Padrino 0.18.3 release

November 3, 2026· Nathan Esquenazi ruby update

Padrino 0.18.3 is a security release. Request paths are now compared the way the router matches them in before/after filters, protect_from_csrf except: entries and padrino-admin access rules, and form tokens written on CSRF-exempt pages are accepted again. Everyone on 0.18.x should upgrade. Thanks to @achiurizo for finding and fixing these with us. The advisories, GHSA-gxmf-3hr3-52rc (padrino-core) and GHSA-2v9v-xpxc-g5p4 (padrino-admin), have the details.

Changes

• Request paths in one place. Static files, filters, protect_from_csrf except: entries and padrino-admin protect/allow rules now share one tested helper and compare the request path in the forms the router matches; compiled routes match the whole path (#2492, @achiurizo).
• Form tokens. With disable :protection (or without :remote_token), the token form_tag, csrf_token_field and csrf_meta_tags write on a protect_from_csrf except: page is accepted by later POSTs instead of returning 403 (#2507).

Upgrading from 0.18.2

1. In your Gemfile, change gem 'padrino', '0.18.2' to gem 'padrino', '~> 0.18.3', then run bundle update padrino (or, if it lists the padrino-* gems, set each to ~> 0.18.3 and update them by name).
2. Check these, as listed in the changelog:
   • Filter paths: write a filter's path decoded (before('/café')). A filter that redirects to the same path with a format or a trailing slash can loop, so check request.path_info first. A path filter also runs for forms of its path that other routes serve, so a filter that only sets state for a later check should name its route instead (before(:list) with get(:list)).
   • except: entries: write protect_from_csrf and filter except: paths as exact decoded Strings. A Regexp entry such as /\.json\z/ or %r{\A/hooks/} may no longer exempt a POST it used to; list that path as a String, or set csrf_protection: false on its route together with enable :allow_disabled_csrf in the app.
   • padrino-admin: protect Regexps can deny more paths than before; allow a path to keep it allowed.
   • A request path that decodes to a newline gets 404.

Nothing else changes: Ruby 2.7.8 or later, Sinatra 4 and Rack 3 are still required.