--- title: Ruby's Bundler adds a cooldown feature | daily.dev description: Bundler 4.0.13 introduces a dependency cooldown feature that prevents resolving to newly published gem versions until they have been public for at least N... canonical: https://daily.dev/posts/ruby-s-bundler-adds-a-cooldown-feature-cgpo3ejk7 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Ruby's Bundler adds a cooldown feature | daily.dev og:description: Bundler 4.0.13 introduces a dependency cooldown feature that prevents resolving to newly published gem versions until they have been public for at least N... og:url: https://daily.dev/posts/ruby-s-bundler-adds-a-cooldown-feature-cgpo3ejk7 og:image: https://api.daily.dev/og/posts/cGPo3ejK7.png og:image:alt: Ruby's Bundler adds a cooldown feature og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Ruby's Bundler adds a cooldown feature **[LWN.net](https://daily.dev/sources/lwn)** · 1 min read · 0 upvotes · 0 comments ## Summary Bundler 4.0.13 introduces a dependency cooldown feature that prevents resolving to newly published gem versions until they have been public for at least N days. This opt-in mechanism targets the narrow window supply-chain attackers exploit — pushing a malicious version immediately after compromising an account. The feature complements existing defenses like mandatory 2FA and trusted publishing, and was designed openly with input from how other ecosystems handle the same problem. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Cool down before you install: give new gems a few days to be vetted](https://daily.dev/posts/cool-down-before-you-install-give-new-gems-a-few-days-to-be-vetted-jou9j1l7a) · RUBYLAND · 1 upvotes · 0 comments - [Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bu...](https://daily.dev/posts/ruby-s-bundler-4-0-18-extends-cooldown-to-bundle-lock-and-bu--0cxaoz1h7) · Socket · 1 upvotes · 0 comments - [Patching fast and slow: Ruby devs delay to defend against supply chain attack](https://daily.dev/posts/patching-fast-and-slow-ruby-devs-delay-to-defend-against-supply-chain-attack-ywjknxskm) · InfoWorld · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ruby](https://daily.dev/tags/ruby) [View this post on daily.dev](https://daily.dev/posts/ruby-s-bundler-adds-a-cooldown-feature-cgpo3ejk7) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Ruby's Bundler adds a cooldown feature","url":"https://daily.dev/posts/ruby-s-bundler-adds-a-cooldown-feature-cgpo3ejk7","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ruby-s-bundler-adds-a-cooldown-feature-cgpo3ejk7"},"datePublished":"2026-06-05T12:59:53.938Z","dateModified":"2026-06-05T13:00:09.737Z","description":"Bundler 4.0.13 introduces a dependency cooldown feature that prevents resolving to newly published gem versions until they have been public for at least N...","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"LWN.net","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"LWN.net","logo":"https://media.daily.dev/image/upload/s--4jjE7GIK--/f_auto,q_auto/v1774960833/logos/lwn?_a=BAMAMiWQ0","url":"https://daily.dev/sources/lwn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ruby-s-bundler-adds-a-cooldown-feature-cgpo3ejk7","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ruby","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"LWN.net","item":"https://daily.dev/sources/lwn"},{"@type":"ListItem","position":3,"name":"Ruby's Bundler adds a cooldown feature"}]} ```