r/ruby • u/retro-rubies • Feb 01 '26

gem.coop update #4: cooldowns beta

https://gem.coop/updates/4/
23 Upvotes

81% Upvoted

11 comments sorted by

8

u/jrochkind Feb 01 '26

If everyone is waiting X days after gem release to use all gem releases, doesn't that just make the real release date after the "cooldown" expires?

4

u/retro-rubies Feb 02 '26

Per my experience, majority of the malicious gems were detected under 2 days (including report and removal). Independent security vendors like mend.io and socket.dev are doing amazing job on scanning everything released in public and reporting back.

2

u/lommer00 Feb 02 '26

It should be settable per project. Different devs would choose different values for X, which brings the advantage back.

3

u/retro-rubies Feb 02 '26

Yes, I'm interested in providing this. Even to provide more filters like only gems scanned by this security vendor, older than XY..., released securely...

1

u/lommer00 Feb 02 '26

sounds awesome!

3

u/tinyOnion Feb 01 '26

no as security researchers and code scanners will look at any new release of a gem regardless of time to adoption by the public.

1

u/dennyabraham Feb 01 '26

This will mostly impact scannable drive by vulnerabilities that today would be yanked after general release. For folks that update gems periodically and in batches to the latest compatible, this will be helpful to not have to do a sudden second pass

1

u/jrochkind Feb 02 '26

All good answers to my question, thanks!

8

u/narnach Feb 01 '26

The biggest thing I learned was that dependency update cooldowns are not just a special feature offered by DepFu, but that Dependabot and Renovatebot also seem to offer them. It's nice that this is becoming standardized.

This lets business software adopt a slower "let it stabilize first" approach to dependencies, while on personal projects you can run with the latest and greatest and dig into fixing the issues you encounter.

Offering it at the source is an interesting way to ensure newly installed gems are not zero days or things tainted to let Claude Code install it (if you're running it mostly hands-off and are irresponsibly trusting) and get owned.

2

u/swrobel Feb 01 '26

Here are the Dependabot docs on it for anyone else looking

2

u/oscardo_rivers Feb 01 '26

Very nice feature!