--- title: Rails World '26: The RubyGems Compact Index | daily.dev description: Notes from Jenny Shen's Rails World talk cover the RubyGems compact index, the three plain-text endpoints (/names, /versions, /info) that Bundler queries on... canonical: https://daily.dev/posts/rails-world-26-the-rubygems-compact-index-71jopqfqg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Rails World '26: The RubyGems Compact Index | daily.dev og:description: Notes from Jenny Shen's Rails World talk cover the RubyGems compact index, the three plain-text endpoints (/names, /versions, /info) that Bundler queries on... og:url: https://daily.dev/posts/rails-world-26-the-rubygems-compact-index-71jopqfqg og:image: https://api.daily.dev/og/posts/71JopQfQG.png og:image:alt: Rails World '26: The RubyGems Compact Index og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Rails World '26: The RubyGems Compact Index **[Ruby Flow](https://daily.dev/sources/rubyflow)** · 8 min read · 1 upvotes · 0 comments ## Summary Notes from Jenny Shen's Rails World talk cover the RubyGems compact index, the three plain-text endpoints (/names, /versions, /info) that Bundler queries on every bundle install, serving over 50 million requests daily across 200,000+ gems. The talk details how checksums, ETags, and HTTP Range requests let the system scale, then covers two recent features: cooldown (a configurable delay, e.g. 7 days, before Bundler will install freshly published gem versions, aimed at slowing supply-chain attacks like the Axios npm compromise) and content-addressable gems (skinny, single-ABI precompiled binaries that cut a fresh Rails app's bundle install from ~25s to ~5s by skipping native extension compilation). Both shipped via RubyGems/Bundler 4.1.0.beta1 and are part of the Ruby Shield initiative, a four-year Ruby Central/Shopify security partnership that also added mandatory MFA and trusted publishing. The piece closes noting a May-June 2026 campaign where automated agents with OpenAI-tooling markers uploaded thousands of malicious packages to RubyGems.org. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does the bundler cooldown feature do and how do I enable it? Cooldown lets Bundler skip any gem version that hasn't been publicly available for a set number of days, giving the community time to catch compromised releases before they get installed. Enable it per source with `source "https://rubygems.org", cooldown: 7` in a Gemfile, via `bundle config set cooldown 7`, a `--cooldown 7` flag, or the `BUNDLE_COOLDOWN` environment variable. It shipped in Bundler 4.0.13 and RubyGems recommends seven days as a starting point. _Teams hardening their ruby supply chain can follow cooldown and similar protections as they land on daily.dev._ ### What are content-addressable gems in RubyGems and how do they speed up bundle install? Content-addressable gems publish one skinny precompiled binary per Ruby ABI, named with a hash of its contents, instead of a single fat gem bundling every supported ABI. Shopify's numbers show a fresh Rails app's bundle install drops from around 25 seconds to about 5 seconds on a MacBook Pro M4 once native extension compilation is skipped. Support merged into RubyGems via pull request on September 6, 2026, and shipped in RubyGems/Bundler 4.1.0.beta1. _Developers chasing faster installs can track packaging changes like this one on daily.dev._ ### What are the three compact index endpoints that Bundler uses during bundle install? Bundler talks to three plain-text endpoints on RubyGems.org: /names lists every gem name ever pushed, /versions lists every release per gem plus an MD5 info checksum, and /info/{gem_name} holds per-version dependency data and a SHA-256 checksum of the .gem file. Bundler caches all three locally and only refetches /info when the versions checksum changes, letting the system handle over 50 million requests a day across more than 200,000 gems. _Anyone debugging bundle install performance can dig into infrastructure explainers like this on daily.dev._ ## Similar posts on daily.dev - [Cool down before you install: give new gems a few days to be vetted](https://daily.dev/posts/cool-down-before-you-install-give-new-gems-a-few-days-to-be-vetted-jou9j1l7a) · RUBYLAND · 1 upvotes · 0 comments - [Ruby Weekly Issue 792: March 19, 2026](https://daily.dev/posts/ruby-weekly-issue-792-march-19-2026-rdzjnbtnc) · Ruby Weekly · 0 upvotes · 0 comments - [Patching fast and slow: Ruby devs delay to defend against supply chain attack](https://daily.dev/posts/patching-fast-and-slow-ruby-devs-delay-to-defend-against-supply-chain-attack-ywjknxskm) · InfoWorld · 0 upvotes · 0 comments - [Ruby's Bundler adds a cooldown feature](https://daily.dev/posts/ruby-s-bundler-adds-a-cooldown-feature-cgpo3ejk7) · LWN.net · 0 upvotes · 0 comments - [What RubyGems Stats Actually Reveal About the Ecosystem](https://daily.dev/posts/what-rubygems-stats-actually-reveal-about-the-ecosystem-y83oo7fgj) · Ruby Flow · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ruby](https://daily.dev/tags/ruby) [View this post on daily.dev](https://daily.dev/posts/rails-world-26-the-rubygems-compact-index-71jopqfqg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Rails World '26: The RubyGems Compact Index","url":"https://daily.dev/posts/rails-world-26-the-rubygems-compact-index-71jopqfqg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/rails-world-26-the-rubygems-compact-index-71jopqfqg"},"datePublished":"2026-10-01T00:57:39.720Z","dateModified":"2026-10-01T00:58:06.800Z","description":"Notes from Jenny Shen's Rails World talk cover the RubyGems compact index, the three plain-text endpoints (/names, /versions, /info) that Bundler queries on...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5f073aa48b104a58b94020838674a8f5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5f073aa48b104a58b94020838674a8f5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Ruby Flow","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Ruby Flow","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/a21aaa8bcbbf448193a016895c90a0e1","url":"https://daily.dev/sources/rubyflow"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/rails-world-26-the-rubygems-compact-index-71jopqfqg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ruby","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Ruby Flow","item":"https://daily.dev/sources/rubyflow"},{"@type":"ListItem","position":3,"name":"Rails World '26: The RubyGems Compact Index"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/rails-world-26-the-rubygems-compact-index-71jopqfqg#faq","mainEntity":[{"@type":"Question","name":"What does the bundler cooldown feature do and how do I enable it?","acceptedAnswer":{"@type":"Answer","text":"Cooldown lets Bundler skip any gem version that hasn't been publicly available for a set number of days, giving the community time to catch compromised releases before they get installed. Enable it per source with `source \"https://rubygems.org\", cooldown: 7` in a Gemfile, via `bundle config set cooldown 7`, a `--cooldown 7` flag, or the `BUNDLE_COOLDOWN` environment variable. It shipped in Bundler 4.0.13 and RubyGems recommends seven days as a starting point. Teams hardening their ruby supply chain can follow cooldown and similar protections as they land on daily.dev."}},{"@type":"Question","name":"What are content-addressable gems in RubyGems and how do they speed up bundle install?","acceptedAnswer":{"@type":"Answer","text":"Content-addressable gems publish one skinny precompiled binary per Ruby ABI, named with a hash of its contents, instead of a single fat gem bundling every supported ABI. Shopify's numbers show a fresh Rails app's bundle install drops from around 25 seconds to about 5 seconds on a MacBook Pro M4 once native extension compilation is skipped. Support merged into RubyGems via pull request on September 6, 2026, and shipped in RubyGems/Bundler 4.1.0.beta1. Developers chasing faster installs can track packaging changes like this one on daily.dev."}},{"@type":"Question","name":"What are the three compact index endpoints that Bundler uses during bundle install?","acceptedAnswer":{"@type":"Answer","text":"Bundler talks to three plain-text endpoints on RubyGems.org: /names lists every gem name ever pushed, /versions lists every release per gem plus an MD5 info checksum, and /info/{gem_name} holds per-version dependency data and a SHA-256 checksum of the .gem file. Bundler caches all three locally and only refetches /info when the versions checksum changes, letting the system handle over 50 million requests a day across more than 200,000 gems. Anyone debugging bundle install performance can dig into infrastructure explainers like this on daily.dev."}}]} ```