Padrino 0.18.2 release

November 1, 2026· Nathan Esquenazi ruby update

Padrino 0.18.2 is a patch release with fixes for apps in directories Padrino mistook for libraries, the Erubis crash with newer Tilt, --api projects, nested controllers, the generated admin and the generators. To upgrade, change the version in your Gemfile and run bundle update (details below). Thanks to @achiurizo for many of these fixes. One change can affect existing apps (nested controller blocks, below), and generated admin and --api code isn't updated by a gem upgrade, so a few manual edits are listed under "Upgrading".

Changes

• Nested controllers. After a controller block nested inside another one, routes defined later kept the outer controller's state: later top-level routes got its path prefix, conditions, filters, cache settings, layout and defaults, and its before and after filters ran for every request. Each controller block now restores the options it opened with (#2469).
• App paths. An app under a directory such as thor-apps/, lib/padrino-blog/ or test/unit/ was taken for library code, so its controller routes answered 404 unless PADRINO_ROOT was set (#2476, @achiurizo).
• Erubis. require 'padrino-helpers' raised uninitialized constant Tilt::ErubisTemplate when the erubis gem was installed alongside Tilt 2.5 or newer. ERB templates now render with Erubi, or Ruby's ERB when Erubi isn't bundled (#2470).
• --api projects. New API projects have no sessions, and CSRF protection follows sessions, so JSON POST requests no longer return 403. padrino g app in an API project writes an app that boots (#2472, @achiurizo).
• Generated admin. Boolean columns in lists show a check mark or a cross instead of an empty cell. A warning flash no longer leaks onto the page after a 404. The layouts no longer load a Google font over plain http or the IE 8 shim (#2478). padrino g admin_page tells a model that fails to load (and shows its error) from one that doesn't exist (#2477).
• Generators. padrino g in a bundle without padrino-gen says how to add it (#2477). Running padrino g admin or g admin_page again without a terminal keeps edited files and doesn't duplicate Gemfile lines (#2471, @achiurizo). --tiny projects pass their own tests, and g admin in a project without an app/ application exits with a message (#2446, @achiurizo).
• Smaller fixes. env['sinatra.route'] is set, so APM and error trackers can name Padrino routes (#2473). l(date, format: :short) no longer raises on Ruby 3 (#2474). Mailers without a delivery_method look up sendmail once instead of on every delivery (#2475), all by @achiurizo.
• Project. Every gem declares Ruby 2.7.8 or later and links to its changelog and source on rubygems.org, and a security policy explains how to report a vulnerability privately (#2468).

Upgrading from 0.18.1

1. In your Gemfile, change gem 'padrino', '0.18.1' (generated projects pin the exact version) to gem 'padrino', '~> 0.18.2', then run bundle update padrino. If it lists the padrino-* gems instead of padrino (as --api projects do), set each to ~> 0.18.2 and update them by name: bundle update padrino-core padrino-gen.
2. If you nest controller blocks, check the routes defined after the block that holds a nested one has closed: later in the same file, at app level, and in controller files loaded after it (with three levels, also the routes in the outermost block after the middle one). On 0.18.1 they wrongly got that block's before and after filters, which also ran for every other request of the app, 404s included, and, when defined in the same file, its path prefix, route name and conditions. On 0.18.2 they don't. If a route relied on any of that (its path, its route name in url(...), its conditions, or an access check in a filter), move it inside that controller block or give it its own filter.
3. If your project was generated with --api and JSON POST requests return 403, delete the set :sessions line from each app.rb, and in config/apps.rb, inside Padrino.configure_apps do, replace set :protect_from_csrf, Padrino.env != :test with set :protect_from_csrf, proc { sessions? && Padrino.env != :test }.
4. If your project has a generated admin, these edits are optional (under the directory you named with -a, if not admin/):
   • Boolean columns: run yes | bundle exec padrino g admin_page <model> to regenerate a page (this overwrites your edits to it), or in admin/views/<models>/index.* replace each post.published ? tag_icon(:ok) : tag_icon(:remove) with tag_icon(post.published ? :check : :times) + content_tag(:span, post.published.to_s, class: 'sr-only') unless post.published.nil?, with your model and column.
   • Flash after a 404: delete the flash[:warning] = ... line before each halt 404 in admin/controllers/*.rb.
   • Font and IE shim: delete the fonts.googleapis.com link from admin/views/layouts/application.* and error.*, the comment starting <!-- Le HTML5 shim and the [if lt IE 9] block below it from those layouts and admin/views/sessions/new.*, and the font-family: 'Varela', sans-serif; lines from public/admin/stylesheets/application.css.

Nothing else changes: Ruby 2.7.8 or later, Sinatra 4 and Rack 3 are still required.