I followed the directions at http://www.rousette.org.uk/projects/downloads/comments/tracks-1042/ but got a “could not open database” error. Could this be because I am using Locomotive? If so, are there changes I could make in Locomotive to make the update work?

Coming at this from another direction, is the security vulnerability in Rails that this fixes an issue for me if I am running Tracks locally on my laptop?

Hmm, I don’t run Locomotive myself, but it could be the problem. Did you check that you’re pointing to the correct database, and that you copied over your config/database.yml from your old installation?

To answer your second question, it shouldn’t be a problem if you’re just running Tracks locally (i.e. on a non-externally accessible port/IP address), but I would feel more comfortable if people upgraded if they can

Problem fixed.

In case it helps anyone else, take note that the directory set up by unzipping the 1.041 release is

tracks-1.041 (with a hyphen)

and the directory set up by unzipping the 1.042 release is

tracks_1.042 (with an underscore).

Once I corrected the references in config/database.yml (before I had changed the number, but not the punctuation) all worked fine with the upgrade.

Many thanks to you both!