#bundler — Public Fediverse posts

Bun in Rust: Report from a large AI coding project, porting a Javascript transpiler from Zig to Rust
https://bun.com/blog/bun-in-rust
#bundler #agents #coding #rust #llm #ai #+

Dependabot has resolved the remaining Bundler 4 compatibility issues. Cleaner Gemfile.lock updates, fewer CI surprises, and more predictable dependency PRs. 🚀

https://rubystacknews.com/2026/07/01/dependabot-resolves-remaining-bundler-4-compatibility-issues/

#ruby #rails #bundler #dependabot

So #bundler added support for cooldowns.

https://blog.rubygems.org/2026/06/03/cooldown-let-new-gems-be-vetted.html

Aside: This feature is mostly developed by Claude. I haven't reviewed the code. Maybe it's fine. Maybe hsbt did actually read, understood, and guided all the code generated here. But in any case it's kinda depressing that even #Ruby, "a Programmer's Best Friend" language with goals like happiness and fun is outsourced to AI that neither can have fun, nor can be happy, nor have friends.

Anyway, I don't fully get the appeal. My main point of contention is that it's a solution trice removed from the problem.

The problem is "supply chain security". Sometimes malicious packages get pushed to package registries. It's not that much of a problem if the package is completely new as it doesn't have users yet and people tend to be cautious about new packages. But it's a problem for established projects that get compromised. They have a lot of users and many people depend on them. So a compromised package with lots of users needs very little time to get installed all over and execute its evil plots.

Someone noticed that it doesn't take much time for people to notice that something's not right. Just days, even mere hours. And they came up with a solution: what if we don't install packages right as they get released but wait, say, a week?

It's a self-defeating strategy. Imagine everyone does this. No one installs packages until they get a week old. How will people know if something's not right if no one's using the package?

The whole thing depends on someone noticing that something's not right. But the fewer people use the package the lower the chance that someone will notice. Package cooldowns work great for the small fraction of users in the beginning. But the closer cooldowns adoption goes to 100% the less effective it becomes.

It also implicitly relies on someone noticing an issue. And someone investigating it. Someone needs to a) install the package, b) notice the issue, c) investigate it. None of this is guaranteed by cooldowns.

A more explicit strategy would be that every package needs a certain amount of reviews from the users to become generally available. So every package upon release becomes available on the index for review. A package manager notifies users that a new version is available in staging and they can help it move along. The package is not available for automatic installation. There's a diff to the previous version that people can review. This is my first idea and it certainly can be improved but, as an example… Users who reviewed the package and approved it can install it right away. The package becomes generally available once a certain amount of reviews came in. E.g. 0.5% of weekly downloads, or 5, 10, 20, etc. approvals from highly trusted well known people in the community who are not involved in the project.

As opposed to cooldowns this explicitly depends on actual reviews. Unlike cooldowns, wider adoption improves efficiency: more reviews—faster availability. It also promotes the "best practice" of actually reading the code you install.

Now, to make it a thing I need a catchy name for it. I'm taking suggestions.

Cooldown Support for Ruby Bundler

https://blog.rubygems.org/2026/06/03/cooldown-let-new-gems-be-vetted.html

#HackerNews #Cooldown #Support #Ruby #Bundler #Gems #Development

Cooldown Support for Ruby Bundler

https://blog.rubygems.org/2026/06/03/cooldown-let-new-gems-be-vetted.html

#HackerNews #Cooldown #Support #Ruby #Bundler #Gems #Development

RubyGems 4.0.13 and Bundler 4.0.13 are out.

The most notable addition is a new cooldown mechanism for newly published gems, helping reduce the risk of supply-chain attacks.

Plus security fixes, Windows improvements, and Bundler enhancements.

Read more 👇

#Ruby #RubyGems #Bundler #OpenSource #AppSec

https://rubystacknews.com/2026/06/03/rubygems-4-0-13-and-bundler-4-0-13-released-with-new-supply-chain-security-protections/

RubyGems 4.0.13 and Bundler 4.0.13 are out.

The most notable addition is a new cooldown mechanism for newly published gems, helping reduce the risk of supply-chain attacks.

Plus security fixes, Windows improvements, and Bundler enhancements.

Read more 👇

#Ruby #RubyGems #Bundler #OpenSource #AppSec

https://rubystacknews.com/2026/06/03/rubygems-4-0-13-and-bundler-4-0-13-released-with-new-supply-chain-security-protections/

Почему ваш бандл тяжелее чем должен быть — тестирую tree shaking на 7 бандлерах

Вы уверены, что ваш бандлер вырезает неиспользуемый код? Я тоже был уверен — пока бандл Next.js проекта не оказался в два раза тяжелее, чем нужно. Прогнал одинаковый тест на webpack, rollup, vite, esbuild и Next.js — 5 из 7 ломаются на банальном barrel файле. Полез в исходники, нашёл основную причину — и она оказалась не там, где ожидал.

https://habr.com/ru/articles/1024404/

#tree_shaking #webpack #barrel_file #bundler #nextjs #rollup #vite #esbuild #оптимизация_бандла #фронтенд

André Arko helped ship Bundler 1.0, wrote The Ruby Way, and started Ruby Together. At Rubycon 2026 he'll present rv: version manager, dependency manager, and script runner for Ruby. Built in Rust.
Rimini, May 8th.

#Rubycon2026 #Ruby #Bundler #DevTools #OpenSource

André Arko helped ship Bundler 1.0, wrote The Ruby Way, and started Ruby Together. At Rubycon 2026 he'll present rv: version manager, dependency manager, and script runner for Ruby. Built in Rust.
Rimini, May 8th.

#Rubycon2026 #Ruby #Bundler #DevTools #OpenSource

I asked the AI on duckduckgo about TypeScript to include bundling, with issue URLs. I got 2 URLs of unrelated issues, and three times the same. Then:

"I’m sorry about that. The URLs I gave were placeholders and don’t correspond to the actual discussions.
The real, relevant TypeScript‑repo issues are:"

And again it gave me the irrelevant URLs. 🤣

It is often surprising how quick I get useful pointers, but building an industry on this. 🤦‍♀️

#GPT-OSS120b #ai #typescript #bundler

One Open-source Project Daily

create a single executable out of your node.js apps

https://github.com/nexe/nexe

#1ospd #opensource #binaries #binary #bundle #bundler #cli #executable #javascript #nexe #nodejs

One Open-source Project Daily

create a single executable out of your node.js apps

https://github.com/nexe/nexe

#1ospd #opensource #binaries #binary #bundle #bundler #cli #executable #javascript #nexe #nodejs

One Open-source Project Daily

create a single executable out of your node.js apps

https://github.com/nexe/nexe

#1ospd #opensource #binaries #binary #bundle #bundler #cli #executable #javascript #nexe #nodejs

One Open-source Project Daily

create a single executable out of your node.js apps

https://github.com/nexe/nexe

#1ospd #opensource #binaries #binary #bundle #bundler #cli #executable #javascript #nexe #nodejs

One Open-source Project Daily

create a single executable out of your node.js apps

https://github.com/nexe/nexe

#1ospd #opensource #binaries #binary #bundle #bundler #cli #executable #javascript #nexe #nodejs

Oh, look! Another mind-blowing revelation: #Bundler might eventually be as fast as uv! 🎉 But wait, it comes with a built-in excuse—a "margin #of #error." 🤔 Let's all hold our breath for this groundbreaking #speed increase... or not. 🙄
https://tenderlovemaking.com/2025/12/29/can-bundler-be-as-fast-as-uv/ #uv #revelation #margin #technews #HackerNews #ngated

Oh, look! Another mind-blowing revelation: #Bundler might eventually be as fast as uv! 🎉 But wait, it comes with a built-in excuse—a "margin #of #error." 🤔 Let's all hold our breath for this groundbreaking #speed increase... or not. 🙄
https://tenderlovemaking.com/2025/12/29/can-bundler-be-as-fast-as-uv/ #uv #revelation #margin #technews #HackerNews #ngated

Can Bundler Be as Fast as uv?

https://tenderlovemaking.com/2025/12/29/can-bundler-be-as-fast-as-uv/

#ruby #bundler #uv

Can Bundler Be as Fast as uv?

https://tenderlovemaking.com/2025/12/29/can-bundler-be-as-fast-as-uv/

#ruby #bundler #uv

Intlayer: альтернатива @nuxt/i18n с фокусом на оптимизации бандла

После интеграции nuxt/i18n в несколько моих проектов я пришел к однозначному выводу: это, безусловно, лучшее i18n-решение для JS-фреймворков. Его «plug&play» настройка, загрузка пространств имен (namespaces) и встроенная маршрутизация, настоящее удовольствие в работе. Однако у этого решения есть серьезная проблема: загруженные пространства имен не подвергаются «тришейкингу» (tree-shaking). Несмотря на то, что JSON-файлы могут загружаться динамически для каждой локали, Nuxt в итоге объединяет их, что означает, что файл locale/zh/about.json загружается на всех страницах.

https://habr.com/ru/articles/978564/

#vue #i18n #vuei18n #bundler

Не спешите выкидывать Webpack: разбор альтернатив и реальных сценариев миграции

Привет, Хабр! На связи Никита Ли, я Frontend-разработчик в Рунити. Вокруг сборщиков последние годы кипят страсти: большинство боготворит Vite, кто-то экспериментирует с esbuild, а энтузиасты активно продвигают инструменты на базе Rust — прежде всего Rspack и SWC. На фоне этого Webpack нередко называют пережитком, который якобы тормозит развитие команд. Но жизнь реальных продуктов куда сложнее, чем пишут в соцсетях . Иногда Webpack остается единственным зрелым вариантом. А иногда — мешает и действительно требует замены. В этой статье я попробую разобраться, откуда вообще взялись сборщики и что именно происходит внутри Webpack, насколько современные альтернативы действительно готовы его заменить, почему в Рунити мы осознанно продолжаем использовать Webpack в основных продуктах и в каких случаях смена сборщика действительно имеет смысл, а в каких может обернуться лишней тратой времени и сил без ощутимой выгоды.

https://habr.com/ru/companies/runity/articles/974916/

#сборка_проекта #webpack #vite #bundler #сборщик

Just released bundler-audit 0.9.3, which officially adds support for Ruby 3.4, 3.5, 4.0, and Bundler 4.x.

https://github.com/rubysec/bundler-audit/releases/tag/v0.9.3
https://github.com/rubysec/bundler-audit#readme

#ruby #bundler #rubysec #bundler_audit #bundleraudit

Just released bundler-audit 0.9.3, which officially adds support for Ruby 3.4, 3.5, 4.0, and Bundler 4.x.

https://github.com/rubysec/bundler-audit/releases/tag/v0.9.3
https://github.com/rubysec/bundler-audit#readme

#ruby #bundler #rubysec #bundler_audit #bundleraudit

end of the drama https://www.ruby-lang.org/en/news/2025/10/17/rubygems-repository-transition/
#bundler #rubygems

end of the drama https://www.ruby-lang.org/en/news/2025/10/17/rubygems-repository-transition/
#bundler #rubygems

https://blog.gslin.org/archives/2025/10/18/12693/ruby-%e7%9a%84-core-team-%e6%8e%a5%e6%89%8b-rubygems-%e8%88%87-bundler-%e7%9a%84%e6%ac%8a%e9%99%90/

Ruby 的 core team 接手 RubyGems 與 Bundler 的權限

#bundler #central #core #ecosystem #matz #ruby #rubygems #team

https://blog.gslin.org/archives/2025/10/18/12693/ruby-%e7%9a%84-core-team-%e6%8e%a5%e6%89%8b-rubygems-%e8%88%87-bundler-%e7%9a%84%e6%ac%8a%e9%99%90/

Ruby 的 core team 接手 RubyGems 與 Bundler 的權限

#bundler #central #core #ecosystem #matz #ruby #rubygems #team

That was the best outcome from this mess

https://www.ruby-lang.org/en/news/2025/10/17/rubygems-repository-transition/

#ruby #RubyGems #bundler

That was the best outcome from this mess

https://www.ruby-lang.org/en/news/2025/10/17/rubygems-repository-transition/

#ruby #RubyGems #bundler

Ruby Core Takes Ownership of Rubygems and Bundler

https://www.ruby-lang.org/en/news/2025/10/17/rubygems-repository-transition/

#HackerNews #Ruby #Core #Rubygems #Bundler #OpenSource #SoftwareDevelopment

Ruby Core Takes Ownership of Rubygems and Bundler

https://www.ruby-lang.org/en/news/2025/10/17/rubygems-repository-transition/

#HackerNews #Ruby #Core #Rubygems #Bundler #OpenSource #SoftwareDevelopment

I see people working on alternatives to rubygems.org.

I don't know all the initiatives but one of the proposals is to set up an alternative gem index. With tiered access and higher tiers are paid and are supposed to finance the operation.

I'm glad people are organisig and doing something. But I think this is ultimately a wrong approach.

First, a simple caching proxy (such as Artifactory) can easily alleviate the need for a higher tier access to the index. And most big orgs already have something like that in place so won't even need additional effort.

Second, a centralised index is subject to all the same issues that befell rubygems.org. It's expensive, requiring some sort of financing on a regular basis. Eventually this might result in the very same issue: either become dependent to corporate interests, or shutdown. Tiered access might also be detrimental for mirroring which may or may not be desirable.

I suggest we should go distributed. Every project should host their gems wherever. Do you have a domain associated with your project where you host it's web site/docs? Host the gems there as well. See `gem generate_index`. Do you host your code on Codeberg/Forgejo? It also can host gems.

I'm not very concerned about gem hosting. We already have tools to do that without rubygems.org.

My bigger concern is that the tools are under… let's say, uncertain control.

RubyGems (the CLI) and bundler are under RC control. The repos can be forked and other people can work on them but, I'm afraid, that doesn't matter. Ruby (the language) bundles both rubygems and bundler. Can we convince Ruby maintainers to use a version that is not under RC control? I doubt. Given that HSBT is on the Ruby Core team, and he was instrumental in the takeover, and that there was no concern voiced by anyone else from Ruby Core team, I take it this move is supported by the Ruby Core.

I'm afraid that any effort to take the development back to the community is futile because of this.

I suspect that for a while all the projects will keep accepting contributions from the community, and will keep insisting they're for the community benefit. But eventually there will be some change that goes against the community interests but is requested by some corporate backer and RC will show their chosen side again. All community concerns will be ignored and the change will be implemented anyway.

My concern is that Ruby transitions from a community, a diverse network of projects to an openly extractive ecosystem. A few wealthy corporations fully control the development of the technology and extract existing value, ride the inertia of the community.

This is a natural progression of every technology. Enthusiasts go elsewhere as the technology stagnates and new shiny things appear, while big corpo stays as it's expensive to migrate away. They become the only benefactors, and effectively, supporters of the technology. And since there's not much interest anyway they can stir it wherever they want.

This certainly was happening with Ruby for a while. The concern that Rails is the major use case for Ruby was around for years. New alternative technologies appear and mature so there are places for people to go, while Ruby has not found new niches to expand to.

RC takeover of rubygems/bundler greatly accelerated this natural process. Whether there was corporate pressure, a prominent figure in leadership ego burst, a malicious intent, or a fumbled attempt at stewardship backed by the best intentions, either way the community is effectively removed from the tools development. Maybe not completely but I find surprising (mostly) silent agreement between RC, Rails Core, and Ruby Core. Basically all technical leadership of the most prominent parts of the Ruby ecosystem are perfectly aligned between themselves even when there's a great deal of concern and uncertainty in the community.

#Ruby #RubyGems #bundler #RubyCentral #RubyOnRails

I don't know how this is going to play out.

It seems like maybe control of the #ruby ecosystem rests predominantly in the hands of Shopify though the proxy of Ruby Central.

Is this the case? I can't tell. Would that be bad? Probably in the long run. Is it bad optics that this is even a question? Yes.

I understand the motivation to protect the supply chain, but events of the last few weeks do not instill confidence.

#programming #rubygems #bundler #rubycentral

I don't know how this is going to play out.

It seems like maybe control of the #ruby ecosystem rests predominantly in the hands of Shopify though the proxy of Ruby Central.

Is this the case? I can't tell. Would that be bad? Probably in the long run. Is it bad optics that this is even a question? Yes.

I understand the motivation to protect the supply chain, but events of the last few weeks do not instill confidence.

#programming #rubygems #bundler #rubycentral

I subscribed to #404media (the free plan, but now I'm on the list) just so I could read their article about the #Ruby #Bundler #RubyCentral drama at https://www.404media.co/how-ruby-went-off-the-rails/

This bit made me raise an eyebrow:
----
“Thanks for the invitation, but not my place to weigh in a lot on this while they're working through these changes,” DHH told me in an email when reached for comment.
----
It's not like DHH is known for his patient reserve. He weighs in, a lot. It's kind of his thing.

#programming

I subscribed to #404media (the free plan, but now I'm on the list) just so I could read their article about the #Ruby #Bundler #RubyCentral drama at https://www.404media.co/how-ruby-went-off-the-rails/

This bit made me raise an eyebrow:
----
“Thanks for the invitation, but not my place to weigh in a lot on this while they're working through these changes,” DHH told me in an email when reached for comment.
----
It's not like DHH is known for his patient reserve. He weighs in, a lot. It's kind of his thing.

#programming

How #Ruby Went Off the #Rails: What happened to #RubyGems, #Bundler, and the Open Source drama that controls the internet infrastructure.

https://www.404media.co/how-ruby-went-off-the-rails/

#opensource

Honestly, I don't really know what "Ruby" even is (or I didn't before this article). But, oh boy, the Internet is so complex and corporate-vulnerable on many levels that it's frightening to think of...

https://www.404media.co/how-ruby-went-off-the-rails/?ref=daily-stories-newsletter

#ruby #opensource #rubygems #bundler #github #shopify

Bundler belongs to the Ruby community: Response to the hostile takeover of core Ruby infrastructure
https://andre.arko.net/2025/09/25/bundler-belongs-to-the-ruby-community/
#rubycentral #bundler #andre #ruby #+

🎩✨ Oh look, another humble brag about how someone wasn't the original creator of a #Ruby #tool but still wants a cookie for being "the #Bundler guy" for 15 years. 📅💼 Also, apparently, the world needs to know the entire #genealogy of Bundler's development like it's the royal family tree of #open-source software. 🙄👑
https://andre.arko.net/2025/09/25/bundler-belongs-to-the-ruby-community/ #humblebrag #softwaredevelopment #HackerNews #ngated

🎩✨ Oh look, another humble brag about how someone wasn't the original creator of a #Ruby #tool but still wants a cookie for being "the #Bundler guy" for 15 years. 📅💼 Also, apparently, the world needs to know the entire #genealogy of Bundler's development like it's the royal family tree of #open-source software. 🙄👑
https://andre.arko.net/2025/09/25/bundler-belongs-to-the-ruby-community/ #humblebrag #softwaredevelopment #HackerNews #ngated

Bundler Belongs to the Ruby Community

https://andre.arko.net/2025/09/25/bundler-belongs-to-the-ruby-community/

#HackerNews #Bundler #Ruby #Community #Open #Source #Software #Developer #Tools

Bundler Belongs to the Ruby Community

https://andre.arko.net/2025/09/25/bundler-belongs-to-the-ruby-community/

#HackerNews #Bundler #Ruby #Community #Open #Source #Software #Developer #Tools

💥Breaking News! #Shopify, the puppeteer of the #Ruby world, just turned Ruby Central into its marionette, snagging #Bundler and #RubyGems like they were on a clearance sale. 🤡 Because nothing screams "community" quite like a corporation bulldozing its way into open source projects. 🎭
https://joel.drapper.me/p/rubygems-takeover/ #OpenSource #HackerNews #ngated

💥Breaking News! #Shopify, the puppeteer of the #Ruby world, just turned Ruby Central into its marionette, snagging #Bundler and #RubyGems like they were on a clearance sale. 🤡 Because nothing screams "community" quite like a corporation bulldozing its way into open source projects. 🎭
https://joel.drapper.me/p/rubygems-takeover/ #OpenSource #HackerNews #ngated

Shopify, pulling strings at Ruby Central, forces Bundler and RubyGems takeover

https://joel.drapper.me/p/rubygems-takeover/

#HackerNews #Shopify #RubyCentral #Bundler #RubyGems #TechNews

Shopify, pulling strings at Ruby Central, forces Bundler and RubyGems takeover

https://joel.drapper.me/p/rubygems-takeover/

#HackerNews #Shopify #RubyCentral #Bundler #RubyGems #TechNews

I wasn't even aware that Bundler 4 was under development. Looks like mostly quality-of-life improvements, and not legacy code removal.

https://github.com/rubygems/rubygems/issues/8650

#ruby #bundler

I wasn't even aware that Bundler 4 was under development. Looks like mostly quality-of-life improvements, and not legacy code removal.

https://github.com/rubygems/rubygems/issues/8650

#ruby #bundler