I don't know the Ruby ecosystem, but do dependencies go by hashes? If so, an update to the dependency won't immediately affect the Popular Gem. Sure, the maint

I don't know the Ruby ecosystem, but do dependencies go by hashes? If so, an update to the dependency won't immediately affect the Popular Gem. Sure, the maintainer could still naively update the dependencies and pull up a bad one during an update of the Popular Gem. But that Popular Gem update would have to happen after an attack on the dependency, and before the breach was discovered (assuming it has any way of being discovered before release of the popular package).