The RubyGems story this week is a registry problem, but your side of the fix has shipped since Bundler 2.6: bundle lock --add-checksums writes a CHECKSUMS section into Gemfile.lock, and every later install raises ChecksumMismatchError if a gem's bytes change. Pin the bytes, not the version.
