Rails 8.0 · security support dates
Rails 8.0 end of life: what to do before November 7, 2026
Rails 8.0 was released on November 7, 2024. Regular bug fixes for it ended on May 7, 2026, and security patches end on November 7, 2026 — two years after release, following the Rails maintenance policy. After that date, new vulnerabilities found in 8.0 will not be fixed.
Not sure what you're running? Paste your Gemfile.lock into the free checkWhat this means for your app
- Until November 7, 2026, the Rails team still ships security fixes for 8.0 — but no regular bug fixes.
- After November 7, any new CVE affecting 8.0 stays open: no patch release, no backport.
- Running an unpatched framework can also surface in security questionnaires, audits, and cyber-insurance reviews.
- Going from 8.0 to 8.1 is a minor-version upgrade: far smaller than a major jump, and much easier to plan before the deadline than after an incident.
What to do now
1. Confirm what you run
Check the Rails and Ruby versions actually deployed (Gemfile.lock, not memory). Our free Rails Expiry Check reads the file in your browser — nothing is uploaded.
2. Review the 8.1 changes
Read the 8.1 release notes and your deprecation warnings under 8.0. Fix deprecations first: a clean 8.0 app usually moves to 8.1 with little friction.
3. Upgrade with tests green
Bump to the latest 8.0 patch, then to 8.1, keeping the test suite passing at each step. If coverage is thin, add tests around the paths that pay the bills before touching versions.
Rails security support end dates
| Rails | Bug fixes until | Security patches until | Latest patch |
|---|---|---|---|
| 8.1 | October 10, 2026 | October 10, 2027 | 8.1.4.1 |
| 8.0 | May 7, 2026 | November 7, 2026 | 8.0.5.2 |
| 7.2 | August 9, 2025 | August 9, 2026 | 7.2.4 |
| 7.1 | October 1, 2024 | October 1, 2025 | 7.1.6 |
| 7.0 | October 15, 2023 | April 1, 2025 | 7.0.10 |
| 6.1 | December 15, 2021 | October 1, 2024 | 6.1.7.10 |
| 6.0 | December 15, 2021 | June 1, 2023 | 6.0.6.1 |
| 5.2 | December 15, 2021 | June 1, 2022 | 5.2.8.1 |
Source: endoflife.date/rails. Refreshed daily.
Frequently asked questions
Is Rails 8.0 unsafe after November 7, 2026?
Not automatically, but any vulnerability discovered after that date will not be patched for 8.0. The risk grows with every new CVE, and you no longer get the fix by simply updating a patch version.
Can we skip 8.1 and wait for the next major version?
Staying current with minor versions is cheaper than letting upgrades pile up. 8.1 is supported and receives fixes; waiting on an unsupported 8.0 means carrying known-unpatched risk in production.
We don't have time or a team for the upgrade. What are the options?
We do incremental Rails upgrades for U.S. businesses: an assessment of the app first, then one tested step at a time. If you already have a quote from another vendor, we also give a free second opinion on that estimate.