Suggestion: Add cooldown support to Gem.latest_version_for

[eliotsykes]

Would support for a cooldown argument on Gem.latest_version_for (or similar) be welcome? For example:

latest = Gem.latest_version_for('brakeman', cooldown: 10)

The reason for this suggestion relates to brakeman's --ensure-latest option. This option can accept a cooldown period and checks if the installed version is up-to-date.

The command for a 10-day cooldown period is brakeman --ensure-latest 10.

To support this, brakeman uses Gem.latest_spec_for('brakeman') and manually checks the release date (source for Brakeman.ensure_latest)

This is a little buggy in some scenarios. For example assume:

• Brakeman 97.0.0 is the currently installed version
• Brakeman 98.0.0 was released 11 days ago
• Brakeman 99.0.0 was released 3 days ago

Running brakeman --ensure-latest 10 will not tell the user to update. The correct behaviour would be to tell the user to update to 98.0.0.

Another problem is if a larger cooldown is used, say 90 days, then it could be that brakeman --ensure-latest 90 never reports a newer version available, if a new brakeman version is released every 89 days (or less) forever. (This is why brakeman currently limits the max cooldown to 15 days to mitigate this scenario).

This is a known bug in brakeman and is unlikely to be fixed with the current rubygems API as it would require brakeman being too tightly coupled to rubygems internals.

However, if rubygems supported a public method accepting the gem name and the cooldown period, then this could be used by brakeman and presumably other projects which have built-in version checks.

Related brakeman discussion: presidentbeef/brakeman#2036