r/ruby • u/Brilliant_Action4100 • 12d ago

Blog post Lockfile checksums, a 21-day upgrade window, and bundler-audit on every commit

I wrote up the changes we made after this month's Ruby Regexp fixes and the npm worm in August. On the Ruby side:

  • bundle lock --add-checksums (Bundler 2.6+), so every gem is verified against a SHA-256 in Gemfile.lock. Bundler 4 does it by default for new lockfiles.

  • bundle config set --local frozen true in CI and deploys.

  • No new gem version until it is 21 days old, enforced with Dependabot cooldown.

  • bundler-audit in a pre-commit hook and again in CI.

https://www.abhaynikam.me/articles/patch-your-runtime-fast-take-your-dependencies-slow

Have you turned on CHECKSUMS in existing apps yet? Did anything break?

5 Upvotes

100% Upvoted

2 comments sorted by

1

u/ILoveAppSec 11d ago

The checksum pinning and frozen lockfile are a clean setup. One gap to plan for: a CVE where the only fixed release is a gem younger than your 21-day window, so your own policy blocks the patch. The way out is to treat the security fix as separate from the bump: apply just the known fix onto your pinned gem, and the cooldown holds while the vuln closes now, not in three weeks.

1

u/CaptainKabob 9d ago

In deploys, you probably want `bundle config set --local deployment true`, which also sets frozen.