Bundler 4.0.13 introduces a 'cooldown' feature that prevents resolving gem versions published within the last N days, mitigating supply-chain attacks that exploit the narrow window between a compromised account pushing a malicious release and developers installing it. The feature is opt-in and configured via a `cooldown:` keyword on Gemfile sources, bundle config settings, environment variables, or CLI flags. It reads per-version `created_at` timestamps from rubygems.org's v2 compact index, never silently blocks resolution, and integrates with `bundle outdated` to show how long held-back versions must wait. An escape hatch (`--cooldown 0`) allows bypassing the policy for urgent security upgrades. The feature complements existing defenses like mandatory 2FA, trusted publishing, and AI-assisted vulnerability scanning.
