Padrino 0.18.4 release

November 4, 2026· Nathan Esquenazi ruby update

Padrino 0.18.4 is a security and performance release. On some text, highlight took time that grew much faster than the text, so a few kilobytes could hold a request for seconds; it now takes time in proportion to the text. Everyone on 0.18.x who calls highlight on text that visitors can influence, such as search results, should upgrade. Thanks to @NotAFlightRisk for reporting it. The advisory, GHSA-3345-9xcr-8cjw (padrino-helpers), has the details.

Changes

• highlight and number_with_delimiter on long text. Both take time in proportion to their input. highlight splits the text into tags and the text between them and highlights only the text, so it no longer puts highlight markup inside a tag name, a closing tag or a quoted attribute (#2517).
• Faster tag helpers. tag, content_tag and the helpers built on them (link_to, form fields, ...) render faster, with unchanged output (#2506).
• Faster block helpers. Helpers that take a block check whether it comes from a template without evaluating code (#2505).
• Faster number helpers. number_to_currency, number_to_percentage, number_to_human_size and number_with_precision look up the locale's formats only for the options you leave out (#2503).
• Mailer templates compiled once. With reload_templates off, mailer templates rendered by name are compiled once and reused across deliveries (#2501).

Upgrading from 0.18.3

1. In your Gemfile, change gem 'padrino', '~> 0.18.3' (or '0.18.3') to gem 'padrino', '~> 0.18.4', then run bundle update padrino (or, if it lists the padrino-* gems, set each to ~> 0.18.4 and update them by name).
2. Check these, as listed in the changelog:
   • highlight: a < followed by an ASCII letter, /, ! or ? starts a tag, as in a browser, so in unescaped text such as x<y and y the words after x<y aren't highlighted up to the next >.
   • number_with_delimiter: the delimiter is inserted as given; a backslash in it is no longer read as a back-reference.
   • block_is_template? returns true or false for a block in a template, instead of a string or nil.
   • Mailer templates: with reload_templates off (the default outside development), an edited mailer template takes effect only after the process restarts.

Nothing else changes: Ruby 2.7.8 or later, Sinatra 4 and Rack 3 are still required.