--- title: Ruby Central’s OSS Changelog: October 2026 | daily.dev description: Ruby Central's relaunched OSS Changelog covers a year of RubyGems.org operations, security, and release work. RubyGems.org now runs on Ruby 4 and Rails 8.1,... canonical: https://daily.dev/posts/ruby-central-s-oss-changelog-october-2026-jg6ihpmb6 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Ruby Central’s OSS Changelog: October 2026 | daily.dev og:description: Ruby Central's relaunched OSS Changelog covers a year of RubyGems.org operations, security, and release work. RubyGems.org now runs on Ruby 4 and Rails 8.1,... og:url: https://daily.dev/posts/ruby-central-s-oss-changelog-october-2026-jg6ihpmb6 og:image: https://api.daily.dev/og/posts/jG6ihPmb6.png og:image:alt: Ruby Central’s OSS Changelog: October 2026 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Ruby Central’s OSS Changelog: October 2026 **[RUBYLAND](https://daily.dev/sources/rubyla)** · 13 min read · 0 upvotes · 0 comments ## Summary Ruby Central's relaunched OSS Changelog covers a year of RubyGems.org operations, security, and release work. RubyGems.org now runs on Ruby 4 and Rails 8.1, handles over 1 billion requests a day, and validates gem pushes against a schema built from auditing 180,000+ gems. A legacy API key endpoint bug that could leak responses via CDN caching was fixed within three days and all legacy keys were revoked. An AI-assisted security scanning program found a critical NTLMv2 bypass in rubyntlm, fixed in 0.6.6, and RubyGems/Bundler 4.1.0.beta2 shipped faster dependency resolution and clearer conflict errors, while dependency cooldowns shipped in Bundler 4.0.13 and were extended to more commands in 4.1.0.beta1. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What was the security vulnerability found in the rubyntlm gem? The rubyntlm gem's NTLMv2 password check ignored the password it was given and instead validated every login against an empty password, letting in anyone who knew a valid username. The maintainer rated the flaw critical at 9.3 out of 10 and fixed it in rubyntlm 0.6.6. Anyone using rubyntlm should upgrade to 0.6.6 or later. _Teams relying on Ruby auth gems can track disclosures like this one on daily.dev to patch before exposure spreads._ ### What are dependency cooldowns in Bundler and how do they work? Dependency cooldowns, shipped in Bundler 4.0.13, hold back newly published gem versions for a configurable number of days before they can be installed, giving time to detect malicious releases before they spread through bundle install. They are opt-in, and passing '--cooldown 0' still allows installing an urgent patch immediately. Bundler 4.1.0.beta1 extends cooldowns to gem install, update, and outdated. _Developers hardening their dependency pipeline against supply chain attacks can follow updates like this on daily.dev._ ### What happened with the RubyGems.org legacy API key endpoint security incident? RubyGems.org's legacy API key endpoint had responses cached by its CDN and served to the wrong user for up to an hour, reported by Luke Marshall of Truffle Security in July. A fix was deployed three days later, the old endpoint was retired, every legacy API key was revoked, and affected accounts were notified; access logs showed no sign of malicious use. Anyone hitting a 401 on gem push, yank, or owner from an older setup needs to generate a new API key. _Maintainers debugging sudden gem push auth failures can check incident write-ups like this on daily.dev._ ## Similar posts on daily.dev - [4.0.13 Released](https://daily.dev/posts/4-0-13-released-a34usskbo) · RUBYLAND · 1 upvotes · 0 comments - [Ruby Weekly Issue 776: November 20, 2025](https://daily.dev/posts/ruby-weekly-issue-776-november-20-2025-slhf3qx7n) · Ruby Weekly · 0 upvotes · 0 comments - [Ruby 4.0.6 Released](https://daily.dev/posts/ruby-4-0-6-released-sud5stqti) · Ruby · 14 upvotes · 0 comments - [Ruby Weekly Issue 783: January 15, 2026](https://daily.dev/posts/ruby-weekly-issue-783-january-15-2026-zz1hecx2x) · Ruby Weekly · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ruby](https://daily.dev/tags/ruby) [View this post on daily.dev](https://daily.dev/posts/ruby-central-s-oss-changelog-october-2026-jg6ihpmb6) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Ruby Central’s OSS Changelog: October 2026","url":"https://daily.dev/posts/ruby-central-s-oss-changelog-october-2026-jg6ihpmb6","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ruby-central-s-oss-changelog-october-2026-jg6ihpmb6"},"datePublished":"2026-10-29T02:20:54.755Z","dateModified":"2026-10-29T02:21:24.979Z","description":"Ruby Central's relaunched OSS Changelog covers a year of RubyGems.org operations, security, and release work. RubyGems.org now runs on Ruby 4 and Rails 8.1,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/294ad834834b54fe5409ae167b820dd9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/294ad834834b54fe5409ae167b820dd9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"RUBYLAND","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"RUBYLAND","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/rubyla","url":"https://daily.dev/sources/rubyla"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ruby-central-s-oss-changelog-october-2026-jg6ihpmb6","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ruby","timeRequired":"PT13M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"RUBYLAND","item":"https://daily.dev/sources/rubyla"},{"@type":"ListItem","position":3,"name":"Ruby Central’s OSS Changelog: October 2026"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ruby-central-s-oss-changelog-october-2026-jg6ihpmb6#faq","mainEntity":[{"@type":"Question","name":"What was the security vulnerability found in the rubyntlm gem?","acceptedAnswer":{"@type":"Answer","text":"The rubyntlm gem's NTLMv2 password check ignored the password it was given and instead validated every login against an empty password, letting in anyone who knew a valid username. The maintainer rated the flaw critical at 9.3 out of 10 and fixed it in rubyntlm 0.6.6. Anyone using rubyntlm should upgrade to 0.6.6 or later. Teams relying on Ruby auth gems can track disclosures like this one on daily.dev to patch before exposure spreads."}},{"@type":"Question","name":"What are dependency cooldowns in Bundler and how do they work?","acceptedAnswer":{"@type":"Answer","text":"Dependency cooldowns, shipped in Bundler 4.0.13, hold back newly published gem versions for a configurable number of days before they can be installed, giving time to detect malicious releases before they spread through bundle install. They are opt-in, and passing '--cooldown 0' still allows installing an urgent patch immediately. Bundler 4.1.0.beta1 extends cooldowns to gem install, update, and outdated. Developers hardening their dependency pipeline against supply chain attacks can follow updates like this on daily.dev."}},{"@type":"Question","name":"What happened with the RubyGems.org legacy API key endpoint security incident?","acceptedAnswer":{"@type":"Answer","text":"RubyGems.org's legacy API key endpoint had responses cached by its CDN and served to the wrong user for up to an hour, reported by Luke Marshall of Truffle Security in July. A fix was deployed three days later, the old endpoint was retired, every legacy API key was revoked, and affected accounts were notified; access logs showed no sign of malicious use. Anyone hitting a 401 on gem push, yank, or owner from an older setup needs to generate a new API key. Maintainers debugging sudden gem push auth failures can check incident write-ups like this on daily.dev."}}]} ```