Five weeks of activity across the Ruby, Python, Node.js, PHP, and Elixir ecosystems. The big ones: Rails continues optimizing schema operations, node-mysql2 landed a major performance overhaul, OpenAI shipped a breaking major version of the Python SDK, and Starlette has a PR that could change how Python APM tools work.
Highlights
Ruby
Rails batches schema column reads into a single query. PR #58494 changes connection.columns to accept a list of tables and read all column metadata in one query. For a 250-table schema dump, statements drop from 255 to 6 and time from 125ms to 44ms. This was the last schema reader that scaled per-table. MySQL, MariaDB, and PostgreSQL all get the bulk path. SQLite falls back to per-table reads.
Bootsnap 1.25.0 fixes a SEGV in instrumentation. The release includes a fix for a segmentation fault around instrumentation_method (PR #564), caused by Ruby assuming errinfo is an object when it isn’t. Also improves YAML cache handling for Date/Time objects and fixes a YJIT cache key invalidation bug.
Python
OpenAI Python SDK hits v3.0.0 with a breaking HTTP client change. The release migrates the default HTTP client from httpx to HTTPX2. Applications using custom HTTPX clients, transports, or configuration objects need to migrate. There’s a temporary runtime escape hatch for legacy httpx usage. If you instrument HTTP calls in your Python apps, check that your tooling handles the new transport.
SQLAlchemy 2.0.52 fixes a data correctness bug in ORM UPDATE. The release fixes a result-column misalignment in ORM-enabled UPDATE statements with synchronize_session="fetch", where .returning() could map columns to wrong keys under concurrent workloads. Also adds Python 3.15 compatibility and fixes bulk operations leaving Session stuck in a “flushing” state.
Node.js
node-mysql2 lands ten performance fixes for 3-6x speedups. PR #4486 profiles the client against typical workloads and eliminates per-query and per-row allocation hotspots. The biggest wins: Query.toPacket was serializing every query twice on MySQL 8+, the binary row parser allocated typeCast wrapper objects per column per row even with no typeCast configured, and text DATE/DATETIME parsing used V8’s slow new Date(string) path. Includes the benchmark harness and full methodology write-up.
node-mysql2 replaces archived denque with a local ring buffer. PR #4472 removes the dependency on the archived denque package (last updated July 2022, repo archived March 2026) and replaces it with a faster in-repo ring buffer. Speedups range from 1.05x to 1.37x across workload patterns.
Elixir
Postgrex 0.22.4 patches CVE-2026-66838. The fix addresses comment escaping in Postgrex.stream/4. Oban picked it up immediately. If you run Ecto with Postgrex (which is most Elixir apps), update.
Also Noteworthy
- doorkeeper-gem/doorkeeper released 6.0.0.beta2 with strict RFC 6749 redirect URI matching, PKCE scope fixes, and Resource Indicators (RFC 8707). Wait for stable.
- phoenixframework/phoenix shipped v1.8.10 and v1.8.11, patch releases.
- nestjs/nest released v11.2.0 with HTTP QUERY method support (RFC 10008).
- Celery bumped cryptography to 50.0.0, picking up the fix for CVE-2026-69247 (Bleichenbacher oracle in PKCS#7 decryption).
Recently Merged
Grape adds compile-time warnings for shadowed rescue_from handlers. PR #2842 warns when a rescue_from handler can never run because a broader handler catches its exception first.
Tesla documents a credential-leaking middleware ordering issue. PR #910 warns that credential middleware placed after FollowRedirects will re-add authorization headers to cross-origin redirect targets.
In Development
Starlette proposes native OpenTelemetry tracing. PR #3438 adds built-in OTel HTTP server spans driven by the global tracer provider. Calling logfire.configure() would be enough to enable Starlette request tracing with no external instrumentor. This could conflict with or duplicate existing APM instrumentation for Starlette and FastAPI apps. We’re tracking this closely.
MCP Ruby SDK applies for Tier 1 status. Issue #3247 shows 100% server conformance (67/67) and 100% client conformance (50/50), with a stable v1.2.0 release. If approved, Ruby joins TypeScript and Python as a Tier 1 MCP SDK.
SQLAlchemy proposes registering generated code with linecache. Issue #13505 would make tracebacks through generated __init__ wrappers readable instead of showing opaque File "<string>" frames. Every mapped class construction passes through this code path.
What We’re Watching
The Starlette OTel PR is the signal to pay attention to. If frameworks start emitting their own traces natively, the role of external APM instrumentation shifts from “wrap everything” to “consume and enrich.” That’s a meaningful change for monitoring tools across the Python ecosystem. Meanwhile, node-mysql2’s systematic profiling approach is a good template for any library maintainer wondering where their per-query overhead comes from.
Try Scout Monitoring
Scout Monitoring gives you errors, logs, and traces in one place: the fastest path to useful information without the bloat. Start your free trial.