Rails and Ruby support calendar
The baseline Rails policy provides one year of bug fixes and two years of security fixes. Published support dates and extensions take precedence over calculated anniversaries. As of 6 September 2026, every 7.x series is outside its published security-support window and 8.0.x has until 7 November 2026. This page explains the dates, Ruby requirements, the libvips floor behind CVE-2026-66066, and Heroku's stack deadline.
Rails
| Series | Bug fixes until | Security fixes until | What it means |
|---|---|---|---|
| Rails 8.1.x | 10 October 2026 | 10 October 2027 | The target. Latest release 8.1.3.1 (29 July 2026). |
| Rails 8.0.x | ended 7 May 2026 | 7 November 2026 | A checkpoint before 8.1. Review its removals and defaults before continuing. Latest 8.0.5.1. |
| Rails 7.2.x | ended 9 August 2025 | ended 9 August 2026 | 7.2.3.2 includes the July advisory fix; the published security-support window has ended. |
| Rails 7.1.x | ended 1 October 2024 | ended 1 October 2025 | Final release 7.1.6 announced 29 October 2025. The July advisory lists no patched 7.1 release; check applicability and its workarounds while progressing to a supported series. |
| Rails 7.0.x | ended | ended 1 April 2025 | Final release 7.0.10 announced 29 October 2025. The July advisory lists no patched 7.0 release; exposure depends on image-processing configuration and untrusted uploads. |
| Rails 6.1.x | ended | ended 1 October 2024 | Latest 6.1.7.10. Zeitwerk and the SHA-256 digest change stand between it and 7.0. |
| Rails 8.2 | not released | not released | No 8.2 gem release as of 14 September 2026; main reports 8.2.0.alpha. Recheck release status and the published maintenance schedule before changing an application's upgrade target. |
Ruby
| Branch | Status | Dates | What it means |
|---|---|---|---|
| Ruby 4.0 | normal maintenance | released 25 December 2025; latest 4.0.6 (14 July 2026) | ZJIT off by default and not for production per Ruby core. Rails states no first compatible patch level; the gem requires 3.2.0 or newer. Adopt with per-app evidence. |
| Ruby 3.4 | normal maintenance | latest 3.4.10 (30 June 2026) | The default target for an 8.1 app. Warns about the gems 4.0 moves out of the default set. |
| Ruby 3.3 | security maintenance | expected end 31 March 2027 | Warns about the gems 3.4 moved; a staging stop, not a destination. |
| Ruby 3.2 | end of life | 1 April 2026 | Rails 8.1 still accepts it, which is how a green Gemfile hides an unsupported runtime. |
| Ruby 3.1 | end of life | 26 March 2025 | The floor for Rails 7.2; Psych 4 work happens here. |
Sources: Ruby branches; Ruby news; Ruby 4.0 release; rails gem.
Ruby floor per Rails series
| Rails | Minimum Ruby |
|---|---|
| Rails 5.x | Ruby 2.2.2 |
| Rails 6.0 and 6.1 | Ruby 2.5 is the declared minimum. Test later Ruby versions against the exact Rails patch, native libraries and locked gems; the floor alone does not establish compatibility. |
| Rails 7.0 and 7.1 | Ruby 2.7 |
| Rails 7.2 | Ruby 3.1 |
| Rails 8.0 and 8.1 | Ruby 3.2 |
CVE-2026-66066
CVSS 9.5, advisory dated 29 July 2026: arbitrary file read and possible remote code execution affecting Active Storage applications using libvips with untrusted image uploads. Generating variants is not an additional requirement. Fixed in 7.2.3.2, 8.0.5.1 and 8.1.3.1. The fix requires libvips 8.13 or newer and ruby-vips 2.2.1 or newer; below the floor, the patched gem raises at boot. load_defaults 7.0 is what switched Active Storage to :vips; an app that never raised its defaults may still be on mini_magick and outside the advisory. Check the actual processor configuration, installed gems and vips --version inside the running image. The advisory also documents workarounds for libvips 8.13 or newer and secret changes for affected applications.
| Distribution | Package's upstream libvips version | Comparison with 8.13 |
|---|---|---|
| Debian bullseye | 8.10.5 | below the native-library floor |
| Ubuntu jammy (22.04) | 8.12.1 | below the native-library floor |
| Debian bookworm | 8.14.1 | meets the native-library floor only |
| Ubuntu noble (24.04) | 8.15.1 | meets the native-library floor only |
| Debian trixie | 8.16.1 | meets the native-library floor only |
These are distribution-package versions, not an inventory of a deployed application. A version at or above 8.13 meets this native-library prerequisite only. Check the installed Active Storage and ruby-vips versions, the library loaded by the Ruby process, and the effective processor configuration against the advisory. Heroku-22 uses an Ubuntu 22.04 base, but buildpacks or application packages can supply a different library; the stack name alone does not establish its libvips version.
Heroku
| Item | Status |
|---|---|
| Business model | Sustaining-engineering model announced 6 February 2026; no sunset date; no new Enterprise Account contracts; existing customers unchanged. |
| Heroku-22 stack | Ubuntu 22.04; end of life 30 April 2027. |
| Supported Ruby | 3.3.12, 3.4.10 and 4.0.6; default 3.3.9; 3.1.x and 3.2.x unsupported on current stacks (page updated 22 July 2026). |
Change log
- 6 September 2026: clarified published support dates and extensions, final-release announcement dates, and the July advisory's applicability and workarounds. Update owner: Naveen Joshi.
- 4 September 2026: page created. Next scheduled updates: 10 October 2026 (Rails 8.1.x bug-fix window closes) and 7 November 2026 (Rails 8.0.x security window closes).
For a machine-readable feed of bare end-of-life dates, endoflife.date publishes an API and calendar; this page exists for the meaning of the dates, not the dates alone.
Next
Part of Ruby on Rails consulting at Allerin. Founded 2005. Austin, Texas.