I'm Hiroshi Shibata (hsbt), a Ruby committer and the lead maintainer of RubyGems and Bundler.

TL;DR

RubyGems and Bundler 4.1.0.beta3 shipped on October 28, 2026. This is Part 2 of a three-part series on what's new in 4.1. Part 1 covered override and prune . This part covers defenses against supply chain attacks, in the order a developer meets them, from fetching and installing gems to publishing your own. Cooldown keeps freshly published versions out of resolution, two install options stop code from running at install time, a credential store moves your API keys into the OS keychain, and gem push attaches an attestation by itself on GitHub Actions. At the end there is a short note on the ML-DSA signature standard. Everything here is opt-in or leaves the default behavior alone.

Cooldown keeps fresh versions out

I wrote about the idea behind cooldown and what other ecosystems do in Should RubyGems/Bundler Have a Cooldown Feature? . Bundler got cooldown in 4.0.13.…