--- title: "A troubling week for RubyGems and Bundler" publication: "Ruby Weekly" issue: 768 published_at: "2025-09-25" canonical_url: "https://rubyweekly.com/issues/768" --- Plus some Ruby events, an open letter, and speeding up JRuby's startup times. | #​768 — September 25, 2025 [Read on the Web](https://rubyweekly.com/issues/768) The top item in today's issue focuses on a complex issue that has arisen around the RubyGems and Bundler projects. These matters are of importance to Ruby's packaging ecosystem but skip to our 'In Brief' section if the inner workings and ownership of these projects aren't of interest to you. __ _Peter Cooper, your editor_ Together with [![FastRuby.io\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_467,h_106/e_make_transparent/co_white,e_outline:14/y65nyff19ylf5udphsq4.png)](https://fastruby.io/blog/automated-roadmap-announcement.html?utm_source=cooperpress&utm_medium=paidplacement&utm_campaign=rw-primary-link-sept-25-2025-2&utm_term=AI-powered-process&utm_content=free-automated-roadmap) Ruby Weekly ![](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/vwb2yf1lmzn04repz5lb.jpg) _Ruby Central_ and the Bundler and RubyGems Takeover Last Friday, Ellen Dash, a long-time RubyGems maintainer, posted [a PDF titled 'Ruby Central's Attack on RubyGems'](https://pup-e.com/goodbye-rubygems.pdf) explaining how the RubyGems GitHub organization was renamed, a new maintainer was added to the RubyGems project, and existing maintainers were removed, noting: _"This was a hostile takeover."_ [Ruby Central](https://rubycentral.org/) then posted ['Strengthing the Stewardship of RubyGems and Bundler'](https://rubycentral.org/news/strengthening-the-stewardship-of-rubygems-and-bundler/), a rather dry explanation saying that in order to "_strengthen supply chain security_" (perhaps triggered by [recent issues in the npm ecosystem](https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages)) they needed to strengthen "_governance processes_" and formalize/tighten access to production systems (as they maintain [RubyGems.org](https://rubygems.org/)). [Ruby Central's Executive Director](https://rubycentral.org/news/welcoming-ruby-centrals-new-executive-director-shan-cureton/) Shan Cureton also posted [▶️ a 9-minute video covering the same ground.](https://www.youtube.com/watch?v=VyCiE3GjQps) Joel Drapper has written a [Ruby Central _Fact Check_](https://joel.drapper.me/p/ruby-central-fact-check/) post tackling the claims made. [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/f552d3b0.png)](https://fastruby.io/blog/automated-roadmap-announcement.html?utm_source=cooperpress&utm_medium=paidplacement&utm_campaign=rw-primary-link-sept-25-2025-2&utm_term=AI-powered-process&utm_content=free-automated-roadmap) [🚨 Ready for Rails 7.1 EOL? Our Free AI Tool Can Help (In Minutes)](https://fastruby.io/blog/automated-roadmap-announcement.html?utm_source=cooperpress&utm_medium=paidplacement&utm_campaign=rw-primary-link-sept-25-2025-2&utm_term=AI-powered-process&utm_content=free-automated-roadmap) — Ready or not, Rails 7.1 EOL is October 1st. [Our FREE AI-powered tool](https://www.fastruby.io/automated-roadmap?utm_source=cooperpress&utm_medium=paidplacement&utm_campaign=rw-primary-link-sept-25-2025-3&utm_term=AI-powered-process&utm_content=free-automated-roadmap) builds your Rails upgrade roadmap in minutes, not weeks. Don’t have time to follow the roadmap? 🌳 Our [Bonsai team can help](https://go.fastruby.io/expand-your-team): Fixed costs, security patches, & zero downtime. FastRuby.io | Upgrade Solutions sponsor **..STORY CONTINUES FROM ABOVE** Was this just a poorly executed attempt to run a tighter ship for the RubyGems system? There's more to it than that, as Joel Drapper [deftly covers in this summary of the entire situation](https://joel.drapper.me/p/rubygems-takeover/) — explaining that access and rights that long-time RubyGems and Bundler maintainers should not have lost were unfairly taken away (since [RubyGems.org](https://rubygems.org/) and the RubyGems/Bundler projects are [_not_ the same thing](https://gist.github.com/simi/ad1681cb3fe63d01995a01dd77c68424#ruby-centrals-role-in-rubygems-bundler-and-rubygemsorg)). Today, Andre Arko (of Bundler fame) posted [his take saying that 'Bundler belongs to the Ruby community'](https://andre.arko.net/2025/09/25/bundler-belongs-to-the-ruby-community/), giving a lot of (interesting!) history to the development of Bundler, how _Ruby Together_ and _Ruby Central_ merged, and why Ruby Central _isn't_ able to assert it owns Bundler itself. The story has yet to reach a conclusion, and we'll let you know when it does. **TLDR:** Read [Joel Drapper's summary](https://joel.drapper.me/p/rubygems-takeover/), as well as [that of former Ruby Central member Josef Šimánek.](https://gist.github.com/simi/349d881d16d3d86947945615a47c60ca) **⚡️ IN BRIEF:** - 🇺🇸 [Jim Remsik is organizing](https://www.xoruby.com/blog/why-i-am-taking-events-on-the-road-this-fall/) a series of 'travelling' Ruby events called [XO Ruby.](https://www.xoruby.com/) The next three, all taking place in October, are in [Portland](https://www.xoruby.com/event/portland/), [San Diego](https://www.xoruby.com/event/san-diego/) and [Austin.](https://www.xoruby.com/event/austin/) - Matheus Richard proposes [the idea of a `Array#values` method](https://bugs.ruby-lang.org/issues/21615) in line with what `Hash`offers. - Mike McQuaid [does some analysis of who's recently contributed code to the RubyGems project.](https://mikemcquaid.com/rubygems-contribution-data-with-homebrews-tooling/) - A group has published [an open letter to the Rails core team](https://github.com/Plan-Vert/open-letter) to fork Rails and 'cut ties with DHH' for various reasons cited in the letter. - The IEEE has released a list of [the top programming languages in 2025](https://spectrum.ieee.org/top-programming-languages-2025) and Ruby comes in at number seventeen. [JRuby and JDK 25: Startup Time with AOTCache](https://blog.headius.com/2025/09/jruby-jdk25-startup-time-with-aotcache.html) — Java 25, and therefore JDK 25, was released last week and JRuby (the JVM-based Ruby implementation), benefits from improvements to the JVM’s ahead-of-time caching feature. JRuby programs have historically run quickly, but had longer startup times than CRuby programs – this is beginning to improve, and here’s how. Charles Oliver Nutter [The Complete Guide to Using Dev Containers with Rails](https://www.rorvswild.com/blog/2025/dev-containers-rails) — An exhaustive look at [development containers (a.k.a. devcontainers)](https://containers.dev/), including how to add tools, switch to Postgres, and configure them for multiple different IDEs. Julian Rubisch [Survey: Tech Challenges in the Healthcare Space 🩺](https://forms.kalynamarketing.com/r/healthcare-it-2025) — Know an engineering, IT, product, marketing, or strategy leader in the healthcare space? We're benchmarking challenges they're facing. Test Double sponsor 📄 [Creating a Rails Console-like Environment for a Plain Ruby Project](https://danielabaron.me/blog/rails-console-like-environment-for-plain-ruby/) – Certainly something I've had to do a few times! Daniela Baron 📄 [Flaky Tests, Be Gone: Long-Lasting Relief for Chronic CI Retry Irritation](https://evilmartians.com/chronicles/flaky-tests-be-gone-long-lasting-relief-chronic-ci-retry-irritation) – An attempt to cover ‘every known cause of test flakiness’ when tests run locally but not in CI. There’s a _lot_ here. Artur Petrov 📄 [Adding User Auth with the Rails 8 Auth Generator in API-Only Apps](https://avohq.io/blog/rails-api-authentication-with-the-auth-generator) Exequiel Rozas 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/ikmgffdviveek3drknk9.jpg)](https://neon.com/blog/elephantshark-monitor-postgres-network-traffic) [Elephantshark: A Tool to Monitor Postgres Network Traffic](https://neon.com/blog/elephantshark-monitor-postgres-network-traffic) — A Ruby-powered tool that sits between the two parties in a Postgres-protocol exchange, forwarding messages in both directions while parsing and logging them. [GitHub repo.](https://github.com/neondatabase-labs/elephantshark) George MacKerron (Neon) 💡 In related news, [Postgres 18 was released today](https://www.postgresql.org/about/news/postgresql-18-released-3142/) – we've covered what's new in [today's issue of Postgres Weekly.](https://postgresweekly.com/issues/617) [🚅 Smart Rails Applications Are Not the Future, They're the Present](https://sinaptia.dev/posts/building-intelligent-applications-with-rails?utm_source=cooperpress&utm_medium=newsletter&utm_campaign=rubyweekly-2025q3) — Learn about the strengths of Rails in the AI era and why we choose it for building AI-powered features. [See what we built](https://sinaptia.dev/blog/tags/ai/?utm_source=cooperpress&utm_medium=newsletter&utm_campaign=rubyweekly-2025q3). SINAPTIA sponsor [Superglue 2.0 Alpha: React + Rails Turbo Streams](https://thoughtbot.com/blog/superglue-2-0-alpha-react-rails-turbo-streams) — [Turbo Streams](https://turbo.hotwired.dev/handbook/streams), part of the Hotwire project, makes it possible to deliver quick page changes as fragments of HTML over WebSockets or SSE and now the [Superglue](https://thoughtbot.github.io/superglue/1.0/) Rails + React integration library has initial support for using Turbo Streams with your Rails-backed React apps too. Johny Ho (Thoughtbot) [Unicode::Emoji: Modern Regular Eexpressions to Work with Emojis](https://github.com/janlelis/unicode-emoji) — Provides various sophisticated regular expressions to work with emoji in strings, incorporating the latest Unicode / Emoji standards. Jan Lelis [Dial: A Modern Profiler for Rails Apps](https://github.com/joshuay03/dial) — Uses Vernier for profiling and Prosopite for N+1 query detection. Unlike [rack-mini-profiler](https://github.com/MiniProfiler/rack-mini-profiler), it’s only for Rails apps. Joshua Young - [Ruby on Rails 8.0.3](https://rubyonrails.org/2025/9/22/Rails-Version-8-0-3-has-been-released) – Nearly entire bug fixes. [Changelog.](https://github.com/rails/rails/releases/tag/v8.0.3) - 🤖 [OpenAI Ruby 0.26](https://github.com/openai/openai-ruby) – Official Ruby SDK for the OpenAI API. Adds support for the coding-focused `gpt-5-codex`model. - 🔎 [Ransack 4.4](https://activerecord-hackery.github.io/ransack/) – Add enhanced search features to Rails apps without extra dependencies. - [Solargraph 0.57.0](https://github.com/castwide/solargraph/blob/master/CHANGELOG.md) – A Ruby language server that provides IntelliSense features over[LSP.](https://microsoft.github.io/language-server-protocol/) - [Top Secret 0.3](https://github.com/thoughtbot/top_secret/releases/tag/v0.3.0) – Filter sensitive information from text before passing it to external services. - [Maxitest 6.0.1](https://github.com/grosser/maxitest) – Minitest, but with lots of added features. - [Geocoder 1.8.6](https://github.com/alexreisner/geocoder) – Complete geocoding solution for Ruby. Curated by [Peter Cooper](https://twitter.com/cooperx86) and [Glenn Goodrich](https://twitter.com/ruprict). Published by [Cooperpress](https://cooperpress.com/). [Change your email](https://rubyweekly.com/edit_subscription/*|UID|*) or [Stop getting this newsletter.](https://rubyweekly.com/leave/*|UID|*) © Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom Other weekly newsletters we publish include [Postgres Weekly](https://postgresweekly.com/), [React Status](https://react.statuscode.com/), [Frontend Focus](https://frontendfoc.us/), and [JavaScript Weekly](https://javascriptweekly.com/).