As cited
Copy frozen at (site build).
vulnerabilities
Risky Bulletin: RubyGems adds dependency cooldowns to counter supply chain attacks
RubyGems has implemented dependency cooldowns, a feature that delays the installation of package dependencies until they reach a minimum age, allowing time for security detection and response. This mechanism lets developers, repository administrators, and security tools identify and remove compromised versions before widespread adoption. The approach mirrors similar protections recently adopted in JavaScript and Python ecosystems.
Why it matters: Ruby developers and security teams should evaluate whether dependency cooldowns fit their supply chain risk strategy, as this native feature can reduce exposure to freshly published malicious packages without requiring external tooling.
- Source published
- First seen by Cybersecurity Tracker