RubyGems 4.0.13 and Bundler 4.0.13 have been released. RubyGems enhancements include a security fix preventing extraction path traversal via pre-existing symlinks, improved stdin handling with popen2e, and Windows symlink fallback support. Bundler enhancements include flexible gem directory permissions during install, gem specification cache clearing after process lock acquisition, and release date display in bundle outdated. A notable security addition is a cooldown mechanism that delays newly published gems to allow vetting before installation. One bug fix addresses cooldown application to locally installed gem versions.
314 Impressions