date; no new Enterprise Account contracts; existing customers unchanged. |
| Heroku-22 stack | Ubuntu 22.04; end of life 30 April 2027. |
| Supported Ruby | 3.3.12, 3.4.10 and 4.0.6; default 3.3.9; 3.1.x and 3.2.x unsupported on current stacks (page updated 22 July 2026). |
Change log
- 4 September 2026: page created. Next scheduled updates: 10 October 2026 (Rails 8.1.x bug-fix window closes) and 7 November 2026 (Rails 8.0.x security window closes).
For a machine-readable feed of bare end-of-life dates, endoflife.date publishes an API and calendar; this page exists for the meaning of the dates, not the dates alone.
Next
Part of Ruby on Rails consulting at Allerin. Founded 2005. Austin, Texas and Navi Mumbai.