RubyGems has introduced a cooldown feature in Bundler that delays installation of recently published or updated gems for a configurable number of days. This gives the community time to vet new packages before they reach developer machines, providing a defense layer against supply chain attacks where stolen credentials are used to inject malicious code into packages. The delay can be overridden when a known-good security patch needs immediate installation.
117 Impressions