ARTIFACTORY: RubyGems.org Dependency API Deprecation

AuthorFullName__c
Elina Floim Alper
articleNumber
000005668
FirstPublishedDate
2023-04-04T07:21:55Z
lastModifiedDate
2025-07-20

ARTIFACTORY: RubyGems.org Dependency API Deprecation

Note that this article applies to remote RubyGems repositories: to manage the /dependencies deprecation for local repositories, see: ARTIFACTORY: RubyGems.org Local Repositories Dependency API Deprecation.

Background:

RubyGems.org has deprecated the dependency API (api/v1/dependency), moving to the “Compact Index” API mechanism. More information on the deprecation process and concrete details can be found in this blog post. April 10th is a “brownout” period during which RubyGems.org returned 404s for the Dependency API. Additional “brownout” dates (the full list can be found here) will take place until the API will be deprecated completely on May 10th, 2023. 

Mitigation steps:

Using the compact index API instead of the deprecated API is the preferred and recommended long-term solution. To utilize the compact index API, follow these steps:

1. Make sure that the Gem and Bundler clients are running on the following versions (upgrade if needed):

a. Gem client: Version 3.2.3 or higher.
b. Bundler client: Version 1.12 or higher.

2. Enable compact indexing (disabled by default) in Artifactory by adding the following property to the artifactory.system.properties file: 

artifactory.gems.compact.index.enabled=true

A Restart of Artifactory is required for the change to take effect.

Note: “Recalculate Index” is required for local and virtual Gem repositories after enabling compact indexing. 

Possible Workaround:

This workaround is relevant in cases where the gems/bundler client is configured against a virtual repository that contains both remote and local repositories. In this case, when the api/v1/dependencies request is executed, the local repository returns a 200 response with an empty list, whereas the remote returns a 404 response. As the repositories are aggregated in a virtual repository, the response that is returned to the client is the aggregation of the “200” and “404” responses, which eventually results in a successful “200” response. Due to this, the client does not fall back to the full index and the installation fails.  
To overcome this, it is possible to modify Artifactory’s response for the api/v1/dependencies request to a “404” response instead of a “200” by adding a rewrite rule to the Reverse Proxy configuration.

The implementation can differ depending on the reverse proxy in use. An example can be found on this public Jira ticket - RTFACT-29525. 

When the client is configured against the remote repository directly, or against a virtual repository that does not aggregate any local repositories, there is no need for the above-mentioned workaround and the fallback to full index should happen automatically by the client.   

Notes:
  • JFrog SaaS customers are not impacted since the compact index flag has been already activated. 
  • For the JFrog self-hosted customers that enable compact indexing, it is also recommended to upgrade Artifactory to version 7.55.9 for the following fixes:
    • RTFACT-27205 - Fixed an issue related to RubyGems whereby, the compact index file in Gems virtual repositories was not updated with the latest versions.
    • RTFACT-29420 - Fixed an issue related to RubyGems whereby, the compact index file in Artifactory merged versions with the same number but different platforms and displayed them as one version.