---
title: "Cool down before you install: give new gems a few days to be vetted"
url: https://daily.dev/posts/cool-down-before-you-install-give-new-gems-a-few-days-to-be-vetted-jou9j1l7a
source_url: https://blog.rubygems.org/2026/06/03/cooldown-let-new-gems-be-vetted.html
type: article
source: "RUBYLAND"
published: 2026-06-03T03:21:36.649Z
updated: 2026-06-07T17:51:24.186Z
tags: ["security", "ruby"]
reading_time: 6
upvotes: 1
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Cool down before you install: give new gems a few days to be vetted

**[RUBYLAND](https://daily.dev/sources/rubyla)** · 6 min read · 1 upvotes · 0 comments

## Summary

Bundler 4.0.13 introduces a 'cooldown' feature that prevents resolving gem versions published within the last N days, mitigating supply-chain attacks that exploit the narrow window between a compromised account pushing a malicious release and developers installing it. The feature is opt-in and configured via a `cooldown:` keyword on Gemfile sources, bundle config settings, environment variables, or CLI flags. It reads per-version `created_at` timestamps from rubygems.org's v2 compact index, never silently blocks resolution, and integrates with `bundle outdated` to show how long held-back versions must wait. An escape hatch (`--cooldown 0`) allows bypassing the policy for urgent security upgrades. The feature complements existing defenses like mandatory 2FA, trusted publishing, and AI-assisted vulnerability scanning.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://blog.rubygems.org/2026/06/03/cooldown-let-new-gems-be-vetted.html>

## Similar posts on daily.dev

- [Ruby's Bundler adds a cooldown feature](https://daily.dev/posts/ruby-s-bundler-adds-a-cooldown-feature-cgpo3ejk7) · LWN.net · 0 upvotes · 0 comments
- [Patching fast and slow: Ruby devs delay to defend against supply chain attack](https://daily.dev/posts/patching-fast-and-slow-ruby-devs-delay-to-defend-against-supply-chain-attack-ywjknxskm) · InfoWorld · 0 upvotes · 0 comments
- [Should RubyGems/Bundler Have a Cooldown Feature?](https://daily.dev/posts/should-rubygems-bundler-have-a-cooldown-feature--dv2ipsadt) · DEV · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#ruby](https://daily.dev/tags/ruby)

[View this post on daily.dev](https://daily.dev/posts/cool-down-before-you-install-give-new-gems-a-few-days-to-be-vetted-jou9j1l7a)