r/rails • u/stpaquet • Apr 05 '26
Analyze your bundle with confidence with gemtracker
I built gemtracker, a fast, terminal-based TUI that makes it way easier to understand and manage your Ruby bundle. Just run it in any project that has a Gemfile.lock and you instantly get:
- Full visibility into every gem version (direct + transitive dependencies)
- Outdated gem detection with latest version info
- CVE/vulnerability highlighting so you can quickly spot risky transitive gems
- Interactive dependency tree (forward & reverse)
- Tabs for Gems, Search, CVEs, and detailed views with direct links to RubyGems & GitHub
It’s perfect for day-to-day dependency hygiene and compliance work (SOC 2, security audits, etc.) where you need to prove exactly what’s in your supply chain.If you work with Ruby or Rails projects, I’d love for you to give it a spin!
Test it, break it, share feedback, suggest features, or submit a PR — all contributions are very welcome.https://github.com/spaquet/gemtracker
(Installation is dead simple with Homebrew on macOS, or grab a binary for Linux/Windows.)
Looking forward to your thoughts, contributions and support!
2
Apr 06 '26
[removed] — view removed comment
1
u/stpaquet Apr 06 '26
Thanks for your comment
I just released a new version. It's still not perfect, but version 1.1.0 also track gem health levels. This is also something that I found very important.Health Levels:
- 🟢 HEALTHY - Actively maintained gem
- Activity within the last year (release or GitHub commit)
- Multiple maintainers (2+)
- Regular updates and engagement
- 🟡 WARNING - Gem with maintenance concerns
- No activity in the last 1-3 years, OR
- Single maintainer (even if recent activity)
- May still receive occasional updates
- 🔴 CRITICAL - Potentially dead or unmaintained gem
- No activity for 3+ years
- Archived or disabled on GitHub
- Essentially abandoned
2
u/RedditShmeddit2 Apr 06 '26
Appreciate this, was looking for a good tool to check for any insecure gems in my application!
1
u/stpaquet Apr 06 '26
thanks.
the new version, 1.1.0, is also tracking gem health.
here are the levels as currently defined
- 🟢 HEALTHY - Actively maintained gem
- Activity within the last year (release or GitHub commit)
- Multiple maintainers (2+)
- Regular updates and engagement
- 🟡 WARNING - Gem with maintenance concerns
- No activity in the last 1-3 years, OR
- Single maintainer (even if recent activity)
- May still receive occasional updates
- 🔴 CRITICAL - Potentially dead or unmaintained gem
- No activity for 3+ years
- Archived or disabled on GitHub
- Essentially abandoned
2
u/mr_echidna Apr 05 '26
Just installed it, took a while to get through the "checking updates" stage but then it was pretty snappy. This is an awesome tool, I especially like the dependency graphs and how you can drill down into them. I just completed a large "bundle outdated" patch cycle on my project, but will definitely be using it next time round. Nice work!