What ruby-grape/grape shipped
Written by FoxPlug from the repository's own releases; not affiliated with Ruby-grape. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/ruby-grape/grape; Ruby-grape did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- Add Grape.config.allow_undeclared_params, which when set to false answers 400 to a request carrying a param the endpoint did not declare; it defaults to true, and false becomes the default in Grape 5.0. Pull request #3054
- Add an RFC 9457 problem details error formatter so errors can be answered as application/problem+json with the matching Content-Type. Pull request #3052
- Fix a route path opening with an optional segment that answered only with the segment once it sat under a namespace. Pull request #3065
- Fix a helper declared in a scope so a route declared above the helpers block in the same scope can call it. Pull request #3061
- When config.eager_load is on, Grape's Railtie now compiles the APIs mounted in a Rails application's routes when the routes are loaded, rather than on the first request each process answers. Pull request #3022
- Add API.eager_load!, which compiles an API and loads I18n's translations so an app can do both at boot. Pull request #3019
- Drop support for Rack 2.2 and 3.0; Grape now requires Rack 3.1 or later. Pull request #3063
- Drop support for Rails 7.2, which reached end of life, so Grape now requires ActiveSupport 8.0 or later. Pull request #3056
- Fix Router#cascade? so a mounted Rack app declining with a lowercase x-cascade header is cascaded past. Pull request #3064
- Remove env['grape.allowed_methods'] after the allowed-methods route answers so the key does not leak into the next app's env. Pull request #3055
Why it matters
This week adds a way to reject undeclared params and an RFC 9457 problem details error formatter, and fixes routing under namespaces, helper visibility and the x-cascade header. It also raises the minimum Rack at 3.1 and ActiveSupport at 8.0, and adds eager loading of mounted APIs at Rails boot.
Changelog entry
- Add Grape.config.allow_undeclared_params, defaulting to true; false answers 400 to undeclared params Pull request #3054
- Add an RFC 9457 problem details error formatter Pull request #3052
- Fix a route opening with an optional segment under a namespace answering only with the segment Pull request #3065
- Fix a helper so routes declared above it in the same scope can call it Pull request #3061
- Compile APIs mounted in a Rails application's routes at boot when
eager_loadis on Pull request #3022 - Add API.eager_load! to compile an API and load its I18n translations Pull request #3019
- Drop support for Rack 2.2 and 3.0; require Rack 3.1 or later Pull request #3063
- Drop support for Rails 7.2; require ActiveSupport 8.0 or later Pull request #3056
- Cascade past a mounted Rack app declining with a lowercase x-cascade header Pull request #3064
- Keep grape.allowed_methods from leaking into the next app's env Pull request #3055
- Look up the validation error format once per response Pull request #3051
- Declare rexml in the test bundle Pull request #3058
This week in Grape: Grape.config.allow_undeclared_params, an RFC 9457 problem details formatter, fixes for optional segments under namespaces and helper visibility, eager loading of mounted Rails APIs at boot, and new minimums of Rack 3.1 and ActiveSupport 8.0.
This week in Grape: Grape.config.allow_undeclared_params lets an endpoint answer 400 to params it did not declare, defaulting to true with false as the 5.0 default. A new error formatter answers as RFC 9457 problem details. Fixes land for a route opening with an optional segment under a namespace, for helpers reached from routes declared above them in the same scope, and for cascading past a mounted Rack app declining with lowercase x-cascade. Rails apps with eager_load on now compile mounted APIs when routes load, and API.eager_load! compiles an API and loads its translations. Grape now requires Rack 3.1 and ActiveSupport 8.0.
Week of October 26, 2026
What shipped
- Released v4.1.0 Release
- Fixed 404 responses when every route on a path declines with cascade Pull request #3043
- Fixed file uploads in oneof validators by copying only containers instead of deep cloning values Pull request #3046
- Refactored router methods to separate no-route-matching from route-declining logic without behavior changes Pull request #3047
- Updated RuboCop to 1.92.2 and tightened metrics and line length limits Pull request #3048
- Removed RuboCop todo file after fixing all 163 offenses in the spec directory Pull request #3049
- Pinned git gem below version 6 to restore Danger CI job functionality Pull request #3045
Why it matters
This release addresses routing edge cases where requests should return 404 instead of 406, fixes a critical bug affecting file uploads in validators, and improves code quality by clearing all RuboCop violations. The refactoring makes the router logic clearer for future maintenance.
Changelog entry
- Fixed 404 responses when every route on a path cascades instead of returning 406 Pull request #3043
- Fixed file uploads in oneof validators by copying only containers instead of deep cloning values Pull request #3046
- Refactored router settle and neighbours methods to separate miss and cascade paths Pull request #3047
- Updated RuboCop to 1.92.2 and tightened metrics and line length limits Pull request #3048
- Removed RuboCop todo file after fixing all 163 offenses Pull request #3049
- Pinned git gem below version 6 to maintain Danger CI compatibility Pull request #3045
Grape 4.1.0 is out. Fixes cascade routing to return 404 when all routes decline, resolves file upload issues in oneof validators, and clears all RuboCop violations.
Grape 4.1.0 is now available. This release includes a fix for cascade routing to properly return 404 responses when all routes on a path decline requests, resolves file upload issues in oneof validators, refactors router methods for clearer logic, and completes RuboCop violations cleanup across the codebase.
Week of October 19, 2026
What shipped
- The router is now wrapped in Rack::Head, so HEAD requests have their bodies stripped even for mounted Rack apps and other responses that bypass an endpoint's stack. Pull request #3042
- A new setting lets an exception raised inside a
rescue_fromblock propagate instead of being redispatched, so Rack middleware above Grape can see it. Pull request #3040 - New:md and:markdown formatters render an object's
to_markdown, matching the text/markdown mime type registered by Rails 8.1. Pull request #3025 - A built-in:jsonl JSON Lines format was added, with a formatter, a parser and an error formatter registered under that name. Pull request #3029
- Content type negotiation for */* now keeps each API's declared content type order instead of picking by another ordering. Pull request #3032
- InheritableSetting's scalar settings and scope flags are now defined by key instead of hand-written methods, covering the ten nearest-wins settings and scope flags. Pull request #3031
Why it matters
This week covers behavior that directly affects how requests and responses are handled: HEAD responses from mounted apps, exceptions raised in rescue_from blocks, and content type negotiation for browsers that end their Accept header in */*. It also adds two new formats, markdown and JSON Lines, and tightens the internals of InheritableSetting. Together these are fixes and opt-ins that change edge-case behavior rather than a new headline feature.
Changelog entry
- Wrap the router in Rack::Head instead of each endpoint's stack, so mounted Rack apps also get HEAD bodies stripped. Pull request #3042
- Add a setting to let an exception raised in a
rescue_fromblock propagate to Rack middleware. Pull request #3040 - Add:md and:markdown formatters that render an object's
to_markdown. Pull request #3025 - Add a built-in:jsonl (JSON Lines) format with formatter, parser and error formatter. Pull request #3029
- Keep each API's content type order when negotiating */*. Pull request #3032
- Define InheritableSetting's scalar settings and scope flags by key. Pull request #3031
This week: Rack::Head now wraps the whole router so HEAD responses from mounted apps lose their bodies. New setting to let rescue_from exceptions propagate to middleware. Added:md and:jsonl formats. */* negotiation keeps your content type order.
This week in Grape: Rack::Head now wraps the router rather than each endpoint's stack, so HEAD requests through mounted Rack apps also have their bodies stripped. A new setting lets an exception raised in a rescue_from block propagate to Rack middleware above Grape. Two formats were added::md/:markdown, which renders an object's to_markdown, and:jsonl for JSON Lines. Content type negotiation for */* now keeps each API's declared order. InheritableSetting's scalar settings and scope flags are now defined by key.
Week of October 12, 2026
What shipped
- A logger set on one API no longer replaces the logger for every other API, since logger was stored in a process-wide hash and the last API to set one decided where all APIs logged. Pull request #3024
- Requests allocate less when presenting an entity or reading path params, removing four per-request allocations that only existed to feed another one. Pull request #3033
- Each request's endpoint is now copied from a prototype without route-building state, so the copy no longer carries 23 instance variables. Pull request #3034
- Requires and optional are now defined from one definition, sharing their signature and deprecated positional-options check instead of duplicating them. Pull request #3035
- The raised Metrics/ModuleLength override is gone, with the DSL routing module split so modules fit RuboCop's default length. Pull request #3039
- The raised Metrics/AbcSize override is dropped and 26 methods are split to meet the default ABC size, with behaviour unchanged. Pull request #3038
- The perceived complexity override is removed so the cop uses RuboCop's default of 8, after the static route table moved into an existing tuple. Pull request #3037
- The cyclomatic complexity override is removed and 31 methods are split to meet RuboCop's default of 7, with behaviour unchanged. Pull request #3036
Why it matters
This week touches two things users feel directly: per-API logging now stays per-API instead of being overwritten process-wide, and request handling allocates less when presenting entities, reading path params and copying endpoints. The remaining changes are internal cleanups that drop raised RuboCop overrides for module length, ABC size and complexity, with behaviour reported unchanged.
Changelog entry
- Keep a logger set on one API from replacing every other API's logger. Pull request #3024
- Allocate less per request when presenting an entity or reading path params. Pull request #3033
- Copy each request's endpoint from a prototype without route-building state. Pull request #3034
- Define requires and optional from one definition. Pull request #3035
- Hold every module to RuboCop's default length. Pull request #3039
- Hold every method to RuboCop's default ABC size. Pull request #3038
- Hold every method to RuboCop's default perceived complexity. Pull request #3037
- Hold every method to RuboCop's default cyclomatic complexity. Pull request #3036
This week: a logger set on one API no longer overrides every other API's logger. Requests also allocate less when presenting entities and reading path params. Internally, the raised RuboCop overrides for module length, ABC size and complexity are gone, with behaviour unchanged.
This week's changes in grape: A logger set on one API no longer replaces the logger for every other API. Previously the logger lived in a hash shared by the whole process, so the last API to set one decided where all APIs logged. Requests allocate less when presenting an entity or reading path params. Four per-request allocations that only existed to feed another one were removed, and each request's endpoint is copied from a prototype without route-building state. requires and optional now share one definition instead of duplicating their signature and deprecated positional-options check. Internally, the raised RuboCop overrides for module length, ABC size, cyclomatic complexity and perceived complexity are removed, with methods split to meet the defaults. Behaviour is unchanged.
Week of September 28, 2026
What shipped
- Error! now raises an exception instead of throwing, so ActiveRecord transactions commit and roll back correctly. Pull request #3023
- Required params with values now reject nil in nested scopes like Hash, Array, and given blocks. Pull request #3010
- Integer params now reject numbers with fractional parts instead of silently truncating them. Pull request #3011
- Header versioning now correctly parses vendor versions containing hyphens. Pull request #3013
- Optional Array params with blocks now validate empty elements sent alongside real ones. Pull request #3014
- Responses now render in the default format when content negotiation picks a format the body cannot render in. Pull request #3015
- Error middleware is no longer copied on successful requests, reducing overhead. Pull request #3016
- Auth middleware is no longer copied per request. Pull request #3018
- Header versioning no longer copies middleware for common Accept headers. Pull request #3017
- Version throughput benchmarks were re-run on Ruby 4.0.7. Pull request #3021
Why it matters
This week addresses correctness issues in parameter validation, content negotiation, and database transaction handling. Performance improvements reduce per-request overhead by eliminating unnecessary middleware copies. These fixes prevent silent data loss and validation bypass in common API patterns.
Changelog entry
- Error! raises an exception instead of throwing, fixing ActiveRecord transaction handling Pull request #3023
- Required params with values now reject nil in Hash, Array, and given block scopes Pull request #3010
- Integer params now reject numbers with fractional parts Pull request #3011
- Header versioning correctly parses vendor versions containing hyphens Pull request #3013
- Optional Array params with blocks validate empty elements sent with real ones Pull request #3014
- Responses render in default format when negotiated format cannot render body Pull request #3015
- Error middleware no longer copied on successful requests Pull request #3016
- Auth middleware no longer copied per request Pull request #3018
- Header versioning no longer copies middleware for common Accept headers Pull request #3017
Grape 2.2 fixes error handling in transactions, validates params correctly in nested scopes, rejects malformed numbers, and eliminates unnecessary per-request middleware copying.
This week's Grape releases address critical correctness issues: error! now properly raises exceptions for database transaction safety, required params reject nil in nested scopes, Integer params reject fractional numbers, and header versioning handles hyphens. We also eliminated per-request middleware copying to reduce overhead on the happy path.
Week of September 21, 2026
What shipped
- Mounted Rack apps now route as ANY methods in the order they were mounted instead of becoming unreachable 405 responses. Pull request #3012
- Request overhead eliminated by stopping the formatter middleware from being copied per request and empty filter phases from running. Pull request #3004
- Rails gemfiles now load Rails before Grape so the railtie initializes properly in CI. Pull request #3005
- Custom coerce messages with { value:, message: } are now honored in param validation. Pull request #2994
- Params and versions with invalid UTF-8 bytes now return gracefully instead of raising ArgumentError. Pull request #3006
- Nested array elements between Hash scopes now name validation errors with correct indices. Pull request #2990
- Header-versioned APIs with capital letters in the vendor now match Accept headers correctly. Pull request #2986
- Requires and optional blocks now enforce declaring exactly one parameter to prevent silent misconfigurations. Pull request #2991
- Blank and present checks reserved for outside input validation to handle loose type requirements. Pull request #3007
- AttributeIterator subclasses folded into a single class reducing duplication. Pull request #3009
Why it matters
This week focused on correctness and performance: mounted Rack apps work as ANY routes, request overhead dropped by eliminating unnecessary middleware copying, and validation now handles edge cases like invalid UTF-8 bytes and nested array error naming. Several subtle routing and formatting bugs were fixed where capital letters in vendors and custom coerce messages were ignored.
Changelog entry
- Mount Rack apps as ANY routes in mount order instead of unreachable 405 responses Pull request #3012
- Fold AttributeIterator subclasses into single class Pull request #3009
- Add grape-on-rack memory profiling harness Pull request #3008
- Improve request performance by eliminating formatter copying and empty filter phases Pull request #3004
- Reserve blank? and present? for outside input validation Pull request #3007
- Handle params and versions with invalid UTF-8 bytes gracefully Pull request #3006
- Load Rails before Grape in Rails gemfiles for proper railtie initialization Pull request #3005
- Honor custom message in coerce option with { value:, message: } syntax Pull request #2994
- Require exactly one parameter name for requires or optional blocks Pull request #2991
- Fix nested array element naming in validation errors through Hash scopes Pull request #2990
- Match header-versioned vendors declared with capital letters Pull request #2986
- Improve test coverage for error messages, middleware, router, and DSL readers Pull request #2983
Grape 4.0 improvements shipping this week: mounted Rack apps now route correctly, request overhead cut by removing middleware copying, and validation handles invalid UTF-8 bytes gracefully.
This week in Grape: mounted Rack apps now route as ANY methods in declaration order, request performance improved by eliminating formatter copying and empty filter phases, Rails initialization fixed in CI, header versioning matches capital letters correctly, custom coerce messages are honored, and nested array validation errors now report accurate indices. Several edge cases in validation and routing are now handled properly.
Week of September 14, 2026
What shipped
- Released v4.0.1 with performance improvements and bug fixes. Release
- Registries for formatters, parsers, params builders, validators and versioners are now replaced on registration instead of written into. Pull request #2976
- Every endpoint's Rack stack now runs through a single shared lambda instead of allocating a fresh one per endpoint. Pull request #2974
- Static values collections are now held as-is instead of wrapped in a lambda to avoid unnecessary per-request calls. Pull request #2975
- Removed two unused match caches per route that Mustermann was never asked to use. Pull request #2973
- Request paths no longer resolve params that were not asked for. Pull request #2972
- README examples and claims were corrected to match actual Grape behavior across roughly 40 passages. Pull request #2971
- Ruby requirement raised to 3.3.1 to avoid anonymous parameter forwarding issues in blocks. Pull request #2966
- Responses are now linted once per API under lint! instead of on every request. Pull request #2960
- Lazy configuration value tree collapsed into a single path-based Value for remountable APIs. Pull request #2950
Why it matters
This release focused on performance optimizations reducing unnecessary allocations and lookups on every request, correctness fixes for edge cases in params handling and error responses, and documentation improvements ensuring the README accurately reflects how Grape works.
Changelog entry
- Replace registries on registration instead of writing into them Pull request #2976
- Hold static values collections as-is instead of behind a lambda Pull request #2975
- Run every endpoint's Rack stack through one shared lambda Pull request #2974
- Copy query params only when params builder hands them back Pull request #2977
- Stop allocating two unused match caches per route Pull request #2973
- Stop request path from resolving params it was not asked for Pull request #2972
- Correct README where examples and claims do not match Grape Pull request #2971
- Correct README passages on given and routes admitting dots Pull request #2969
- Label redirect body with API's content type Pull request #2968
- Hand a Proc passed as last middleware argument to the middleware Pull request #2967
- Require Ruby 3.3.1 Pull request #2966
- Correct two README examples whose response did not match request Pull request #2965
- Let go of mount instances that refresh replaces Pull request #2964
- Stop recording a setting read as a setup step Pull request #2963
- Correct README on param versioning and unsupported request bodies Pull request #2961
- Send content type for
api_formatthe API does not declare Pull request #2959 - Reject non-Hash elements in Array params with blocks Pull request #2957
- Reject what variant collection types cannot coerce Pull request #2955
- Keep String error message's status when route names failure entity Pull request #2953
- Answer HEAD request for unmatched path without body Pull request #2958
Grape v4.0.1 ships with significant performance improvements: fewer allocations per request, smarter registry handling, and optimized path matching. Plus comprehensive README corrections ensuring examples match actual behavior.
Grape v4.0.1 is out with meaningful performance work: shared Rack lambda per endpoint, optimized registry writes, removed unused match caches, and faster path-versioned requests. We also corrected roughly 40 README passages to match actual behavior, improving the experience for developers discovering and using the framework.