--- title: Ruby Central’s OSS Changelog: October 2026 | daily.dev description: Ruby Central's open source team details a year of RubyGems.org security, infrastructure and governance work. A CDN caching bug let legacy API key responses be... canonical: https://daily.dev/posts/ruby-central-s-oss-changelog-october-2026-pkql1jxvd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Ruby Central’s OSS Changelog: October 2026 | daily.dev og:description: Ruby Central's open source team details a year of RubyGems.org security, infrastructure and governance work. A CDN caching bug let legacy API key responses be... og:url: https://daily.dev/posts/ruby-central-s-oss-changelog-october-2026-pkql1jxvd og:image: https://api.daily.dev/og/posts/pkql1jXVd.png og:image:alt: Ruby Central’s OSS Changelog: October 2026 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Ruby Central’s OSS Changelog: October 2026 **[RUBYLAND](https://daily.dev/sources/rubyla)** · 12 min read · 0 upvotes · 0 comments ## Summary Ruby Central's open source team details a year of RubyGems.org security, infrastructure and governance work. A CDN caching bug let legacy API key responses be served to the wrong person for up to an hour; it was patched three days later, the old endpoint was retired and all legacy keys were revoked. An AI-assisted scanning program has scanned about 317 of 619 top gems, rejecting 90% of 134 evaluated findings as unreachable, intended behavior or duplicates, and six security advisories have been opened, including a critical rubyntlm flaw (rated 9.3 out of 10) where the NTLMv2 password check used an empty password, fixed in 0.6.6. RubyGems/Bundler 4.1.0.beta2 shipped October 8 with faster dependency resolution, clearer conflict errors, and opt-in dependency cooldowns that hold back recently published versions so malicious ones have time to be detected. RubyGems.org also moved to Ruby 4 and Rails 8.1 and completed a site redesign. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why is my gem push, gem yank, or gem owner command suddenly returning a 401 error on RubyGems.org? This happens because RubyGems.org retired its legacy API key endpoint and revoked every legacy API key after a security issue. In July 2026, a reported bug allowed responses from the legacy API key endpoint to be cached by the CDN and served to the wrong person for up to an hour. A fix shipped three days after the report. Create a new API key on RubyGems.org and update your local and CI configuration. _daily.dev helps developers catch breaking security changes like legacy API key retirements before CI breaks._ ### What is the rubyntlm NTLM authentication vulnerability and how do I fix it? The rubyntlm gem's NTLMv2 password check ignored the password it was given and checked every login attempt against an empty password instead, letting in anyone who knew a valid username. The maintainer rated the flaw critical, 9.3 out of 10, and fixed it in rubyntlm 0.6.6. Anyone using rubyntlm, which has over 94 million downloads, should upgrade to 0.6.6 or later. _Developers auditing authentication dependencies can track critical gem advisories like this via daily.dev._ ### What do dependency cooldowns do in Bundler and RubyGems? Dependency cooldowns hold back newly published gem versions for a set number of days before installs will resolve to them, giving time to detect malicious releases before they spread through supply chain attacks. They shipped in Bundler 4.0.13 in June, are opt-in, and support an override like '--cooldown 0' for urgent patches. RubyGems/Bundler 4.1.0.beta1 extended cooldowns to gem install, update, and outdated. _Teams deciding how to harden their dependency pipeline can follow Bundler and RubyGems releases on daily.dev._ ## Similar posts on daily.dev - [4.0.13 Released](https://daily.dev/posts/4-0-13-released-a34usskbo) · RUBYLAND · 1 upvotes · 0 comments - [Ruby Weekly Issue 776: November 20, 2025](https://daily.dev/posts/ruby-weekly-issue-776-november-20-2025-slhf3qx7n) · Ruby Weekly · 0 upvotes · 0 comments - [Rails World '26: The RubyGems Compact Index](https://daily.dev/posts/rails-world-26-the-rubygems-compact-index-71jopqfqg) · Ruby Flow · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ruby](https://daily.dev/tags/ruby) [View this post on daily.dev](https://daily.dev/posts/ruby-central-s-oss-changelog-october-2026-pkql1jxvd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Ruby Central’s OSS Changelog: October 2026","url":"https://daily.dev/posts/ruby-central-s-oss-changelog-october-2026-pkql1jxvd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ruby-central-s-oss-changelog-october-2026-pkql1jxvd"},"datePublished":"2026-10-29T00:28:56.430Z","dateModified":"2026-10-29T00:29:30.246Z","description":"Ruby Central's open source team details a year of RubyGems.org security, infrastructure and governance work. A CDN caching bug let legacy API key responses be...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ffa2094b24bb9a55168c826d2737e021?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ffa2094b24bb9a55168c826d2737e021?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"RUBYLAND","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"RUBYLAND","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/rubyla","url":"https://daily.dev/sources/rubyla"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ruby-central-s-oss-changelog-october-2026-pkql1jxvd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ruby","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"RUBYLAND","item":"https://daily.dev/sources/rubyla"},{"@type":"ListItem","position":3,"name":"Ruby Central’s OSS Changelog: October 2026"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ruby-central-s-oss-changelog-october-2026-pkql1jxvd#faq","mainEntity":[{"@type":"Question","name":"Why is my gem push, gem yank, or gem owner command suddenly returning a 401 error on RubyGems.org?","acceptedAnswer":{"@type":"Answer","text":"This happens because RubyGems.org retired its legacy API key endpoint and revoked every legacy API key after a security issue. In July 2026, a reported bug allowed responses from the legacy API key endpoint to be cached by the CDN and served to the wrong person for up to an hour. A fix shipped three days after the report. Create a new API key on RubyGems.org and update your local and CI configuration. daily.dev helps developers catch breaking security changes like legacy API key retirements before CI breaks."}},{"@type":"Question","name":"What is the rubyntlm NTLM authentication vulnerability and how do I fix it?","acceptedAnswer":{"@type":"Answer","text":"The rubyntlm gem's NTLMv2 password check ignored the password it was given and checked every login attempt against an empty password instead, letting in anyone who knew a valid username. The maintainer rated the flaw critical, 9.3 out of 10, and fixed it in rubyntlm 0.6.6. Anyone using rubyntlm, which has over 94 million downloads, should upgrade to 0.6.6 or later. Developers auditing authentication dependencies can track critical gem advisories like this via daily.dev."}},{"@type":"Question","name":"What do dependency cooldowns do in Bundler and RubyGems?","acceptedAnswer":{"@type":"Answer","text":"Dependency cooldowns hold back newly published gem versions for a set number of days before installs will resolve to them, giving time to detect malicious releases before they spread through supply chain attacks. They shipped in Bundler 4.0.13 in June, are opt-in, and support an override like '--cooldown 0' for urgent patches. RubyGems/Bundler 4.1.0.beta1 extended cooldowns to gem install, update, and outdated. Teams deciding how to harden their dependency pipeline can follow Bundler and RubyGems releases on daily.dev."}}]} ```