Wait two weeks before trusting a new gem, or patch the moment a fix ships? I've been going back and forth on that all week.

It's been a rough one. On November 4, Rails shipped 8.0.5.2 and 8.1.4.1 with fixes for 21 security advisories, one of them critical. Trilogy, the MySQL client gem behind one of Rails' database adapters, had fixed a critical SQL injection six days earlier and shipped a follow-up release the same day as Rails. Crass, a CSS parser that Rails pulls in through rails-html-sanitizer, picked up five advisories in ten days. Every one of those fixes was a brand-new release, and both apps I work on have a 14-day cooldown in their Gemfiles telling Bundler to skip brand-new releases.

The pressure to wait has been building all year!…