--- title: "Bundler's new dependency cooldown feature" publication: "Ruby Weekly" issue: 803 published_at: "2026-06-04" canonical_url: "https://rubyweekly.com/issues/803" --- Plus managing Ruby versions with Mise, how to choose a gem wisely, and Shopify turns 20. #​803 — June 4, 2026 [Read on the Web](https://rubyweekly.com/issues/803) Together with [![Testdouble\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_1280,h_279/e_make_transparent/co_white,e_outline:32/fuxab1jg21v6anerbqwg.png)](https://link.testdouble.com/0b3f38) Ruby Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/haj3cwdrxntdfofg2xv7.jpg)](https://blog.rubygems.org/2026/06/03/cooldown-let-new-gems-be-vetted.html) [Cool Down Before You Install: Give New Gems a Few Days to Be Vetted](https://blog.rubygems.org/2026/06/03/cooldown-let-new-gems-be-vetted.html) — A compromised account can ship a malicious gem and your next `bundle install` can pull it within minutes. [Bundler 4.0.13](https://blog.rubygems.org/2026/06/03/4.0.13-released.html), released yesterday, provides an opt-in 'cooldown' to hold back releases until they've 'aged' a few days. Meanwhile, `bundle outdated` shows what’s waiting and for how long. Hiroshi Shibata (RubyGems) [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/6665f9bd.jpg)](https://link.testdouble.com/0b3f38) [What Is Legacy Software in the Age of AI?](https://link.testdouble.com/0b3f38) — Software becomes legacy by succeeding long enough to accumulate the weight of every decision and shortcut made along the way. AI creates speed, but also many unintended consequences resulting in more user friction, not less. Test Double sponsor [Beyond `Enumerable`: For Want of Better Windows](https://baweaver.com/writing/2026/05/31/beyond-enumerable-for-want-of-better-windows/) — `Enumerable` gives names to most of the loops you’d otherwise hand-write, but not _all_ of them. Brandon goes after a shape it doesn't have, stateful sliding windows, and builds his own efficient implementation. Brandon Weaver 💡 I've been using Ruby for decades but still enjoy an occasional [browse through the `Enumerable` docs](https://docs.ruby-lang.org/en/master/Enumerable.html) as I still haven't internalized it all! **⚡️ IN BRIEF:** - Matz's [Spinel](https://github.com/matz/spinel) Ruby AOT compiler has continued to improve over the past few weeks, adding support for `Time`, `Rational`/`Complex`, keyword args, GC introspection, and initial steps towards networking and gem support. - 📺 [The videos from _Tropical on Rails_](https://www.youtube.com/@tropicalonrails/videos), which took place in Brazil this April, are now available on YouTube. - 🎂 _Shopify_, perhaps the world's largest [Rails monolith](https://shopify.engineering/shopify-monolith), launched 20 years ago this week. [Managing Ruby Versions with Mise](https://mitrev.net/2026/06/03/mise-ruby-rails/) — A very basic introduction, but as I’ve fallen in love with [Mise](https://mise.jdx.dev/) this year for managing _all_ of my languages (e.g. Go, Node, Rust) and multiple Ruby implementations (e.g. TruffleRuby and JRuby, alongside CRuby) I want it to be on everyone’s radar. It’s great! Georgi Mitrev 💰 37signals became [Mise's first 'premier' sponsor](https://en.dev/sponsors.html) this week. [What If Hanami Had Templateless Views?](https://katafrakt.me/2026/05/29/hanami-templateless-views/) — It doesn’t take much to add this to Hanami, showing just how flexible the web framework can be. Paweł Świątkowski [Jidoka: Automation with a Human Touch](https://sinaptia.dev/jidoka?utm_source=cooperpress&utm_medium=newsletter&utm_campaign=rubyweekly-2026q2&utm_content=sponsored) — Pair coding agents with senior engineers to modernize legacy code and ship faster with built-in quality. JIDOKA by SINAPTIA sponsor 📄 [How to Choose a Gem Wisely](https://www.fastruby.io/blog/how-to-choose-a-ruby-gem.html) – The basics of dependency hygiene. Gelsey Torres 📄 [Implementing Account-Specific Rate Limits in Rails](https://tejasbubane.github.io/posts/rate-limit-rack-app-per-account/) Tejas Bubane 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/lb8kzyedutk7spsovwx8.jpg)](https://railsdesigner.com/meet-mata/) [Meet Mata: Live Reloading with DOM Morphing for Rack Apps](https://railsdesigner.com/meet-mata/) — A lightweight "live reload" solution for views in Rack apps. It uses Server-Sent Events (SSE) and [idiomorph](https://github.com/bigskysoftware/idiomorph) for updating the DOM. [GitHub repo.](https://github.com/Rails-Designer/mata) Rails Designer ⚡ If you only need Rails, [Hotwire Spark](https://dev.37signals.com/announcing-hotwire-spark-live-reloading-for-rails/) offers a broader live reloading approach. [Depot's Sherlock Can Now Analyze Your CI Builds](https://fandf.co/4nUsavS) — Ask it to break down your pipeline analytics, debug slow builds, or open a support ticket. It just works. Depot sponsor [SimpleCov 1.0 RC1: The Code Coverage Analysis Tool](https://github.com/simplecov-ruby/simplecov/blob/main/CHANGELOG.md) — [SimpleCov](https://github.com/simplecov-ruby/simplecov) provides an effective way to use the code coverage data collected during testing by [Coverage](https://docs.ruby-lang.org/en/master/Coverage.html). The changelog is a rather long list, but shows big strides forward in its config, parallel test support, and coverage for unloaded files. Berlin, Fleischer, Matsuda, et al. 🔒 [Console1984: A More Secure, Auditable Rails Console](https://github.com/basecamp/console1984) — `rails console` can often come in handy in prod, but it can also provide users with a little too much power. This extension helps to protect against easy access of sensitive information and provides an audit trail for when it happens. Basecamp 💡 Back in 2023, 37signals wrote about how they use Console1984 and other tools to [allow employees to navigate customer information with care.](https://dev.37signals.com/navigating-personal-information-with-care/) [Tmuxinator: A Tool to Manage Complex `tmux` Sessions Easily](https://github.com/tmuxinator/tmuxinator) — [tmux](https://en.wikipedia.org/wiki/Tmux) is a terminal multiplexer a lot like `screen` but with more features (and increasingly popular in the LLM era as a way to give agents persistent, controllable terminal sessions). Bargi and Chow - 🎁 [Gem in a Box 3.1](https://github.com/geminabox/geminabox) – Self-hosted gems server with push support. v3.1 deprecates the RubyGems proxy. - [RuboCop 1.87.0](https://github.com/rubocop/rubocop/releases/tag/v1.87.0) – Adds `--enable-all-cops` and `--disable-all-cops` options along with an experimental [Rubydex](https://railsatscale.com/2026-05-12-one-engine-many-tools/) integration. - [Ratomic 0.2](https://github.com/mperham/ratomic) – Mike Perham's library of Ractor-safe mutable data structures. - 🔒 [Puma 8.0.2](https://github.com/puma/puma/releases/tag/v8.0.2) and [7.2.1](https://github.com/puma/puma/releases/tag/v7.2.1) – Two security-related bugs patched. - [Excon 1.5](https://github.com/excon/excon) – Fast HTTP 1.1 client library. - [Cucumber 11.1](https://github.com/cucumber/cucumber-ruby/releases/tag/v11.1.0), [RMagick 7.0.3](https://github.com/rmagick/rmagick/releases/tag/RMagick_7-0-3), [Passenger 6.1.4](https://blog.phusion.nl/passenger-6-1-4/) 📰 Classifieds 🔬 Shipping AI code? [Undercover CI](https://undercover-ci.com) catches untested methods in your PRs before you merge. Coverage percentages won't. Free for open source. 📢 Elsewhere in the ecosystem [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/esgf3ag3ra1bdpygf18p.jpg)](https://www.rubyforum.org/) - 🗣️ [The Ruby Users Forum](https://www.rubyforum.org/) _(above)_ launched earlier this year as a venue for Rubyists to ask questions and hang out with other Rubyists. It has also become a way to get support for numerous Ruby projects, [now including Sidekiq and Faktory](https://www.rubyforum.org/t/get-sidekiq-and-faktory-support-in-the-ruby-users-forum/414), with creator Mike Perham ready to answer your questions. - As well as being a Rubyist, Remi Mercier is also a _glass-maker_ and is [going to make a limited-edition stained glass](https://remimercier.com/ruby-stained-glass/) to commemorate Ruby. - DHH makes the argument that [agents 'democratize open source'](https://world.hey.com/dhh/let-the-agents-democratize-open-source-9fd630a9). - PostgreSQL 19, currently in beta, is getting built-in support for [graph style SQL/PGQ queries and traversal.](https://www.cybertec-postgresql.com/en/handling-graphs-with-sql-pgq-in-postgresql/) Curated by [Peter Cooper](https://twitter.com/cooperx86) and [Glenn Goodrich](https://twitter.com/ruprict). Published by [Cooperpress](https://cooperpress.com/). [Change your email](https://rubyweekly.com/edit_subscription/*|UID|*) or [Stop getting this newsletter.](https://rubyweekly.com/leave/*|UID|*) © Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom Other weekly newsletters we publish include [Postgres Weekly](https://postgresweekly.com/), [React Status](https://react.statuscode.com/), [Frontend Focus](https://frontendfoc.us/), and [JavaScript Weekly](https://javascriptweekly.com/).