# How We Fixed the Dependency Confusion Vulnerability in Over 600 Ruby Applications

DevFeed: [How We Fixed the Dependency Confusion Vulnerability in Over 600 Ruby Applications](<https://devfeed.tech/articles/how-we-fixed-the-dependency-confusion-vulnerability-in-over-600-ruby-applications-1396.md>)

Original publisher: [Read original article](<https://shopify.engineering/fixing-dependency-confusion-ruby-applications>)

Author: Frederik Dudzik

Published: 2022-01-27T15:42:25Z

Content type: article

Language: en

Sources: [Shopify Engineering](<https://devfeed.tech/sources/shopify-engineering.md>), [Shopify Engineering - Shopify Engineering](<https://devfeed.tech/sources/shopify-engineering-shopify-engineering.md>)

Topics: [Ruby](<https://devfeed.tech/topics/ruby.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [migration](<https://devfeed.tech/topics/migration.md>), [Tooling](<https://devfeed.tech/topics/tooling.md>), [Deployment](<https://devfeed.tech/topics/deployment.md>), [ci](<https://devfeed.tech/topics/ci.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [Shopify](<https://devfeed.tech/topics/shopify.md>), [Bug Bounty](<https://devfeed.tech/topics/bugbounty.md>)

Tags: [bug-bounty](<https://devfeed.tech/tags/bug-bounty.md>), [ci](<https://devfeed.tech/tags/ci.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [migration](<https://devfeed.tech/tags/migration.md>), [ruby](<https://devfeed.tech/tags/ruby.md>), [security](<https://devfeed.tech/tags/security.md>), [shopify](<https://devfeed.tech/tags/shopify.md>), [tooling](<https://devfeed.tech/tags/tooling.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

Shopify describes how its Ruby Conventions team addressed a dependency confusion vulnerability affecting more than 600 Ruby applications. The article covers impact assessment, CI/CD data collection, Bundler source pinning, and tooling for large-scale migration.

## Source excerpt

How Shopify solved the dependency confusion vulnerability in over 600 Ruby applications and created tailored large-scale migration tooling to make it easier.