Runtime
Ruby on Rails
Rails 7.2 stops receiving security patches — the end of its two-year maintenance window
departs 9 Aug 2026
What this means for you
After 9 August 2026, Rails 7.2 receives no further security releases. Its bug-fix window already closed on 9 August 2025; security-only support ends exactly two years after the 7.2.0 release. In practice that means a security fix landing in the Rails 8.x line after that date will not be backported to 7.2, so an app pinned to 7.2 accumulates unpatched vulnerabilities in the framework itself. Nothing stops your app from running on 10 August — this is not a service switch-off — but it moves off the supported track, which matters most for anything internet-facing or handling user data.
Where to go
Rails ships supported releases on a fixed schedule: starting with 7.2, each minor release (7.2, 8.0, 8.1, …) gets one year of bug fixes and two years of security fixes from its release date. Getting back onto a supported line means upgrading off 7.2 to a current release — Rails 8.x — following the official upgrade guide, which documents the framework changes and deprecations between versions. Rails upgrades are stepwise by design (bump one minor at a time, run the app's test suite, address deprecation warnings surfaced by the previous version), so budget it as a planned upgrade rather than a same-day swap.
- Upgrade to a supported Rails 8.x release (the current maintained line)
Ruby on Rails maintains only a rolling window of recent releases, and Rails 7.2 is about to fall out of it. Under the project’s maintenance policy — “each minor release (7.2, 8.0, etc.) is officially supported based on a fixed, yearly duration: 1 year for bug fixes and 2 years for security fixes” — Rails 7.2 was released on 9 August 2024, so its bug-fix support ended a year later and its security support ends on 9 August 2026.
This is a quiet, predictable sunset rather than a breakage, and it belongs on the calendar precisely because it is easy to miss: nothing changes about a running 7.2 app on the day. What changes is upstream. Once security support ends, vulnerabilities fixed in the maintained Rails line stop being backported to 7.2, and an app left on the version quietly drifts from “supported” to “on its own” — the kind of gap that surfaces later as an audit finding or an unpatched CVE rather than an outage.
The path off is the ordinary Rails upgrade: move onto a current 8.x release using the official upgrade guide, one minor version at a time, leaning on your test suite and the deprecation warnings the previous version prints to catch what changed. There is no forced migration and no data loss here — just the recurring cost of staying on a framework that only supports its recent past. If you run a Rails 7.2 app, the useful thing this entry buys you is the date: plan the upgrade before 9 August, not after the next security advisory.
Entry changelog
- — last reviewed.
- — Entry created from the Rails maintenance policy (rubyonrails.org/maintenance); 7.2 security-support end date cross-checked on endoflife.date/rails.
Spot an error or a changed date? Tell us and it’s corrected the same night.