Add optional created_at field to GemVersion

[marcbest]

Problem

Supply chain attacks targeting package registries are a growing concern. Other package managers have already shipped minimum age features — npm, pnpm, and yarn all allow users to reject recently published versions during resolution.

Bundler currently has no equivalent. Adding one requires knowing when each gem version was published, but the compact index has no publication timestamp. Without it, clients must make a separate V1 API call per gem (/api/v1/versions/<gem>.json) — adding seconds of latency and hitting the RubyGems.org rate limit (10 req/s) on projects with 50+ gems.

Solution

Add an optional created_at field to GemVersion. When populated, it is appended to the requirements section of the /info line:

1.0.0 rack:>= 1.0|checksum:abc123,ruby:>= 2.7.0,created_at:2024-05-01T12:00:00Z

When nil, the field is omitted entirely:

• Full backwards compatibility — old clients ignore unknown requirement fields, old servers simply don't populate it
• No flag or query parameter needed — the server decides whether to include it
• Zero extra API calls — clients read created_at from data already fetched during resolution

Changes

• GemVersion struct: added created_at as 8th field (default nil)
• GemVersion#to_line: appends created_at:<timestamp> when present
• build_version test helper: accepts optional :created_at kwarg
• 3 new specs: timestamp present, timestamp with other requirements, omitted when nil

Downstream

• rubygems/rubygems.org#6380 — passes created_at to compact index output

[eileencodes]

Hi @marcbest looks like you accidentally closed this? I'll reopen because so we can discuss adding this.

[marcbest]

Hi @marcbest looks like you accidentally closed this? I'll reopen because so we can discuss adding this.

Thanks @eileencodes 🙇

I had closed it as I thought I was being a bit hasty after noticing there was already some discussion here: ruby/rubygems#9113

Thanks for picking it up!

[hsbt]

👍