Hacker News Reader

They still allow you to deploy you just have to explicitly set a variable in the deploy command so they know you are aware whats going on

The point was unless you also previously cached all your gems somewhere you'd have to deploy using potentially compromised gems from rubygems.

Is this safe if you haven't changed any gems since the last deploy? I have a bugfix that I would like to deploy...

Heroku runs bundle install on deploy, so it's not safe until all your gems (and their dependencies in gemfile.lock) are cleared.