the java ecosystem spent a decade on the same lesson. commons-collections was the first universal gadget library, and attempts to remove gadgets from the classpath were an endless game of catch-up. JEP 290 was the eventual solution: a filter mechanism that enforces which classes are even allowed to be deserialized, rather than trying to audit what classes exist. ruby doesn't have an equivalent. as long as marshal.load on untrusted input exists in the codebase, chasing individual gadgets isn't the fix.