---
title: "Fixing the Dependency Confusion Vulnerability in 600+ Ruby Apps - Shopify"
description: "Shopify identified a dependency confusion vulnerability through its bug bounty program; an attacker could exploit ambiguous package sources to install a malicious dependency and gain access to local, CI/CD, and production environments. To assess exposure, the Ruby Conventions team collected Bundler versions from repositories in a data lake and found around 600 susceptible Ruby applications. An experimental Bundler plugin converted Gemfile.lock files to the explicit-source format while restoring existing gem versions, and a CI-backed CLI later provided per-repository environments, parallel execution, pull requests, and easier failure tracking. After incremental migrations exposed configuration and tooling issues, Shopify updated supporting systems, set Bundler requirements, changed local and CI defaults, and worked with Bundler maintainers; the company reports migrating all its applications in less than a day and contributing to Bundler 2.2.21 and 2.2.22."
---

# Fixing the Dependency Confusion Vulnerability in 600+ Ruby Apps - Shopify

[Shopify](https://yomu.fyi/company/shopify) · 2023-10-18 · Jan 27, 2022

**Type:** Problem & solution

## Summary

Shopify identified a dependency confusion vulnerability through its bug bounty program; an attacker could exploit ambiguous package sources to install a malicious dependency and gain access to local, CI/CD, and production environments. To assess exposure, the Ruby Conventions team collected Bundler versions from repositories in a data lake and found around 600 susceptible Ruby applications. An experimental Bundler plugin converted Gemfile.lock files to the explicit-source format while restoring existing gem versions, and a CI-backed CLI later provided per-repository environments, parallel execution, pull requests, and easier failure tracking. After incremental migrations exposed configuration and tooling issues, Shopify updated supporting systems, set Bundler requirements, changed local and CI defaults, and worked with Bundler maintainers; the company reports migrating all its applications in less than a day and contributing to Bundler 2.2.21 and 2.2.22.

## Context

A bug bounty report showed that ambiguous package sources could let an external gem with a higher version number replace an internal Shopify package, potentially exposing local, CI/CD, and production environments. Shopify did not initially know how many applications were susceptible, while the new Bundler lockfile format required an upgrade that could update dependencies and introduce regressions.

## Approach / What changed

The Ruby Conventions team gathered Bundler version data from repositories, built a Bundler plugin to convert Gemfile.lock files without changing the existing gem versions, and rolled out migrations incrementally. After local execution became difficult to scale across Ruby versions and configurations, they built a CI-backed CLI that created repository-specific environments, ran commands in parallel, tracked failures, and opened pull requests. They also updated supporting tooling, enforced Bundler versions locally and in CI, and collaborated with Bundler maintainers.

## Takeaways

- A cron job collecting Bundler versions into a data lake revealed that around 600 Ruby applications were susceptible and created a metric for tracking outstanding migrations.
- The migration plugin preserved existing gem versions while converting Gemfile.lock files to the newer explicit-source format; a CI-backed CLI later addressed environment differences, parallelization, recovery, and tracking.
- Shopify made local tooling default to the recommended Bundler version and configured CI to fail on outdated versions, while collaboration with maintainers led to Bundler 2.2.21 and 2.2.22 changes.

**Tags:** [CI/CD](https://yomu.fyi/topic/ci-cd), [Migrations](https://yomu.fyi/topic/migration), [Open Source](https://yomu.fyi/topic/open-source)

- Source: [Shopify](https://shopify.engineering/fixing-dependency-confusion-ruby-applications)
- Source URL: https://shopify.engineering/fixing-dependency-confusion-ruby-applications
- Ingested by Yomu: 2026-08-30T15:27:58.312Z

[Read original post](https://shopify.engineering/fixing-dependency-confusion-ruby-applications)