---
title: Deprecating Paperclip
teaser: 'We are deprecating Paperclip in favor of ActiveStorage. Learn what this means
  for you.

  '
tags: news,paperclip,ruby
author: Mike Burns
published_on: 2018-05-14
---

In its eleventh year as an open source project, we have decided to halt work on
[Paperclip]. This comes from a combination of already slowed work on the project,
a constantly growing list of issues and pull requests that we struggle to keep
on top of, and most recently the release of [ActiveStorage] in Rails 5.2.

[Paperclip]: https://github.com/thoughtbot/paperclip
[ActiveStorage]: http://guides.rubyonrails.org/active_storage_overview.html

## Migrating

For moving from Paperclip to ActiveStorage, please see [the migration guide].
As you migrate and learn lessons, please _contribute back to the migration
guide_.

## Deprecation Plan

We have closed issues and pull requests unrelated to our deprecation process.

1. *Merge bug fixes.* We do not want to introduce new bugs so we are being
   careful to merge very few remaining pull requests, focusing on bug fixes. We
   understand that new bugs often occur when bugs are fixed and we want to
   leave the project in a stable state.
2. *One last official release.* This will be a major version bump containing
   the last of the bug fixes and maintenance we will perform.
3. *Release with a deprecation notice.* This will be identical to the bugfix
   release, only it spams your logs with a deprecation notice. This is
   a separate release so that you can upgrade to it at your leisure.

We will leave the Issues open but _will not monitor it_. Feel free to use it as
a forum among yourselves.

We will only accept _pull requests against [the migration guide]_.

This work will be done during our [investment time], and we intend to finish it
by September 2018.

[the migration guide]: https://github.com/thoughtbot/paperclip/blob/master/MIGRATING.md
[investment time]: https://thoughtbot.com/playbook/our-company/time#investment

## History

Paperclip began in August of 2007 in reaction to [hand-rolled file uploading]
and the [attachment_fu] project. It was a pet project of Jon Yurek, worked on
at thoughtbot between projects (this was before we had regular [investment
time]), with [the first commit from someone besides Jon] coming in April of
2008 by Mark Van Holstyn.

From there it took off. It, and later shoulda, defined open source at
thoughtbot for an era, driving our marketing ideas, setting precedent for when
and how to work on projects, and connecting us with the larger Rails ecosystem.

De facto maintainership changed hands a few times. [Prem Sichanugrist's first
commit] came in 2011; he co-maintained it with Jon, eventually swapping in as
the main point of contact.  Soon thereafter [I came in], giving it the light
touch of merging pull requests and [ensuring releases went out].

Our first security report came in [2014 from Egor Homakov]. More came after,
which caused me to disable image rendering in my browser. Many reporters used
[our secure reporting process] for this.

Other milestones of note: we [switched from Subversion to Git] in 2008. In 2011
we began [a refactoring effort to make Paperclip easier to extend]. We [did
this again in 2013].

In late 2017 we began the internal discussions of deprecating Paperclip.
ActiveStorage was under heavy development, Paperclip was not, and another
security bug report came in. We came up with a plan, caused one or two mistakes
along the way, and now here we are.

Paperclip has been an amazing journey and we wish ActiveStorage the best of
luck along their new adventure.

[hand-rolled file uploading]: https://matt.berther.io/2007/10/19/uploading-files-to-a-database-using-rails/
[attachment_fu]: https://github.com/technoweenie/attachment_fu
[the first commit from someone besides Jon]: https://github.com/thoughtbot/paperclip/commit/c653447e03d6605ebccc5ca404d6285ab7b5968b
[Prem Sichanugrist's first commit]: https://github.com/thoughtbot/paperclip/commit/23a71ec86f61672ee2c0a4648817c93594bccf5c
[I came in]: https://github.com/thoughtbot/paperclip/commit/59e52b70c9438ea65d9cef99fe33e934bfa89643
[ensuring releases went out]: https://thoughtbot.com/blog/every-two-weeks
[2014 from Egor Homakov]: http://homakov.blogspot.com/2014/02/paperclip-vulnerability-leading-to-xss.html
[our secure reporting process]: https://thoughtbot.com/security
[switched from Subversion to Git]: https://thoughtbot.com/blog/moving-to-github
[a refactoring effort to make Paperclip easier to extend]: https://thoughtbot.com/blog/a-paperclip-refactoring-tale-part-one-dependency
[did this again in 2013]: https://github.com/thoughtbot/paperclip/commit/40bdd3d5fa002d02d36d96801f930d209a6be224

## Thank you

Thank you to [all who contributed to Paperclip] over the past decade. We could
not have gotten here without you.

And an extra big thank you to the project leaders along the way. A project
lives or dies by their leader, and you all lead one of the most successful and
popular open source projects on GitHub and within the Rails ecosystem.

Most importantly, thank you to all who used Paperclip along the years. You
trusted us with your files and pushed us to do better every day.

[all who contributed to Paperclip]: https://github.com/thoughtbot/paperclip/graphs/contributors