It happens.
(Without meaning to sound callous to folks who have been reduced to firefighting this week: with sane practices on applying updated libraries to production, it happens to other people.)
It looks like the only diff is in activepack: http://github.com/rails/rails/blob/2-3-stable/actionpack/CHA...
2.3.8 (May 24, 2010)
* HTML safety: fix compatibility without the optional rails_xss plugin.
2.3.7 (May 24, 2010)
* HTML safety: fix compatibility with the optional rails_xss plugin. [Nathan Weizenbaum, Santiago Pastorino]
Broad test coverage is not always the safety net that its proponents like to claim it is.
jeez, when I read "2.3.8", I thought surely that was an error. 2.3.6 was just released.
they did it for the lolz
This morning I wrote (http://news.ycombinator.com/item?id=1375009)
Turns out that was wishful thinking: Get it while it's hot: http://www.railstutorial.org/book