---
title: "Finding Relationships Between Ruby’s Top 100 Packages and Their Dependencies"
description: "RubyGems’ phased MFA rollout required owners of gems with at least 180 million downloads to use MFA, but raised a supply-chain question: could a popular gem depend on a less-downloaded gem that remained an account-takeover target? The investigation loaded rubygems.org data dumps to identify 112 gems above the threshold, queried the API for direct dependencies, and used Bundler with Gemfile.lock files to resolve transitive dependencies. It found 13 big gems with small direct dependencies and 24 with small dependencies overall, attributing the mismatch mainly to newer dependencies and gems shipped with Ruby, such as racc and rexml. Graph visualizations, breadth-first traversal, and a custom depth-first search then mapped dependency structure and paths; the post leaves open whether to do nothing or enforce MFA early for the 24 technically insecure gems."
---

# Finding Relationships Between Ruby’s Top 100 Packages and Their Dependencies

[Shopify](https://yomu.fyi/company/shopify) · 2023-10-18 · Oct 19, 2022

**Type:** Explainer

## Summary

RubyGems’ phased MFA rollout required owners of gems with at least 180 million downloads to use MFA, but raised a supply-chain question: could a popular gem depend on a less-downloaded gem that remained an account-takeover target? The investigation loaded rubygems.org data dumps to identify 112 gems above the threshold, queried the API for direct dependencies, and used Bundler with Gemfile.lock files to resolve transitive dependencies. It found 13 big gems with small direct dependencies and 24 with small dependencies overall, attributing the mismatch mainly to newer dependencies and gems shipped with Ruby, such as racc and rexml. Graph visualizations, breadth-first traversal, and a custom depth-first search then mapped dependency structure and paths; the post leaves open whether to do nothing or enforce MFA early for the 24 technically insecure gems.

## Context

RubyGems was gradually rolling out MFA and needed a first cohort that included at least the top 100 gems without allowing packages to fall out later. It set the cohort threshold at 180 million downloads, but this raised the possibility that big gems could depend on smaller gems whose owners were not yet required to use MFA.

## Approach / What changed

The investigation used rubygems.org database dumps and a Rails query to identify gems with at least 180 million downloads. It checked direct dependencies through the rubygems.org API, resolved transitive dependencies by generating Gemfiles and Gemfile.lock files with Bundler, and used graph visualizations, breadth-first search, and a custom depth-first search to examine dependency relationships and paths.

## Takeaways

- The 180 million download threshold produced a list of 112 big gems, while the rubygems.org stats pages did not provide a complete list below the relevant cutoff.
- The API identified 13 big gems with small direct dependencies; Bundler’s transitive dependency analysis increased that number to 24.
- The post attributes lower download counts mainly to newer dependencies and gems shipped with Ruby, and proposes either waiting for universal MFA or enforcing it early for the 24 affected gems.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [Open Source](https://yomu.fyi/topic/open-source)

- Source: [Shopify](https://shopify.engineering/relationships-between-ruby-top-100-packages-dependencies)
- Source URL: https://shopify.engineering/relationships-between-ruby-top-100-packages-dependencies
- Ingested by Yomu: 2026-08-30T13:38:17.587Z

[Read original post](https://shopify.engineering/relationships-between-ruby-top-100-packages-dependencies)