I remember an instance where someone updated and deployed the strong_passwords ruby gem since "it had an update". This was more or less right after it was found

I remember an instance where someone updated and deployed the strong_passwords ruby gem since "it had an update". This was more or less right after it was found out that the v0.7 gem was compromised. Cue rushing at the commit and double checking that it was using the "fixed" 0.8 and not the 0.7. Developer had no idea that 0.7 was compromised, and just updated the gem because they could without looking at patch notes.