Quarantine

Vein can delay new package versions from appearing in dependency resolution, giving the community time to catch malicious releases before they reach your CI/CD.

Scope today: quarantine applies to RubyGems metadata/index responses. The roadmap extends the same protection to crates.io and npm.

How it works

• New gem versions are quarantined for a configurable period (default: 3 days).
• bundle update and bundle outdated won’t see quarantined versions.
• Direct installs (gem install foo -v 1.2.3) still work - that’s an explicit choice by the operator, not an accident.
• Versions auto-promote once their quarantine period expires.

Why this matters

rest-client 1.6.13 (August 2019): a malicious version was published and yanked roughly 12 hours later. Any CI/CD pipeline running bundle update during that window installed the compromised gem. A 3-day quarantine window would have given zero exposure.

Configuration

[delay_policy]
enabled = true
default_delay_days = 3
skip_weekends = true        # Don't release on Sat/Sun
business_hours_only = true  # Only release during business hours
release_hour_utc = 10       # Release at 10:00 UTC

# Per-gem overrides (glob patterns supported)
[[delay_policy.gems]]
name = "rails*"
pattern = true
delay_days = 7              # Extra scrutiny for Rails ecosystem

[[delay_policy.gems]]
name = "internal-*"
pattern = true
delay_days = 0              # Trust internal gems

# Pin specific versions for immediate availability
[[delay_policy.pinned]]
name = "rails"
version = "8.0.1"
reason = "Security patch - verified safe"

CLI commands

# Show quarantine status
vein quarantine status

# List versions currently in quarantine
vein quarantine list

# Manually promote all expired quarantines now
vein quarantine promote

# Approve a version for immediate release
vein quarantine approve rails 8.0.1 --reason "Security patch"

# Block a malicious version (marks it as yanked)
vein quarantine block badgem 1.0.0 --reason "Malware detected"

Both approve and block accept an optional --platform flag for platform-specific gem builds.

Admin UI

Browse to /quarantine on the admin dashboard to view quarantine stats and approve or block versions without the CLI.