Padrino 0.18.1 release

October 31, 2026· Nathan Esquenazi ruby update

Padrino 0.18.1 is a patch release with security fixes for page caching and for generated admin apps, and a fix for the Active Record database tasks. Upgrade with bundle update padrino. Admin apps you generated before need a small manual edit, described below, because generated code isn't updated by a gem upgrade.

Changes

• Page caching. A cache_key or expires set while handling a request was stored on the route and reused by later requests, so a key built from the request (cache_key "post-#{params[:id]}") could make another visitor receive that request's cached page. A String key and the expiry now belong to the request that set them. A cached page is also now served only after the route's before filters and conditions have run, so access checks written in a controller block or as route conditions apply to cached pages too (#2448).
• Admin login bypass removed. The sessions controller that padrino g admin generates logged in as the first account when a bypass parameter was sent and the app ran in development, and the login page showed a "Bypass login?" checkbox. An app started without RACK_ENV runs in development, so a deployment that leaves RACK_ENV unset accepted the bypass from anyone. New admin apps no longer have it (#2445; reported by @achiurizo).
• Mongoid account lookup. The generated Mongoid Account.authenticate matched any part of an email address, so it could pick the wrong account. It now matches the whole address, ignoring case, like the Active Record and Sequel models (#2445).
• Active Record database tasks. rake db:migrate (ar:migrate), ar:schema:dump and ar:structure:dump create db/ when it is missing, so a new -d activerecord project on Postgres or MySQL can migrate before it has a model (#2433, @achiurizo).

Upgrading from 0.18.0

1. Run bundle update padrino. If your Gemfile pins 0.18.0, change it to ~> 0.18.1 first. If it lists the padrino-* gems instead of padrino (as --api projects do), set each to ~> 0.18.1 and update them by name: bundle update padrino-core padrino-gen.
2. If your project has a generated admin, edit two files (under the directory you named with -a, if not admin/):
   • In admin/controllers/sessions.rb, delete the branch that starts with elsif Padrino.env == :development && params[:bypass] and its three lines.
   • In admin/views/sessions/new.*, delete the fieldset that holds the bypass checkbox (check_box_tag :bypass).
3. If you use page caching (cache: true):
   • A String cache_key set inside a route handler now names only that request's entry, so it no longer produces cache hits. Set it in a before filter instead, or use a block that reads params (cache_key { "post-#{params[:id]}" }). A block runs again for each request, so it must read params or request, not the handler's local variables.
   • A Symbol key (cache_key :my_name) is one entry shared by every request of the route: set it unconditionally, and only on routes whose page is the same for everyone.
   • before filters in a controller block and route conditions now also run when the page comes from the cache.
4. If your admin uses Mongoid, change the lookup in models/account.rb (or the model you named with -m) to account = where(email: /\A#{Object::Regexp.escape(email)}\z/i).first if email.present?.
5. Make sure production sets RACK_ENV=production. Running a deployment in development also turns on code reloading and detailed error pages.

Nothing else changes: Ruby 2.7.8 or later, Sinatra 4 and Rack 3 are still required.