Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
Bundler 4.0.18 adds --cooldown flag to bundle lock and bundle cache commands.
Summary
Bundler 4.0.18 has extended the opt-in --cooldown flag to the bundle lock and bundle cache commands. This feature, originally introduced in Bundler 4.0.13, delays the resolution of new gem versions for a specified number of days, helping to mitigate the risk of inadvertently pulling in malicious packages. The update ensures that this security control is now available across more dependency management workflows.
Full text
Security NewsUK Cyber Test: AI Agent Attempted to Social Engineer Open Source Maintainer Into Merging MalwareDuring a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.By Sarah Gooding - Aug 05, 2026