Blog
24 Jan 2025
December 2024 RubyGems Updates
Welcome to the RubyGems monthly update! As part of our efforts at Ruby Central, we publish a recap of the work that we’ve done the previous month. Read on to find out what updates were made to RubyGems and RubyGems.org in December. Although December was a slower month as the team enjoyed time off during the holiday season, but we’re happy to share the progress we made nonetheless. Read on for a report of the OSS work we did last month.
Monthly Update changes
We’ll be cutting our reporting on the monthly RubyGems and RubyGems.org GitHub repo summary, in favor of quarterly and annual reports published separately by Ruby Central. These reports will allow us to provide a more expansive view into the volume and impact of our security work for the Ruby community.
RubyGems News
In December, we released RubyGems 3.6.0, 3.6.1, 3.6.2 and Bundler 2.6.0, 2.6.1, 2.6.2 by mid-December, addressing and resolving identified regressions, and coordinating with the Ruby core team to ensure the new versions were integrated with Ruby ahead of its December 25th release. Ultimately, we shipped RubyGems 3.6.2 and Bundler 2.6.2 alongside Ruby 3.4, resolving several regressions from the initial releases.
The release of Bundler 2.6 and RubyGems 3.6 is the culmination of previous year’s work, particularly in regard to the lockfile checksum’s feature that we decided to delay and not ship with Bundler 2.5.
Other notable improvements include fixing an issue where gem info tagged some non-default gems as default, adding a --attestation option to gem push for improved security, introducing bundle lock --add-checksums to add checksums to existing lockfiles and fixing JRuby warnings when using bundler/setup with Ruby’s -w flag.
RubyGems.org News
The updates made this month to RubyGems.org reflect a strong commitment to improving user experience, enhancing security, and modernizing the platform. Sponsored hosting for RubyGems.org in December was provided by AWS, Fastly, and DataDog.
The following are highlights of what the team worked on this month:
An update to RubyGems 3.6 and Bundler 2.6
- This update includes the release of RubyGems 3.6 and Bundler 2.6, delivering enhancements and fixes to improve the overall developer experience.
- Key changes address minor regressions and stability improvements introduced in previous versions.
Expanded availability of the admin user create button
- The admin user creation button is now displayed either in local environments or when user signups are disabled.
- This update ensures admins can easily create new users under these specific conditions, improving usability and access control management.
An update toPasswordsControllerTest to use modern Rails IntegrationTest
- During a review of a potential vulnerability report, which was deemed not an issue, test coverage for the
PasswordsControllerwas increased to ensure robustness. - Additionally, the tests were migrated to use the modern Rails
IntegrationTestframework, replacing the older controller tests. This update aligns with current Rails recommendations and improves test reliability and maintainability.
RubyGems Ecosystem News
This is where we highlight other exciting updates made to Ruby infrastructure projects that support our RubyGems work.
Ruby Toolbox
Keeping the Ruby Toolbox Up to Date and Stable: to ensure Ruby Toolbox remains modern and stable, we’ve upgraded the application to Rails 8 and Ruby 3.4.
Thank you
Thank you to all the contributors of RubyGems and RubyGems.org for this month! Your contributions are greatly appreciated, and we are grateful for your support.
Contributors to RubyGems:
- @segiddins Samuel Giddins
- @nobu Nobuyoshi Nakada
- @simi Josef Šimánek
- @deivid-rodriguez David Rodríguez
- @hsbt Hiroshi Shibata
- @soda92 Maple
- @st0012 Stan Lo
- @CamJN Camden Narzt
- @addersuk Adam Leach
- @djoooooe Josef Haider
- @bquorning Benjamin Quorning
- @luizkowalski Luiz Eduardo Kowalski
- @martinemde Martin Emde
- @kou Sutou Kouhei
Contributors to RubyGems.org:
- @martinemde Martin Emde
- @simi Josef Šimánek
- @segiddins Samuel Giddins
- @hsbt Hiroshi Shibata
- @indirect André Arko
- @Uaitt Lorenzo Zabot
- @ozovalihasan Hasan Özovalı
- @mehulkar Mehul Kar
- @Kuanchiliao1 Tony Liao
- @yob James Healy
- @colby-swandale Colby Swandale
If we missed you, please let us know so we can include you in our shout out!
Learn more about contributing to RubyGems by visiting the RubyGems Contributing Guide. We welcome all kinds of contributions, including bug fixes, feature implementation, writing and updating documentation, and bug triage.