Rails 7.2 · security support dates
Rails 7.2 end of life: it no longer gets security patches
Rails 7.2 reached the end of its support window: regular bug fixes ended on August 9, 2025, and security patches ended on August 9, 2026. Any vulnerability found in 7.2 from now on will not be fixed — apps still running it are carrying open risk today, not at some future date.
Not sure what you're running? Paste your Gemfile.lock into the free checkWhat this means for your app
- 7.2 receives no fixes of any kind anymore: no bug fixes, no security patches, no backports.
- Every new CVE that affects 7.2 stays exploitable until you upgrade; there is no patch release to apply.
- An end-of-life framework is a common red flag in security questionnaires, customer audits, and cyber-insurance reviews.
- The supported path is 8.1. Rails 8.0 stops getting security patches on November 7, 2026, so an upgrade landing on 8.0 only buys a few weeks.
What to do now
1. Confirm what you run
Check the Rails and Ruby versions actually deployed (Gemfile.lock, not memory). Our free Rails Expiry Check reads the file in your browser — nothing is uploaded.
2. Clear deprecations on 7.2
Bump to the latest 7.2 patch and fix every deprecation warning. That work is what makes the jump to 8.0 — and then 8.1 — predictable instead of risky.
3. Upgrade one minor at a time
Go 7.2 → 8.0 → 8.1 with the test suite passing at each step, checking gem compatibility before each jump. If coverage is thin, add tests around the paths that pay the bills first.
Rails security support end dates
| Rails | Bug fixes until | Security patches until | Latest patch |
|---|---|---|---|
| 8.1 | October 10, 2026 | October 10, 2027 | 8.1.4.1 |
| 8.0 | May 7, 2026 | November 7, 2026 | 8.0.5.2 |
| 7.2 | August 9, 2025 | August 9, 2026 | 7.2.4 |
| 7.1 | October 1, 2024 | October 1, 2025 | 7.1.6 |
| 7.0 | October 15, 2023 | April 1, 2025 | 7.0.10 |
| 6.1 | December 15, 2021 | October 1, 2024 | 6.1.7.10 |
| 6.0 | December 15, 2021 | June 1, 2023 | 6.0.6.1 |
| 5.2 | December 15, 2021 | June 1, 2022 | 5.2.8.1 |
Source: endoflife.date/rails. Refreshed daily.
Frequently asked questions
We're on Rails 7.2 and nothing is broken. Why move?
Nothing being broken is not the same as nothing being vulnerable. Since August 9, 2026, new security issues in 7.2 go unpatched, and the gap between your version and the supported ones only gets more expensive to close.
Should we stop at 8.0 or go straight to 8.1?
Plan the path to land on 8.1. 8.0 loses security patches on November 7, 2026, so stopping there leaves you in the same situation within weeks. The 8.0 step is still useful as an intermediate, tested stop.
We don't have time or a team for the upgrade. What are the options?
We do incremental Rails upgrades for U.S. businesses: an assessment of the app first, then one tested step at a time. If you already have a quote from another vendor, we also give a free second opinion on that estimate.