ci: Apply a Bundler cooldown to dependency resolution

.github/actions/check/action.yml

@@ -23,7 +23,7 @@ runs:
 
     - name: Run RuboCop
       shell: bash
-      run: bundle exec rubocop --parallel
+      run: bundle exec rubocop
 
     - name: Build contract tests
       if: ${{ inputs.flaky != 'true' }}

.github/actions/setup/action.yml

@@ -15,7 +15,8 @@ runs:
     - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
       with:
         ruby-version: ${{ inputs.version }}
-        bundler: 2
+        # The Gemfile cooldown needs Bundler 4, which requires Ruby 3.2 or later.
+        bundler: ${{ startsWith(inputs.version, 'jruby-9') && '2' || '4.0.19' }}
 
     - name: Install dependencies
       if: ${{ inputs.install-dependencies == 'true' }}

CONTRIBUTING.md

@@ -16,6 +16,8 @@ We encourage pull requests and other contributions from the community. Before su
 
 This SDK is built with [Bundler](https://bundler.io/). To install Bundler, run `gem install bundler`. You might need `sudo` to execute the command successfully.
 
+The `Gemfile` declares a [cooldown](https://blog.rubygems.org/2026/06/03/cooldown-let-new-gems-be-vetted.html), so dependencies only resolve to versions that have been published for at least seven days. `ld-eventsource` is exempt, because we publish it ourselves and generally want to build against a release immediately. Cooldown requires Bundler 4.0.13 or later; older versions ignore the setting and resolve to the newest matching version. Pass `--cooldown 0` to reach a version inside the window, for instance when a security fix has just been released.
+
 To install the runtime dependencies:
 
 ```

Gemfile

@@ -1,3 +1,9 @@
-source "https://rubygems.org"
+source "https://rubygems.org", cooldown: 7
 
 gemspec
+
+# Cooldown is configured per source, so exempting our own libraries from it
+# requires a second remote for the same registry.
+source "https://index.rubygems.org", cooldown: 0 do
+  gem "ld-eventsource"
+end