From fe2bd52184fdb01c0aad43756686c47e377b12c8 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Tue, 25 Aug 2026 21:36:31 +0000 Subject: [PATCH 1/3] ci: Apply a Bundler cooldown to dependency resolution Co-Authored-By: rlamb@launchdarkly.com <4955475+kinyoklion@users.noreply.github.com> --- .github/actions/ci/action.yml | 1 + CONTRIBUTING.md | 2 ++ Gemfile | 2 +- 3 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/actions/ci/action.yml b/.github/actions/ci/action.yml index 1a6bc97..1659d0e 100644 --- a/.github/actions/ci/action.yml +++ b/.github/actions/ci/action.yml @@ -11,6 +11,7 @@ runs: - uses: ruby/setup-ruby@3ff19f5e2baf30647122352b96108b1fbe250c64 # v1.299.0 with: ruby-version: ${{ inputs.ruby-version }} + bundler: 4.0.19 - name: Install dependencies shell: bash diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index f04f0d3..96c4baa 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -16,6 +16,8 @@ We encourage pull requests and other contributions from the community. Before su This SDK is built with [Bundler](https://bundler.io/). To install Bundler, run `gem install bundler`. You might need `sudo` to execute the command successfully. +The `Gemfile` declares a [cooldown](https://blog.rubygems.org/2026/06/03/cooldown-let-new-gems-be-vetted.html), so dependencies only resolve to versions that have been published for at least three days. This requires Bundler 4.0.13 or later; older versions ignore the setting and resolve to the newest matching version. Pass `--cooldown 0` to reach a version inside the window, for instance when a security fix has just been released. + To install the runtime dependencies: ``` diff --git a/Gemfile b/Gemfile index d3276be..965ce6b 100644 --- a/Gemfile +++ b/Gemfile @@ -1,6 +1,6 @@ # frozen_string_literal: true -source "https://rubygems.org" +source "https://rubygems.org", cooldown: 3 # Specify your gem's dependencies in launchdarkly-openfeature-server-sdk.gemspec gemspec From 75debf0463f194b0a44e2463002f08f9340a7057 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Tue, 25 Aug 2026 21:41:53 +0000 Subject: [PATCH 2/3] ci: Exempt launchdarkly-server-sdk from the cooldown and raise it to 7 days Co-Authored-By: rlamb@launchdarkly.com <4955475+kinyoklion@users.noreply.github.com> --- CONTRIBUTING.md | 2 +- Gemfile | 8 +++++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 96c4baa..0cb6d8d 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -16,7 +16,7 @@ We encourage pull requests and other contributions from the community. Before su This SDK is built with [Bundler](https://bundler.io/). To install Bundler, run `gem install bundler`. You might need `sudo` to execute the command successfully. -The `Gemfile` declares a [cooldown](https://blog.rubygems.org/2026/06/03/cooldown-let-new-gems-be-vetted.html), so dependencies only resolve to versions that have been published for at least three days. This requires Bundler 4.0.13 or later; older versions ignore the setting and resolve to the newest matching version. Pass `--cooldown 0` to reach a version inside the window, for instance when a security fix has just been released. +The `Gemfile` declares a [cooldown](https://blog.rubygems.org/2026/06/03/cooldown-let-new-gems-be-vetted.html), so dependencies only resolve to versions that have been published for at least seven days. `launchdarkly-server-sdk` is exempt, because we publish it ourselves and generally want to build against a release immediately. Cooldown requires Bundler 4.0.13 or later; older versions ignore the setting and resolve to the newest matching version. Pass `--cooldown 0` to reach a version inside the window, for instance when a security fix has just been released. To install the runtime dependencies: diff --git a/Gemfile b/Gemfile index 965ce6b..13bc9af 100644 --- a/Gemfile +++ b/Gemfile @@ -1,6 +1,6 @@ # frozen_string_literal: true -source "https://rubygems.org", cooldown: 3 +source "https://rubygems.org", cooldown: 7 # Specify your gem's dependencies in launchdarkly-openfeature-server-sdk.gemspec gemspec @@ -13,3 +13,9 @@ gem "rubocop", "~> 1.76" gem "rubocop-performance", "~> 1.25" gem "rubocop-rake", "~> 0.6" gem "rubocop-rspec", "~> 3.9" + +# Cooldown is configured per source, so exempting our own SDK from it requires a +# second remote for the same registry. +source "https://index.rubygems.org", cooldown: 0 do + gem "launchdarkly-server-sdk" +end From a2cca54c5757ef749963f1d14df0a63264642a60 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Thu, 27 Aug 2026 16:36:02 +0000 Subject: [PATCH 3/3] ci: Pin Bundler on the Windows job as well Co-Authored-By: rlamb@launchdarkly.com <4955475+kinyoklion@users.noreply.github.com> --- .github/workflows/ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3d7a5aa..6d6d020 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -46,6 +46,7 @@ jobs: - uses: ruby/setup-ruby@3ff19f5e2baf30647122352b96108b1fbe250c64 # v1.299.0 with: ruby-version: 3.4 + bundler: 4.0.19 - name: Install dependencies run: bundle install