---
title: "Bundler tightens its security"
publication: "Ruby Weekly"
issue: 540
published_at: "2021-02-18"
canonical_url: "https://rubyweekly.com/issues/540"
---

Plus a handy tallying tip, decorators for Ruby methods, and tuning your VCR. |        

#540 — February 18, 2021 

[Read on the Web](https://rubyweekly.com/issues/540)    

💡 The _Tip of the Week_ is back – see the end of the issue for that. It covers a Ruby 2.7 feature that makes a reasonably common task a single call and I'm very glad for its addition to the language 😄
__
_Peter Cooper, editor_  

![](https://res.cloudinary.com/cpress/image/upload/e_grayscale,w_150,h_170,c_pad,g_south/xrupigpv8kyjqotfdgy8.jpg)    

Ruby Weekly 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/ngotzmleprpuv1uhku7r.jpg)](https://bundler.io/blog/2021/02/15/a-more-secure-bundler-we-fixed-our-source-priorities.html)  

[A More Secure _Bundler:_ How We Fixed Our Source Priorities](https://bundler.io/blog/2021/02/15/a-more-secure-bundler-we-fixed-our-source-priorities.html) — Last week there was a major story where a non-malicious developer pushed libraries to public repositories with the same name as _private_ packages and these then took precedence over the private packages several companies’ systems _expected_ to install. Uh-oh! While [RubyGems.org was safe](https://mensfeld.pl/2021/02/rubygems-dependency-confusion-attack-side-of-things/), Bundler was affected and v2.2.10 adds a fix to prioritize block sources in `Gemfile`s. 

The Bundler and RubyGems Team   

[Adornable: A Way to Use Decorators on Ruby Methods](https://github.com/kjleitz/adornable) — If you’ve ever looked at Python’s decorators or Lisp’s ‘[advice](https://en.wikipedia.org/wiki/Advice_%28programming%29)’ and thought you’d like a similar way to extend Ruby methods, this is for you. The syntax is nice, although there’s a lot of [magic](https://github.com/kjleitz/adornable/blob/main/lib/adornable/machinery.rb) behind the scenes, as you’d expect. 

Keegan Leitz   [![\](https://copm.s3.amazonaws.com/ebdc6501.png)](https://blog.cloud66.com/taking-rails-to-the-next-level-with-hotwire/?utm_source=cooperpress&utm_medium=newsletter&utm_campaign=RubyWeekly-21-q1-1) 

[Building Fast & Modern Web Applications with Rails & Hotwire](https://blog.cloud66.com/taking-rails-to-the-next-level-with-hotwire/?utm_source=cooperpress&utm_medium=newsletter&utm_campaign=RubyWeekly-21-q1-1) — Taking Rails to the next level with Hotwire for faster, more responsive apps. Part 1 of our introduction to the different components of Hotwire: Turbo and Stimulus. We explore how these elements work and how they can be used in your own projects. 

Cloud 66 sponsor   

[Using Webpacker in Your Rails Apps — A Deep Dive](https://blog.appsignal.com/2021/02/17/using-webpacker-in-your-ruby-on-rails-app-deep-dive.html) — A look under the hood of [Webpacker](https://github.com/rails/webpacker) (basically a Rails friendly wrapper for webpack as used in Rails 6). 

Paweł Dąbrowski   

[Rails 6.1.3 Released](https://weblog.rubyonrails.org/2021/2/17/Rails-6-1-3-has-been-released/) — It’s a minor [fix-oriented](https://github.com/rails/rails/releases/tag/v6.1.3) update. [5.2.4.5, 6.0.3.5 and 6.1.2.1](https://weblog.rubyonrails.org/2021/2/10/Rails-5-2-4-5-6-0-3-5-and-6-1-2-1-have-been-released/) have also been released fixing two security issues. 

Official Rails Blog     

Quick Bits 

- [RubyGems 3.2.10](https://blog.rubygems.org/2021/02/15/3.2.10-released.html) has been released which installs Bundler 2.2.10 fixing the source priority issue in the top most feature of this issue.
- [RubyGems 3.2.11](https://blog.rubygems.org/2021/02/17/3.2.11-released.html) quickly followed 3.2.10 (above) with a new feature to optionally fallback to IPv4 when an IPv6 network is unreachable.  

💻 Jobs  

[Senior Ruby on Rails Engineer (Remote)](https://nebulab.it/careers/?utm_source=newsletter&utm_medium=email&utm_campaign=rw) — Join our distributed team and build high-volume eCommerce applications in a workplace made by developers for developers. 

Nebulab   

[Experienced UK-Based Ruby/Rails Developer](http://apply.itison.com/apply/VRkjMU7Hmw/) — We’re looking for a Rails dev to join our team to produce high-quality, tested code, working on an e-commerce platform that processes thousands of transactions daily. 

Itison   

[Find Your Next Job Through Hired](https://hired.com/join/?utm_source=newsletter&utm_medium=sponsor&utm_campaign=%28b2c%29%28l-all%29%28r-all%29%28cooper-rubyweekly%29&utm_content=find-your-next-job) — Create a profile on Hired to connect with hiring managers at growing startups and Fortune 500 companies. It's free for job-seekers. 

Hired  

📘 Articles & Tutorials  

[Ruby Garbage Collection Deep Dive: Tri-Color Mark and Sweep](https://jemma.dev/blog/gc-mark-and-sweep) — This article builds on Jemma’s previous outing on the [internal constants used by Ruby’s garbage collector](https://jemma.dev/blog/gc-internal) and teaches us more about how Ruby manages memory. 

Jemma Issroff   

▶[Ruby Game Development with the DragonRuby Game Toolkit](https://www.youtube.com/watch?v=ILdmGv_PY-0) — If you love Ruby but fancy a break from building webapps, say, how about creating your own game? This 18 minute screencast introduces how DragonRuby works at the technical level. 

Amir Rajan   

[3 Tips to Tune Your VCR in Tests](https://blog.arkency.com/3-tips-to-tune-your-vcr-in-tests/) — [VCR](https://github.com/vcr/vcr) is a long standing tool for recording HTTP interactions and replaying them during test runs. This post shares three techniques for improving its usage. 

Pawel Pacana   

[Free eBook: Efficient Search in Rails with Postgres](https://pganalyze.com/ebooks/efficient-search-in-rails-with-postgres?utm_source=RubyWeeklySecondary02182021) — Speed up a search query from seconds to milliseconds and learn about exact matches, trigrams, ILIKE, and full-text search. 

pganalyze sponsor   

[How to Use Sidekiq in Rails 6](https://t.co/RxhdoeZ4fv?amp=1) — A post from last year about the popular background-processing system but just updated for Rails 6.1 and Sidekiq 6.1.3 – there’s also a guide for getting it running on Heroku. 

Catalin Ionescu   

[Don’t Wrap Instance Variables in `attr_reader` Unless Necessary](https://www.codewithjason.com/dont-wrap-instance-variables-attr_reader-unless-necessary/) — While there are purported benefits of using `attr_reader`, some of them are specious at best, plus you’re changing the public interface of the class, which may not be your intention. 

Jason Swett   

[Tensors using NumRuby](http://sciruby.com/blog/2021/02/16/tensors/) — [NumRuby](https://github.com/SciRuby/numruby) is a SciRuby-related project for doing fast numerical linear algebra in Ruby. 

Udit Gulati   

[Tip: Use Rails' `link_to_unless_current` for Your Navigation Links](https://boringrails.com/tips/rails-link-to-unless-current) 

Matt Swanson   

[ActiveRecord For Databases Without Unique Ids](https://www.honeybadger.io/blog/activerecord-without-unique-id/) — The real takeaway is: Don’t do this. However, the journey to make AR work is an interesting code romp. 

Regan Ryan (Honeybadger)   

▶[Bridgetown: Ruby on the Jamstack, or Why I Forked Jekyll](https://www.youtube.com/watch?v=btOuSOZd-6c) — Jared White discusses why he decided to fork Jekyll and create the [Bridgetown](https://www.bridgetownrb.com/) static site generator. 

YouTube  

🛠 Code and Tools  

[Chewy 6.0: A High-Level Elasticsearch Framework](https://github.com/toptal/chewy) — An ODM and wrapper for working with Elasticsearch in a more idiomatically Ruby, developer-friendly way (check out the examples in the README). This week’s 6.0 release adds Elasticsearch 6 support and there’s a brief [migration guide.](https://github.com/toptal/chewy/blob/v6.0.0/migration_guide.md) 

Toptal   

[Avro::Builder: A Ruby DSL to Create Apache Avro Schemas](https://github.com/salsify/avro-builder) — [Apache Avro](https://avro.apache.org/) is a schema-driven data serialization system. 

Salsify   

[Founders/CTO’s: Can't Scale in Production? Let’s Talk](https://hint.io/helps-you-ship-code) 

Hint sponsor   

[twterm: A Terminal UI Twitter Client](https://github.com/ryota-ka/twterm) — Want a day to day Twitter client on the terminal? This is one option. Packaged up with nix for easier installation if you’re a nix user. 

Ryota Kameoka   

[Kittyverse: Helper Classes for Cryptokitties Related Data](https://github.com/cryptocopycats/kittyverse/tree/master/kittyverse) — Honestly, I have no idea what is going on here.. 😂 

The CryptoCopycats   

[Rpush 5.4: A Push Notification Service for Ruby](https://github.com/rpush/rpush) — A long standing project. Rpush supports numerous push notification services including those from Apple, Firebase, and Amazon, and this new release adds Ruby 3 and Rails 6.1 support. 

Ian Leitch   

[RuboCop 1.10: The Ruby Static Code Analyzer and Formatter](https://github.com/rubocop-hq/rubocop) 

RuboCop Headquarters      

💡**Tip of the Week** 

Tallying and Counting 

Counting is one of the _many_ things computers do better than humans. Ruby's [`Enumerable#tally`](https://ruby-doc.org/core-3.0.0/Enumerable.html#method-i-tally), introduced in Ruby 2.7, makes counting even more straightforward. 

It counts the occurences of each element in a collection, and returns a hash whose keys are all of the distinct elements in the collection, and whose values are the number of times each key appears. 

Pre Ruby 2.7, if we wanted a hash which gave us counts of the elements in a collection, there were a few less straightforward ways we could do it. One example of code we might have written is:  

[1, 2, 0, 2, 2, 3, 2, 1, 3].group_by(&:itself).transform_values(&:size)
 => {1=>2, 2=>4, 0=>1, 3=>2}   

Luckily, we now have `Enumerable#tally` which makes this same functionality cleaner to write and easier to read. Let's look at a couple of examples:  

[1, 2, 0, 2, 2, 3, 2, 1, 3].tally
 => {1=>2, 2=>4, 0=>1, 3=>2}
 
 %w(r u b y w e e k l y).tally
 => {"r"=>1, "u"=>1, "b"=>1, "y"=>2,
 "w"=>1, "e"=>2, "k"=>1, "l"=>1}   

As we can see, the keys are the elements in each array, and the values are their counts. If we were only interested in the number of times a specific element appeared in an Enumerable, we could also use [`Enumerable#count`](https://ruby-doc.org/core-3.0.0/Enumerable.html) which takes an element as a parameter. For example:  

[1, 2, 0, 2, 2, 3, 2, 1, 3].count(1)
 => 2
 
 [1, 2, 0, 2, 2, 3, 2, 1, 3].count(5)
 => 0   

Hopefully `Enumerable#tally` and `Enumerable#count` help with any Ruby counting needs! 

This week’s tip was written by [Jemma Issroff](https://twitter.com/jemmaissroff).          

Curated by [Peter Cooper](https://twitter.com/peterc), [Glenn Goodrich](https://twitter.com/ruprict) and [Cooperpress](https://cooperpress.com/). 

[Change your email address](https://rubyweekly.com/edit_subscription/*|UID|*) or[Stop getting this newsletter](https://rubyweekly.com/leave/*|UID|*) 

© Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom