Skip to content
Heist/ feed
Back to feed
UnratedFix available

RubyGems 4.0.21 and Bundler 4.0.21 release notes

Type: patchSources: RubyGems and Bundler

Bundler 4.0.21 rejects redirects that downgrade HTTPS to HTTP.

Products
Bundler
Affected versions
Not specified
Fixed versions
4.0.21
CVEs
Not specified
Confirmed fixed CVEs
Not specified
Updated in this feed
30 Oct 2026, 06:32 UTC · Revision 1

Source evidence

RubyGems 4.0.21 and Bundler 4.0.21 release notes

github-rubygems-rubygems · Original source

Published 17 Sept 2026, 22:00 UTC

Bundler 4.0.21 rejects redirects that downgrade HTTPS to HTTP.

Reject Bundler redirects that downgrade https to http.

Bundler

Fixed versions: 4.0.21

Complete source record
{
  "id": "4c694b1c2a78d719b67f2b7b45386ad79442b6a25acafd4cc7f8ed309ebaab44",
  "url": "https://github.com/ruby/rubygems/releases/tag/v4.0.21",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "RubyGems 4.0.21 and Bundler 4.0.21 release notes",
    "summary": "Bundler 4.0.21 rejects redirects that downgrade HTTPS to HTTP.",
    "evidence": "Reject Bundler redirects that downgrade https to http.",
    "products": [
      {
        "name": {
          "value": "Bundler",
          "evidence": "Bundler 4.0.21 Enhancements:"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "4.0.21",
            "evidence": "Bundler 4.0.21 Enhancements:"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-rubygems-rubygems",
  "document_id": 22523,
  "published_at": "2026-09-17T22:00:47+00:00"
}