Cooldown option for bundle update and bundle outdated

[mudge]

@woodruffw’s “We should all be using dependency cooldowns” makes a good case that supporting a cooldown (a window of time between when a dependency is published and when it’s considered suitable for use) when updating dependencies is an effective way to mitigate common supply chain attacks.

npm-check-update supports this natively via its cooldown option, pnpm via its minimumReleaseAge, and Dependabot via cooldown.

Could Bundler support this directly itself when calling the likes of bundle update and bundle outdated?

At the moment, it seems Dependabot separately queries the RubyGems (and private registries’) API to determine the release date for each gem version so I assume this isn’t already readily available via a CLI command.