Rails 7.2.4 is the final 7.2 release, fixes now only for 8.0 and 8.1
Victoria Shinder2 min readThe Rails team released Rails 7.2.4 on 24 September and, in the same announcement, ended the 7.2 series. The post says plainly that 7.2.4 is the last release of 7.2.x, and that security issues and bug fixes will from now on only be provided for the 8.0.x and 8.1.x series. As usual the announcement lists SHA-256 checksums for each of the thirteen gems - from activesupport to railties and the rails meta-gem - so that anyone can verify the packages they install match what was uploaded, and it points to GitHub for the summary of changes and the per-gem changelogs.
The announcement is short, and the substance is in its second sentence. Rails 7.2 applications that upgrade to 7.2.4 get the final set of fixes for that line; after that, any vulnerability found in code shared with 7.2 will be fixed in 8.0 and 8.1 only.
What it means
For teams still on 7.2, the calendar just changed from "upgrade when convenient" to "upgrade before the next advisory". The practical risk of running an unsupported framework is not that it stops working, but that the next security release arrives for versions you cannot adopt in a day. A security fix to a supported line is usually a patch-level bump; for an unsupported one, it becomes a major-version migration done under time pressure.
The sensible order is to take 7.2.4 now, since it is a patch release with the last fixes, and then plan the move to 8.0 or directly to 8.1 as a scheduled project rather than an incident response. Upgrading one major version at a time and fixing deprecation warnings at each step keeps each change reviewable. The checksums in the announcement are worth using as part of that process too: pinning gems by version is common, but verifying that the published artefact is the one the maintainers uploaded is the part most teams skip.
For libraries and gems that support multiple Rails versions, the end of 7.2 is also the moment to decide whether to keep testing against it. Dropping an unsupported framework version from a CI matrix is not neglect; it is aligning the promise a library makes with the one its upstream still keeps.