Merge pull request #266 from rubygems/colby-swandale-patch-1

Update cooldown explanation and compact index details

Author: hsbt

_posts/2026-06-03-cooldown-let-new-gems-be-vetted.md

@@ -94,6 +94,6 @@ aws-partitions  1.1251.0  1.1256.0 (cooldown 3d)  = 1.1251.0  default
 
 Cooldown is most useful as one part of the wider security investment happening on rubygems.org. The registry now validates gem contents at push time and checks logins against Have I Been Pwned so that compromised passwords cannot be reused, work described in [Protecting rubygems.org from the outside in]({% post_url 2026-04-09-protecting-rubygems-from-the-outside-in %}). A dedicated team is running [AI-assisted vulnerability scanning against the most critical gems]({% post_url 2026-04-29-scaling-rubys-defenses-with-ai %}), backed by Alpha Omega and Anthropic, and the direction of all of this is tracked on a [public roadmap]({% post_url 2026-04-15-rubygems-org-has-a-public-roadmap %}). Trusted publishing and mandatory 2FA already raise the bar for who can push a release in the first place.
 
-Cooldown itself only works because rubygems.org now publishes the per-version `created_at` timestamp through its [v2 compact index](https://github.com/rubygems/rubygems.org/issues/6412), delivered through a careful dual-write migration and a flagged cutover with no disruption for clients. I'm grateful to the rubygems.org team for that groundwork. Cooldown is a thin client-side filter on top of it.
+Cooldown itself only works because rubygems.org now publishes the per-version `created_at` timestamp through its [v2 compact index](https://github.com/rubygems/rubygems.org/issues/6412) (v2 is an internal format version, not a public API change), delivered through a careful dual-write migration and a flagged cutover with no disruption for clients. I'm grateful to the rubygems.org team for that groundwork. Cooldown is a thin client-side filter on top of it.
 
 Each of these defenses covers a different gap, and they compound. Resolving your dependencies against rubygems.org is what puts all of them to work on your behalf, which makes it the safest default for Ruby projects.