Bundler 4.0.18 extends the opt-in --cooldown flag to bundle lock and bundle cache commands, closing gaps where the supply chain protection feature previously could not be applied. The cooldown feature, introduced in Bundler 4.0.13, delays dependency resolution to gem versions published within a configurable time window (e.g., 7 days), helping projects avoid consuming malicious packages that are typically detected and removed within hours. Previously, bundle lock and bundle cache resolved dependencies without accepting the flag, leaving automated workflows unable to override cooldown delays. The update also adds a regression test ensuring cooldown keys on gem name and version rather than platform, preventing attackers from bypassing the filter by pushing fresh platform-specific builds under an already-aged version number. Additionally, Bundler now warns when duplicate source declarations conflict on cooldown values. The change aligns Bundler with similar features in pnpm and npm.
