Provenance Record

Tight, accurate developer-tools News piece (599 words) that explains the cooldown mechanism, the attack it targets, the per-command behavior, and the cross-ecosystem prior art, with every quote attributed to the specific source that carries it.

Both snapshots read from disk (HTTP 200). source-0 (LWN.net) — the committed snapshot is LWN's free teaser, and it contains, verbatim, all three quoted passages: 'Bundler 4.0.13 introduces cooldown, a time-based filter that refuses to resolve to a version until it has been public for at least N days'; 'an account is compromised, a malicious version ships, and any bundle install in the minutes that follow resolves straight to it'; and 'It is opt-in, and complements rather than replaces existing defenses like mandatory 2FA and trusted publishing.' It also confirms 'Version 4.0.13 of Ruby's Bundler'. source-1 (RubyGems GitHub discussion #9113) confirms the discussion was opened by mudge on Nov 23, 2025; the 'versions within the cooldown period are excluded from the candidate set … treated as if they do not exist' quote; the '--cooldown 3 means "only consider versions published 3 or more days ago"' and '--cooldown 0 temporarily disables cooldown regardless of other settings' flags; the per-source 'cooldown: 7' Gemfile syntax; the behavior table (bundle install with-lockfile = not applied / without-lockfile = applied, plus bundle update/add/outdated and gem install/update); and the 'npm-check-update … cooldown … pnpm via its minimumReleaseAge … Dependabot via cooldown' prior-art line.

Every direct quote is verbatim in its single cited source; the version number (4.0.13), the contributor handle and date (mudge, November 2025), the flag semantics, the per-source syntax, the affected-command list, and the lockfile-exemption are all confirmed. No compound-citation overreach — LWN-sourced and GitHub-sourced claims are kept separate.

Fully-verified, well-scoped developer-tooling/security News piece with disciplined single-source quote attribution. APPROVE.