For a security fix, run the update for that gem with the patch and conservative options to prefer the next patch version and keep indirect dependencies from moving. Add strict if you want no gem updated past the chosen level. Otherwise a dependency can still jump a minor or major version.
What each option means
The Bundler reference defines them like this: patch prefers updating only to the next patch version, minor prefers the next minor, and major (the default) prefers the latest major. Strict does not allow any gem to be updated past the latest patch, minor or major level you chose. Conservative uses the install behaviour and does not allow indirect dependencies to be updated.
| Option | Effect |
|---|---|
| patch | Prefer next patch version |
| minor | Prefer next minor version |
| major | Prefer latest major (default) |
| strict | No gem past the chosen level |
| conservative | Indirect dependencies stay put |
Why patch alone surprises people
The reference includes a worked example. With patch, the target gem moves to its latest patch, but a dependency of it can still increase by a minor version, because the new patch release requires it. When only one gem is named, other gems that are not declared in your Gemfile may still move. Strict removes that wiggle room, which can mean no valid resolution exists.
Steps for a minimal security update
- Find the fixed version in the advisory.
- Run the update for that gem with patch and conservative.
- If the diff is larger than expected, retry with strict and see whether it resolves.
- Read the Gemfile.lock diff line by line.
- Run tests and an advisory scan.
- If nothing small works, accept a minor update and test more widely.
bundle update nokogiri --patch --conservative
bundle update nokogiri --patch --strict
git diff Gemfile.lock
The cooldown interaction
If you use a cooldown that delays new releases, an urgent fix may fall inside the window. The documentation suggests bypassing the cooldown for one run with a zero value, combined with conservative to limit other changes. Do this only for a fix you have reviewed.
Try it yourself
Click through it at your own pace, or open it full screen. Watch a fix move from advisory to a small change.
Where Safeguard fits
Safeguard's SBOM and dependency scanning reads composer.lock and Gemfile.lock and flags known advisories. A free scan takes a few minutes.
Quick check
Is conservative the same as patch?
No. Patch is about how far the named gem moves. Conservative is about whether indirect dependencies may move.
Why might strict fail to resolve?
A fixed version can require a newer version of another gem. Strict forbids going past your chosen level, so no answer may exist.
Sources
Last reviewed: 19 October 2026.
