A CDN caching bug on RubyGems.org could hand one account’s API key to another person for up to an hour. If you signed in to RubyGems.org with a gem client older than v3.2.0, your key could have been exposed (the technical details are below). Currently, 18% of sign-ins through gem signin come from an affected version, and for the first several years of this bug, before we changed the client’s sign-…
RubyGems 4.0.17 includes enhancements and bug fixes and Bundler 4.0.17 includes enhancements, bug fixes and documentation. To update to the latest RubyGems you can run: gem update --system [--pre] To update to the latest Bundler you can run: gem install bundler [--pre] bundle update --bundler=4.0.17 RubyGems Release Notes Enhancements: Validate spec name before writing to the spec cache. Pull requ…
RubyGems 4.0.16 includes enhancements and bug fixes and Bundler 4.0.16 includes enhancements, bug fixes and documentation. To update to the latest RubyGems you can run: gem update --system [--pre] To update to the latest Bundler you can run: gem install bundler [--pre] bundle update --bundler=4.0.16 RubyGems Release Notes Enhancements: Installs bundler 4.0.16 as a default gem. Bug fixes: Skip the…
RubyGems 4.0.15 includes enhancements and bug fixes and Bundler 4.0.15 includes enhancements and bug fixes. To update to the latest RubyGems you can run: gem update --system [--pre] To update to the latest Bundler you can run: gem install bundler [--pre] bundle update --bundler=4.0.15 RubyGems Release Notes Enhancements: Rubygems: Fix Gem::Request for PQC support, adding integration connection tes…
RubyGems 4.0.14 includes enhancements and Bundler 4.0.14 includes bug fixes. To update to the latest RubyGems you can run: gem update --system [--pre] To update to the latest Bundler you can run: gem install bundler [--pre] bundle update --bundler=4.0.14 RubyGems Release Notes Enhancements: Add executables and bindir validation to the gem installer. Pull request #9595 by hsbt Strip C1 control char…
RubyGems 4.0.13 includes enhancements and Bundler 4.0.13 includes enhancements, bug fixes and security. To update to the latest RubyGems you can run: gem update --system [--pre] To update to the latest Bundler you can run: gem install bundler [--pre] bundle update --bundler=4.0.13 RubyGems Release Notes Enhancements: Prevent extraction from escaping destination_dir via pre-existing symlinks. Pull…
Most supply-chain attacks against RubyGems exploit a narrow window: an account is compromised, a malicious version ships, and any bundle install in the minutes that follow resolves straight to it. Bundler 4.0.13 introduces cooldown, a time-based filter that refuses to resolve to a version until it has been public for at least N days. Releases too new to have been scrutinized are passed over in fav…
RubyGems 4.0.12 includes enhancements and bug fixes and Bundler 4.0.12 includes enhancements and bug fixes. To update to the latest RubyGems you can run: gem update --system [--pre] To update to the latest Bundler you can run: gem install bundler [--pre] bundle update --bundler=4.0.12 RubyGems Release Notes Enhancements: Remove cygwin from WIN_PATTERNS. Pull request #9527 by fd00 Installs bundler…
RubyGems 4.0.11 includes enhancements and Bundler 4.0.11 includes enhancements, bug fixes and documentation. To update to the latest RubyGems you can run: gem update --system [--pre] To update to the latest Bundler you can run: gem install bundler [--pre] bundle update --bundler=4.0.11 RubyGems Release Notes Enhancements: Add commented-out rubygems_mfa_required to bundle gem template. Pull request…
On April 23rd, we submitted a vulnerability report to the Nokogiri maintainers. It was the first one our team has filed using AI-assisted scanning. The maintainers accepted the report and published it as GHSA-c4rq-3m3g-8wgx. The same week, news broke that Mythos, Anthropic’s most capable security model, had been accessed by unauthorized users through a third-party vendor. According to Anthropic, M…
rubygems.org has been a busy project. This past year we shipped formal policies for the first time in the registry’s history, launched the Organizations private beta, and made some meaningful security improvements to how gems get validated and how compromised passwords get caught. A lot of that work happened quietly. If you wanted to know where things were headed, you had to catch the right confer…
Every gem published to rubygems.org ends up running on someone’s computer. It’s up to rubygems.org to ensure that each gem contains what it claims, that its metadata is well-formed, and that the person who pushed it is who they say they are. We’ve been chipping away at that. Over the past few months, we shipped two changes that tighten rubygems.org’s defences at very different layers: stronger val…
RubyGems 4.0.10 includes enhancements and bug fixes and Bundler 4.0.10 includes enhancements and bug fixes. To update to the latest RubyGems you can run: gem update --system [--pre] To update to the latest Bundler you can run: gem install bundler [--pre] bundle update --bundler=4.0.10 RubyGems Release Notes Enhancements: Ignore warnings with spec different platforms. Pull request #8508 by hsbt Bet…
I’m one of the operators of rubygems.org. Here’s what’s been happening over the past week, and a temporary change we’re making as a result. For the past seven days, rubygems.org has been under sustained bot traffic from many different sources scraping data from every published gem. The volume has been large enough to force the site offline while we respond. The bots are deliberately bypassing the…
RubyGems 4.0.9 includes enhancements, bug fixes and documentation and Bundler 4.0.9 includes enhancements and bug fixes. To update to the latest RubyGems you can run: gem update --system [--pre] To update to the latest Bundler you can run: gem install bundler [--pre] bundle update --bundler=4.0.9 RubyGems Release Notes Enhancements: Fix: include owner role in gem owner. Pull request #9403 by gjtor…
RubyGems 4.0.8 includes enhancements and documentation and Bundler 4.0.8 includes enhancements and bug fixes. To update to the latest RubyGems you can run: gem update --system [--pre] To update to the latest Bundler you can run: gem install bundler [--pre] bundle update --bundler=4.0.8 RubyGems Release Notes Enhancements: Use JSON for cargo metadata parsing. Pull request #9373 by hsbt Fix NameErro…
RubyGems 4.0.7 includes enhancements and documentation and Bundler 4.0.7 includes enhancements, bug fixes and documentation. To update to the latest RubyGems you can run: gem update --system [--pre] To update to the latest Bundler you can run: gem install bundler [--pre] bundle update --bundler=4.0.7 RubyGems Release Notes Enhancements: Add Gem.disable_system_update_message in setup.rb. Pull reque…
We’re excited to announce that the Organizations feature for RubyGems.org has entered private beta! A long time coming We started the Organizations work back in 2024 as announced in our June 2024 RubyGems update, where we shared our plans to bring organization accounts, memberships, and more precise gem permission controls to the platform. Since then, the team has been steadily building out the fe…
RubyGems 4.0.6 includes enhancements and Bundler 4.0.6 includes bug fixes and documentation. To update to the latest RubyGems you can run: gem update --system [--pre] To update to the latest Bundler you can run: gem install bundler [--pre] bundle update --bundler=4.0.6 RubyGems Release Notes Enhancements: Update vendored resolv to 0.7.0. Pull request #9298 by hsbt Installs bundler 4.0.6 as a defau…
RubyGems 4.0.5 includes enhancements, bug fixes and documentation and Bundler 4.0.5 includes enhancements and bug fixes. To update to the latest RubyGems you can run: gem update --system [--pre] To update to the latest Bundler you can run: gem install bundler [--pre] bundle update --bundler=4.0.5 RubyGems Release Notes Enhancements: Removed unused deprecate loading. Pull request #9266 by hsbt Vali…
RubyGems 4.0.4 includes enhancements and bug fixes and Bundler 4.0.4 includes enhancements and bug fixes. To update to the latest RubyGems you can run: gem update --system [--pre] To update to the latest Bundler you can run: gem install bundler [--pre] bundle update --bundler=4.0.4 RubyGems Release Notes Enhancements: Remove date require from rebuild command. Pull request #9232 by jeremyevans Inst…
Ruby 4.0.0 was released on December 25, 2025, and RubyGems/Bundler 4.0.3 is now bundled with Ruby 4.0.0. Since my previous post focused on migration and compatibility concerns, I’d like to highlight some of the exciting new features in this release. Parallelization of C-extension Gem Builds Add MAKEFLAGS=-j by default before compiling When installing gems with C extensions (such as mysql2 or pg),…
RubyGems 4.0.3 includes enhancements and documentation and Bundler 4.0.3 includes enhancements. To update to the latest RubyGems you can run: gem update --system [--pre] To update to the latest Bundler you can run: gem install bundler [--pre] bundle update --bundler=4.0.3 RubyGems Release Notes Enhancements: Installs bundler 4.0.3 as a default gem. Documentation: Fix broken documentation links. Pu…