Pipelines should run bundle install. With a Gemfile.lock present, it installs the locked versions instead of resolving again. bundle update ignores the locked versions for the gems you name, or all gems with the all option, and should only run in a deliberate, reviewed change.
How each command behaves
The Bundler reference describes three cases for install. With no Gemfile.lock, Bundler fetches sources, resolves dependencies and installs. With a lock file and an unchanged Gemfile, it uses the dependencies in the lock file instead of resolving. With a lock file and a changed Gemfile, it keeps locked versions for gems you did not touch and re-resolves those you did.
| Command | Uses lock file | Changes lock file | Use for |
|---|---|---|---|
| bundle install | Yes | Only when the Gemfile changed | Build, CI, deploy |
| bundle update gem | Ignores it for that gem | Yes | Targeted upgrade |
| bundle update all | Ignores it for all gems | Yes | Planned refresh |
The update page says that in general you should use install to get the same exact gems and versions across machines, and use update to explicitly update the version of a gem.
Why this is a security control
If a deploy step runs update, production gets whatever is newest at that moment. A newly published malicious or broken gem version would reach your servers with no review. With install, new releases are invisible until someone updates the lock file in a pull request.
A safe update routine
- Branch and run an update for the specific gem.
- Read the Gemfile.lock diff.
- Run tests and an advisory scan.
- Merge, and let the pipeline run install.
bundle update rack --conservative
git diff Gemfile.lock
bundle install
The conservative option stops indirect dependencies from being updated, which keeps the diff small. Our guide to patch level updates shows how it compares with the other options.
Common mistakes
- Running update in a Dockerfile, so every image build picks up new versions.
- Deleting Gemfile.lock to fix a conflict, which forces a full re-resolve.
- Ignoring the lock file for libraries without thinking about who consumes them.
Try it yourself
Click through it at your own pace, or open it full screen. Watch how a lock file change gets checked before merge.
Where Safeguard fits
Safeguard's policies and gates can check dependency changes in a pull request before merge. A free scan shows what it finds today.
Quick check
Is it safe to delete Gemfile.lock and run bundle install?
It works, but it re-resolves every gem to the latest allowed version, which is a full update with no review.
Does bundle install ever change Gemfile.lock?
Yes, when the Gemfile changed. In deployment settings you can block that, as covered in our frozen mode guide.
Sources
Last reviewed: 19 October 2026.
