Issue with new Bundler Cooldown feature when re-resolving dependencies

[gregfletch]

Describe the problem as clearly as you can

Updated to Bundler 4.0.13 and added cooldown: 7 to https://rubygems.org source. Running bundle install works as expected and installs all dependencies (despite some versions being newer than the 7 day cooldown period due to being installed before cooldown was introduced). However, bundler commands where bundler re-resolves dependency versions (i.e. bundle update, bundle outdated) now fail with an exit status of 7 with an output similar to the following (truncated the list of versions to reduce verbosity):

Could not find gems matching 'json-jwt (> 0)' valid for all resolution platforms (arm64-darwin-24, arm64-darwin-25, x86_64-linux, x86_64-linux-musl) in rubygems repository https://rubygems.org/ or installed locally.

The source contains the following gems matching 'json-jwt (> 0)':
  * json-jwt-0.0.1
  * json-jwt-0.0.2
...
  * json-jwt-1.17.0
  * json-jwt-1.17.1

1 version excluded by the cooldown setting; pass `--cooldown 0` to bypass.

Package managers for other languages (uv, npm, bun, as examples) are able to cleanly handle this situation (updating/listing outdated dependencies when some dependencies are newer than the cooldown period).

Did you try upgrading rubygems & bundler?

Bundler 4.0.13 is the latest version of bundler at the time of writing.

Post steps to reproduce the problem

To reproduce:

• Create a Gemfile with some dependencies (no cooldown settings yet), ensure at least one of the dependencies latest version is within the last 7 days (or whatever cooldown period you want to use).
• Run bundle install to generate the lock file and install dependencies.
• Update Gemfile to add cooldown: 7 (or whatever cooldown period you want) for at least one gem source (i.e. rubygems.org).
• Run bundle update and/or bundle outdated and observe the error exit status and error output.

Which command did you run?

• bundle update
• bundle outdated

What were you expecting to happen?

A clean exit status (exit status 0), and for bundler to be able to handle updating/listing outdated dependencies when one or more dependencies is within the defined cooldown period, mirroring the behaviour of other package managers that support cooldown periods.

What happened instead?

Could not find gems matching 'json-jwt (> 0)' valid for all resolution platforms (arm64-darwin-24, arm64-darwin-25, x86_64-linux, x86_64-linux-musl) in rubygems repository https://rubygems.org/ or installed locally.

The source contains the following gems matching 'json-jwt (> 0)':
  * json-jwt-0.0.1
  * json-jwt-0.0.2
...
  * json-jwt-1.17.0
  * json-jwt-1.17.1

1 version excluded by the cooldown setting; pass `--cooldown 0` to bypass.

If not included with the output of your command, run bundle env and paste the output below

Environment

Bundler       4.0.13
  Platforms   ruby, arm64-darwin-25
Ruby          4.0.5p0 (2026-05-20 revision 64336ffd0ee9e1f4c05891695a3d7b49cb709721) [arm64-darwin-25]
  Full Path   /Users/user/.rubies/ruby-4.0.5/bin/ruby
  Config Dir  /Users/user/.rubies/ruby-4.0.5/etc
RubyGems      4.0.10
  Gem Home    /Users/user/.gem/ruby/4.0.5
  Gem Path    /Users/user/.gem/ruby/4.0.5:/Users/user/.rubies/ruby-4.0.5/lib/ruby/gems/4.0.0
  User Home   /Users/user
  User Path   /Users/user/.gem/ruby/4.0.0
  Bin Dir     /Users/user/.gem/ruby/4.0.5/bin
Tools         
  Git         2.52.0
  RVM         not installed
  rbenv       not installed
  chruby      0.3.9

Bundler Build Metadata

Timestamp  2026-06-04
Git SHA    003f20f0dc

[hsbt]

Thanks for the clear report and steps to reproduce, they made it easy to find the cause.

The design intends locked versions to be exempt from cooldown, so an existing lockfile is never broken. That exemption was only wired up for bundle install and bundle lock, and the re-resolve done by bundle update and bundle outdated was overlooked. Those commands won't go below the locked version, but cooldown still hides that same version, so nothing is left to pick and resolution fails. This happens for both direct and indirect dependencies, just as you saw.

A fix is ready at #9599. It lets bundler keep the already-locked version during a re-resolve, while still applying cooldown to gems you update on purpose. For now, you can add --cooldown 0 to get bundle update and bundle outdated working again.

[hsbt]

I will release 4.0.14 with that fix at next week.